METHODS AND APPARATUS TO CONFIGURE VIRTUAL PRIVATE MOBILE NETWORKS FOR SECURITY

• US 20120331545A1
• Filed: 06/21/2011
• Published: 12/27/2012
• Est. Priority Date: 06/21/2011
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Baliga, Arati, Chen, Xu, Coskun, Baris, de los Reyes, Gustavo, Lee, Seungjoon, Mathur, Suhas, Van der Merwe, Jacobus, Xu, Gang
• Granted Patent: US 9,386,035 B2
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04W 12/086 using security domains

Abstract

Methods and apparatus to configure virtual private mobile networks for security are disclosed. A disclosed example method includes identifying, in a wireless network, a communication from a user equipment that matches a security event profile, transmitting, from the wireless network, an instruction to enable the user equipment to be communicatively coupled to a virtual private mobile network, the virtual private mobile network being provisioned for security within the wireless network, and enabling the user equipment to transmit a second communication through the virtual private mobile network securely isolated from other portions of the wireless network.

Claims

1. A method to configure a virtual private mobile network, the method comprising:

identifying, in a wireless network, a communication from a user equipment that matches a security event profile;

transmitting, from the wireless network, an instruction to enable the user equipment to be communicatively coupled to a virtual private mobile network, the virtual private mobile network being provisioned for security within the wireless network; and

enabling the user equipment to transmit a second communication through the virtual private mobile network securely isolated from other portions of the wireless network.

2. A method as defined in claim 1, wherein provisioning the virtual private wireless network includes:

identifying available network elements within the wireless network; and

configuring a portion of a control plane and a portion of a data plane of the identified network elements for the virtual private mobile network.

3. A method as defined in claim 2, wherein the network elements include a wireless base transceiver station, a serving gateway, a packet data network gateway, a mobility management entity, a home subscriber server, a eNodeB, a Serving General Packet Radio Service Support Node, or a Gateway General Packet Radio Service Support Node.

4. A method as defined in claim 1, wherein the network elements identify the potential threat to the wireless network.

5. A method as defined in claim 1, wherein instructing the user equipment to communicatively couple to the virtual private mobile network includes using over the air programming to provision a subscriber identity module card associated with the user equipment with an access point name corresponding to the virtual private mobile network.

6. A method as defined in claim 1, wherein the potential threat is identified within a second virtual private mobile network that processes communications from a plurality of user equipment associated with the wireless network.

7. A method as defined in claim 1, wherein the virtual private mobile network prevents the second communication associated with a potential threat from affecting other communications processed within the wireless network.

8. A method as defined in claim 7, wherein the potential threat is associated with at least one of a virus, a network worm, a denial of service attack, an unsupported feature on the user equipment, a vulnerability on the user equipment, a malicious application on the user equipment, or a troublesome application on the user equipment.

9. A method as defined in claim 7, further comprising analyzing communications associated with the potential threat with security tools implemented within the virtual private mobile network to determine a defense strategy, the defense strategy including at least one of blocking the communications, filtering the communications, or monitoring the communications.

10. A method as defined in claim 7, further comprising:

communicating the security event profile associated with the potential threat to other virtual private mobile networks associated with the wireless network;

determining communications that match the security event profile in the other virtual private mobile networks; and

provisioning user equipment associated with the determined communications to communicatively couple to the virtual private mobile network.

11. An apparatus to configure a virtual private mobile network, the apparatus comprising:

a network manager to;

identify available network elements within a wireless network to provision a virtual private mobile network; and

configure a portion of a control plane and a portion of a data plane of the identified network elements for the virtual private mobile network; and

a security processor to;

provision the virtual private mobile network for security to process communications securely isolated from other portions of the wireless network; and

a device migrator to communicatively couple user equipment to the virtual private mobile network.

12. An apparatus as defined in claim 11, wherein the security processor is to identify the communications from the user equipment that match a security event profile.

13. An apparatus as defined in claim 11, wherein the security processor is to provision the virtual private wireless network by installing a security protocol within the virtual private wireless network.

14. An apparatus as defined in claim 11, wherein the device migrator is to communicatively couple the user equipment to the virtual private mobile network by using over the air programming to provision a subscriber identity module card associated with the user equipment with an access point name corresponding to the virtual private mobile network.

15. An apparatus as defined in claim 11, wherein the virtual private mobile network includes security algorithms to analyze the communications associated with a potential threat to determine a defense strategy, the defense strategy including at least one of blocking the communications, filtering the communications, or monitoring the communications.

16. An apparatus as defined in claim 15, wherein the device migrator is to communicatively couple the user equipment to the wireless network after the potential threat is resolved.

17. A tangible machine-accessible medium having instructions stored thereon that, when executed, cause a machine to at least:

identify, in a wireless network, a communication from a user equipment that matches a security event profile;

transmit, from the wireless network, an instruction to enable the user equipment to be communicatively coupled to a virtual private mobile network, the virtual private mobile network being provisioned for security within the wireless network; and

enable the user equipment to transmit a second communication through the virtual private mobile network securely isolated from other portions of the wireless network.

18. A tangible article of manufacture as defined in claim 17, wherein the machine-readable instructions, when executed, cause the machine to:

communicate the security event profile associated with the potential threat to other virtual private mobile networks associated with the wireless network;

determine communications that match the security event profile in the other virtual private mobile networks; and

communicatively couple user equipment associated with the determined communications to the virtual private mobile network.

19. A tangible article of manufacture as defined in claim 17, wherein the machine-readable instructions, when executed, cause the machine to analyze communications associated with the potential threat using security tools implemented within the virtual private mobile network to determine a defense strategy, the defense strategy including at least one of blocking the communications, filtering the communications, or monitoring the communications.

20. A tangible article of manufacture as defined in claim 17, wherein the machine-readable instructions, when executed, cause the machine to provision the virtual private wireless network by:

identifying available network elements within the wireless network; and

configuring a portion of a control plane and a portion of a data plane of the identified network elements for the virtual private mobile network.