Abstract: An orchestration platform communicatively coupled to a mobile-core orchestration interface and to a security platform located outside a mobile core network receives device-context data for user equipment attached to the mobile core network without requiring the security platform to inspect control-plane signaling of the mobile core network. The orchestration platform maintains a synchronized device-context record that correlates a mobile-device identifier with one or more of an Internet Protocol address, device state, location or access-point attribute, device-group attribute, application-observation attribute, security-incident attribute, or configuration-management-database metadata.

Abstract: Techniques for mobile network information sharing via extended Berkeley Packet Filter (eBPF) for zero trust security are disclosed. In some embodiments, a system/process/computer program product for mobile network information sharing via eBPF for zero trust security includes monitoring network traffic in a core mobile network using an agent executed on a network element in the core mobile network to identify a session associated with a User Equipment (UE) that attached to the core mobile network for mobile network communications; extracting meta information associated with the session using the agent executed on a network element in the core mobile network; sending the extracted meta information to a security platform located outside of the core mobile network; and enforcing a security policy on the session at the security platform based on the extracted meta information to apply granular-based security in the core mobile network based on a security policy.

Abstract: Techniques for enhanced visibility of devices behind cellular routers using intelligent network address translation (NAT) are disclosed. A cellular router allocates a unique block of ports to each device connecting to the router, performs intelligent NAT using the allocated unique block of ports for each device, and aggregates default device information (e.g., inner IP, outer IP, port block, MAC address, etc.) and optional device related metadata (e.g., device type including manufacturer/make and model, risk assessment, etc.). Router-specific data (e.g., router identifier (ID), location, etc.) can also be included in this aggregated information. The aggregated information is sent to a Device Intelligence Collection Engine (DICE), which distributes the aggregated information to observers (e.g., to security platforms/NGFWs, SIEMs, analytics platforms, etc.) via a publish/subscribe (pub/sub) messaging model, enabling device-specific policy enforcement and analytics in a scalable, hierarchical structure.

Abstract: Techniques for data ingestion enabling context awareness and real-time actions in mobile networks are disclosed. In some embodiments, a system, a process, and/or a computer program product for data ingestion enabling context awareness and real-time actions in mobile networks includes extracting a plurality of parameters from a mobile core network entity using an application programming interface (API) call, messages over a message broker, and/or logs from the mobile core network entity; determining a context for a session using one or more of the plurality of parameters associated with a mobile device communicating over the mobile core network; and applying a security policy using a security platform to the session based on the context.

Abstract: Techniques for data ingestion enabling context awareness and real-time actions in mobile networks are disclosed. In some embodiments, a system, a process, and/or a computer program product for data ingestion enabling context awareness and real-time actions in mobile networks includes extracting a plurality of parameters from a mobile core network entity using an application programming interface (API) call, messages over a message broker, and/or logs from the mobile core network entity; determining a context for a session using one or more of the plurality of parameters associated with a mobile device communicating over the mobile core network; and applying a security policy using a security platform to the session based on the context.

Abstract: Techniques for mobile network information sharing via extended Berkeley Packet Filter (eBPF) for zero trust security are disclosed. In some embodiments, a system/process/computer program product for mobile network information sharing via eBPF for zero trust security includes monitoring network traffic in a core mobile network using an agent executed on a network element in the core mobile network to identify a session associated with a User Equipment (UE) that attached to the core mobile network for mobile network communications; extracting meta information associated with the session using the agent executed on a network element in the core mobile network; sending the extracted meta information to a security platform located outside of the core mobile network; and enforcing a security policy on the session at the security platform based on the extracted meta information to apply granular-based security in the core mobile network based on a security policy.

Abstract: Techniques for providing a securing platform for service provider network environments are disclosed. In some embodiments, a system/process/computer program product for providing a securing platform for service provider network environments includes communicating with an orchestrator and/or another network element on a service provider network to identify a subscriber with a new IP flow using a security platform; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

Abstract: Techniques for dynamic per subscriber policy enablement for security platforms within service provider network environments are disclosed. In some embodiments, a system/process/computer program product for dynamic per subscriber policy enablement for security platforms within service provider network environments includes monitoring network traffic on a service provider network at a security platform to identify a subscriber with a new IP flow; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

Abstract: Techniques for providing a securing platform for service provider network environments are disclosed. In some embodiments, a system/process/computer program product for providing a securing platform for service provider network environments includes communicating with an orchestrator and/or another network element on a service provider network to identify a subscriber with a new IP flow using a security platform; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

Abstract: Techniques for providing a securing platform for service provider network environments are disclosed. In some embodiments, a system/process/computer program product for providing a securing platform for service provider network environments includes communicating with an orchestrator and/or another network element on a service provider network to identify a subscriber with a new IP flow using a security platform; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

Abstract: Techniques for dynamic per subscriber policy enablement for security platforms within service provider network environments are disclosed. In some embodiments, a system/process/computer program product for dynamic per subscriber policy enablement for security platforms within service provider network environments includes monitoring network traffic on a service provider network at a security platform to identify a subscriber with a new IP flow; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

Abstract: Techniques for dynamic per subscriber policy enablement for security platforms within service provider network environments are disclosed. In some embodiments, a system/process/computer program product for dynamic per subscriber policy enablement for security platforms within service provider network environments includes monitoring network traffic on a service provider network at a security platform to identify a subscriber with a new IP flow; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

Abstract: Techniques for dynamic per subscriber policy enablement for security platforms within service provider network environments are disclosed. In some embodiments, a system/process/computer program product for dynamic per subscriber policy enablement for security platforms within service provider network environments includes monitoring network traffic on a service provider network at a security platform to identify a subscriber with a new IP flow; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

Abstract: Techniques for providing a securing platform for service provider network environments are disclosed. In some embodiments, a system/process/computer program product for providing a securing platform for service provider network environments includes communicating with an orchestrator and/or another network element on a service provider network to identify a subscriber with a new IP flow using a security platform; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

Abstract: Techniques for providing a securing platform for service provider network environments are disclosed. In some embodiments, a system/process/computer program product for providing a securing platform for service provider network environments includes communicating with an orchestrator and/or another network element on a service provider network to identify a subscriber with a new IP flow using a security platform; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

Abstract: Techniques for dynamic per subscriber policy enablement for security platforms within service provider network environments are disclosed. In some embodiments, a system/process/computer program product for dynamic per subscriber policy enablement for security platforms within service provider network environments includes monitoring network traffic on a service provider network at a security platform to identify a subscriber with a new IP flow; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.