Authentication and authorization in a private mobile network
Some embodiments provide a method for implementing a software-defined private mobile network (SD-PMN) for an entity. At a physical location of the entity, the method deploys a first set of control plane components for the SD-PMN, the first set of control plane components including a security gateway, a user-plane function (UPF), an AMF (access and mobility management function), and an SMF (session management function). At an SD-WAN (software-defined wide area network) PoP (point of presence) belonging to a provider of the SD-PMN, the method deploys a second set of control plane components for the SD-PMN that includes a subscriber database that stores data associated with users of the SD-PMN. The method uses an SD-WAN edge router located at the physical location of the entity and a SD-WAN gateway located at the SD-WAN PoP to establish a connection from the physical location of the entity to the SD-WAN PoP.
1 . A method of authenticating and authorizing user devices requesting to access an SD-PMN (software-defined private mobile network) deployed for a particular geographic area, the method comprising:
from a new user device, receiving a request to access the SD-PMN;
performing a look-up in a UDM (unified data management) comprising user information for a plurality of users authorized to access the SD-PMN to determine whether the new user device is authorized to access the SD-PMN; and
upon determining that the new user device is authorized, directing a UPF (user plane function) deployed for the SD-PMN to enable the new user device to access the SD-PMN;
wherein receiving the request to access the SD-PMN from the new user device comprises receiving the request to access the SD-PMN from an SD-WAN edge router deployed to a same location in the particular geographical area as the new user device;
wherein the SD-PMN includes on-premises equipment having a radio access network (RAN) and the SD-WAN edge router which reside at an on-premises location;
wherein the SD-PMN further includes SD-WAN point of presence (POP) equipment having the UDM, the SD-WAN POP equipment residing at an SD-WAN POP location which is different from the on-premises location;
wherein one of the on-premises equipment residing at the on-premises location and the SD-WAN POP equipment residing at the SD-WAN PoP location further has an access and mobility management function (AMF); and
wherein performing the look-up in the UDM includes:
accessing the UDM of the SD-WAN POP equipment at the SD-WAN POP location to authenticate the new user device after the request to access the SD-PMN is received by the AMF through the RAN at the on-premises location.
2 . The method of claim 1 , wherein performing the look-up in the UDM to determine whether the new user device is authorized to access the SD-PMN comprises performing a look-up in the UDM to determine whether a user identifier associated with the new user device is included in a list of user identifiers associated with users that are authorized to access the SD-PMN.
3 . The method of claim 2 , wherein each user identifier is associated with one or more user devices.
4 . The method of claim 3 , wherein each user device associated with a particular user is required to be authenticated based on a particular user identifier associated with the particular user.
5 . The method of claim 1 , wherein directing the UPF deployed for the SD-PMN to enable the new user device to access the SD-PMN comprises directing the UPF to (i) provide the new user device with an IP (Internet protocol) address, (ii) enable a particular QoS (quality of service) for the new user device, and (iii) identify one or more subnets of the SD-PMN on which to put traffic associated with new user device.
6 . The method of claim 1 , wherein the method is performed by a set of control plane components deployed for the SD-PMN, the set of control plane components comprising at least the AMF and an SMF (session management function).
7 . The method of claim 1 , wherein the new user device is a first new user device and the request to access the SD-PMN is a first request to access the SD-PMN, the method further comprising:
from a second new user device, receiving a second request to access the SD-PMN;
performing a look-up in the UDM to determine whether the second new user device is authorized to access the SD-PMN; and
upon determining that the second new user device is not authorized, sending a reply to the second new user device to indicate that the second new user device is not authorized to access the SD-PMN.
8 . The method of claim 1 , wherein the new user device connects to the SD-WAN edge router via one of an LTE (long term evolution) connection, a 4G connection, and a 5G connection.
9 . The method of claim 8 , wherein the SD-WAN edge router has a connection to the SD-PMN via a tower deployed to the particular geographical area as part of a RAN (radio access network) of the SD-PMN.
10 . The method of claim 9 , wherein the connection between the SD-WAN edge router and the tower comprises one of an LTE connection, a 4G connection, and a 5G connection via CBRS (citizens broadband radio service).
11 . The method of claim 1 , wherein the AMF belongs to the on-premises equipment and resides at the on-premises location.
12 . The method of claim 1 , wherein the AMF belongs to the SD-WAN POP equipment and resides at the SD-WAN POP location.
13 . A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for authenticating and authorizing user devices requesting to access an SD-PMN (software-defined private mobile network) deployed for a particular geographic area, the program comprising sets of instructions for:
from a new user device, receiving a request to access the SD-PMN; performing a look-up in a UDM (unified data management) comprising
user information for a plurality of users authorized to access the SD-PMN to determine whether the new user device is authorized to access the SD-PMN; and
upon determining that the new user device is authorized, directing a UPF (user plane function) deployed for the SD-PMN to enable the new user device to access the SD-PMN;
wherein the set of instructions for receiving the request to access the SD-PMN from the new user device comprises a set of instructions for receiving the request to access the SD-PMN from an SD-WAN edge router deployed to a same location in the particular geographical area as the new user device;
wherein the SD-PMN includes on-premises equipment having a radio access network (RAN), an access and mobility management (AMF) function, and the SD-WAN edge router which reside at an on-premises location;
wherein the SD-PMN further includes SD-WAN point of presence (POP) equipment having the UDM, the SD-WAN POP equipment residing at an SD-WAN POP location which is different from the on-premises location; and
wherein performing the look-up in the UDM includes:
accessing the UDM of the SD-WAN POP equipment at the SD-WAN POP location to authenticate the new user device after the request to access the SD-PMN is received by the AMF at the on-premises location through the RAN at the on-premises location.
14 . The non-transitory machine readable medium of claim 13 , wherein the set of instructions for performing the look-up in the UDM to determine whether the new user device is authorized to access the SD-PMN comprises a set of instructions for performing a look-up in the UDM to determine whether a user identifier associated with the new user device is included in a list of user identifiers associated with users that are authorized to access the SD-PMN.
15 . The non-transitory machine readable medium of claim 14 , wherein each user identifier is associated with one or more user devices; and
wherein each user device associated with a particular user is required to be authenticated based on a particular user identifier associated with the particular user.
16 . The non-transitory machine readable medium of claim 13 , wherein the set of instructions for directing the UPF deployed for the SD-PMN to enable the new user device to access the SD-PMN comprises a set of instructions for directing the UPF to (i) provide the new user device with an IP (Internet protocol) address, (ii) enable a particular QoS (quality of service) for the new user device, and (iii) identify one or more subnets of the SD-PMN on which to put traffic associated with new user device.
17 . The non-transitory machine readable medium of claim 13 , wherein the new user device is a first new user device and the request to access the SD-PMN is a first request to access the SD-PMN, the program further comprising sets of instructions for:
from a second new user device, receiving a second request to access the SD-PMN;
performing a look-up in the UDM to determine whether the second new user device is authorized to access the SD-PMN; and
upon determining that the second new user device is not authorized, sending a reply to the second new user device to indicate that the second new user device is not authorized to access the SD-PMN.
18 . The non-transitory machine readable medium of claim 13 , wherein the new user device connects to the SD-WAN edge router via one of an LTE (long term evolution) connection, a 4G connection, and a 5G connection.
19 . The non-transitory machine readable medium of claim 18 , wherein: the SD-WAN edge router has a connection to the SD-PMN via a tower deployed to the particular geographical area as part of a RAN (radio access network) of the SD-PMN; and the connection between the SD-WAN edge router and the tower comprises one of an LTE connection, a 4G connection, and a 5G connection via CBRS (citizens broadband radio service).
20 . A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for authenticating and authorizing user devices requesting to access an SD-PMN (software-defined private mobile network) deployed for a particular geographic area, the program comprising sets of instructions for:
from a new user device, receiving a request to access the SD-PMN; performing a look-up in a UDM (unified data management) comprising
user information for a plurality of users authorized to access the SD-PMN to determine whether the new user device is authorized to access the SD-PMN; and
upon determining that the new user device is authorized, directing a UPF (user plane function) deployed for the SD-PMN to enable the new user device to access the SD-PMN;
wherein the set of instructions for receiving the request to access the SD-PMN from the new user device comprises a set of instructions for receiving the request to access the SD-PMN from an SD-WAN edge router deployed to a same location in the particular geographical area as the new user device;
wherein the SD-PMN includes on-premises equipment having a radio access network (RAN) and the SD-WAN edge router which reside at an on-premises location;
wherein the SD-PMN further includes SD-WAN point of presence (POP) equipment having an access and mobility management (AMF) function and the UDM which reside at an SD-WAN POP location which is different from the on-premises location; and
wherein performing the look-up in the UDM includes:
accessing the UDM of the SD-WAN POP equipment at the SD-WAN POP location to authenticate the new user device after the request to access the SD-PMN is received by the AMF at the SD-WAN POP location through the RAN at the on-premises location.