Proxy based network access
Techniques for proxy based network access are discussed herein. In some examples, the techniques can be implemented in a network proxy device for Citizens Broadband Radio Service (CBRS). A base station or a domain proxy device may manage or otherwise use CBRS resources by exchanging signaling messages with a Spectrum Access System (SAS). The base station or domain proxy device may transmit signaling messages in a first private network to a network device bridging the first private network and a second private network with limited access to a public network. The network device send proxy message(s) in response to the signaling messages to the SAS and can establish an encrypted session layer or application layer tunnel between the base station and/or domain proxy device. The proxy based network access preserves secure networks while still allowing limited messaging with other public or private networks.
1. A system comprising:
one or more processors;
a memory; and
one or more components stored in the memory and executable by the one or more processors to perform operations comprising:
receiving, at a computing device, a first communication from a domain proxy device, the first communication received as a first control plane communication via a first network and comprising a message associated with a Citizens Broadband Radio Service (CBRS) Spectrum Access System (SAS);
terminating a first connection associated with the first communication;
sending a second communication to the SAS via a second network, the second communication addressed to a public IP address associated with the SAS;
receiving, in response to the second communication, a third communication from the SAS; and
establishing at least one of an encrypted application layer tunnel or an encrypted session layer tunnel between the domain proxy device and the SAS in response to the third communication.
2. The system of claim 1 , wherein the first communication comprises at least one of:
a registration request associated with a CBRS resource;
a spectrum inquiry associated with the CBRS resource;
a grant request associated with the CBRS resource; or
a grant release associated with the CBRS resource.
3. The system of claim 1 , wherein a fourth communication transmitted via the at least one of the encrypted application layer tunnel or the encrypted session layer tunnel comprises at least one of:
a registration response associated with a CBRS resource;
an inquiry response associated with the CBRS resource;
a grant response associated with the CBRS resource; or
a release response associated with the CBRS resource.
4. The system of claim 1 , wherein computing device includes an access list associated with authorized devices, the operations further comprising determining, based at least in part on the access list, that the domain proxy device is an authorized device.
5. The system of claim 1 , wherein the first communication is one of a plurality of first communications, wherein the plurality of first communications are addressed to a same address that corresponds to a plurality of computing devices.
6. The system of claim 1 , wherein the first network is a private network without direct access to a public network.
7. The system of claim 1 , wherein the second network is a private network with access to a public network, wherein the access is controlled based at least in part on a firewall.
8. A processor-implemented method comprising:
receiving, at a network proxy device, a first communication from a first computing device, the first communication received via a first network and addressed to the network proxy device;
sending, in response to the first communication, a second communication to a second computing device associated with a second network receiving, in response to the second communication, a third communication from the second computing device; and
establishing an encrypted tunnel between the first computing device and the second computing device in response to the third communication,
wherein the first computing device comprises at least one of a base station or a domain proxy device.
9. The processor-implemented method of claim 8 , wherein the first communication comprises at least one of:
a registration request associated with a Citizens Broadband Radio Service (CBRS) resource;
a spectrum inquiry associated with the CBRS resource;
a grant request associated with the CBRS resource; or
a grant release associated with the CBRS resource.
10. The processor-implemented method of claim 8 , wherein the third communication is associated with a three-way handshake procedure.
11. The processor-implemented method of claim 8 , wherein the second computing device comprises at least one of a firewall or a Citizens Broadband Radio Service (CBRS) Spectrum Access System (SAS).
12. The processor-implemented method of claim 8 , wherein the first network is a private network without direct access to a public network.
13. The processor-implemented method of claim 8 , wherein the second network is a private network with access to a public network, the access controlled based at least in part by a firewall.
14. A non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform operations comprising:
receiving a first communication from at least one of a base station or a domain proxy device, the first communication received via a first network and comprising a message associated with a Citizens Broadband Radio Service (CBRS) Spectrum Access System (SAS);
terminating a first connection associated with the first communication;
sending, based at least in part on the first communication, a second communication to the SAS via a second network, the second communication addressed to a public IP address associated with the SAS;
receiving, in response to the second communication, a third communication from the SAS; and
establishing an encrypted tunnel between the domain proxy device and the SAS in response to the third communication.
15. The non-transitory computer-readable medium of claim 14 , wherein the first communication comprises at least one of:
a registration request associated with a CBRS resource;
a spectrum inquiry associated with the CBRS resource;
a grant request associated with the CBRS resource; or
a grant release associated with the CBRS resource.
16. The non-transitory computer-readable medium of claim 14 , wherein a fourth communication transmitted via the encrypted tunnel comprises at least one of:
a registration response associated with a CBRS resource;
an inquiry response associated with the CBRS resource;
a grant response associated with the CBRS resource; or
a release response associated with the CBRS resource.
17. The non-transitory computer-readable medium of claim 14 , wherein the second communication is a proxy message in response to the first communication.
18. The non-transitory computer-readable medium of claim 14 , wherein the first network is a private network without layer 4 access to a public network.
19. The non-transitory computer-readable medium of claim 14 , wherein the second network is a private network with limited access to a public network.