TSG maintains a dynamic runtime table (TSG_DYN_IPPORT_SUBSCRIBER_MAPPING) that correlates each network session's IP/port tuple with a subscriber's IMSI and phone number, loaded via incremental Redis-backed updates into the policy-matching engine — i.e. blocking/monitoring decisions can be attributed to a specific subscriber identity, not just an IP.
table[TSG_DYN_IPPORT_SUBSCRIBER_MAPPING] ... entries pair each flow's IP/port tuple with fields including imsi and phone_number, loaded incrementally via Redis into the policy runtime (7.9M+ entries observed in one deployment's table).
Defense implications
- This is a mass-surveillance / lawful-intercept-style capability distinct from pure traffic blocking — session-to-subscriber-identity correlation implies integration with telecom-side subscriber data (likely via mobile-network AAA/RADIUS or CGN logs), not just DPI. Relevant context for threat-modeling mobile-network deployments specifically, beyond fixed-line censorship.
capabilitysubscriber-correlation