Benu Networks pushed secure access service edge (SASE) services deeper into the telecom edge today with the launch of its cloud-native SD-Edge platform.

Founded in 2010, Benu Networks specializes in broadband network gateways (BNG). These devices sit at the network edge and provide, among other things, authentication services for internet service providers, like Comcast and Liberty Global.

Traditionally, these services are rather straightforward. The customer’s CPE — think optical network terminal, cable, or DSL modem — communicates with the gateway and checks to see if the subscriber’s account is in good standing or if they've exceeding bandwidth limits.

“We have about 25 million homes and business sites that are connecting through our platforms today,” Michael McFarland, VP of product management and marketing at Benu Networks, said. “It’s about seven petabytes of traffic each day.”

However, as telecommunications companies and ISPs look to offer new customer-facing services, they are increasingly pushing these gateways closer to the customer edge.

“An example of one of these very large deployments is the Comcast Xfinity service. On most Comcast WiFi access points, there’s a second SSID — or WiFi name — that’s called Xfinity, and if you’re a subscriber of Comcast, you can connect to that basically for free, regardless of where you are in the country,” McFarland said. “Most of that actually is serviced by our software, and we’ve done the same for a lot of carriers.”

But with Benu’s shift from virtualized appliances to a cloud-native software stack that runs and scales on standard server hardware, the company saw the opportunity to turn every broadband network gateway into a SASE point of presence (PoP).

“Our customers have identified not only that there's a huge trend towards SASE on the enterprise side, but now the enterprise network is getting extended out to the homes,” McFarland said. “So you have many more endpoints to the enterprise network whereas it used to be there were certain offices and that’s where it sort of was.”

The problem is the network operators don’t want to resell an over-the-top SASE platform and instead want something that can take advantage of their infrastructure, he argued, adding that network operators can do just that by running the SASE platform on the BNG.

Pushing the SASE platform out to BNG has other advantages as well, McFarland explained. One of the biggest is that in many cases it eliminates the need for remote workers to use a VPN or endpoint agent to connect to the corporate data center or SASE PoP. Instead, all traffic is routed to the local gateway where the routing and security policy is applied.

As part of Benu’s SASE push the company will provide some security functionality, like URL filtering, while also playing host to more established SASE vendors, many of which have existing relationships with the network operators.

“We don’t have full-blown intrusion detection, or sandboxing, or inline antivirus. For these kinds of things we would partner with a third-party security firm,” McFarland said. “Usually in that case, if it’s for an enterprise, they may have a brand preference, like Palo Alto or Fortinet, the carrier can actually stitch that particular carrier into the flow.”

He argues that the vast majority of users and small to midsized businesses (SMB) just want the basic security functionality encompassed by Benu’s own security implementation.

The company also announced a new 5G access gateway function, which was defined jointly with the Broadband Forum and 3GPP, and allows carriers to manage a fixed network via a 5G mobile core.

“It basically looks like a BNG with some control-plane interfaces for policy and subscriber management from the 5G core,” McFarland said.

According to Benu, the company’s access gateway function will consolidate billing for fixed and mobile services, and allow the same services to be delivered over any type of network.