Enterprise subscription management
An enterprise entitlement server is deployed on an enterprise communication platform. The enterprise entitlement server retrieves authorization data from an authorization server controlled by an enterprise. The authorization data indicates to which one or more resources a subject of the enterprise is entitled to subscribe and/or indicates which one or more types of subscription management actions the subject is authorized to perform. The enterprise entitlement server controls management of a subscription for the subject in accordance with the authorization data.
1 . A method performed by an enterprise entitlement server dedicated to an enterprise or common to multiple enterprises, the method comprising:
retrieving, from an authorization server in the form of an OAuth server and controlled by an enterprise, authorization data that indicates to which one or more resources a subject of the enterprise is entitled to subscribe and/or that indicates which one or more types of subscription management actions the subject is authorized to perform, wherein the authorization data is retrieved from the authorization server by the enterprise entitlement server as deployed on an enterprise communication platform in a mobile network that provides and/or controls an access network for the enterprise, and wherein the one or more types of subscription management actions include deletion of a subscription for the subject; and
controlling, by the enterprise entitlement server, management of the subscription for the subject in accordance with the authorization data from the authorization server, wherein said controlling comprises controlling deletion of a Subscriber Identity Module (SIM) profile of the subscription upon receipt of a request from the subject to delete the SIM profile if the authorization data indicates that subscription deletion is authorized.
2 . The method of claim 1 , further comprising obtaining one or more entitlement plans specific to the enterprise, wherein each entitlement plan is associated with one or more resources, wherein the authorization data indicates to which one or more resources a subject of the enterprise is entitled to subscribe by indicating to which entitlement plan the subject is entitled.
3 . The method of claim 2 , further comprising obtaining a mapping of which classes of subjects of the enterprise are entitled to which one or more entitlement plans, and wherein the authorization data indicates to which entitlement plan the subject is entitled by indicating to which one or more classes the subject belongs.
4 . The method of claim 2 , further comprising:
obtaining, for each entitlement plan, one or more attributes required of any given subject in order for the given subject to be entitled to the entitlement plan;
determining an entitlement plan to which the subject is entitled according to the authorization data; and
enforcing a requirement that the subject have the one or more attributes obtained for the determined entitlement plan.
5 . The method of claim 1 , wherein controlling management of a subscription for the subject further comprises:
controlling provisioning of the subscription for the subject that entitles the subject to the one or more resources indicated by the authorization data.
6 . The method of claim 5 , wherein controlling provisioning of a subscription for the subject comprises:
requesting a profile management server to generate a profile of a subscription that entitles the subject to the one or more resources indicated by the authorization data; and
triggering the subject to obtain subscription profile from the profile management server.
7 . The method of claim 1 , further comprising controlling provisioning of the one or more resources to which the subject is entitled.
8 . The method of claim 1 , wherein the one or more types of subscription management actions further include one or more of:
provisioning of a subscription for the subject; or
modifying a subscription for the subject.
9 . The method of claim 1 , wherein the resources include resources of the access network that is provided by and/or controlled by a mobile network operator of the mobile network, wherein the enterprise entitlement server is configured to provide enterprise-specific entitlement services for one or more enterprises, wherein the enterprise entitlement server is configured to provide entitlement services for entitlement to the resources of any of multiple mobile network operators, and wherein the subject is a device or a user.
10 . A method performed by an enterprise authorization server in the form of an OAuth server controlled by an enterprise, the method comprising:
generating authorization data for a subject associated with the enterprise, wherein the authorization data indicates to which one or more resources the subject is entitled to subscribe and/or indicates which one or more types of subscription management actions the subject is authorized to perform, and wherein the one or more types of subscription management actions include deletion of a subscription for the subject; and
sending the authorization data to an enterprise entitlement server deployed on an enterprise communication platform in a mobile network that provides and/or controls an access network for the enterprise, wherein the enterprise communication platform is dedicated to the enterprise or common to multiple enterprises, and wherein sending the authorization data enables the enterprise entitlement server to control deletion of a Subscriber Identity Module (SIM) profile of the subscription upon receipt of a request from the subject to delete the SIM profile if the authorization data indicates that subscription deletion is authorized.
11 . The method of claim 10 , wherein the authorization data indicates to which one or more resources the subject is entitled to subscribe.
12 . The method of claim 11 , wherein the authorization data indicates to which one or more resources the subject is entitled to subscribe by indicating to which entitlement plan the subject is entitled, wherein the entitlement plan is associated with the one or more resources.
13 . The method of claim 12 , wherein the authorization data explicitly indicates to which entitlement plan the subject is entitled.
14 . The method of claim 12 , wherein the authorization data indicates to which entitlement plan the subject is entitled by indicating to which one or more classes the subject belongs, wherein different classes of subjects of the enterprise are entitled to one or more respective entitlement plans.
15 . The method of claim 10 , wherein the authorization data indicates which one or more types of subscription management actions the subject is authorized to perform.
16 . The method of claim 10 , wherein the one or more types of subscription management actions further include one or more of:
provisioning of a subscription for the subject; or
modifying a subscription for the subject.
17 . The method of claim 10 , wherein the resources include resources of an access network that is provided by and/or controlled by a mobile network operator, or include resources of a service network that is provided by and/or controlled by the enterprise, wherein the enterprise entitlement server is configured to provide enterprise-specific entitlement services for one or more enterprises, and wherein the subject is a device or a user.
18 . The method of claim 10 , further comprising configuring a subscription profile management server with a range of subscription identifiers specific to the enterprise and/or with a range of integrated circuit card identifiers specific to the enterprise.
19 . An enterprise entitlement server dedicated to an enterprise or common to multiple enterprises, the enterprise entitlement server comprising:
communication circuitry; and
processing circuitry configured to:
retrieve, from an authorization server in the form of an OAuth server and controlled by an enterprise, authorization data that indicates to which one or more resources a subject of the enterprise is entitled to subscribe and/or that indicates which one or more types of subscription management actions the subject is authorized to perform, wherein the enterprise entitlement server is configured to be deployed on an enterprise communication platform in a mobile network that provides and/or controls an access network for the enterprise, and wherein the one or more types of subscription management actions include deletion of a subscription for the subject; and
control management of the subscription for the subject in accordance with the authorization data from the authorization server, wherein the processing circuitry is configured to control management of the subscription by controlling deletion of a Subscriber Identity Module (SIM) profile of the subscription upon receipt of a request from the subject to delete the SIM profile if the authorization data indicates that subscription deletion is authorized.
20 . An enterprise authorization server in the form of an OAuth server controlled by an enterprise, the enterprise authorization server comprising:
communication circuitry; and
processing circuitry configured to:
generate authorization data for a subject associated with an enterprise, wherein the authorization data indicates to which one or more resources the subject is entitled to subscribe and/or indicates which one or more types of subscription management actions the subject is authorized to perform, and wherein the one or more types of subscription management actions include deletion of a subscription for the subject; and
send the authorization data to an enterprise entitlement server deployed on an enterprise communication platform in a mobile network that provides and/or controls an access network for the enterprise, wherein the enterprise communication platform is dedicated to the enterprise or common to multiple enterprises, and wherein the processing circuitry is configured to send the authorization data to enable the enterprise entitlement server to control deletion of a Subscriber Identity Module (SIM) profile of the subscription upon receipt of a request from the subject to delete the SIM profile if the authorization data indicates that subscription deletion is authorized.