Method and system for selective and secure interaction of BYOD (bring your own device) with enterprise network through mobile wireless networks
View Patent ↗A mechanism to allow provisioning and use of BYOD (Bring Your Own Device) for authorized access in the enterprise network through a 3G/4G/Wi-Fi access network is provided. A brokering entity in the mobile packet core is provisioned for each authorized employee with enterprise specific rules for security and steering of user traffic. An Enterprise Container is defined as entity on the User Equipment that is self-contained virtual machine with enterprise sanctioned applications. An intelligent mechanism for and steering of signaling and traffic from such BYOD devices to the brokering entity is defined. At any time by using the personal container or the default behavior of the user equipment the user can get mobile service as if the Enterprise Container did not exist. Further, when such employment relationship is terminated the user's BYOD needs to be restored to its pre-employment functionality.
1. A network element for processing network traffic of a packet network comprising:
an access network interface unit configured to send and receive communications from a mobile device and an enterprise network; and
a processor with a memory associated with the network interface unit and adapted to:
receive a first subscriber identification code and a request for service from a mobile device;
match the first subscriber identification code to an employee record from the memory;
query a remote database to obtain a mobile subscriber record and authentication vectors associated with the employee record;
perform authentication of the mobile device; and
fulfill the request for service from the mobile device.
2. The network element of claim 1 , wherein the processor is further adapted to:
assign a second subscriber identification code to the mobile device which is encoded with predetermined rules to route the subsequent signaling.
3. The network element of claim 1 , wherein the processor is further adapted to:
receive provisioning data from the enterprise network, modify the first subscriber identification code according to a predetermined rules to route the subsequent signaling to the corresponding enterprise network, store the provisioning data and modified first subscriber identification code in the memory associated with each enterprise employee's device, and send the modified first subscriber identification code to each enterprise employee's device.
4. The network element of claim 3 , wherein the provisioning data includes enterprise network policies associated with each employee, employee subscription and employee mobile devices.
5. The network element of claim 1 , wherein the first subscriber identification code is an International mobile subscriber identity (IMSI).
6. The network element of claim 2 , wherein the second subscriber identification code is a packet temporary mobile subscriber identity (P-TMSI) or global user temporary identity (GUTI).
7. The network element of claim 1 , wherein the processor is further adapted to:
receive a modified first identification code from the mobile device through a SGSN at 3GPP based core network in a case where a RAN does not have a direct communication link to the network element to transfer a signal from the mobile device.
8. The network element of claim 1 , wherein the processor is further adapted to:
receive a modified first identification code from the mobile device through a foreign SGSN and a roaming exchange in a case where the mobile device is in a foreign mobile network.
9. The network element of claim 1 , wherein the processor is further adapted to:
receive instructions regarding ending a relationship with an employee from the enterprise network; and
sending instructions to the mobile device to restore the first subscriber identification code for subsequent signaling.
10. The network element of claim 1 , wherein the remote database is an HLR/HSS database.
11. A system comprising:
a mobile device comprising:
an access network interface configured to send and receive communications from a packet network; and
a processor with a memory associated with the network interface unit and adapted to:
operate an isolated container for enterprise authorized applications;
a network element for processing network traffic of a packet network and in communication with the mobile device, said network element comprising:
an access network interface unit configured to send and receive communications from a mobile device and an enterprise network; and
a processor with a memory associated with the network interface unit and adapted to:
receive a first subscriber identification code and a request for service from the mobile device;
match the first subscriber identification code to an employee record from the memory;
query a remote database to obtain a mobile subscriber record and authentication vectors associated with the employee record;
perform authentication of the mobile device; and fulfill the request for service from the mobile device.
12. The system of claim 11 , wherein the processor is further adapted to:
assign a second subscriber identification code to the mobile device which is encoded with predetermined rules to route the subsequent signaling.
13. The system of claim 11 , wherein the processor is further adapted to:
receive provisioning data from the enterprise network, modify the first subscriber identification code according to a predetermined rules to route the subsequent signaling to the corresponding enterprise network, store the provisioning data and modified first subscriber identification code in the memory associated with each enterprise employee's device, and send the modified first subscriber identification code to each enterprise employee's device.
14. The system of claim 13 , wherein the provisioning data includes enterprise network policies associated with each employee, employee subscription and employee mobile devices.
15. The system of claim 11 wherein the first subscriber identification code is an International mobile subscriber identity (IMSI).
16. The system of claim 12 , wherein the second subscriber identification code is a packet temporary mobile subscriber identity (P-TMSI) or global user temporary identity (GUTI).
17. The system of claim 11 , wherein the processor is further adapted to:
receive a modified first identification code from the mobile device through a SGSN at 3GPP based core network in a case where a RAN does not have a direct communication link to the network element to transfer a signal from the mobile device.
18. The system of claim 11 , wherein the processor is further adapted to:
receive a modified first identification code from the mobile device through a foreign SGSN and a roaming exchange in a case where the mobile device is in a foreign mobile network.
19. A system of claim 11 , wherein the mobile device is further comprising:
an access network interface unit configured to send and receive communications from a packet network; and
a processor with a memory associated with the access network interface unit and adapted to:
modify the Network Resource Indication (NRI) bits of a Packet Temporary Mobile Subscriber Identity (P-TMSI) to a value corresponding to an enterprise broker located in a mobile packet core; and
send and receive communications to and from the enterprise broker.
20. The system of claim 19 , wherein the processor is further adapted to:
recognize a failure of a query to reach an HSS/HLR database;
transmit the query to an enterprise broker instead of the HSS/HLR database; and
receive the response to the query from the enterprise broker.
21. A method performed with a network element having an access network unit interface, a processor and memory, said network element configured to process network signaling of a packet core network, the method comprising:
receiving a first subscriber identification code and a request for service from a mobile device;
matching the first subscriber identification code to an employee record from the memory;
querying a remote database to obtain a mobile subscriber record and authentication vectors associated with the employee record;
performing an authentication of the mobile device; and
fulfilling the request for service from the mobile device.
22. The method of claim 21 , wherein the processor is further adapted to:
receive provisioning data from the enterprise network, modify the first subscriber identification code according to a predetermined rules to route the subsequent signaling to the corresponding enterprise network, store the provisioning data and modified first subscriber identification code in the memory associated with each enterprise employee's device, and send the modified first subscriber identification code to each enterprise employee's device.