Access restriction for a private or neutral-host network
During operation, a computer receives an attachment request from a radio node, where the attachment request is associated with an electronic device, and includes an identifier of the radio node, an identifier of the electronic device and an identifier of a service provider. Then, the computer determines a first entity identifier of an entity based at least in part on the identifier of the radio node and a second entity identifier of the entity based at least in part on the identifier of the electronic device. When the first entity identifier matches the second entity identifier, the computer performs authentication of the electronic device. Alternatively, if the entity identifiers are different, but the identifier of the service provider matches a stored identifier, the computer performs the authentication of the electronic device. Otherwise, the computer does not allow the electronic device to attach to a private or neutral-host network.
1. A computer system, comprising:
an interface circuit configured to communicate with a radio node;
a processor coupled to the interface circuit; and
memory, coupled to the processor, configured to store program instructions, wherein, when executed by the processor, the program instructions cause the computer system to perform operations, comprising:
receive an attachment request associated with the radio node in a private or neutral-host network, wherein the attachment request is sourced from an electronic device, and comprises an identifier of the radio node, an identifier of the electronic device and an identifier of a service provider;
determine a first entity identifier of an entity associated with the private or neutral-host network based at least in part on the identifier of the radio node, and a second entity identifier of the entity based at least in part on the identifier of the electronic device;
perform authentication of the electronic device based at least in part on a result of a comparison of the first entity identifier and the second entity identifier;
perform the authentication of the electronic device based at least in part on a second result of the comparison and a third result of a second comparison of the identifier of the service provider and a predefined identifier of the service provider; and
otherwise, does not allow the electronic device to attach to the private or neutral-host network.
2. The computer system of claim 1 , wherein the result of the comparison comprises a match between the first entity identifier and the second entity identifier, the second result of the comparison comprises a difference between the first entity identifier and the second entity identifier, and the third result of the second comparison comprises a match between the identifier of the service provider and the predefined identifier of the service provider.
3. The computer system of claim 1 , wherein the radio node comprises: an Evolved Node B (eNodeB), a Universal Mobile Telecommunications System (UMTS) NodeB and radio network controller (RNC), or a New Radio (NR) gNB or gNodeB.
4. The computer system of claim 1 , wherein the identifier of the radio node comprises an E-UTRAN cell global identifier (ECGI).
5. The computer system of claim 1 , wherein the identifier of the electronic device comprises an international mobile subscriber identity (IMSI) or a subscription permanent identifier (SUPI).
6. The computer system of claim 1 , wherein the identifier of the service provider comprises a public land mobile network (PLMN) identifier.
7. The computer system of claim 1 , wherein the identifier of the service provider is included in the identifier of the electronic device.
8. The computer system of claim 1 , wherein the identifier of the radio node comprises a unique identifier, and the identifier of the electronic device comprises a second unique identifier.
9. The computer system of claim 1 , wherein determining the first entity identifier comprises performing a lookup in a predefined list of identifiers of one or more radio nodes in the private or neutral-host network and the first entity identifier; and
wherein determining the second entity identifier comprises performing a lookup in a predefined list of one or more identifiers of electronic devices and the second entity identifier.
10. The computer system of claim 1 , wherein the computer system is configured to selectively restrict access to the private or neutral-host network without using a closed subscriber group (CSG).
11. A non-transitory computer-readable storage medium for use in conjunction with a computer system, the computer-readable storage medium storing program instructions that, when executed by the computer system, cause the computer system to perform operations comprising:
receiving an attachment request associated with a radio node in a private or neutral-host network, wherein the attachment request is sourced from an electronic device, and comprises an identifier of the radio node, an identifier of the electronic device and an identifier of a service provider;
determining a first entity identifier of an entity associated with the private or neutral-host network based at least in part on the identifier of the radio node, and a second entity identifier of the entity based at least in part on the identifier of the electronic device;
performing authentication of the electronic device based at least in part on a result of a comparison of the first entity identifier and the second entity identifier;
performing the authentication of the electronic device based at least in part on a second result of the comparison and a third result of a second comparison of the identifier of the service provider and a predefined identifier of the service provider; and
otherwise, not allowing the electronic device to attach to the private or neutral-host network.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the result of the comparison comprises a match between the first entity identifier and the second entity identifier, the second result of the comparison comprises a difference between the first entity identifier and the second entity identifier, and the third result of the second comparison comprises a match between the identifier of the service provider and the predefined identifier of the service provider.
13. The non-transitory computer-readable storage medium of claim 11 , wherein the identifier of the radio node comprises an E-UTRAN cell global identifier (ECGI).
14. The non-transitory computer-readable storage medium of claim 11 , wherein the identifier of the electronic device comprises an international mobile subscriber identity (IMSI) or a subscription permanent identifier (SUPI).
15. The non-transitory computer-readable storage medium of claim 11 , wherein the identifier of the service provider comprises a public land mobile network (PLMN) identifier.
16. The non-transitory computer-readable storage medium of claim 11 , wherein determining the first entity identifier comprises performing a lookup in a predefined list of identifiers of one or more radio nodes in the private or neutral-host network and the first entity identifier; and
wherein determining the second entity identifier comprises performing a lookup in a predefined list of one or more identifiers of electronic devices and the second entity identifier.
17. A method for restricting access to a private or neutral-host network associated with an entity, comprising:
by a computer system:
receiving an attachment request associated with a radio node in the private or neutral-host network, wherein the attachment request is sourced from an electronic device, and comprises an identifier of the radio node, an identifier of the electronic device and an identifier of a service provider;
determining a first entity identifier of the entity based at least in part on the identifier of the radio node, and a second entity identifier of the entity based at least in part on the identifier of the electronic device;
performing authentication of the electronic device based at least in part on a result of a comparison of the first entity identifier and the second entity identifier;
performing the authentication of the electronic device based at least in part on a second result of the comparison and a third result of a second comparison of the identifier of the service provider and a predefined identifier of the service provider; and
otherwise, not allowing the electronic device to attach to the private or neutral-host network.
18. The method of claim 17 , wherein the result of the comparison comprises a match between the first entity identifier and the second entity identifier, the second result of the comparison comprises a difference between the first entity identifier and the second entity identifier, and the third result of the second comparison comprises a match between the identifier of the service provider and the predefined identifier of the service provider.
19. The method of claim 17 , wherein the identifier of the radio node comprises an E-UTRAN cell global identifier (ECGI), the identifier of the electronic device comprises an international mobile subscriber identity (IMSI) or a subscription permanent identifier (SUPI), and the identifier of the service provider comprises a public land mobile network (PLMN) identifier.
20. The method of claim 17 , wherein determining the first entity identifier comprises performing a lookup in a predefined list of identifiers of one or more radio nodes in the private or neutral-host network and the first entity identifier; and
wherein determining the second entity identifier comprises performing a lookup in a predefined list of one or more identifiers of electronic devices and the second entity identifier.