SIM Whitelisting and Multi-Operator Core Networks
A method may be disclosed in accordance with some embodiments, comprising: receiving, at a virtualizing gateway, a first service request from a first user equipment (UE) via a first eNodeB; creating, at the virtualizing gateway, an association from each of a plurality of UE identifiers to a desired core network; applying, at the virtualizing gateway, a first filter using a first UE identifier of the first UE, based on the association; forwarding, at the virtualizing gateway, based on the applied first filter, the first service request from the first UE to the first core network; receiving, at the virtualizing gateway, via a second eNodeB, a second service request from a second user equipment (UE); applying, at the virtualizing gateway, a second filter using a second UE identifier of the second UE, based on the association; and forwarding, at the virtualizing gateway, based on the applied second filter, the second service request from the second UE to the second core network.
1 . A method comprising:
receiving, at an eNodeB from a user equipment (UE), one of a request for attaching to an eNodeB wherein the request includes UE identifier derived from an International Mobile Subscriber Identity (IMSI) or a periodic tracking area update (TAU);
establishing a connection between the UE and the EnodeB;
sending, by the eNodeB, one of a UE message to a virtualizing gateway or a TAU request, the message including the UE identifier derived from an IMSI, the virtualizing gateway in communication with a plurality of core networks, the virtualizing gateway configured to provide multi-operator core network (MOCN) gateway functionality for the eNodeB;
performing a whitelisting lookup by the virtualizing gateway based on the UE identifier derived from an IMSI and based on a mapping of UE identifiers to authorized core networks for each UE identifier in the plurality of core networks, to determine whether to send a service request to a first core network or a second core network; and
wherein when a record of the UE is not found, then using the identifier derived from the IMSI at the virtualizing gateway.
2 . The method of claim 1 wherein the identifier derived from an IMSI comprises a System Architecture Evolution Temporary Mobile Subscriber Identity (S-TMSI).
3 . The method of claim 1 further comprising:
sending a network access stratum (NAS) identity request message to the UE from the virtualizing gateway via the eNodeB requesting the identifier derived from an IMSI from the UE;
sending the identifier derived from an IMSI from the UE to the virtualizing gateway; and
verifying, at the coordinating gateway, credentials of the UE.
4 . The method of claim 3 further comprising wherein the IMSI is not authenticated by the virtualizing gateway resulting in rejection of the service request.
5 . The method of claim 4 further comprising:
sending one of a service rejection or a TAU rejection from the virtualizing gateway to the eNodeB;
sending one of the service rejection or the TAU rejection from the eNodeB to the UE; and
releasing the connection from the UE to the virtualizing gateway.
6 . The method of claim 3 further comprising wherein the identifier derived from an IMSI is authenticated by the virtualizing gateway.
7 . The method of claim 6 further comprising storing at the virtualizing gateway the identifier derived from an IMSI;
receiving at an MME one of the service request or the TAU request; and
authorizing the UE.
8 . The method of claim 5 further comprising releasing the UE when the UE enters an idle state.
9 . A system, comprising:
an eNodeB in communication with a first user equipment (UE);
a virtualized gateway in communication with the eNodeB and acting as a virtualizing gateway for communications with a plurality of core networks, the virtualizing gateway configured to provide multi-operator core network (MOCN) gateway functionality for the eNodeB;
wherein the system performs steps including:
receiving, at an eNodeB from a UE, one of a request for attaching to an eNodeB wherein the request includes a UE identifier derived from an International Mobile Subscriber Identity (IMSI) or a periodic tracking area update (TAU);
establishing a connection between the UE and the EnodeB;
sending by the eNodeB, one of a UE message to a virtualizing gateway or a TAU request, the message including the UE identifier derived from an IMSI, the virtualizing gateway in communication with a plurality of core networks, the virtualizing gateway configured to provide multi-operator core network (MOCN) gateway functionality for the eNodeB;
performing a whitelisting lookup by the virtualizing gateway based on the UE identifier derived from an IMSI and based on a mapping of UE identifiers to authorized core networks for each UE identifier in the plurality of core networks, to determine whether to send a service request to a first core network or a second core network; and
wherein when a record of the UE is not found, then using the identifier derived from the IMSI at the virtualizing gateway.
10 . The system of claim 9 wherein the identifier derived from an IMSI comprises a System Architecture Evolution Temporary Mobile Subscriber Identity (S-TMSI).
11 . The system of claim 9 further comprising:
sending a network access stratum (NAS) identity request message to the UE from the virtualizing gateway via the eNodeB requesting the identifier derived from an IMSI from the UE;
sending the identifier derived from an IMSI from the UE to the virtualizing gateway; and
verifying, at the coordinating gateway, credentials of the UE.
12 . The system of claim 11 further comprising wherein the IMSI is not authenticated by the virtualizing gateway resulting in rejection of the service request.
13 . The system of claim 12 further comprising:
sending one of a service rejection or a TAU rejection from the virtualizing gateway to the eNodeB;
sending one of the service rejection or the TAU rejection from the eNodeB to the UE; and
releasing the connection from the UE to the virtualizing gateway.
14 . The system of claim 11 further comprising wherein the identifier derived from an IMSI is authenticated by the virtualizing gateway.
15 . The system of claim 14 further comprising storing at the virtualizing gateway the identifier derived from an IMSI;
receiving at an MME one of the service request or the TAU request; and
authorizing the UE.
16 . A non-transitory computer-readable medium comprising instructions that, when executed cause a system to:
receive, at an eNodeB from a UE, one of a request for attaching to an eNodeB
wherein the request includes a S-TMSI or a periodic tracking area update (TAU), wherein a UE identifier derived from an IMSI comprises a System Architecture Evolution Temporary Mobile Subscriber Identity (S-TMSI);
establish a connection between the UE and the EnodeB;
send by the eNodeB, one of a UE message to a virtualizing gateway or a TAU request, the message including the S-TMSI, the virtualizing gateway in communication with a plurality of core networks, the virtualizing gateway configured to provide multi-operator core network (MOCN) gateway functionality for the eNodeB;
perform whitelisting lookup by the virtualizing gateway based on the S-TMSI and based on a mapping of UE identifiers to authorized core networks for each UE identifier in the plurality of core networks; and
determining whether to send a service request to a first core network or a second core network.
17 . The non-transitory computer-readable medium of claim 16 further comprising instructions for sending a network access stratum (NAS) identity request message to the UE from the virtualizing gateway via the eNodeB requesting the identifier derived from an IMSI from the UE;
sending the identifier derived from an IMSI from the UE to the virtualizing gateway; and
verifying, at the coordinating gateway, credentials of the UE.
18 . The method of claim 1 further comprising providing services to a public safety agency limited to public safety personnel with subscriber identity module (SIM) cards having IMSIs that have been configured in a first filter to permit access.
19 . The system of claim 9 further comprising wherein services are provided to a public safety agency limited to public safety personnel with subscriber identity module (SIM) cards having IMSIs that have been configured in a first filter to permit access.
20 . The non-transitory computer-readable medium of claim 16 further comprising instructions for providing services to a public safety agency limited to public safety personnel with subscriber identity module (SIM) cards having IMSIs that have been configured in a first filter to permit access.
21 . The method of claim 1 , further comprising caching subscriber authentication information after retrieval from a remote core network in a MOCN core network.
22 . The system of claim 9 , further comprising a subscriber authentication information cache configured to perform caching after retrieval from a remote core network in a MOCN core network.
23 . The non-transitory computer-readable medium of claim 16 , further comprising instructions for caching subscriber authentication information after retrieval from a remote core network in a MOCN core network.