SIM whitelisting and multi-operator core networks
A method may be disclosed in accordance with some embodiments, comprising: receiving, at a virtualizing gateway, a first service request from a first user equipment (UE) via a first eNodeB; creating, at the virtualizing gateway, an association from each of a plurality of UE identifiers to a desired core network; applying, at the virtualizing gateway, a first filter using a first UE identifier of the first UE, based on the association; forwarding, at the virtualizing gateway, based on the applied first filter, the first service request from the first UE to the first core network; receiving, at the virtualizing gateway, via a second eNodeB, a second service request from a second user equipment (UE); applying, at the virtualizing gateway, a second filter using a second UE identifier of the second UE, based on the association; and forwarding, at the virtualizing gateway, based on the applied second filter, the second service request from the second UE to the second core network.
1. A method comprising:
receiving, at an eNodeB from a user equipment (UE), one of a request for attaching to an eNodeB wherein the request includes UE identifier derived from an International Mobile Subscriber Identity (IMSI) or a periodic tracking area update (TAU);
establishing a connection between the UE and the EnodeB;
sending, by the eNodeB, one of a UE message to a virtualizing gateway or a TAU request, the message including the UE identifier derived from an IMSI, the virtualizing gateway in communication with a plurality of core networks, the virtualizing gateway configured to provide multi-operator core network (MOCN) gateway functionality for the eNodeB;
performing a whitelisting lookup by the virtualizing gateway based on the UE identifier derived from an IMSI and based on a mapping of UE identifiers to authorized core networks for each UE identifier in the plurality of core networks, to determine whether to send a service request to a first core network or a second core network; and
wherein when a record of the UE is not found, then using the identifier derived from the IMSI at the virtualizing gateway.
2. The method of claim 1 wherein the identifier derived from an IMSI comprises a System Architecture Evolution Temporary Mobile Subscriber Identity (S-TMSI).
3. The method of claim 1 further comprising:
sending a network access stratum (NAS) identity request message to the UE from the virtualizing gateway via the eNodeB requesting the identifier derived from an IMSI from the UE;
sending the identifier derived from an IMSI from the UE to the virtualizing gateway; and
verifying, at the coordinating gateway, credentials of the UE.
4. The method of claim 1 further comprising providing services to a public safety agency limited to public safety personnel with subscriber identity module (SIM) cards having IMSIs that have been configured in a first filter to permit access.
5. The method of claim 1 , further comprising caching subscriber authentication information after retrieval from a remote core network in a MOCN core network.
6. The method of claim 3 further comprising wherein the IMSI is not authenticated by the virtualizing gateway resulting in rejection of the service request.
7. The method of claim 3 further comprising wherein the identifier derived from an IMSI is authenticated by the virtualizing gateway.
8. The method of claim 6 further comprising:
sending one of a service rejection or a TAU rejection from the virtualizing gateway to the eNodeB;
sending one of the service rejection or the TAU rejection from the eNodeB to the UE; and
releasing the connection from the UE to the virtualizing gateway.
9. The method of claim 7 further comprising storing at the virtualizing gateway the identifier derived from an IMSI;
receiving at an MME one of the service request or the TAU request; and
authorizing the UE.
10. The method of claim 8 further comprising releasing the UE when the UE enters an idle state.
11. A system, comprising:
an eNodeB in communication with a first user equipment (UE);
a virtualized gateway in communication with the eNodeB and acting as a virtualizing gateway for communications with a plurality of core networks, the virtualizing gateway configured to provide multi-operator core network (MOCN) gateway functionality for the eNodeB;
wherein the system performs steps including:
receiving, at an eNodeB from a UE, one of a request for attaching to an eNodeB wherein the request includes a UE identifier derived from an International Mobile Subscriber Identity (IMSI) or a periodic tracking area update (TAU);
establishing a connection between the UE and the EnodeB;
sending by the eNodeB, one of a UE message to a virtualizing gateway or a TAU request, the message including the UE identifier derived from an IMSI, the virtualizing gateway in communication with a plurality of core networks, the virtualizing gateway configured to provide multi-operator core network (MOCN) gateway functionality for the eNodeB;
performing a whitelisting lookup by the virtualizing gateway based on the UE identifier derived from an IMSI and based on a mapping of UE identifiers to authorized core networks for each UE identifier in the plurality of core networks, to determine whether to send a service request to a first core network or a second core network; and
wherein when a record of the UE is not found, then using the identifier derived from the IMSI at the virtualizing gateway.
12. The system of claim 11 wherein the identifier derived from an IMSI comprises a System Architecture Evolution Temporary Mobile Subscriber Identity (S-TMSI).
13. The system of claim 11 further comprising:
sending a network access stratum (NAS) identity request message to the UE from the virtualizing gateway via the eNodeB requesting the identifier derived from an IMSI from the UE;
sending the identifier derived from an IMSI from the UE to the virtualizing gateway; and
verifying, at the coordinating gateway, credentials of the UE.
14. The system of claim 11 further comprising wherein services are provided to a public safety agency limited to public safety personnel with subscriber identity module (SIM) cards having IMSIs that have been configured in a first filter to permit access.
15. The system of claim 11 , further comprising a subscriber authentication information cache configured to perform caching after retrieval from a remote core network in a MOCN core network.
16. The system of claim 13 further comprising wherein the IMSI is not authenticated by the virtualizing gateway resulting in rejection of the service request.
17. The system of claim 13 further comprising wherein the identifier derived from an IMSI is authenticated by the virtualizing gateway.
18. The system of claim 16 further comprising:
sending one of a service rejection or a TAU rejection from the virtualizing gateway to the eNodeB;
sending one of the service rejection or the TAU rejection from the eNodeB to the UE; and
releasing the connection from the UE to the virtualizing gateway.
19. The system of claim 17 further comprising storing at the virtualizing gateway the identifier derived from an IMSI;
receiving at an MME one of the service request or the TAU request; and
authorizing the UE.
20. A non-transitory computer-readable medium comprising instructions that, when executed cause a system to:
receive, at an eNodeB from a UE, one of a request for attaching to an eNodeB wherein the request includes a S-TMSI or a periodic tracking area update (TAU), wherein a UE identifier derived from an IMSI comprises a System Architecture Evolution Temporary Mobile Subscriber Identity (S-TMSI);
establish a connection between the UE and the EnodeB;
send by the eNodeB, one of a UE message to a virtualizing gateway or a TAU request, the message including the S-TMSI, the virtualizing gateway in communication with a plurality of core networks, the virtualizing gateway configured to provide multi-operator core network (MOCN) gateway functionality for the eNodeB;
perform whitelisting lookup by the virtualizing gateway based on the S-TMSI and based on a mapping of UE identifiers to authorized core networks for each UE identifier in the plurality of core networks; and
determining whether to send a service request to a first core network or a second core network.
21. The non-transitory computer-readable medium of claim 20 further comprising instructions for sending a network access stratum (NAS) identity request message to the UE from the virtualizing gateway via the eNodeB requesting the identifier derived from an IMSI from the UE;
sending the identifier derived from an IMSI from the UE to the virtualizing gateway; and
verifying, at the coordinating gateway, credentials of the UE.
22. The non-transitory computer-readable medium of claim 20 further comprising instructions for providing services to a public safety agency limited to public safety personnel with subscriber identity module (SIM) cards having IMSIs that have been configured in a first filter to permit access.
23. The non-transitory computer-readable medium of claim 20 , further comprising instructions for caching subscriber authentication information after retrieval from a remote core network in a MOCN core network.