SIM whitelisting and multi-operator core networks

Patent metadata

Field	Value
Publication number	US-11140611-B2
Application number	US-201916691599-A
Country	US
Kind code	B2
Filing date	Nov 21, 2019
Priority date	Apr 21, 2015
Publication date	Oct 5, 2021
Grant date	Oct 5, 2021

Abstract

A method may be disclosed in accordance with some embodiments, comprising: receiving, at a virtualizing gateway, a first service request from a first user equipment (UE) via a first eNodeB; creating, at the virtualizing gateway, an association from each of a plurality of UE identifiers to a desired core network; applying, at the virtualizing gateway, a first filter using a first UE identifier of the first UE, based on the association; forwarding, at the virtualizing gateway, based on the applied first filter, the first service request from the first UE to the first core network; receiving, at the virtualizing gateway, via a second base station, a second service request from a second user equipment (UE); applying, at the virtualizing gateway, a second filter using a second UE identifier of the second UE, based on the association; and forwarding, at the virtualizing gateway, based on the applied second filter, the second service request from the second UE to the second core network.

First claim

The invention claimed is:

1. A method, comprising:
receiving, at a virtualizing gateway, a first service request from a first user equipment (UE) via a first eNodeB, wherein the virtualizing gateway is in communication with a first core network of a first mobile operator and a second core network of a second mobile operator, the first and the second core network each including a serving gateway (SGW) and a packet data network gateway (PGW);
creating, at the virtualizing gateway, an association from each of a plurality of UE identifiers to a desired core network;
applying, at the virtualizing gateway, a first filter using a first UE identifier of the first UE, based on the association;
forwarding, at the virtualizing gateway, based on the applied first filter, the first service request from the first UE to the first core network;
receiving, at the virtualizing gateway, via a second base station, a second service request from a second user equipment (UE);
applying, at the virtualizing gateway, a second filter using a second UE identifier of the second UE, based on the association; and
forwarding, at the virtualizing gateway, based on the applied second filter, the second service request from the second UE to the second core network,
wherein the virtualizing gateway is acting as a gateway between the first eNodeB and the first core network, and between the second base station and the second core network, and
wherein the second core network uses a different radio access technology (RAT) than the first core network.

2. The method of claim 1 , wherein the first UE identifier is an international mobile subscriber identity (IMSI), wherein the first filter is a whitelist containing a plurality of IMSIs to be granted service or a blacklist containing a plurality of IMSIs to be denied service, wherein the first service request is a Long Term Evolution (LTE) attach request, wherein the method further comprises forwarding a message from the first UE to a first mobility management entity (MME) in the first core network, and wherein the second core network uses a 3G radio access technology.

3. The method of claim 1 , further comprising sending a network access stratum (NAS) message to the first UE to request an international mobile subscriber identity (IMSI) when the IMSI is not provided by the first UE.

4. The method of claim 1 , further comprising receiving a global unique temporary ID (GUTI) or a System Architecture Evolution temporary mobile subscriber identity (STMSI) from the first UE, comparing the received GUTI or S-TMSI to the plurality of UE identifiers to identify an international mobile subscriber identity (IMSI) of the first UE, and applying the first filter using the identified IMSI.

5. The method of claim 1 , further comprising receiving a temporary mobile subscriber identity (TMSI), temporary logical link identity (TLLI), P-TMSI, M-TMSI, or S-TMSI from the first UE, determining an international mobile subscriber identity (IMSI) of the first UE, and determining whether to authenticate the identified first UE.

6. The method of claim 5 , further comprising handling sequence number breaks in a series of messages between the first UE and the first core network by restarting a message sequence.

7. The method of claim 1 , further comprising synchronizing a filter configuration from a configuration server to the virtualizing gateway.

8. The method of claim 1 , further comprising providing services to a public safety agency limited to public safety personnel with subscriber identity module (SIM) cards having IMSIs that have been configured in the first filter to permit access.

9. The method of claim 1 , further comprising providing services to the first UE of a mobile subscriber roaming from the first mobile operator to a second international mobile operator and having a subscriber identity module (SIM) card for the first mobile operator, the first mobile operator having a secure route to the second international mobile operator, the second international mobile operator receiving an international mobile subscriber identity (IMSI) from the mobile subscriber's first UE, the first mobile operator forwarding a message to the second international mobile operator's core network via the secure route to the second international mobile operator, the first mobile operator performing charging and settlement services through the secure route.

10. The method of claim 1 , further comprising identifying a set of international mobile subscriber identities (IMSIs) using the first filter to be provided priority treatment of traffic.

11. The method of claim 1 , further comprising identifying a set of international mobile subscriber identities (IMSIs) using the first filter to be provided an elevated level of logging and monitoring at the first core network, and sending a message to one of the first core network or the first eNodeB of the first UE to set the elevated logging and monitoring level.

12. The method of claim 1 , further comprising providing services to the first UE within a corporate network at a base station connected within the corporate network; and
forwarding, based on the first-filter, the message from the UE via the corporate network to an operator core network to provide services to the UE from the operator core network.

13. The method of claim 1 , further comprising performing per-UE throttling of service requests to the first core network.

14. The method of claim 1 , further comprising blocking a rogue UE from reaching the first core network using a blacklist at the virtualizing gateway.

15. A system, comprising:
a first base station for receiving messages from a first user equipment (UE);
a second base station for receiving messages from a second user equipment (UE); and
a gateway coupled to at least one eNodeB and acting as a virtualizing gateway for communications from at least one eNodeB to one or more core networks, the one or more core networks including a serving gateway (SGW) and a packet data network gateway (PGW), the one or more core networks having at least two radio access technologies (RATs),
wherein the virtualizing gateway further comprises:
a processor; and
a memory comprising instructions that, when executed by the processor, cause the processor to perform steps including:
receiving, at the virtualizing gateway, a first service request from a first user equipment (UE) via the first base station;
creating, at the virtualizing gateway, an association from each of a plurality of UE identifiers to a desired core network;
applying, at the virtualizing gateway, a first filter using a first UE identifier of the first UE, based on the association;
forwarding, at the virtualizing gateway, the first service request from the first UE to a first core network based on the applied first filter;
receiving, at the virtualizing gateway, via the second base station, a second service request from a second user equipment (UE);
applying, at the virtualizing gateway, a second filter using a second UE identifier of the second UE, based on the association; and
forwarding, at the virtualizing gateway, the second service request from the second UE to the second core network based on the applied second filter.

16. A non-transitory computer-readable medium comprising instructions that, when executed by a processor at a virtualizing gateway, cause the virtualizing gateway to:
receive a first service request from a first user equipment (UE) via a first base station;
create an association from each of a plurality of UE identifiers to a desired core network;
apply a first filter using a first U

Assignees

• Parallel Wireless Inc

Inventors

• Raval Kartik Shashikant
• Mishra Rajesh Kumar
• Agarwal Kaitki
• Donepudi Sridhar
• Mehta Pratik
• Cao Yang
• Papa Steven Paul
• Arora Jitender

Classifications

• H04W84/042

  Public Land Mobile systems, e.g. cellular systems · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04W12/08

  Access security · CPC title

• H04W48/18

  Selecting a network or a communication service · CPC title