Granted Patent B2

US 12,581,392 · App. 18/215,768 · Granted Mar 17, 2026

Inventor: Amit Singh (Woodside, CA)

Assignee: VMware LLC

H04W48/06H04W48/08

Abstract

Claims (33)

1 . A method of implementing access controls in a RAN (radio access network) to limit access to a plurality of base station components of the RAN by a plurality of RAN applications, the method comprising:

at a RIC (RAN intelligent controller) that connects the plurality of RAN applications to the plurality of base station components:

receiving a set of access control data that specifies which RAN applications in the plurality of RAN applications are allowed to access which base station components in the plurality of base station components;

from a particular RAN application in the plurality of RAN applications, receiving a data message destined for a particular base station component in the plurality of base station components;

based on the set of access control data, determining that the particular RAN application is allowed to access the particular base station component; and

forwarding the data message to the particular base station component.

2 . The method of claim 1 , wherein when, based on the set of access control data, the particular RAN application is not allowed to access the particular base station component, the method further comprises sending a notification to the particular RAN application indicating the particular RAN application is not allowed to access the particular base station component.

3 . The method of claim 1 , wherein the set of access control data comprises (i) a set of access control lists, each access control list specifying a particular set of accessible base station components, and (ii) a set of access maps that specify, for each access control list, one or more RAN applications in the plurality of RAN applications for which the access control list is applicable.

4 . The method of claim 3 , wherein each base station component in the plurality of base station components comprises one or more RAN functions, wherein each access control list in the set of access control lists further specifies one or more operations that can be performed against the one or more RAN functions of each base station component in the particular set of accessible base station components specified by the access control list.

5 . The method of claim 4 , wherein the one or more operations comprise one or more operations from a set of operations comprising (i) an insert operation for instructing the one or more RAN functions to activate a user plane function, (ii) a reporting operation for receiving reports from the one or more RAN functions, (iii) a policy operation for setting a policy parameter for the one or more RAN functions, and (iv) a control operation for instructing the one or more RAN functions to activate a control plane function.

6 . The method of claim 4 , wherein the one or more operations are defined in access profiles, each access profile comprising (i) a unique identifier assigned to the access profile, (ii) a unique name assigned to the access profile, and (iii) a set of access rules specifying the one or more operations.

7 . The method of claim 6 , wherein each access list in the set of access lists specifies the one or more operations by specifying a unique identifier assigned to an access profile that defines the one or more operations.

8 . The method of claim 4 , wherein:

the base station components comprise centralized units (CUs) and distributed units (DUs);

the set of RAN functions performed by CUs comprises non-real-time higher layer 2 (L2) functions; and

the set of RAN functions performed by DUs comprises real-time layer 1 (L1) functions and lower L2 functions.

9 . The method of claim 8 , wherein the lower L2 functions comprise data link layer functions and scheduling functions.

10 . The method of claim 9 , wherein the CUs comprise central unit control planes (CU-CPs) and central unit user planes (CU-UPs).

11 . The method of claim 1 , wherein said receiving, determining and forwarding are performed by a datapath pod of the RIC that forwards traffic between the plurality of RAN applications and the plurality of base station components.

12 . The method of claim 11 , wherein receiving the set of access control data comprises receiving the set of access control data at the datapath pod of the RIC from a management pod of the RIC.

13 . The method of claim 12 , wherein the management pod comprises an O1 interface for exchanging communications with a RIC management system that manages the RIC, wherein the set of access control data is received by the management pod of the RIC from a network management server via the O1 interface and provided to the datapath pod of the RIC.

14 . The method of claim 11 , wherein (i) the datapath pod is a first datapath pod of a plurality of datapath pods of the RIC, (ii) the plurality of RAN applications is a first plurality of RAN applications, and (iii) the plurality of base station components is a first plurality of base station components.

15 . The method of claim 14 , wherein each datapath pod in the plurality of datapath pods is connected to (i) a respective plurality of RAN applications and (ii) a respective plurality of base station components.

16 . The method of claim 14 , wherein each datapath pod in the plurality of datapath pods is connected to (i) each RAN application of each plurality of RAN applications and (ii) a respective plurality of base station components.

17 . The method of claim 14 , wherein each base station component connected to the RIC is assigned to one datapath pod in the plurality of datapath pods by a base station component load distributer of the RIC.

18 . A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for implementing access controls in a RAN (radio access network) to limit access to a plurality of base station components of the RAN by a plurality of RAN applications, the program comprising sets of instructions for:

at a RIC (RAN intelligent controller) that connects the plurality of RAN applications to the plurality of base station components:

receiving a set of access control data that specifies which RAN applications in the plurality of RAN applications are allowed to access which base station components in the plurality of base station components;

from a particular RAN application in the plurality of RAN applications, receiving a data message destined for a particular base station component in the plurality of base station components;

based on the set of access control data, determining that the particular RAN application is allowed to access the particular base station component; and

forwarding the data message to the particular base station component.

19 . The non-transitory machine readable medium of claim 18 , wherein when, based on the set of access control data, the particular RAN application is not allowed to access the particular base station component, the program further comprises a set of instructions for sending a notification to the particular RAN application indicating the particular RAN application is not allowed to access the particular base station component.

20 . The non-transitory machine readable medium of claim 18 , wherein the set of access control data comprises (i) a set of access control lists, each access control list specifying a particular set of accessible base station components, and (ii) a set of access maps that specify, for each access control list, one or more RAN applications in the plurality of RAN applications for which the access control list is applicable.

Assignments (2)

Continuity (1)

References Cited (235)