SIM whitelisting and multi-operator core networks

• US 10,021,623 B2
• Filed: 04/21/2016
• Issued: 07/10/2018
• Est. Priority Date: 04/21/2015
• Status: Active Grant

• Current Assignee: Parallel Wireless, Inc.
• Original Assignee: Parallel Wireless, Inc.
• Inventors: Raval, Kartik Shashikant, Mishra, Rajesh Kumar, Agarwal, Kaitki, Donepudi, Sridhar, Mehta, Pratik, Cao, Yang, Papa, Steven Paul
• Primary Examiner(s): Nawaz, Asad
• Assistant Examiner(s): Belete, Berhanu
• Application Number:
  US15/135,535
• Publication Number:
  US 20160316416A1
• Time in Patent Office: 810 Days
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 84/042 Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 88/12 Access point controller devices

Abstract

A method may be disclosed in accordance with some embodiments, comprising: receiving, at a virtualizing gateway between the eNodeB and a first core network, a service request from a first user equipment (UE) via an eNodeB; applying a filter to an identifier of the UE to authenticate the UE; and forwarding, based on the applied filter, the service request from the first UE to the first core network. The identifier may be an international mobile subscriber identity (IMSI). The filter may be a whitelist containing a plurality of IMSIs to be granted service or a blacklist containing a plurality of IMSIs to be denied service, the service request may be a Long Term Evolution (LTE) attach request, and the method may further comprise forwarding the message from the first UE to a first mobility management entity (MME) in the first core network.

Claims

1. A method, comprising:

receiving, at a virtualizing gateway, a first service request from a first user equipment (UE) via a first eNodeB, wherein the virtualizing gateway is in communication with a first core network of a first mobile operator and a second core network of a second mobile operator, the first and the second core network each including a serving gateway (SGW) and a packet data network gateway (PGW);

creating, at the virtualizing gateway, an association from each of a plurality of UE identifiers to a desired core network;

applying, at the virtualizing gateway, a first filter using a first UE identifier of the first UE, based on the association;

forwarding, at the virtualizing gateway, based on the applied first filter, the first service request from the first UE to the first core network;

receiving, at the virtualizing gateway, via a second eNodeB, a second service request from a second user equipment (UE);

applying, at the virtualizing gateway, a second filter using a second UE identifier of the second UE, based on the association; and

forwarding, at the virtualizing gateway, based on the applied second filter, the second service request from the second UE to the second core network,

wherein the virtualizing gateway is acting as a gateway between the first eNodeB and the first core network, and between the second eNodeB and the second core network.

2. The method of claim 1, wherein the first UE identifier is an international mobile subscriber identity (IMSI), wherein the first filter is a whitelist containing a plurality of IMSIs to be granted service or a blacklist containing a plurality of IMSIs to be denied service, wherein the first service request is a Long Term Evolution (LTE) attach request, and wherein the method further comprises forwarding a message from the first UE to a first mobility management entity (MME) in the first core network.

3. The method of claim 1, further comprising sending a network access stratum (NAS) message to the first UE to request an international mobile subscriber identity (IMSI) when the IMSI is not provided by the first UE.

4. The method of claim 1, further comprising receiving a global unique temporary ID (GUTI) or a System Architecture Evolution temporary mobile subscriber identity (STMSI) from the first UE, comparing the received GUTI or S-TMSI to the plurality of UE identifiers to identify an international mobile subscriber identity (IMSI) of the first UE, and applying the first filter using the identified IMSI.

5. The method of claim 4, further comprising handling sequence number breaks in a series of messages between the first UE and the first core network by restarting a message sequence.

6. The method of claim 1, further comprising receiving a temporary mobile subscriber identity (TMSI), temporary logical link identity (TLLI), P-TMSI, M-TMSI, or S-TMSI from the first UE, determining an international mobile subscriber identity (IMSI) of the first UE, and determining whether to authenticate the identified first UE.

7. The method of claim 1, further comprising synchronizing a filter configuration from a configuration server to the virtualizing gateway.

8. The method of claim 1, further comprising providing services to a public safety agency limited to public safety personnel with subscriber identity module (SIM) cards having IMSIs that have been configured in the first filter to permit access.

9. The method of claim 1, further comprising providing services to the first UE of a mobile subscriber roaming from the first mobile operator to a second international mobile operator and having a subscriber identity module (SIM) card for the first mobile operator, the first mobile operator having a secure route to the second international mobile operator, the second international mobile operator receiving an international mobile subscriber identity (IMSI) from the mobile subscriber'"'"'s first UE, the first mobile operator forwarding a message to the second international mobile operator'"'"'s core network via the secure route to the second international mobile operator, the first mobile operator performing charging and settlement services through the secure route.

10. The method of claim 1, further comprising identifying a set of international mobile subscriber identities (IMSIs) using the first filter to be provided priority treatment of traffic.

11. The method of claim 1, further comprising identifying a set of international mobile subscriber identities (IMSIs) using the first filter to be provided an elevated level of logging and monitoring at the first core network, and sending a message to one of the first core network or the first eNodeB of the first UE to set the elevated logging and monitoring level.

12. The method of claim 1, further comprising providing services to the first UE within a corporate network at a base station connected within the corporate network;

and

forwarding, based on the first-filter, the message from the UE via the corporate network to an operator core network to provide services to the UE from the operator core network.

13. The method of claim 1, further comprising performing per-UE throttling of service requests to the first core network.

14. The method of claim 1, further comprising blocking a rogue UE from reaching the first core network using a blacklist at the virtualizing gateway.

15. A system, comprising:

a first eNodeB for receiving messages from a first user equipment (UE);

a second eNodeB for receiving messages from a second user equipment (UE); and

a gateway coupled to at least one eNodeB and acting as a virtualizing gateway for communications from at least one eNodeB to one or more core networks, the one or more core networks including a serving gateway (SGW) and a packet data network gateway (PGW),

wherein the virtualizing gateway further comprises;

a processor; and

a memory comprising instructions that, when executed by the processor, cause the processor to perform steps including;

receiving, at the virtualizing gateway, a first service request from a first user equipment (UE) via the first eNodeB;

creating, at the virtualizing gateway, an association from each of a plurality of UE identifiers to a desired core network;

applying, at the virtualizing gateway, a first filter using a first UE identifier of the first UE, based on the association;

forwarding, at the virtualizing gateway, the first service request from the first UE to a first core network based on the applied first filter;

receiving, at the virtualizing gateway, via the second eNodeB, a second service request from a second user equipment (UE);

applying, at the virtualizing gateway, a second filter using a second UE identifier of the second UE, based on the association; and

forwarding, at the virtualizing gateway, the second service request from the second UE to the second core network based on the applied second filter.

16. A non-transitory computer-readable medium comprising instructions that, when executed by a processor at a virtualizing gateway, cause the virtualizing gateway to:

receive a first service request from a first user equipment (UE) via a first eNodeB;

create an association from each of a plurality of UE identifiers to a desired core network;

apply a first filter using a first UE identifier of the first UE, based on the association;

forward the first service request from the first UE to a first core network based on the applied first filter;

receive via a second eNodeB, a second service request from a second user equipment (UE);

apply a second filter using a second UE identifier of the second UE, based on the association;

forward the second service request from the second UE to the second core network based on the applied second filter; and

act as a gateway between at least one eNodeB and one or more core networks,

wherein the one or more core networks each including a serving gateway (SGW) and a packet data network gateway (PGW).