Access and mobility management function relocation due to security gateway overload/failure

1 . A method, comprising:

establishing, by a mobile network entry node, a first encrypted tunnel with a first active N2 interface security gateway at a first data center to enable the mobile network entry node to communicate, via the first encrypted tunnel, an N2 interface, and the first active N2 interface security gateway, with a first access and mobility management function (AMF), paired with the first active N2 interface security gateway, at the first data center, wherein the mobile network entry node comprises a device in a Radio Access Network (RAN), a device associated with a femtocell connected to a mobile network, or an Interworking Function (IWF) that enables interworking between one or more other networks and the mobile network;

determining an occurrence of a failure or overload condition at the first active N2 interface security gateway at the first data center;

establishing, by the mobile network entry node based on the determined occurrence of the failure or overload condition at the first active N2 interface security gateway, a second encrypted tunnel with a standby N2 interface security gateway at a second data center to temporarily pair the standby N2 interface security gateway at the second data center with the first AMF at the first data center and enable the mobile network entry node to communicate, via the second encrypted tunnel, the N2 interface, and the standby N2 interface security gateway, with the first AMF at the first data center;

initiating, by the mobile network entry node based on the determined occurrence of the failure or overload condition at the first active N2 interface security gateway, AMF relocation from the first AMF at the first data center to a second AMF at the second data center; and

initiating, in coordination with the AMF relocation, security gateway relocation from the standby N2 interface security gateway at the second data center to a second active N2 interface security gateway at the second data center to pair the second active N2 interface security gateway with the second AMF.

2 . The method of claim 1 , further comprising:

establishing, by the mobile network entry node, based on the coordinated AMF relocation and security gateway relocation, a third encrypted tunnel with the second active N2 interface security gateway to enable the mobile network entry node to communicate, via the third encrypted tunnel, the N2 interface, and the second active N2 interface security gateway, with the paired second AMF at the second data center; and

forwarding, by the mobile network entry node via the third encrypted tunnel, the N2 interface, and the second active N2 interface security gateway, at least one third User Equipment device (UE) message to the second AMF at the second data center.

3 . The method of claim 2 , further comprising:

engaging, by the mobile network entry node in conjunction with the first active N2 interface security gateway paired with the first AMF at the first data center, in an encryption key management protocol for establishing the first encrypted tunnel between the mobile entry node and the first active N2 interface security gateway; and

engaging, by the mobile network entry node in conjunction with the second active N2 interface security gateway at the second data center, in the encryption key management protocol for establishing the third encrypted tunnel between the mobile entry node and the second active N2 interface security gateway.

4 . The method of claim 3 , wherein the encryption key management protocol comprises Internet Key Exchange (IKE) and wherein the encryption protocol comprises Internet Protocol Security (IPSec).

5 . The method of claim 3 , wherein engaging, by the mobile network entry node in conjunction with the first active N2 interface security gateway, in the encryption key management protocol results in obtaining one or more first encryption keys,

wherein establishing the first encrypted tunnel with the first active N2 interface security gateway further comprises using an encryption protocol and the one or more first encryption keys to establish the first encrypted tunnel between the mobile network entry node and the first active N2 interface security gateway,

wherein engaging, by the mobile network entry node in conjunction with the second active N2 interface security gateway, in the encryption key management protocol results in obtaining one or more third encryption keys, and

wherein establishing the third encrypted tunnel with the second active N2 interface security gateway at the second data center further comprises using the encryption protocol and the one or more third encryption keys to establish the third encrypted tunnel between the mobile network entry node and the second active N2 interface security gateway at the second data center.

6 . The method of claim 1 , further comprising:

installing, prior to establishing the first encrypted tunnel, the first AMF and the first active N2 interface security gateway at the first data center; and

installing, prior to establishing the first encrypted tunnel, the second AMF, the standby N2 interface security gateway, and the second active N2 interface security gateway at the second data center.

7 . The method of claim 1 , wherein the first data center is located at a first data center site and the second data center is located at a second data center site, wherein the first data center site comprises a first geographic location and the second data center site comprises a second geographic location, and wherein the first geographic location is located in geographic proximity to the second geographic location.

8 . The method of claim 1 , wherein the mobile network comprises a Fifth Generation (5G) mobile network.

9 . A device, comprising:

at least one transceiver configured to communicate via a mobile core network; and

at least one hardware processor, microprocessor, or processing logic configured to:

establish a first encrypted tunnel with a first active N2 interface security gateway at a first data center to enable the device to communicate, via the first encrypted tunnel and the first active N2 interface security gateway, with a first access and mobility management function (AMF), paired with the first active N2 interface security gateway, at the first data center, wherein the device comprises a device in a Radio Access Network (RAN), a device associated with a femtocell connected to a mobile network, or a device executing an Interworking Function (IWF) that enables interworking between one or more other networks and the mobile network,

determine an occurrence of a failure or overload condition at the first active N2 interface security gateway at the first data center,

establish, based on the determined occurrence of the failure or overload condition at the first active N2 interface security gateway, a second encrypted tunnel with a standby N2 interface security gateway at a second data center to temporarily pair the standby N2 interface security gateway at the second data center with the first AMF at the first data center and enable the device to communicate, via the second encrypted tunnel, the N2 interface, and the standby N2 interface security gateway, with the first AMF at the first data center,

initiate, based on the determined occurrence of the failure or overload condition at the first active N2 interface security gateway, AMF relocation from the first AMF at the first data center to a second AMF at the second data center, and

initiate, in coordination with the AMF relocation, security gateway relocation from the standby N2 interface security gateway at the second data center to a second active N2 interface security gateway at the second data center to pair the second active N2 interface security gateway with the second AMF at the second data center.

10 . The device of claim 9 , wherein the at least one hardware processor, microprocessor, or processing logic is further configured to:

establish, based on the coordinated AMF relocation and security gateway relocation, a third encrypted tunnel with the second active N2 interface security gateway to enable the device to communicate, via the third encrypted tunnel, the N2 interface, and the second active N2 interface security gateway, with the paired second AMF at the second data center, and

forward, via the third encrypted tunnel, the N2 interface, and the second active N2 interface security gateway, at least one UE message to the second AMF at the second data center.

11 . The device of claim 10 , wherein the at least one hardware processor, microprocessor, or processing logic is further configured to:

engage, in conjunction with the first active N2 interface security gateway paired with the first AMF at the first data center, in an encryption key management protocol for establishing the first encrypted tunnel between the device and the first active N2 interface security gateway, and

engage, in conjunction with the second active N2 interface security gateway at the second data center, in the encryption key management protocol for establishing the third encrypted tunnel between the device and the second active N2 interface security gateway.

12 . The device of claim 11 , wherein the encryption key management protocol comprises Internet Key Exchange (IKE) and wherein the encryption protocol comprises Internet Protocol Security (IPSec).

13 . The device of claim 11 , wherein engaging, in conjunction with the first active N2 interface security gateway, in the encryption key management protocol results in obtaining one or more first encryption keys,

wherein, when establishing the first encrypted tunnel with the first active N2 interface security gateway, the hardware processor, microprocessor, or processing logic is further configured to use an encryption protocol and the one or more first encryption keys to establish the first encrypted tunnel between the device and the first active N2 interface security gateway,

wherein engaging, in conjunction with the second active N2 interface security gateway, in the encryption key management protocol results in obtaining one or more third encryption keys, and

wherein, when establishing the third encrypted tunnel with the second active N2 interface security gateway at the second data center, the at least one hardware processor, microprocessor, or processing logic is further configured to use the encryption protocol and the one or more third encryption keys to establish the third encrypted tunnel between the device and the second active N2 interface security gateway at the second data center.

14 . The device of claim 9 , wherein the mobile network comprises a Fifth Generation (5G) mobile network.

15 . The device of claim 9 , wherein the first data center is located at a first data center site and the second data center is located at a second data center site, wherein the first data center site comprises a first geographic location and the second data center site comprises a second geographic location, and wherein the first geographic location is located in geographic proximity to the second geographic location.

16 . A non-transitory storage medium storing instructions executable by a network device, wherein the instructions cause the network device to:

establish a first encrypted tunnel with a first active N2 interface security gateway at a first data center to enable the network device to communicate, via the first encrypted tunnel and the first active N2 interface security gateway, with a first access and mobility management function (AMF), paired with the first active N2 interface security gateway, at the first data center, wherein the network device comprises a device in a Radio Access Network (RAN), a device associated with a femtocell connected to a mobile network, or an Interworking Function (IWF) that enables interworking between one or more other networks and the mobile network;

determine an occurrence of a failure or overload condition at the first active N2 interface security gateway at the first data center;

establish, based on the determined occurrence of the failure or overload condition at the first active N2 interface security gateway, a second encrypted tunnel with a standby N2 interface security gateway at a second data center to temporarily pair the standby N2 interface security gateway at the second data center with the first AMF at the first data center and enable the network device to communicate, via the second encrypted tunnel, the N2 interface, and the standby N2 interface security gateway, with the first AMF at the first data center;

initiate, based on the determined occurrence of the failure or overload condition at the first active N2 interface security gateway, AMF relocation from the first AMF at the first data center to a second AMF at the second data center; and

initiate, in coordination with the AMF relocation, security gateway relocation from the standby N2 interface security gateway at the second data center to a second active N2 interface security gateway at the second data center to pair the second active N2 interface security gateway with the second AMF at the second data center.

17 . The non-transitory storage medium of claim 16 , wherein the instructions further cause the network device to:

establish, based on the coordinated AMF relocation and security gateway relocation, a third encrypted tunnel with the second active security gateway to enable the network device to communicate, via the third encrypted tunnel, the N2 interface, and the second active N2 interface security gateway, with the paired second AMF at the second data center; and

forward, via the third encrypted tunnel, the N2 interface, and the second active N2 interface security gateway at the second data center, at least one UE message to the second AMF at the second data center.

18 . The non-transitory storage medium of claim 17 , wherein the instructions further cause the network device to:

engage, in conjunction with the first active N2 interface security gateway paired with the first AMF at the first data center, in an encryption key management protocol for establishing the first encrypted tunnel between the network device and the first active N2 interface security gateway; and

engage, in conjunction with the second active N2 interface security gateway at the second data center, in the encryption key management protocol for establishing the third encrypted tunnel between the network device and the second active N2 interface security gateway.

19 . The non-transitory storage medium of claim 18 , wherein engaging, in conjunction with the first active N2 interface security gateway, in the encryption key management protocol results in obtaining one or more first encryption keys,

wherein the instructions to cause the network device to establish the first encrypted tunnel with the first active N2 interface security gateway further cause the network device to use an encryption protocol and the one or more first encryption keys to establish the first encrypted tunnel between the network device and the first active N2 interface security gateway,

wherein engaging, in conjunction with the second active N2 interface security gateway, in the encryption key management protocol results in obtaining one or more third encryption keys, and

wherein the instructions to cause the network device to establish the third encrypted tunnel with the second active N2 interface security gateway at the second data center further cause the network device to use the encryption protocol and the one or more third encryption keys to establish the third encrypted tunnel between the network device and the second active N2 interface security gateway at the second data center.

20 . The non-transitory storage medium of claim 16 , wherein the mobile network comprises a Fifth Generation (5G) mobile network.

21 . The non-transitory storage medium of claim 16 , wherein the first data center is located at a first data center site and the second data center is located at a second data center site, wherein the first data center site comprises a first geographic location and the second data center site comprises a second geographic location, and wherein the first geographic location is located in geographic proximity to the second geographic location.