AT&T today said it’s working with Palo Alto Networks and Broadcom on a new open framework for disaggregated security infrastructure at the edge of the network called the Disaggregated Scalable Firewall (DSFW) framework.

Originally, the partners planned to present the high-level concept and design at the Open Compute Project (OCP) Global Summit this week, but the OCP Foundation cancelled that event due to the coronavirus risk. Instead the companies will present it at a virtual OCP event in May.

DSFW is a programmable fabric with embedded security functions will allow network operators to deploy firewalls as software-based platforms rather than hardware appliances, according to AT&T. And it builds on the companies’ earlier  work — specifically the Distributed Disaggregated Chassis (DDC) recently contributed to OCP.

It includes open hardware — Broadcom’s Jericho 2 switch — plus software components including Palo Alto Network’s security, automation, and analytics services. AT&T, which has been disaggregating its network components for several years, says it worked with Palo Alto Networks and Broadcom to define scalability and functionality requirements for network security services in a carrier environment.

This framework differs from a virtualized firewall, which is typically located in a cloud and not integrated into the network, said an AT&T spokesperson in an email. “DSFW is integrated directly with our provider edge fabric so we can offer firewall capabilities in the transport layer (layer 4). This means we can move security closer to our customers and better protect them and our network.”

This becomes more important as 5G networks enable more users and devices to connect to the network, and transport massive amounts of data over it.

“With the size and scale of the AT&T network and the rise in traffic coming from IoT, 5G, etc., this is the only way to cost-effectively secure every point of it versus just the edge,” said Zeus Kerravala, principal analyst at ZK Research.

And while Palo Alto Network’s software provides the initial security services, AT&T worked with Palo Alto Network to create an open API that other security vendors can use if they want to, according to AT&T.

“The idea is this is an open program where other security vendors will join, and eventually the intent is to have a security infrastructure that has a choice of different firewalls or devices working with that common API,” said Cliff Grossner, executive research director at Omdia. “The big openness really comes from this being something they are contributing to the OCP.”

AT&T and Palo Alto Networks say they “look forward to input from other OCP members.”

Additionally, Broadcom’s Jericho 2 chip, which it contributed to the OCP’s Distributed Disaggregated Chassis project, plays a key role in DSFW. Specific to DSFW, Broadcom developed a new feature on the chip to retain Layer 4 session information, which allows for the hardware offload and thus improves the scalability. The session-aware application will determine what can be processed directly on the fabric silicon instead of having to go to the DSFW for further inspection.

Performing some policy enforcement on a switch and then using an API to push some traffic to a specialized device for an additional layer of security isn’t a new idea, Grossner said. “But typically, in the past it’s been done with closed equipment and vendor-branded equipment. What’s new here is making this a community effort in the public domain,” he said.

It’s also noteworthy because it integrates security into the disaggregated networking infrastructure as opposed to bolting it on afterward, Grossner added. “Security has always been something that has been looked at as an afterthought, which is never good, and it’s always been a huge, complex problem solved by a lot of different pieces that have to be glued together somehow to create a workable security infrastructure with manageable risk,” he said. “Looking at security in this comprehensive, holistic way makes it important.”

In addition to allowing other security vendors to deploy their software on top of this distributed hardware framework, it also opens the door for a future AT&T software-as-a-service play — and a way for operators to monetize edge services, said Mauricio Sanchez, Dell’Oro Group’s research director of network security. “One could imagine that AT&T, once they deploy this type of architecture and really get it off the ground, to offer security series at those distributed PoPs [points of presences].”

Plus, it gives both Broadcom and Palo Alto Networks an “easy button” into other operators’ environments, Sanchez added. “It creates the economics of scale for this type of architecture. AT&T blessed this architecture and with their blessing they get other service provides to also join in,” he said. “Palo Alto and Broadcom are now part of a blessed carrier architecture, so there’s likely going to be a preference for Palo Alto and Broadcom. It’s going to be an easy button.”

The new framework is also interesting in that it targets carriers as opposed to top-tier cloud providers like Facebook, Microsoft, and Google and tech giants like Intel. It also indicates that telco cloud may, in fact, be the next wave for OCP gear.

“Facebook and other hyperscalers use it,” Sanchez said, referring to OCP hardware. “But this increases the legitimacy of the OCP server and data center architecture to expand beyond the traditional hyperscale data centers into the operators’ environment. I could foresee this leading to some wind in the sales of OCP increasing its legitimacy as the de facto server standard in the carrier space.”