Method and system for selective and secure interaction of BYOD (bring your own device) with enterprise network through mobile wireless networks
View Patent ↗A mechanism to allow provisioning and use of BYOD (Bring Your Own Device) for authorized access in the enterprise network through a 3G/4G/Wi-Fi access network is provided. A brokering entity in the mobile packet core is provisioned for each authorized employee with enterprise specific rules for security and steering of user traffic. An Enterprise Container is defined as entity on the User Equipment that is self-contained virtual machine with enterprise sanctioned applications. An intelligent mechanism for and steering of signaling and traffic from such BYOD devices to the brokering entity is defined. At any time by using the personal container or the default behavior of the user equipment the user can get mobile service as if the Enterprise Container did not exist. Further, when such employment relationship is terminated the user's BYOD needs to be restored to its pre-employment functionality.
1. A network element for processing network traffic of a packet network comprising:
an access network interface unit configured to send and receive communications from a mobile device and an enterprise network; and
a processor with a memory associated with the network interface unit and adapted to:
receive a request for service with a first subscriber identification code altered by the mobile device to direct the request for service to the network element from the mobile device;
query the mobile device for a second subscriber identification code upon receiving the request for service;
receive the second subscriber identification code from the mobile device;
match the second subscriber identification code to an employee record from the memory;
query a remote database to obtain a mobile subscriber record and authentication vectors associated with the employee record;
perform authentication of the mobile device; and
fulfill the request for service from the mobile device after receiving the mobile subscriber record and authentication vectors.
2. The network element of claim 1 , wherein the processor is further adapted to:
assign a third subscriber identification code to the mobile device which is encoded with predetermined rules to route the subsequent signaling to the network element.
3. The network element of claim 2 , wherein the mobile device is in a home network but does not have a direct communication link to the network element,
wherein the first subscriber identification code is a packet temporary mobile subscriber identity (P-TMSI),
wherein the second subscriber identification code is an IMSI,
wherein the third subscriber identification code is a P-TMSI, and
wherein the received second subscriber identification code was altered by the mobile device.
4. The network element of claim 1 , wherein the processor is further adapted to:
receive instructions regarding ending a relationship with an employee from the enterprise network; and
send instructions to the mobile device to restore the first subscriber identification code for subsequent signaling.
5. The network element of claim 1 , wherein the remote database is an HLR/HSS database.
6. A system comprising:
a mobile device comprising:
an access network interface configured to send and receive communications from a packet network; and
a processor with a memory associated with the network interface unit and adapted to:
alter a first subscriber identification code to direct a request for service to a desired network element;
a network element for processing network traffic of a packet network and in communication with the mobile device, said network element comprising:
an access network interface unit configured to send and receive communications from a mobile device and an enterprise network; and
a processor with a memory associated with the network interface unit and adapted to:
receive a request for service with a first subscriber identification code altered by the mobile device to direct the request for service to the network element from the mobile device;
query the mobile device for a second subscriber identification code upon receiving the request for service;
receive the second subscriber identification code from the mobile device;
match the second subscriber identification code to an employee record from the memory;
query a remote database to obtain a mobile subscriber record and authentication vectors associated with the employee record;
perform authentication of the mobile device; and
fulfill the request for service from the mobile device after receiving the mobile subscriber record and authentication vectors.
7. The system of claim 6 , wherein the network element processor is further adapted to:
assign a third subscriber identification code to the mobile device which is encoded with predetermined rules to route the subsequent signaling to the network element.
8. The system of claim 7 , wherein the mobile device is in a home network and the network element is reachable,
wherein the first subscriber identification code is a packet temporary mobile subscriber identity (P-TMSI),
wherein the second subscriber identification code is an International mobile subscriber identity (IMSI), and
wherein the third subscriber identification code is a P-TMSI or global user temporary identity (GUTI).
9. The system of claim 7 , wherein the mobile device is in a home network but does not have a direct communication link to the network element,
wherein the first subscriber identification code is a packet temporary mobile subscriber identity (P-TMSI),
wherein the second subscriber identification code is an IMSI,
wherein the third subscriber identification code is a P-TMSI, and
wherein the received second subscriber identification code was altered by the mobile device.
10. The system of claim 6 , wherein the network element processor is further adapted to:
receive instructions regarding ending a relationship with an employee from the enterprise network; and
send instructions to the mobile device to restore the first subscriber identification code for subsequent signaling.
11. A method performed with a network element having an access network unit interface, a processor and memory, said network element configured to process network signaling of a packet core network, the method comprising:
receiving a request for service with a first subscriber identification code altered by the mobile device to direct the request for service to the network element the mobile device;
querying the mobile device for a second subscriber identification code upon receiving the request for service;
receiving the second subscriber identification code from the mobile device;
matching the second subscriber identification code to an employee record from the memory;
querying a remote database to obtain a mobile subscriber record and authentication vectors associated with the employee record;
performing an authentication of the mobile device; and
fulfilling the request for service from the mobile device.
12. The method of claim 11 further comprising:
assigning a third subscriber identification code to the mobile device which is encoded with predetermined rules to route the subsequent signaling to the network element.
13. The network element of claim 2 , wherein the mobile device is in a home network and the network element is reachable,
wherein the first subscriber identification code is a packet temporary mobile subscriber identity (P-TMSI),
wherein the second subscriber identification code is an International mobile subscriber identity (IMSI), and
wherein the third subscriber identification code is a P-TMSI or global user temporary identity (GUTI).
14. The method of claim 12 , wherein the mobile device is in a home network and the network element is reachable,
wherein the first subscriber identification code is a packet temporary mobile subscriber identity (P-TMSI),
wherein the second subscriber identification code is an International mobile subscriber identity (IMSI), and
wherein the third subscriber identification code is a P-TMSI or global user temporary identity (GUTI).
15. The method of claim 12 , wherein the mobile device is in a home network but does not have a direct communication link to the network element,
wherein the first subscriber identification code is a packet temporary mobile subscriber identity (P-TMSI),
wherein the second subscriber identification code is an IMSI,
wherein the third subscriber identification code is a P-TMSI, and
wherein the received second subscriber identification code was altered by the mobile device.