Access restriction for a private or neutral-host network
During operation, a computer receives an attachment request from a radio node, where the attachment request is associated with an electronic device, and includes an identifier of the radio node, an identifier of the electronic device and an identifier of a service provider. Then, the computer determines a first entity identifier of an entity based at least in part on the identifier of the radio node and a second entity identifier of the entity based at least in part on the identifier of the electronic device. When the first entity identifier matches the second entity identifier, the computer performs authentication of the electronic device. Alternatively, if the entity identifiers are different, but the identifier of the service provider matches a stored identifier, the computer performs the authentication of the electronic device. Otherwise, the computer does not allow the electronic device to attach to a private or neutral-host network.
1. A computer, comprising:
an interface circuit configured to communicate with a radio node;
a processor coupled to the interface circuit; and
memory, coupled to the processor, configured to store program instructions, wherein, when executed by the processor, the program instructions cause the computer to perform operations, comprising:
receive an attachment request associated with the radio node in a private or neutral-host network, wherein the attachment request is sourced from an electronic device, and comprises an identifier of the radio node, an identifier of the electronic device and an identifier of a service provider;
determine a first entity identifier of an entity associated with the private or neutral-host network based at least in part on the identifier of the radio node, and a second entity identifier of the entity based at least in part on the identifier of the electronic device;
when the first entity identifier matches the second entity identifier, perform authentication of the electronic device;
when the first entity identifier is different from the second entity identifier, and when the identifier of the service provider matches a predefined identifier of the service provider that is stored in the memory, perform the authentication of the electronic device; and
otherwise, does not allow the electronic device to attach to the private or neutral-host network.
2. The computer of claim 1 , wherein the radio node comprises: an Evolved Node B (eNodeB), a Universal Mobile Telecommunications System (UMTS) NodeB and radio network controller (RNC), or a New Radio (NR) gNB or gNodeB.
3. The computer of claim 1 , wherein the identifier of the radio node comprises an E-UTRAN cell global identifier (ECGI).
4. The computer of claim 1 , wherein the identifier of the electronic device comprises an international mobile subscriber identity (IMSI) or a subscription permanent identifier (SUPI).
5. The computer of claim 1 , wherein the identifier of the service provider comprises a public land mobile network (PLMN) identifier.
6. The computer of claim 1 , wherein the identifier of the service provider is included in the identifier of the electronic device.
7. The computer of claim 1 , wherein the identifier of the radio node comprises a unique identifier, and the identifier of the electronic device comprises a second unique identifier.
8. The computer of claim 1 , wherein determining the first entity identifier comprises performing a lookup in a predefined list of identifiers of one or more radio nodes in the private or neutral-host network and the first entity identifier; and
wherein determining the second entity identifier comprises performing a lookup in a predefined list of one or more identifiers of electronic devices and the second entity identifier.
9. The computer of claim 1 , wherein the computer comprises a computer system.
10. The computer of claim 1 , wherein the computer is configured to selectively restrict access to the private or neutral-host network without using a closed subscriber group (CSG).
11. A non-transitory computer-readable storage medium for use in conjunction with a computer, the computer-readable storage medium storing program instructions that, when executed by the computer, cause the computer to perform operations comprising:
receiving an attachment request associated with a radio node in a private or neutral-host network, wherein the attachment request is sourced from an electronic device, and comprises an identifier of the radio node, an identifier of the electronic device and an identifier of a service provider;
determining a first entity identifier of an entity associated with the private or neutral-host network based at least in part on the identifier of the radio node, and a second entity identifier of the entity based at least in part on the identifier of the electronic device;
when the first entity identifier matches the second entity identifier, performing authentication of the electronic device;
when the first entity identifier is different from the second entity identifier, and when the identifier of the service provider matches a predefined identifier of the service provider that is stored in memory, performing the authentication of the electronic device; and
otherwise, not allowing the electronic device to attach to the private or neutral-host network.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the radio node comprises: an Evolved Node B (eNodeB), a Universal Mobile Telecommunications System (UMTS) NodeB and radio network controller (RNC), or a New Radio (NR) gNB or gNodeB.
13. The non-transitory computer-readable storage medium of claim 11 , wherein the identifier of the radio node comprises an E-UTRAN cell global identifier (ECGI).
14. The non-transitory computer-readable storage medium of claim 11 , wherein the identifier of the electronic device comprises an international mobile subscriber identity (IMSI) or a subscription permanent identifier (SUPI).
15. The non-transitory computer-readable storage medium of claim 11 , wherein the identifier of the service provider comprises a public land mobile network (PLMN) identifier.
16. The non-transitory computer-readable storage medium of claim 11 , wherein determining the first entity identifier comprises performing a lookup in a predefined list of identifiers of one or more radio nodes in the private or neutral-host network and the first entity identifier; and
wherein determining the second entity identifier comprises performing a lookup in a predefined list of one or more identifiers of electronic devices and the second entity identifier.
17. A method for restricting access to a private or neutral-host network associated with an entity, comprising:
by a computer:
receiving an attachment request associated with a radio node in the private or neutral-host network, wherein the attachment request is sourced from an electronic device, and comprises an identifier of the radio node, an identifier of the electronic device and an identifier of a service provider;
determining a first entity identifier of the entity based at least in part on the identifier of the radio node, and a second entity identifier of the entity based at least in part on the identifier of the electronic device;
when the first entity identifier matches the second entity identifier, performing authentication of the electronic device;
when the first entity identifier is different from the second entity identifier, and when the identifier of the service provider matches a predefined identifier of the service provider that is stored in memory, performing the authentication of the electronic device; and
otherwise, not allowing the electronic device to attach to the private or neutral-host network.
18. The method of claim 17 , wherein the identifier of the radio node comprises an E-UTRAN cell global identifier (ECGI), and the identifier of the electronic device comprises an international mobile subscriber identity (IMSI) or a subscription permanent identifier (SUPI).
19. The method of claim 17 , wherein the identifier of the service provider comprises a public land mobile network (PLMN) identifier.
20. The method of claim 17 , wherein determining the first entity identifier comprises performing a lookup in a predefined list of identifiers of one or more radio nodes in the private or neutral-host network and the first entity identifier; and
wherein determining the second entity identifier comprises performing a lookup in a predefined list of one or more identifiers of electronic devices and the second entity identifier.