Authentication and authorization in a private mobile network

1 . A method of authenticating and authorizing user devices requesting to access an SD-PMN (software-defined private mobile network) deployed for a particular geographic area, the method comprising:

from a new user device, receiving a request to access the SD-PMN;

performing a look-up in a UDM (unified data management) comprising user information for a plurality of users authorized to access the SD-PMN to determine whether the new user device is authorized to access the SD-PMN; and

upon determining that the new user device is authorized, directing a UPF (user plane function) deployed for the SD-PMN to enable the new user device to access the SD-PMN;

wherein receiving the request to access the SD-PMN from the new user device comprises receiving the request to access the SD-PMN from an SD-WAN edge router deployed to a same location in the particular geographical area as the new user device;

wherein the SD-PMN includes on-premises equipment having a radio access network (RAN) and the SD-WAN edge router which reside at an on-premises location;

wherein the SD-PMN further includes SD-WAN point of presence (POP) equipment having the UDM, the SD-WAN POP equipment residing at an SD-WAN POP location which is different from the on-premises location;

wherein one of the on-premises equipment residing at the on-premises location and the SD-WAN POP equipment residing at the SD-WAN PoP location further has an access and mobility management function (AMF); and

wherein performing the look-up in the UDM includes:

accessing the UDM of the SD-WAN POP equipment at the SD-WAN POP location to authenticate the new user device after the request to access the SD-PMN is received by the AMF through the RAN at the on-premises location.

2 . The method of claim 1 , wherein performing the look-up in the UDM to determine whether the new user device is authorized to access the SD-PMN comprises performing a look-up in the UDM to determine whether a user identifier associated with the new user device is included in a list of user identifiers associated with users that are authorized to access the SD-PMN.

3 . The method of claim 2 , wherein each user identifier is associated with one or more user devices.

4 . The method of claim 3 , wherein each user device associated with a particular user is required to be authenticated based on a particular user identifier associated with the particular user.

5 . The method of claim 1 , wherein directing the UPF deployed for the SD-PMN to enable the new user device to access the SD-PMN comprises directing the UPF to (i) provide the new user device with an IP (Internet protocol) address, (ii) enable a particular QoS (quality of service) for the new user device, and (iii) identify one or more subnets of the SD-PMN on which to put traffic associated with new user device.

6 . The method of claim 1 , wherein the method is performed by a set of control plane components deployed for the SD-PMN, the set of control plane components comprising at least the AMF and an SMF (session management function).

7 . The method of claim 1 , wherein the new user device is a first new user device and the request to access the SD-PMN is a first request to access the SD-PMN, the method further comprising:

from a second new user device, receiving a second request to access the SD-PMN;

performing a look-up in the UDM to determine whether the second new user device is authorized to access the SD-PMN; and

upon determining that the second new user device is not authorized, sending a reply to the second new user device to indicate that the second new user device is not authorized to access the SD-PMN.

8 . The method of claim 1 , wherein the new user device connects to the SD-WAN edge router via one of an LTE (long term evolution) connection, a 4G connection, and a 5G connection.

9 . The method of claim 8 , wherein the SD-WAN edge router has a connection to the SD-PMN via a tower deployed to the particular geographical area as part of a RAN (radio access network) of the SD-PMN.

10 . The method of claim 9 , wherein the connection between the SD-WAN edge router and the tower comprises one of an LTE connection, a 4G connection, and a 5G connection via CBRS (citizens broadband radio service).

11 . The method of claim 1 , wherein the AMF belongs to the on-premises equipment and resides at the on-premises location.

12 . The method of claim 1 , wherein the AMF belongs to the SD-WAN POP equipment and resides at the SD-WAN POP location.

13 . A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for authenticating and authorizing user devices requesting to access an SD-PMN (software-defined private mobile network) deployed for a particular geographic area, the program comprising sets of instructions for:

from a new user device, receiving a request to access the SD-PMN; performing a look-up in a UDM (unified data management) comprising

user information for a plurality of users authorized to access the SD-PMN to determine whether the new user device is authorized to access the SD-PMN; and

upon determining that the new user device is authorized, directing a UPF (user plane function) deployed for the SD-PMN to enable the new user device to access the SD-PMN;

wherein the set of instructions for receiving the request to access the SD-PMN from the new user device comprises a set of instructions for receiving the request to access the SD-PMN from an SD-WAN edge router deployed to a same location in the particular geographical area as the new user device;

wherein the SD-PMN includes on-premises equipment having a radio access network (RAN), an access and mobility management (AMF) function, and the SD-WAN edge router which reside at an on-premises location;

wherein the SD-PMN further includes SD-WAN point of presence (POP) equipment having the UDM, the SD-WAN POP equipment residing at an SD-WAN POP location which is different from the on-premises location; and

wherein performing the look-up in the UDM includes:

accessing the UDM of the SD-WAN POP equipment at the SD-WAN POP location to authenticate the new user device after the request to access the SD-PMN is received by the AMF at the on-premises location through the RAN at the on-premises location.

14 . The non-transitory machine readable medium of claim 13 , wherein the set of instructions for performing the look-up in the UDM to determine whether the new user device is authorized to access the SD-PMN comprises a set of instructions for performing a look-up in the UDM to determine whether a user identifier associated with the new user device is included in a list of user identifiers associated with users that are authorized to access the SD-PMN.

15 . The non-transitory machine readable medium of claim 14 , wherein each user identifier is associated with one or more user devices; and

wherein each user device associated with a particular user is required to be authenticated based on a particular user identifier associated with the particular user.

16 . The non-transitory machine readable medium of claim 13 , wherein the set of instructions for directing the UPF deployed for the SD-PMN to enable the new user device to access the SD-PMN comprises a set of instructions for directing the UPF to (i) provide the new user device with an IP (Internet protocol) address, (ii) enable a particular QoS (quality of service) for the new user device, and (iii) identify one or more subnets of the SD-PMN on which to put traffic associated with new user device.

17 . The non-transitory machine readable medium of claim 13 , wherein the new user device is a first new user device and the request to access the SD-PMN is a first request to access the SD-PMN, the program further comprising sets of instructions for:

from a second new user device, receiving a second request to access the SD-PMN;

performing a look-up in the UDM to determine whether the second new user device is authorized to access the SD-PMN; and

upon determining that the second new user device is not authorized, sending a reply to the second new user device to indicate that the second new user device is not authorized to access the SD-PMN.

18 . The non-transitory machine readable medium of claim 13 , wherein the new user device connects to the SD-WAN edge router via one of an LTE (long term evolution) connection, a 4G connection, and a 5G connection.

19 . The non-transitory machine readable medium of claim 18 , wherein: the SD-WAN edge router has a connection to the SD-PMN via a tower deployed to the particular geographical area as part of a RAN (radio access network) of the SD-PMN; and the connection between the SD-WAN edge router and the tower comprises one of an LTE connection, a 4G connection, and a 5G connection via CBRS (citizens broadband radio service).

20 . A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for authenticating and authorizing user devices requesting to access an SD-PMN (software-defined private mobile network) deployed for a particular geographic area, the program comprising sets of instructions for:

from a new user device, receiving a request to access the SD-PMN; performing a look-up in a UDM (unified data management) comprising

user information for a plurality of users authorized to access the SD-PMN to determine whether the new user device is authorized to access the SD-PMN; and

upon determining that the new user device is authorized, directing a UPF (user plane function) deployed for the SD-PMN to enable the new user device to access the SD-PMN;

wherein the set of instructions for receiving the request to access the SD-PMN from the new user device comprises a set of instructions for receiving the request to access the SD-PMN from an SD-WAN edge router deployed to a same location in the particular geographical area as the new user device;

wherein the SD-PMN includes on-premises equipment having a radio access network (RAN) and the SD-WAN edge router which reside at an on-premises location;

wherein the SD-PMN further includes SD-WAN point of presence (POP) equipment having an access and mobility management (AMF) function and the UDM which reside at an SD-WAN POP location which is different from the on-premises location; and

wherein performing the look-up in the UDM includes:

accessing the UDM of the SD-WAN POP equipment at the SD-WAN POP location to authenticate the new user device after the request to access the SD-PMN is received by the AMF at the SD-WAN POP location through the RAN at the on-premises location.