SIM-Based Identification Allows SASE to Address Resource-Constrained IoT Devices

Internet of Things (IoT) service provider NTT Transatel, alongside its sister company NTT DOCOMO BUSINESS, and in collaboration with Zscaler Inc. launched an integrated cellular connectivity and cybersecurity service called “Cellular SASE for IoT.” NTT Transatel is a Mobile Virtual Network Operator (MVNO) and a Mobile Virtual Network Enabler (MVNE), selling managed connectivity to enterprises directly, as well as to companies that wish to sell their own connected products and services. In the case of the former, customers can launch own-brand MVNO services that use NTT Transatel’s core network, billing system, Subscriber Identity Module (SIM) provisioning platform, and virtual global radio network wholesaled from spectrum-owning carrier partners worldwide. Transatel has been an NTT Group company since the end of February 2019, when NTT Communications acquired a majority stake. NTT Transatel reports enabling 120 downstream MVNOs, for which it hosts 1.3 million connections, out of a total of 10 million connections managed in total across MVNOs, the IoT and automotive, and travel embedded SIMs (eSIMs).

The new offering provides a full Secure Access Service Edge (SASE) system with global cellular connectivity, and is available in three ways: 1) existing NTT Transatel customers can add Zscaler’s services; 2) existing Zscaler customers can add NTT Transatel’s connectivity; and 3) NTT DOCOMO BUSINESS can sell either the full package to its customers, or upsell just NTT Transatel or Zscaler’s services to them. Zscaler Internet Access (ZIA) provides secure Internet access, and Zscaler Private Access (ZPA) provides secure private access. The customer can choose which they need. Every function of Zscaler’s SASE system is available, and the majority of Transatel’s Connectivity Management Platform (CMP) abilities are available. Zscaler’s SASE has Transatel’s CMP integrated into it, so customers can gain access to Zscaler through NTT Transatel’s Application Programming Interfaces (APIs); while NTT Transatel’s CMP will expose its Call Data Records (CDRs) and network events records (e.g., cell site hand-offs) through Zscaler’s interface. The system can be bought standalone and self-managed, or purchased as a managed service.

An SASE architecture combines networking with cybersecurity. Cybersecurity is a subset of security that protects digital assets, networks, and data from attacks. SASE integrates connectivity networks with a variable suite of security features—most typically Firewall-as-a-Service (FWaaS), Secure Web Gateway (SWG), Zero-Trust Network Access (ZTNA), and policy enforcement and usage monitoring for cloud-based apps. All of these capabilities are cloud-based for ease of scale and management and, vitally, without compromising security. SASE should be an attractive proposition for enterprises as it is intended to improve network performance, simplify security, and provide self-service controls, visualizations, and real-time insights via a managed service platform. Customers can set what policies to control, and what to have managed automatically.

SASE should be able to secure geographically expansive networks with greater ease, as network owners will have fewer vendors to deal with and the convenience of using virtualized infrastructure that is managed for them. This is a good option for rapidly growing networks of connected devices, for international networks, and for both mobile devices and workforces—a proposition with clear synergies to the IoT. The SASE concept has existed for a long time and has been used in the past to secure enterprise laptops and private connected endpoints, for example. But the IoT is different as it is not possible to install SASE client software on resource-constrained IoT devices. NTT Transatel and Zscaler wanted to capitalize on their existing SASE setup, but to innovate by making the SIM card the unique identifier for an IoT device; thereby setting up a secure tunnel between the cellular network and the SASE tenants of the enterprise customer. Such tenants can be use case-specific or general purpose.

Leveraging the SIM creates a pathway for IoT devices that cannot host a client to enable critical cybersecurity features. A dedicated Access Point Name (APN) and secure and redundant Internet Protocol Security (IPsec) tunnels are established in NTT Transatel’s core network to ensure all necessary device security policies are enforced. The key to NTT Transatel and Zscaler’s system is its ability to support a decentralized connected device network architecture. A single customer can have multiple tenants in different geographic locations, should they have business activities in countries with region-specific data protection and/or localized policy enforcement requirements. NTT Transatel operates a global distributed packet communications network. The combination of a decentralized mobile network with SASE aligns with Zscaler’s way of working and its view of the IoT. A decentralized architecture minimizes latency and, according to NTT Transatel and Zscaler, gives the best performance overall.

NTT Transatel and Zscaler had worked together before. Zscaler had experience collaborating with MVNOs and found its way to NTT Transatel. Both parties agreed that their business needs and working practices fitted together well, so they decided to build a common product. NTT DOCOMO BUSINESS was a natural choice of Systems Integrator (SI) to commercialize the combination the two companies’ services for sale to downstream customers. And NTT DOCOMO BUSINESS will be the primary commercial provider in Japan, while sister company NTT DATA will sell to the rest of the world. NTT Transatel will have the ability to commercialize the service through its own sales force, too. However, SIs are the typical channel to market for NTT Transatel and completely define its activity in specific industries that are closed ecosystems, so they require relationships with specialized partners to access. NTT Transatel also acquires customers directly when appropriate and according to what makes the best business sense.

This is an interesting time for IoT MVNOs, as more clearly than ever they are picking specific paths, in terms of the types of customers and customer needs they are targeting, as well as in their channels to market and how they serve enterprises. NTT Transatel, floLIVE, Aeris, 1nce, KORE Wireless, Wireless Logic, and Soracom are all well-known, traditional IoT MVNOs, and in some cases MVNEs. The carrier spinouts of Telenor IoT and Vodafone IoT can be added to the list, too. But they all have different enough strategies that each cannot be thought of as a direct competitor to the other in an absolute sense. Instead, each is suited to a different type of IoT customer, with some overlapping in some places in the customers they are targeting. NTT Transatel’s path is to go to market as a strategic partner, to sell to common customers alongside ground-up developers of IoT systems and providers of complementary technology; NTT Transatel is acting as a technical enabler for the wider interests of its parent NTT Group.

The IoT was an industry of core competencies, serving niches within niches, which is increasingly being served by niches within core competencies. To compete in a market of low margins that is sustained by high volume, every participant needs a unique selling point. Security is a crucial concern, not just by natural necessity in a business-critical domain defined by Return on Investment (ROI), Quality of Service (QoS) and Service-Level Agreements (SLAs), but by virtue of regulation. The European Union (EU) Cyber Resilience Act (CRA) applies to all hardware and software products with digital elements available in the EU regardless of origin, and it is having a knock-on effect worldwide. Sensor-based, resource-constrained devices represent most of the addressable market for the IoT, period. Developing a means of delivering SASE in this scenario fundamentally adds to NTT Transatel’s value-added abilities and reinforces its MVNE specialization, instead of allowing it to become a limitation. NTT Transatel is also co-developing cellular SASE solutions with Fortinet and Palo Alto Networks.