Remote provisioning of 3GPP downloadable subscriber identity module for virtual machine applications

• US 9,549,321 B2
• Filed: 12/29/2011
• Issued: 01/17/2017
• Est. Priority Date: 12/29/2011
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Slavov, Kristian, Salmela, Patrik, Ylitalo, Jukka
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Kaplan, Benjamin
• Application Number:
  US14/369,538
• Publication Number:
  US 20140337940A1
• Time in Patent Office: 1,846 Days
• Field of Search: 726/5
• US Class Current: 1/1
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 28/16 Central resource management; Negotiation of resources or communication parameters, e.g. negotiating bandwidth or QoS [Quality of Service]
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

A method is presented of providing a subscriber identity for the provision of services on behalf of the subscriber in a virtual computing environment. The method includes receiving a request to establish an execution environment for a virtual machine-to-machine equipment, vM2 M E. The vM2ME is provided, comprising software for execution in the virtual computing environment and a downloadable Subscriber Identity Module. A Communications Module, CM, is set up for execution in a domain of a virtualization platform. The CM provides an end-point for communications between the vM2ME and a 3GPP network. The Subscriber Identity Module is installed for execution together with the CM, the Subscriber Identity Module including a 3GPP identity of the subscriber, security data and functions for enabling access to the vM2ME via the 3GPP network.

Claims

1. A method of providing a subscriber identity for the provision of services on behalf of the subscriber in a virtual computing environment, the method comprising:

receiving a request to establish an execution environment for a virtual machine-to-machine equipment (vM2ME);

providing the vM2ME comprising software for execution in the virtual computing environment and a Machine Communication Identity Module (MCIM);

setting up a Communications Module (CM) for execution in a domain of a virtualization platform, the CM providing an end-point for communications between the vM2ME and a 3GPP network; and

installing the MCIM for execution together with the CM, the MCIM including a 3GPP identity of the subscriber, security data and functions for enabling access to the vM2ME via the 3GPP network.

2. The method of claim 1, wherein setting up the CM comprises:

providing a preliminary, MCIM;

performing a bootstrapping procedure based on identities and security information provided in the preliminary MCIM; and

upon successfully completing the bootstrapping procedure, providing a subscriber MCIM that includes the 3GPP identity of the subscriber, security data and functions for enabling access to the vM2ME via the 3GPP network.

3. The method of claim 2, further comprising sending a request for allocation of resources for the vM2ME to a management domain of the virtualization platform, and in response to a confirmation of allocation of the resources, providing the preliminary MCIM to an allocated domain or location of the virtualization platform for performing the bootstrapping procedure to set up the CM for execution in the allocated domain or location.

4. The method of claim 3, wherein the allocated domain or location in which the CM is set up for execution is the management domain of the virtualization platform.

5. The method of claim 3, wherein the 3GPP network is associated with a mobile network operator, and wherein the allocated domain or location in which the CM is set up for execution is a domain of the virtualization platform that comprises a virtual machine operated by the mobile network operator.

6. The method of claim 3, wherein the allocated domain or location in which the CM is set up for execution is a physical network interface card (pNIC) that interfaces with a virtual machine manager (VMM) of the virtualization platform.

7. The method of claim 2, further comprising obtaining authorizations from a registration function and a provisioning function, to authenticate the preliminary MCIM and to authorize provisioning of the MCIM for the subscriber.

8. The method of claim 1, further comprising establishing a Trusted Environment, (TRE) that includes a virtual machine manager (VMM) and a management domain of the virtualization platform together with the CM and the MCIM installed for the subscriber.

9. The method of claim 8, further comprising validating the TRE using an external validation authority.

10. A 3GPP network entity configured to provide a subscriber identity for the provision of services on behalf of the subscriber in a virtual computing environment the network entity being configured:

on receiving a request to establish an execution environment for virtual machine-to-machine equipment (vM2ME) to provide the vM2ME that comprises a virtual machine (VM) software for execution in the virtual computing environment and a Machine Communication Identity Module (MCIM);

to set up a Communications Module (CM) for execution in a virtualization platform, the CM providing an end-point for 3GPP communications to and from the VM; and

to install the MCIM for execution together with the CM, the MCIM including a 3GPP identity of the subscriber, security data and functions for enabling access to the vM2ME via the 3GPP network.

11. The 3GPP network entity of claim 10, further configured to:

provide a preliminary MCIM and to cause a bootstrapping procedure to be carried out based on identities and security information provided in the preliminary MCIM to set up the CM; and

in response to notification of a successful completion of the bootstrapping procedure, provide the MCIM including the 3GPP identity of the subscriber, the security data and the functions for enabling access to the VM via a 3GPP network.

12. The 3GPP network entity of claim 11, further configured to send a request for allocation of resources for the vM2ME to a management domain of a virtualization platform, and in response to receiving a confirmation of allocation of the resources, to provide the preliminary MCIM to an allocated domain or location of the virtualization platform for performing the bootstrapping procedure to set up the CM in the allocated domain or location.

13. The 3GPP network entity of claim 11, configured to obtain authorizations from a registration function and a provisioning function, the authorizations authenticating the preliminary MCIM and authorizing provisioning of the MCIM for the subscriber.

14. The 3GPP network entity of claim 11, further configured to establish a Trusted Environment, (TRE) that includes a VMM and a management domain of the virtualization platform together with the CM and MCIM of the subscriber.

15. The 3GPP network entity of claim 14, further configured to initiate a validation of the TRE using an external validation authority.

16. A non-transitory computer-readable medium storing a computer program product comprising instructions that, when executed by a computer in a network, cause the computer to provide a subscriber identity for the provisioning of services from a virtual computing environment, including program instructions to cause the computer to:

in response to receiving a request to establish an execution environment for a virtual machine-to-machine equipment (VM2ME), provide the vM2ME comprising software for execution in the virtual computing environment and a Machine Communication Identity Module (MCIM);

set up a Communications Module (CM) for execution in a domain of a virtualization platform, the CM providing an end-point for communications between the vM2ME and a 3GPP network; and

install the MCIM for execution together with the CM, the MCIM including a 3GPP identity of the subscriber, security data and functions for enabling access to the vM2ME via the 3GPP network.

17. The non-transitory computer-readable medium of claim 16, wherein

the computer program product further comprises instructions configuring the computer to:

provide a preliminary MCIM;

initiate a bootstrapping procedure to be carried out based on identities and security information provided in the preliminary MCIM to set up the Communications Module (CM), and

in response to notification of a successful completion of the bootstrapping procedure, to install the MCIM for the subscriber, including the security data and the functions for enabling access to the vM2ME via the 3GPP network for execution together with the CM.