Intelligent steering in 5G

Patent metadata

Field	Value
Publication number	US-12167273-B2
Application number	US-202217699455-A
Country	US
Kind code	B2
Filing date	Mar 21, 2022
Priority date	Mar 8, 2021
Publication date	Dec 10, 2024
Grant date	Dec 10, 2024

Abstract

The present disclosure relates to systems and methods for cloud-based 5G security network architectures intelligent steering, workload isolation, identity, and secure edge steering. Specifically, various approaches are described to integrate cloud-based security services into Multiaccess Edge Compute servers (MECs). That is, existing cloud-based security services are in line between a UE and the Internet. The present disclosure includes integrating the cloud-based security services and associated cloud-based system within service provider's MECs. In this manner, a cloud-based security service can be integrated with a service provider's 5G network or a 5G network privately operated by the customer. For example, nodes in a cloud-based system can be collocated within a service provider's network, to provide security functions to 5G users or connected by peering from the cloud-based security service into the 5G service provider's regional communications centers.

First claim

What is claimed is:

1. A method of intelligent traffic path steering comprising:
receiving a request from an endpoint for connection to a workload destination;
identifying a path by utilizing a set of data identification services to assess all parts of an endpoint to workload traffic flow;
determining how to steer each part of an endpoint traffic flow to achieve a desired goal; and

steering the endpoint traffic based on the determination, wherein workload providers are able to select exactly where a workload may appear for a user and enforce only local placement and connectivity.

2. The method of claim 1 , wherein the identifying and determining is performed manually, by Artificial Intelligence (AI), and/or Machine Learning (ML), based on datasets.

3. The method of claim 1 , wherein the data is calculated data by an AI-engine for known sets of workload, protocol, latency, speed, and endpoint combinations.

4. The method of claim 3 , wherein the AI-engine delivers an outcome to a steering platform that instructs it on how and where to send the traffic.

5. The method of claim 3 , wherein the AI-engine exists as a core function of an internet access platform and can be queried for insights.

6. The method of claim 1 , wherein the desired goals are based on performance and cost.

7. A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of
receiving a request from an endpoint for connection to a workload destination;
identifying a path by utilizing a set of data identification services to assess all parts of an endpoint to workload traffic flow;
determining how to steer each part of an endpoint traffic flow to achieve a desired goal; and

steering the endpoint traffic based on the determination, wherein workload providers are able to select exactly where a workload may appear for a user and enforce only local placement and connectivity.

8. The non-transitory computer-readable medium of claim 7 , wherein the identifying and determining is performed manually, by Artificial Intelligence (AI), and/or Machine Learning (ML), based on datasets.

9. The non-transitory computer-readable medium of claim 7 , wherein the data is calculated data by an AI-engine for known sets of workload, protocol, latency, speed, and endpoint combinations.

10. The non-transitory computer-readable medium of claim 9 , wherein the AI-engine delivers an outcome to a steering platform that instructs it on how and where to send the traffic.

11. The non-transitory computer-readable medium of claim 9 , wherein the AI-engine exists as a core function of an internet access platform and can be queried for insights.

12. The non-transitory computer-readable medium of claim 7 , wherein the desired goals are based on performance and cost.

13. An edge compute system configured for cloud-based 5G security via an endpoint service, the edge compute system comprising:
one or more processors and memory storing instructions that, when executed, cause the one or more processors to
receive a request from an endpoint for connection to a workload destination;
identify a path by utilizing a set of data identification services to assess all parts of an endpoint to workload traffic flow;
determine how to steer each part of an endpoint traffic flow to achieve a desired goal; and

steer the endpoint traffic based on the determination, wherein workload providers are able to select exactly where a workload may appear for a user and enforce only local placement and connectivity.

14. The edge compute system of claim 13 , wherein the identifying and determining is performed manually, by Artificial Intelligence (AI), and/or Machine Learning (ML), based on datasets.

15. The edge compute system of claim 13 , wherein the data is calculated data by an AI-engine for known sets of workload, protocol, latency, speed, and endpoint combinations.

16. The edge compute system of claim 15 , wherein the AI-engine delivers an outcome to a steering platform that instructs it on how and where to send the traffic.

17. The edge compute system of claim 15 , wherein the AI-engine exists as a core function of an internet access platform and can be queried for insights.

18. The edge compute system of claim 13 , wherein the desired goals are based on performance and cost.

Assignees

• Zscaler Inc

Inventors

• Howe Nathan
• Urquhart Kenneth B
• Srinivasan Subramanian
• Deshpande Sridhar Kartik Kumar Chatnalli
• Foxhoven Patrick

Classifications

• H04W28/0215

  based on user or device properties, e.g. MTC-capable devices (services for machine-to-machine communication [M2M] or machine type communication [MTC] H04W4/70; wireless resource selection or allocation plan definition based on terminal or device properties H04W72/51) · CPC title

• H04W28/0268

  using specific QoS parameters for wireless networks, e.g. QoS class identifier [QCI] or guaranteed bit rate [GBR] (negotiating SLA or negotiating QoS H04W28/24) · CPC title

• H04W28/0247 Primary

  based on conditions of the access network or the infrastructure network (central resource management H04W28/16) · CPC title