Wireless network policy manager for a service mesh

Patent metadata

Field	Value
Publication number	US-12369014-B2
Application number	US-202318161535-A
Country	US
Kind code	B2
Filing date	Jan 30, 2023
Priority date	Jun 11, 2020
Publication date	Jul 22, 2025
Grant date	Jul 22, 2025

Abstract

A computer device may include a memory storing instructions and processor configured to execute the instructions to host a network function container that implements a microservice for a network function in a wireless communications network, wherein the network function container is deployed by a container orchestration platform; host a service proxy container associated with the network function container, wherein the service proxy container is deployed by the container orchestration platform; and configure the hosted service proxy container to apply a wireless network policy to the microservice for the network function. The processor may be further configured to intercept messages associated with the microservice for the network function using the configured service proxy container; and apply the wireless network policy to the intercepted messages using the configured service proxy container.

First claim

What is claimed is:

1. A method comprising:
collecting, by a computer device, values for a plurality of metrics from a plurality of service meshes, wherein a service mesh, of the plurality of service meshes, enables communication between network function containers;
detecting, by the computer device, a security threat based on the collected values;
updating, by the computer device, a security policy based on the detected security threat; and
instructing, by the computer device, at least one of the plurality of service meshes to apply the updated security policy to network functions associated with the at least one of the plurality of service meshes.

2. The method of claim 1 , wherein detecting the security threat based on the collected values includes:
using a machine learning model trained to detect security threats in a wireless communications network.

3. The method of claim 1 , wherein different ones of the plurality of service meshes are located in different geographic locations.

4. The method of claim 1 , wherein different ones of the plurality of service meshes are associated with different providers of wireless communications networks.

5. The method of claim 1 , wherein different ones of the plurality of service meshes are associated with different enterprises.

6. The method of claim 1 , wherein different ones of the plurality of service meshes are associated with different network slices.

7. The method of claim 1 , wherein updating the security policy based on the detected security threat includes:
updating a security policy manager in a service proxy container associated with a network function container serviced by a service mesh of the plurality of service meshes.

8. The method of claim 1 , wherein updating the security policy based on the detected security threat includes:
updating a malware detection and mitigation engine associated with a service mesh of the plurality of service meshes.

9. The method of claim 1 , wherein updating the security policy based on the detected security threat includes:
updating a chain of trust detection policy,
updating a policy for flagging anomalous behavior,
updating a blacklist security policy, or
updating an encryption policy.

10. The method of claim 1 , further comprising:
load balancing traffic between different ones of the plurality of service meshes.

11. A device comprising:
a memory and;
a processor configured to execute instructions to:
collect values for a plurality of metrics from a plurality of service meshes, wherein a service mesh, of the plurality of service meshes, enables communication between network function containers;
detect a security threat based on the collected values;
update a security policy based on the detected security threat; and
instruct at least one of the plurality of service meshes to apply the updated security policy to network functions associated with the at least one of the plurality of service meshes.

12. The device of claim 11 , wherein, when detecting the security threat based on the collected values, the processor is further configured to:
use a machine learning model trained to detect security threats in a wireless communications network.

13. The device of claim 11 , wherein different ones of the plurality of service meshes are located in different geographic locations.

14. The device of claim 11 , wherein different ones of the plurality of service meshes are associated with different providers of wireless communications networks.

15. The device of claim 11 , wherein different ones of the plurality of service meshes are associated with different enterprises.

16. The device of claim 11 , wherein different ones of the plurality of service meshes are associated with different network slices.

17. The device of claim 11 , wherein, when updating the security policy based on the detected security threat, the processor is further configured to:
update a security policy manager in a service proxy container associated with a network function container serviced by a service mesh of the plurality of service meshes.

18. The device of claim 11 , wherein, when updating the security policy based on the detected security threat, the processor is further configured to:
update a malware detection and mitigation engine associated with a service mesh of the plurality of service meshes.

19. The device of claim 11 , wherein, when updating the security policy based on the detected security threat, the processor is further configured to:
update a chain of trust detection policy,
update a policy for flagging anomalous behavior,
update a blacklist security policy, or
update an encryption policy.

20. A system comprising:
a first computer device, included in a network, configured to:
implement a network function container that implements a microservice for a network function in a wireless communications network, wherein the network function container is deployed by a container orchestration platform; and
implement a service proxy container associated with the network function container, wherein the service proxy container is deployed by the container orchestration platform; and
a second computer device, included in the network, configured to:

collect values for a plurality of metrics from a plurality of service meshes, wherein a service mesh, of the plurality of service meshes, enables communication between network function containers deployed by the container orchestration platform;
detect a security threat based on the collected values;
update a security policy based on the detected security threat; and
instruct the service proxy container to apply the updated security policy to the network function container.

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Taft David
• Choyi Vinod Kumar
• Chauhan Maqbool
• Steben Jerry
• Booker Parry Cornell
• Ahmadi Hossein M
• Li Minbao
• PATIL Sudhakar Reddy

Classifications

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04W12/37

  Managing security policies for mobile devices or for controlling mobile applications · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04W84/18

  Self-organising networks, e.g. ad-hoc networks or sensor networks · CPC title

• H04L67/564

  Enhancement of application control based on intercepted application data · CPC title