Bidirectional communication protocol for private networks

Abstract

A system, method, and computer-readable medium are disclosed for facilitating bidirectional edge proxy-to-edge proxy communication across an enterprise firewall in a 5G service-based architecture. In an aspect, the method includes receiving a subscription request from a user device to operate on a visited private network, determining that the user device is associated with a home network, and establishing a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, the communication protocol enabling exchange of bidirectional roaming signals between the visited private network and the home network while the user device is operating on the visited private network.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of priority to U.S. Non-Provisional Patent Application No. 17 / 846,582, entitled "BI-DIRECTIONAL COMMUNICATION PROTOCOL FOR PRIVATE NETWORKS," filed on June 22, 2022, and U.S. Provisional Patent Application No. 63 / 305,502, entitled "EDGE PROXY TO EDGE PROXY COMMUNICATIONS ACROSS ENTERPRISE FIREWALLS," filed on February 1, 2022, the disclosures of which are incorporated by reference in their entireties herein.

[0002] Technical Field The subject matter of this disclosure relates generally to the field of computer networking, and more specifically to facilitating bidirectional communication between private networks across enterprise firewalls. [Background technology]

[0003] background

[0003] Current mobile and wireless communication systems are widely adopting 5G, a next-generation wireless communication system that provides much higher data rates and lower latency. Many communication service providers (e.g., mobile network operators) deploying 5G systems have developed roaming services that extend the coverage of a home operator's services and allow its mobile users to use those services in another operator's network. In the 5G system, for roaming services, Service-Based Architecture (SBA) and security functions to protect the network edge are newly supported by a new network function (NF) called Security Edge Protection Proxy (SEPP).

[0004] BRIEF DESCRIPTION OF THE DRAWINGS

[0004] To illustrate how the above and other advantages and features of the present disclosure can be obtained, a more particular description of the principles briefly described above is provided by reference to specific embodiments shown in the accompanying drawings. With the understanding that these drawings are merely illustrative of exemplary embodiments of the present disclosure and therefore should not be considered as limiting its scope, the principles herein will be described and explained with greater particularity through the use of the accompanying drawings. [Brief description of the drawings]

[0005] [Figure 1]

[0005] An exemplary schematic diagram of a 5G network environment in which one or more aspects of the present disclosure may operate is shown. [Diagram 2]

[0006] 1 illustrates an exemplary network environment for establishing a bidirectional communication protocol in a 5G service-based architecture, in accordance with some examples of the present disclosure. [Figure 3A]

[0007] 1 illustrates an example diagram of an enhanced roaming system supporting bidirectional communication between 5G networks, in accordance with some examples of the present disclosure. [Figure 3B]

[0007] An exemplary diagram of an enhanced roaming system supporting bidirectional communication between 5G networks in accordance with some examples of the present disclosure is shown. [Figure 3C]

[0007] An exemplary diagram of an enhanced roaming system supporting bidirectional communication between 5G networks in accordance with some examples of the present disclosure is shown. [Figure 3D]

[0007] An exemplary diagram of an enhanced roaming system supporting bidirectional communication between 5G networks in accordance with some examples of the present disclosure is shown. [Figure 4A]

[0008] 1 illustrates an example diagram of an enhanced roaming system supporting bidirectional communication between a 4G network and a 5G network, in accordance with some examples of the present disclosure. [Figure 4B]

[0008] An example diagram of an enhanced roaming system supporting bidirectional communication between a 4G network and a 5G network in accordance with some examples of the present disclosure is shown. [Figure 4C]

[0008] An example diagram of an enhanced roaming system supporting bidirectional communication between a 4G network and a 5G network in accordance with some examples of the present disclosure is shown. [Figure 4D]

[0008] An example diagram of an enhanced roaming system supporting bidirectional communication between a 4G network and a 5G network in accordance with some examples of the present disclosure is shown. [Diagram 5]

[0009] 1 illustrates a flowchart of a method for enabling bidirectional communication between networks according to some examples of the present disclosure. [Figure 6]

[0010] 1 illustrates an example network device in accordance with certain aspects of the present disclosure. [Figure 7]

[0011] An exemplary computing system is illustrated, which can be, for example, any computing device capable of implementing the components of the system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0006] Detailed Description

[0012] Various embodiments of the present disclosure are described in detail below. Although specific implementations are described, it should be understood that this is done for illustrative purposes only. Those skilled in the relevant art will recognize that other components and configurations can be used without departing from the spirit and scope of the present disclosure. Therefore, the following description and drawings are illustrative and should not be construed as limiting. Numerous specific details are described to provide a thorough understanding of the present disclosure. However, in some cases, well-known or conventional details are not described to avoid obscuring the description. Reference to one embodiment or an embodiment in the present disclosure may be a reference to the same embodiment or any embodiment, and such reference means at least one of the embodiments.

[0007]

[0013] Reference to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with that embodiment is included in at least one embodiment of the disclosure. The appearances of the phrase "in one embodiment" in various places in the specification do not necessarily all refer to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Also, various features are described that may be exhibited in some embodiments and not in other embodiments.

[0008]

[0014] The terms used herein generally have their ordinary meaning in the art, within the context of this disclosure and in the specific context in which each term is used. Alternative words and synonyms may be used for any one or more of the terms described herein, and no special emphasis is placed on whether a term is detailed or described herein. In some cases, synonyms of a particular term are provided. The detailed description of one or more synonyms does not exclude the use of other synonyms. The use of examples anywhere in this specification, including examples of terms described herein, is merely illustrative and is not intended to further limit the scope and meaning of the disclosure or the exemplary terms. Similarly, the disclosure is not limited to the various embodiments provided herein.

[0009]

[0015] Without intending to limit the scope of the present disclosure, examples of instruments, devices, methods, and their related results according to the embodiments of the present disclosure are given below. Please note that for the convenience of the reader, titles or subtitles may be used in the examples, but this does not limit the scope of the present disclosure in any way. Unless otherwise defined, technical and scientific terms used herein have the meanings that are commonly understood by those skilled in the art to which the present disclosure belongs. In case of conflict, the present specification, including definitions, shall prevail.

[0010]

[0016] Additional features and advantages of the present disclosure will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the principles disclosed herein. The features and advantages of the present disclosure may be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. These and other features of the present disclosure will become more fully apparent from the following description and the appended claims, or may be learned by practice of the principles described herein.

[0011]

[0017]

[0012]

[0018] overview

[0019] Aspects of the invention are set out in the independent claims and preferred features are set out in the dependent claims. Features of one aspect may be applied to each aspect alone or in combination with other aspects.

[0013]

[0020] Disclosed herein are systems, methods, and computer-readable media for supporting bidirectional communication between private networks across enterprise firewalls of the private networks.

[0014]

[0021] In an aspect, a method includes receiving a subscription request from a user device to operate on a visited private network, determining that the user device is associated with a home network, and establishing a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, the communication protocol enabling bidirectional exchange of roaming signals between the visited private network and the home network while the user device is operating on the visited private network.

[0015]

[0022] In another aspect, the method further includes rewriting a callback Uniform Resource Identifier (URI) signaled by a network function of the visited private network and received by the security edge protection proxy of the home network to a URI that resolves to the security edge protection proxy of the home network.

[0016]

[0023] In another aspect, the method further includes recovering Diameter origin host and origin information from the subscription request and updating routing information in the home network to enable routing of server-initiated messages originating in the home network toward the visited private network.

[0017]

[0024] In another aspect, the method further includes determining that a subscription of the user device to the visited private network has terminated and terminating a communication protocol between the security edge protection proxy of the home network and the security edge protection proxy of the visited private network.

[0018]

[0025] In another aspect, the method further includes determining that a timer has expired, the timer defining a period of the communication protocol, and terminating the communication protocol between the home network and the visited private network upon determining that the timer has expired.

[0019]

[0026] In another aspect, when the visited private network is a private 5G network, a bidirectional N32 interface is used to transfer signals between the visited private network and the home network via a communication protocol.

[0020]

[0027] In another aspect, when the visited private network is a private LTE network, the S6a interface is used to transfer signals between the visited private network and the home network via a communication protocol.

[0021]

[0028] In another aspect, the method further includes determining that there is at least one outstanding subscription to the visited private network, where the outstanding subscription is for a second user device associated with the home network, and maintaining a communication protocol between a security edge protection proxy of the home network and a security edge protection proxy of the visited private network while the at least one outstanding subscription is valid.

[0022]

[0029] In an aspect, a network component includes one or more memories having computer-readable instructions stored therein and one or more processors configured to execute the computer-readable instructions to receive a subscription request from a user device to operate on a visited private network, determine that the user device is associated with a home network, and establish a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, the communication protocol enabling bidirectional exchange of roaming signals between the visited private network and the home network while the user device is operating on the visited private network.

[0023]

[0030] In an aspect, one or more non-transitory computer-readable media include computer-readable instructions that, when executed by one or more processors of a network component, cause the network component to receive a subscription request from a user device to operate on a visited private network, determine that the user device is associated with a home network, and establish a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, the communication protocol enabling bidirectional exchange of roaming signals between the visited private network and the home network while the user device is operating on the visited private network.

[0024]

[0031]

[0025]

[0032] Description of Example Embodiments

[0033] The following abbreviations are used throughout this disclosure, which are provided below for convenience: 5GNF: 5G network function AAA: Authentication, Authorization, and Accounting ANP or AP: Access Network Provider or Access Provider DEA: Diameter Edge Agent DNS: Domain Name System DRA: Diameter Routing Agent HPLMN:Home Public Land Mobile Network IDP: Identity Provider NAS: Non-Access Stratum PLMN:Public Land Mobile Network SBA: Service-Based Architecture SCP:Service Communication Proxy SEPP:Security Edgy Protection Proxy TCP:Transmission Control Protocol TLS: Transport Layer Security UE: User Equipment VPLMN: Visited Public Land Mobile Network

[0026]

[0034] As mentioned above, the SEPP is a new network function of the 5G system, which supports the 5G service-based architecture and security functionality (i.e., protecting the network edge). The 5G service-based architecture allows any third-party application to interact with the 5G NF in a secure manner. As follows, the 5G service-based architecture requires the ability to support any inbound connection from the initiating SEPP to the responding SEPP. For example, the GSM Association (GSMA) requires that the IP address of the initiating SEPP be registered and shared among operators so that the risk of accepting inbound connections from third-party networks can be reduced.

[0027]

[0035] However, existing approaches for roaming between private networks can be problematic when the number of networks is large, as border node registration can be cumbersome. Furthermore, the increasing diversity of networks requires enabling traditional firewall traversal for inter-SEPP communication. However, traditional firewalls prioritize policy control of outbound connections and do not allow inbound connections. 5G network architecture also requires timely delivery of messages from HPLMN to VPLMN. For example, delays in delivery of information (e.g., Nudm_UECM_DeregistrationNotify) after a UE registers to a neighboring PLMN may cause problems if the UE subsequently moves back to the original PLMN.

[0028]

[0036] Therefore, there is a need for a communication protocol that can support bidirectional communication between networks across an enterprise firewall in a 5G service-based architecture. The present technology includes, among other things, a system, a method, and a computer-readable medium for solving the problems and contradictions mentioned above. In some examples, a system, a method, and a computer-readable medium for enabling bidirectional communication between a home network provider and a visited network provider (e.g., inter-SEPP communication in a 5G service-based architecture) are provided. In particular, the proposed solution relates to establishing a communication protocol for bidirectional communication between a home network provider and a visited network provider when a user device from a home network enters a visited private network. Furthermore, the proposed solution relates to automatically terminating the communication protocol when the user device leaves the visited network. It is understood that the term "WebSocket" is used to represent the communication protocol of the present disclosure that supports bidirectional communication between private networks, more specifically, inter-SEPP communication across an enterprise firewall.

[0029]

[0037] 1 illustrates an example schematic diagram of a 5G network environment 100 in which one or more aspects of the present disclosure may operate. As illustrated, the network environment 100 is divided into four domains, with each domain described in more depth below: a user equipment (UE) domain 110, e.g., of one or more enterprises, where multiple user mobile phones or other connected devices 112 reside; a radio access network (RAN) domain 120, where multiple radio cells, base stations, towers, or other wireless infrastructure 122 reside; a core network 130, where multiple network functions (NFs) 131, 132, ..., n reside; and a data network 140, where one or more data communications networks, such as the Internet 142 reside. Additionally, the data network 140 may support a SaaS provider configured to provide SaaS to enterprises, e.g., users within the UE domain 110.

[0030]

[0018] The core network 130 includes multiple network functions (NFs), denoted here as NF131, NF132, ..., NFn. In some examples, the core network 130 is a 5G Core Network (5GC) network that conforms to one or more accepted 5GC architectures or designs. In some cases, the core network 130 is an Evolved Packet Core (EPC) network that combines aspects of 5GC with existing 4G networks. Regardless of the particular design of the core network 130, the multiple NFs typically run in the control plane of the core network 130, providing a service-based architecture that allows a given NF to access its services to any other authorized NF. For example, a Session Management Function (SMF) controls session establishment, modification, release, etc., and in the process of doing so provides other NFs with access to these constituent SMF services.

[0031]

[0019] In some examples, the NFs of the core network 130 may include one or more Access and Mobility Management Functions (AMFs) (typically used when the core network 130 is a 5GC network) and Mobility Management Entities (MMEs) (typically used when the core network 130 is an EPC network) (collectively referred to herein as AMF / MMEs for simplicity and clarity). In some examples, the AMF / MME may be common to or otherwise shared by multiple slices of the multiple network slices 152, and in some examples, the AMF / MME may be specific to a single slice of the multiple network slices 152.

[0032] The same is true for the remaining NFs of the core network 130, which may be shared among one or more network slices or may be provided as unique instances specific to a single slice of the multiple network slices 152. In addition to the NFs including the AMF / MME as described above, the multiple NFs of the core network 130 may further include one or more of the following: UPE (User Plane Function); PCF (Policy Control Function); AUSF (Authentication Server Function); UDM (Unified Data Management function); AF (Application Function); NEF (Network Exposure Function); NRF (NF Repository Function); and NSSF (Network Slice Selection Function). As will be appreciated by those skilled in the art, various other NFs may be provided without departing from the scope of the present disclosure.

[0033]

[0021] Across these four domains of the 5G network environment 100, an overall operator network domain 150 is defined. The operator network domain 150 is a Public Land Mobile Network (PLMN) in some examples and can be thought of as a carrier or entity that provides cellular services to end users in the UE domain 110. Within the operator network domain 150, multiple network slices 152 are created, defined, or otherwise provisioned to deliver a desired set of defined features and functions, e.g., SaaS, for a particular use case or in response to other requirements or specifications. It should be noted that the network slicing of the multiple network slices 152 is implemented in an end-to-end manner across multiple different technology and management domains, including a management and orchestration plane (not shown). That is, the network slicing occurs at least from the enterprise or subscriber edge of the UE domain 110, through the RAN 120, through the 5G access edge and 5G core network 130, and to the data network 140. Also, note that this network slicing can span multiple different 5G providers.

[0034]

[0022] For example, as shown, the plurality of network slices 152 includes slice 1 corresponding to smartphone subscribers of a 5G provider that also operates the network domain, and slice 2 corresponding to smartphone subscribers of a virtual 5G provider that leases capacity from the actual operator of the network domain 150. Also shown is slice 3, which may be provided to a fleet of connected vehicles, and slice 4, which may be provided to a factory network or an IoT goods or container tracking system across a supply chain. It should be noted that these network slices 152 are provided for illustrative purposes and in accordance with the present disclosure, and that the operator network domain 150 may implement any number of network slices as needed and for purposes, use cases, or subsets of users and user equipment in addition to those listed above. In particular, the operator network domain 150 may implement any number of network slices to provision SaaS from a SaaS provider to one or more enterprises.

[0035]

[0023] 5G mobile and wireless networks are intended to provide improved mobile broadband communications and deliver a broader range of services and applications compared to all previous generations of mobile and wireless networks. In comparison to previous generations of mobile and wireless networks, the 5G architecture is service-based, meaning that architecture elements are defined as network functions that provide services to other network functions, where appropriate, through a common framework interface. To support such a broad range of services and network functions across an ever-increasing base of user equipment (UE), 5G networks incorporate the concept of network slicing that was utilized in previous generations of architectures.

[0036]

[0038] Within the scope of the 5G mobile and wireless network architecture, a network slice includes a defined set of features and functions that together form a complete Public Land Mobile Network (PLMN) for serving UEs. This network slicing allows for the controlled configuration of PLMNs with specific network functions and service offerings required for specific usage scenarios. In other words, network slicing allows 5G network operators to deploy multiple independent PLMNs, each customized by instantiating only the features, capabilities, and services required to meet a given subset of UEs or associated business customer needs.

[0037]

[0039] 2 illustrates an example network environment 200 for establishing a bidirectional communication protocol according to some examples of the present disclosure. In some examples, the network environment 200 includes a UE 202, a visited network provider 210, and a home network provider 230. The UE 202, which was initially connected to the home network provider 230, roams into an area where the connection is covered by the visited network provider 210.

[0038]

[0040] According to some implementations, visited network provider 210 includes a V-SEPP 212 and a number of network functions 221, 222, 223, etc. (e.g., similar to network functions 131, 132, ..., n of core network 130 as shown in FIG. 1 ). Home network provider 230 also includes an H-SEPP 232 and a number of network functions 241, 242, 243, etc. (e.g., similar to network functions 131, 132, ..., n of core network 130 as shown in FIG. 1 ). In some cases, an N32 interface is used as an interface between V-SEPP 212 of visited network provider 210 and H-SEPP 232 of home network provider 230, thereby enabling bidirectional communication between V-SEPP 212 and H-SEPP 232.

[0039]

[0041] In some examples, the UE 202 appears in an area covered by the visited network provider 210. The visited network provider 210 needs to authenticate the UE 202 (e.g., by an HTTP / 2 request) as follows: An inbound user device on the network (e.g., the UE 202 on the visited network provider 210) can trigger the establishment of a WebSocket with the network that holds the necessary credentials to authenticate the particular user device. In some cases, while the UE 202 is being served by the network, the WebSocket can exist to allow a bidirectional flow of information (i.e., exchange of roaming signals) between the visited network provider 210 and the home network provider 230. When the UE 202 leaves the area covered by the visited network provider 210, the WebSocket can be terminated since roaming is no longer necessary.

[0040]

[0042] In some cases, when a second UE from the same home network joins the same visited network, the second UE can use the same WebSocket. The WebSocket is maintained as long as at least one UE remains in the visited network. That is, the WebSocket can be terminated only when the last UE of the home network provider 230 leaves the visited network provider 210 network. In some examples, the home network of a UE can be identified based on the network code of the UE.

[0041]

[0043] 3A-3D illustrate an example enhanced roaming system 300 having data flows for supporting bidirectional communication between 5G networks, according to some examples of the present disclosure. The example network environment of FIG. 3A-3D includes a 5G Access Network Provider (ANP) 302 (i.e., a visited network provider), a 5G Identity Provider (IDP) 304 (i.e., a home network provider), and a Domain Name System (DNS) 306 between the 5G ANP 302 and the 5G IDP 304. In some examples, the 5G ANP 302 includes a 5G NF 308, an SCP 310, a V-SEPP 312, and a firewall 314. Also, the 5G IDP 304 includes 5G NFs 316 and 318, an SCP 320, and an H-SEPP 322.

[0042]

[0044] In some examples, the 5G ANP 302 and the 5G IDP 304 may be an HPLMN and a VPLMN (or vice versa). The VPLMN is the PLMN to which the mobile subscriber roamed when leaving the HPLMN.

[0043]

[0045] According to some examples, the V-SEPP 312 and the H-SEPP 322 may be located at the edge of each network (e.g., the 5G ANP 302 and the 5G IDP 304, respectively) to provide border protection in the mobile core infrastructure network. The V-SEPP 312 and the H-SEPP 322 may also be configured to proxy messages from the network functions in the 5G ANP 302 (e.g., the 5G NF 308) to the network functions in the 5G IDP 304 (e.g., the 5G NFs 316 and 318) or vice versa. Information may be exchanged between the NFs of both the 5G ANP 302 and the 5G IDP 304 as follows:

[0044]

[0046] As shown in FIG. 3A, the 5G IDP 304 can configure a record to point to the SEPP in step 324. The 5G ANP 302 also allows outbound ports from the SEPP in step 326. In some examples, the 5G NP 308 sends an http / 2 request to the SCP 310 in step 328, which then forwards it to the V-SEPP 312 in step 332. The SCP 310 also establishes a routing policy for all initiating requests toward a particular SEPP instance in step 330. In step 334, the V-SEPP 312 sends a DNS query to the DNS 306, which then sends back a DNS response in step 336. Next, TLS is established between the V-SEPP 312 and the H-SEPP 322 in step 338, for example using the Wireless Broadband Alliance (WBA) Public Key Infrastructure (PKI).

[0045]

[0047] FIG. 3B is a continuation diagram from FIG. 3A. More specifically, FIG. 3B illustrates the setup process of WebSocket-based N32-f. N32-f is a transport interface between SEPPs that can be used to transport communications between, for example, an access provider's network function (e.g., 5GNF 308 of 5G ANP 302) and an identity provider's network function (e.g., 5GNFs 316 and 318 of 5G IDP 304). In some examples, the WebSocket of the present disclosure is a communication protocol that can provide a communication channel over a single TCP connection and thus enable two-way interactive communications (i.e., bidirectional communications) between the 5GNFs 221, 222, and 223 of the visited network provider 210 and the 5GNFs 241, 242, and 243 of the home network provider 230 via two SEPPs (e.g., V-SEPP 312 and H-SEPP 322).

[0046]

[0048] In step 340, V-SEPP312 sends an HTTPget request to H-SEPP322, which then returns an HTTP101 response. A WebSocket is established between V-SEPP312 and H-SEPP322 in step 342 as follows. In step 344, V-SEPP312 can send a subscription request to H-SEPP322 via the N32-f service. If the subscription request is rejected, in step 346, H-SEPP322 sends a subscription rejection message to V-SEPP312 via the N32-f service. In some cases, the subscription rejection message may include details of the problem. If the subscription request is accepted, in step 348, H-SEPP322 sends a subscription accept message to V-SEPP312 via the N-32-f service, and in step 350, SCP320 updates the routing information of 5G ANP302. A bidirectional N-32-f service may be established between V-SEPP 312 and H-SEPP 322 in step 352 as follows.

[0047]

[0049] FIG. 3C is a continuation diagram from FIG. 3B. More specifically, FIG. 3C shows the process of WebSocket-based N32-f service. In step 354, 5GNF308 of 5G ANP302 sends an http / 2 request to SCP310, which then forwards the http / 2 request to V-SEPP312. Upon receiving the http / 2 request, V-SEPP can encode the http / 2 request in JSON (JavaScript Object Notation) in step 354. In step 356, V-SEPP312 sends an N32-f message request to H-SEPP322 as follows. Upon receiving the request, H-SEPP322 can restore the JSON http / 2 request and send the http / 2 request to SCP320 in step 358, which then forwards the http / 2 request to 5GNF318. 5GNF318 then sends the http / 2 response to SCP320, which forwards the http / 2 response to H-SEPP322. H-SEPP322 encodes the http / 2 response in JSON and sends an N32-f message response to V-SEPP312 in step 360. In step 368, V-SEPP312 tracks responses from other networks. In step 370, V-SEPP312 recovers the JSON http / 2 response and forwards the response to SCP310, which then forwards the response to 5GNF308.

[0048]

[0050] Similar to steps 354-370, the 5G IDP 304 can utilize the same WebSocket-based N32-f since it supports bidirectional communication between SEPPs. The 5GNF 316 of the 5G IDP 304 can send the http / 2 request to the SCP 320. The 5G IDP 304 can select a SEPP instance using a routing policy in step 372 and forward the http / 2 request to the H-SEPP 322, which then encodes the http / 2 request in JSON. In step 374, the H-SEPP 322 can send an N32-f message request to the V-SEPP 312, which then recovers the JSON http / 2 request in step 376. The V-SEPP 312 can forward the recovered http / 2 request to the SCP 310, which then forwards the http / 2 request to the 5GNF 308. Upon receiving the request, 5GNF308 can send an http / 2 response to SCP310, which then forwards the http / 2 response to V-SEPP312. V-SEPP312 can encode the http / 2 response in JSON. In step 378, V-SEPP312 sends an N32-f message response to H-SEPP322. In step 380, H-SEPP322 restores the JSON http / 2 response and forwards the http / 2 response to SCP320, which then forwards the http / 2 response to 5GNF316 that originally requested the http / 2 request.

[0049]

[0051] FIG. 3D is a continuation view from FIG. 3C. More specifically, FIG. 3D illustrates the process of terminating the WebSocket-based N32-f. In step 382, ​​the V-SEPP 312 can check two conditions to determine whether the WebSocket-based N32-f can be terminated. First, the V-SEPP 312 determines that there is no outstanding subscription to the 5G NF of the 5G ANP 302. Also, the V-SEPP 312 determines that the timer has expired since the last transaction. If both conditions are met, in step 384, the V-SEPP 312 can send a termination request to the H-SEPP 322. Upon receiving the termination request, in step 386, the H-SEPP 322 can send a termination accept message to the V-SEPP 312. Also, the H-SEPP 322 requests the SCP 320 to remove the routing information of the 5G ANP 302 in step 388. The outbound TLS connection between V-SEPP 312 and H-SEPP 322 may be terminated in step 390 as follows.

[0050]

[0052] 4A-4D illustrate an example enhanced roaming system 400 having data flows for supporting bidirectional communication between a 4G network and a 5G network, according to some examples of the present disclosure. The example network environment of FIGs. 4A-4D includes a 4G ANP 402 (i.e., a visited network provider), a 5G IDP 404 (i.e., a home network provider), and a DNS 406 between the 4G ANP 402 and the 5G IDP 404. In some examples, the 4G ANP includes a NAS 408, a DRA 410, a V-DEA 412, and a firewall 414. Also, the 5G IDP 404 includes a H-DEA 416, a DRA 418, and an AAA server 420. Compared to the example flows of FIGs. 3A-D, the example flows of the enhanced roaming system 400 illustrated in FIGs. 4A-4D utilize the use of S6a services. In some examples, S6a is a diameter-based authentication application used by a Mobility Management Entity (MME) node to retrieve authentication information from a Home Subscriber Server (HSS).

[0051]

[0053] In some cases, the 4G ANP 402 and the 5G IDP 404 may be the HPLMN and the VPLMN (or vice versa). The VPLMN is the PLMN to which the mobile subscriber roamed when leaving the HPLMN.

[0052]

[0054] As shown in FIG. 4A, the 5G IDP 404 can configure a record to point to the DEA in step 422. The 4G ANP 402 also allows outbound ports from the DEA in step 424. In step 426, the NAS 408 sends a Diameter request to the DRA 410, which then forwards the Diameter request to the V-DEA 412. In step 428, the V-DEA 412 sends a DNS query to the DNS 406. Then, in step 430, the DNS 406 sends a DNS response to the V-DEA 412. Next, in step 432, TLS is established between the V-DEA 412 and the H-DEA 416, for example, using the PKI of the WBA.

[0053]

[0055] FIG. 4B is a continuation diagram from FIG. 4A. More specifically, FIG. 4B shows the setup process of WebSocket-based S6a-f. More specifically, procedure 400 includes the establishment of WebSocket between 4G ANP and 5G IDP. S6a-f is an interface that supports end-to-end diameter-based signaling between network functions (e.g., NAS 408 of 4G ANP 402 and AAA server 420 of 5G IDP 404). As mentioned above, WebSocket is a computer communication protocol that provides a communication channel over a single TCP connection, thus enabling two-way interactive communication (i.e., bidirectional communication) between two DEAs (e.g., V-DEA 412 and H-DEA 416).

[0054]

[0056] In step 434, the V-DEA 412 sends an HTTP get request to the H-DEA 416, which then sends back an HTTP 101 response in step 436. Next, in step 438, a WebSocket is established between the V-DEA 412 and the H-DEA 416.

[0055]

[0057] In step 440, the V-DEA 412 can send a subscription request to the H-DEA 416 via the S6a service. The subscription request includes a Diameter origin host and realm identifier for the NAS 408 of the 4G ANP 402. If the subscription request is rejected, in step 442, the H-DEA 416 sends a subscription reject message to the V-DEA 412 via the S6a service. In some cases, the subscription reject message may include details of the problem. If the subscription request is accepted, in step 444, the H-DEA 416 sends a subscription accept message to the V-DEA 412 via the S6a service. Also, in step 446, the H-DEA 416 updates the routing information of the Diameter origin host and realm identifier of the NAS 408 of the 4G ANP 402 in the DRA 418. Next, in step 448, bidirectional S6a-f services are established between the V-DEA 412 and the H-DEA 416.

[0056]

[0058] 4B further illustrates the capability exchange process of the WebSocket-based S6a service. In step 450, the V-DEA can generate a diameter capability exchange request. In step 452, the V-DEA 412 can send an S6a message request to the H-DEA 416, which then decodes the diameter capability exchange request and generates an answer in step 454. The H-DEA 416 sends a diameter capability exchange answer to the V-DEA 412 in step 456. In step 458, the V-DEA decodes the diameter capability exchange answer.

[0057]

[0059] FIG. 4C is a continuation diagram from FIG. 4B. Specifically, FIG. 4C shows the process of the WebSocket-based S6a forwarding service. In step 460, the NAS 408 sends a diameter credential request to the DRA 410, which then forwards the diameter credential request to the V-DEA 412. The V-DEA 412 encodes the diameter credential request in JSON. In step 462, the V-DEA 412 sends an N32f message request to the H-DEA 416. In step 464, the H-DEA 416 recovers the diameter request from the JSON and sends a diameter credential request to the DRA 418, which then forwards the diameter credential request to the AAA server 420. Upon receiving the request, the AAA server 420 sends the diameter authentication information answer to the DRA 418, which then forwards the diameter authentication information answer to the H-DEA 416. The H-DEA 416 then encodes the diameter authentication information answer in JSON. In step 466, the H-DEA 416 sends an S6a message response to the V-DEA 412. In step 468, the V-DEA 412 recovers the diameter authentication information answer from the JSON and sends the diameter authentication information answer to the DRA 410, which then forwards the diameter authentication information answer to the NAS 408. The UE is authenticated in step 470 as follows:

[0058]

[0060] Further, in step 472, NAS 408 can send a diameter location update request to DRA 410, which then forwards the diameter location update request to V-DEA 412. V-DEA 412 sends an N32f message request to H-DEA 416. The diameter location request is distributed to AAA server 420 from H-DEA 416 to DRA 418 and AAA server 420. Upon receiving the request, AAA server 420 sends a diameter location update answer to DRA 418, which then forwards the diameter location update answer to H-DEA 416. H-DEA 416 sends an S6a message response to V-DEA 412. In step 474, V-DEA 412 can track the location update procedure on a "per UE" basis. In step 476, the V-DEA 412 may send a diameter location update answer to the DRA 410, which then forwards the diameter location update answer to the NAS 408.

[0059]

[0061] According to some implementations, in step 478, the AAA server 420 of the 5G IDP 404 can send a diameter location cancellation request to the DRA 418. The 5G IDP 404 selects a DEA instance using a routing policy in step 480. In step 482, the DRA 418 sends a diameter location cancellation request to the H-DEA 416. The H-DEA 416 sends an S6a message request to the V-DEA 412. The V-DEA 412 sends a diameter location cancellation request to the DRA 410, which then forwards the diameter location cancellation request to the NAS 408, as follows: The NAS 408 sends a diameter location cancellation answer to the DRA 410, which then forwards the diameter location cancellation answer to the V-DEA 412. In step 484, the V-DEA 412 removes the UE from tracking. In step 486, the V-DEA 412 sends an S6a message response to the H-DEA 416. The H-DEA 416 sends a diameter location cancel answer to the DRA 418, which then forwards the diameter location cancel answer to the AAA server 420.

[0060]

[0062] FIG. 4D is a continuation diagram from FIG. 4C. Specifically, FIG. 4D illustrates the termination process of WebSocket-based S6a-f. In step 488, the V-DEA 412 can check two conditions to determine whether the WebSocket-based S6a-f can be terminated. First, the V-DEA 412 determines that there are no active UEs (e.g., no outstanding registrations) from the HPLMN (e.g., the PLMN of the 5G IDP 404). Also, the V-DEA 412 determines that a timer has expired since the last transaction. If both conditions are met, in step 490, the V-DEA 412 can send a termination request to the H-DEA 416 via the S6a service. Upon receiving the termination request, in step 492, the H-DEA 416 sends a termination accept message to the V-DEA 412 via the S6a service. In step 494, the H-DEA 416 removes the routing information of the 4G ANP 402. The outbound TLS connection between the V-DEA 412 and the H-DEA 416 may be terminated in step 496 as follows.

[0061]

[0063] 5 illustrates a flowchart of a method 500 for supporting bidirectional inter-SEPP communication according to some examples of the present disclosure. Although the example method 500 illustrates a particular order of operations, this order may be changed without departing from the scope of the present disclosure. For example, some of the illustrated operations may be performed in parallel or in a different order without substantially affecting the functionality of the method 500. In other examples, different components of an example device or system implementing the method 500 may perform functions substantially simultaneously or in a particular order.

[0062]

[0064] At step 510, the method 500 includes receiving a subscription request from a user device to operate on (register with) a visited private network. For example, the enhanced roaming systems 300 and 400 as shown in Figures 3-4, respectively, can receive a subscription request from a user device to register with and operate on a visited private network (e.g., the 5G ANP 302 as shown in Figure 3, or the 4G ANP 402 as shown in Figure 4).

[0063]

[0065] In some cases, the visited private network may include an edge protection provider, such as a SEPP or DEA (eg, V-SEPP 312 as shown in FIG. 3, or V-DEA 412 as shown in FIG. 4).

[0064]

[0066] At step 520, the method 500 includes determining that the user device is from a home network (e.g., a home private network). For example, the enhanced roaming systems 300 and 400, as shown in Figures 3-4, respectively, can determine that the user device is from a home network (e.g., the 5G IDP 304 as shown in Figure 3, or the 5G IDP 404 as shown in Figure 4).

[0065]

[0067] At step 530, the method 500 includes establishing a communication protocol between the home network and the visited network (e.g., the visited private network). The communication protocol may enable bidirectional exchange of roaming signals between the visited private network and the home network during subscription of the user device to the visited private network across a firewall, such as firewall 314 and / or firewall 414. In some cases, the term "WebSocket" is used to refer to the communication protocol that enables bidirectional exchange of roaming signals.

[0066]

[0068] For example, the extended roaming systems 300 and 400 shown in Figures 3-4, respectively, can establish a communication protocol between a 5G ANP 302 and a 5G IDP 304 as shown in Figure 3, or between a 4G ANP 402 and a 5G IDP 404 as shown in Figure 4.

[0067]

[0069] In some examples, once bidirectional forwarding services are established with the visited private network, the enhanced roaming system can signal the network function of the visited private network to ensure that PLMN-based routing decisions for home network-originated requests destined for the visited private network are routed via a SEPP or DEA. For example, the enhanced roaming system can rewrite a callback Uniform Resource Identifier (URI) signaled by the network function of the visited private network and received in a signaling message by the security edge protection proxy of the home network to a URI that resolves to the security edge protection proxy of the home network. Additionally, the enhanced roaming system can recover Diameter origin host and origin realm information from the subscription request and update routing information in the home network to enable routing of server-initiated messages originating within the home network destined for the visited private network.

[0068]

[0070] In some cases, once a two-way forwarding service is established with the home network, the enhanced roaming system may be operable to intercept response OK messages to subscribe and unsubscribe request messages via the home network.

[0069]

[0071] At step 540, the method 500 includes determining whether an outstanding subscription exists. For example, the enhanced roaming systems 300 and 400, as shown in Figures 3-4, respectively, can determine whether an outstanding subscription exists to a visited private network (e.g., the 5G ANP 302 as shown in Figure 3, or the 4G ANP 402 as shown in Figure 4).

[0070]

[0072] In some examples, the extended roaming system may have a counter of outstanding subscriptions between the VPLMN and the HPLMN (e.g., the 5G ANP 302 and the 5G IDP 304 as shown in FIGS. 3A-3D, or the 4G ANP 402 and the 5G IDP 404 as shown in FIGS. 4A-4D). For example, the extended roaming systems 300 and 400 as shown in FIGS. 3-4, respectively, may refer to the counter to determine whether there are outstanding subscriptions between the networks before terminating the bidirectional communication protocol between the networks. More specifically, the V-SEPP 312 as shown in FIGS. 3A-3D or the V-DEA 412 as shown in FIGS. 4A-4D may be extended with functionality to record the number of outstanding subscriptions to services of the 5G ANP 302 or the 4G ANP 402, respectively, and trigger a disconnect / termination if there are no outstanding subscriptions.

[0071]

[0073] If an outstanding subscription exists, the method 500 includes maintaining a two-way communication protocol at step 550. For example, the enhanced roaming systems 300 and 400 as shown in Figures 3-4, respectively, may maintain a two-way communication protocol between the 5G ANP 302 and the 5G IDP 304 as shown in Figure 3, or between the 4G ANP 402 and the 5G IDP 404 as shown in Figure 4.

[0072]

[0074] If there are no outstanding subscriptions, the method 500 includes determining whether a timer has expired, at step 560. For example, the enhanced roaming systems 300 and 400, as shown in Figures 3-4, respectively, may determine whether a timer has expired since a last transaction with the 5G ANP 302, as shown in Figure 3, or the 4G ANP 402, as shown in Figure 4.

[0073]

[0075] If the timer has not expired, the method 500 includes maintaining a two-way communication protocol at step 550. For example, the enhanced roaming systems 300 and 400 as shown in Figures 3-4, respectively, may maintain a two-way communication protocol between the 5G ANP 302 and the 5G IDP 304 as shown in Figure 3, or between the 4G ANP 402 and the 5G IDP 404 as shown in Figure 4.

[0074]

[0076] If the timer has expired, the method 500 includes terminating the two-way communication protocol at step 570. For example, the enhanced roaming systems 300 and 400 as shown in Figures 3-4, respectively, terminate the two-way communication protocol between the 5G ANP 302 and the 5G IDP 304 as shown in Figure 3, or between the 4G ANP 402 and the 5G IDP 404 as shown in Figure 4.

[0075]

[0077] More specifically, if there are no outstanding subscriptions and a timer has expired since the last transaction (e.g., the last response received by the visited private network or the home network), the enhanced roaming system may terminate the two-way communication protocol. For example, the enhanced roaming systems 300 and 400 as shown in Figures 3-4, respectively, may terminate the two-way communication protocol between the 5G ANP 302 and the 5G IDP 304 as shown in Figure 3, or between the 4G ANP 402 and the 5G IDP 404 as shown in Figure 4, if there are no outstanding subscriptions and a timer has expired.

[0076]

[0078] Further, the method 500 includes signaling the SCP of the home network to update the routing information when the two-way communication protocol ends. For example, the enhanced roaming systems 300 and 400, as shown in Figures 3-4, respectively, can signal the SCP 310 of the 5G ANP 302, as shown in Figures 3A-3D, to update the routing information when the two-way forwarding instance with the 5G IDP 304 ends.

[0077]

[0079] According to some implementations, information exchanged by WebSockets can mimic information exchanged using established N32-c signaling as defined in 3GPP 29.573, however, instead of establishing a unidirectional N32-f instance, the enhanced roaming system of the present disclosure establishes a bidirectional N32-f forwarding instance.

[0078]

[0080] FIG. 6 illustrates an exemplary network device 600 suitable for performing switching, routing, load balancing, and other networking operations. The network device 600 includes a central processing unit (CPU) 604, an interface 602, and a bus 610 (e.g., a PCI bus). When operating under the control of appropriate software or firmware, the CPU 604 is responsible for performing packet management, error detection, and / or routing functions. The CPU 604 accomplishes all of these functions preferably under the control of software, including an operating system and any appropriate application software. The CPU 604 may include one or more processors 608, such as a processor from the INTEL X86 family of microprocessors. In some cases, the processor 608 may be hardware specifically designed to control the operation of the network device 600. In some cases, the memory 606 (e.g., non-volatile RAM, ROM, etc.) also forms part of the CPU 604. However, there are many different ways in which memory may be coupled to the system.

[0079]

[0081] The interfaces 602 are typically provided as modular interface cards (sometimes called "line cards"). In general, they control the transmission and reception of data packets over a network and sometimes support other peripherals used with the network device 600. Among the interfaces that may be provided are Ethernet interfaces, Frame Relay interfaces, cable interfaces, DSL interfaces, Token Ring interfaces, etc. Additionally, various super-speed interfaces may be provided, such as high-speed Token Ring interfaces, wireless interfaces, Ethernet interfaces, Gigabit Ethernet interfaces, ATM interfaces, HSSI interfaces, POS interfaces, FDDI interfaces, WIFI interfaces, 3G / 4G / 5G cellular interfaces, CAN BUS, LoRA, etc. In general, these interfaces may include ports appropriate for communication with an appropriate medium. In some cases, they may also include a separate processor, and in some cases volatile RAM. The separate processor may control communication-intensive tasks such as packet switching, media control, signal processing, cryptography, and management. By providing separate processors for communication-intensive tasks, these interfaces allow the master CPU 604 to efficiently perform routing calculations, network diagnostics, security functions, etc.

[0080]

[0082] 6 is one illustrative network device of the present technology, but is by no means the only network device architecture in which the present technology can be implemented. For example, architectures with a single processor that handles communications and routing calculations, etc. are often used. Additionally, other types of interfaces and media may be used in network device 600.

[0081]

[0083] Regardless of the configuration of the network device, it may employ one or more memories or memory modules (including memory 606) configured to store program instructions for general network operations and mechanisms for roaming, route optimization, and routing functions described herein. The program instructions may, for example, control the operation of an operating system and / or one or more applications. The one or more memories may also be configured to store tables, such as mobility binding, registration, and association tables. The memory 606 may also hold various software containers and virtualization execution environments and data.

[0082]

[0084] Network device 600 may also include application specific integrated circuits (ASICs), which may be configured to perform routing and / or switching operations. The ASICs may communicate with other components in network device 600 via bus 610 to exchange data and signals and to coordinate various types of operations, such as routing, switching, and / or data storage operations, by network device 600.

[0083]

[0085] 7 illustrates an exemplary computing system 700 including components in electronic communication with each other using connections 705 in which one or more aspects of the present disclosure may be implemented. The connections 705 may be physical connections via a bus or direct connections to a processor 710, such as in a chipset architecture. The connections 705 may also be virtual, networked, or logical connections.

[0084]

[0086] In some embodiments, computing system 700 is a distributed system in which the functions described in this disclosure may be distributed among a data center, multiple data centers, a peer network, etc. In some embodiments, one or more of the system components described represent multiple such components, each performing some or all of the functions for which the component is described. In some embodiments, a component may be a physical or virtual device.

[0085]

[0087] The exemplary system 700 includes at least one processing unit (CPU or processor) 710 and connections 705 coupling various system components to the processor 710, including system memory 715, such as read only memory (ROM) 720 and random access memory (RAM) 725. The computing system 700 may include a cache 712 of high-speed memory either directly or closely connected to the processor 710, or incorporated as part of the processor 710.

[0086]

[0088] Processor 710 may include any general purpose processor, hardware or software services, such as services 732, 734, and 736 stored in storage device 730, configured to control processor 710, and special purpose processors where software instructions are embedded into the actual processor design. Processor 710 may essentially be a completely self-contained computing system including multiple cores or processors, buses, memory controllers, caches, etc. Multi-core processors may be symmetric or asymmetric.

[0087]

[0089] To enable user interaction, the computing system 700 includes input devices 745, which may represent any number of input mechanisms, such as a microphone for speech, a touch screen for gesture or graphical input, a keyboard, a mouse, motion input, speech, etc. The computing system 700 may also include output devices 735, which may be one or more of a number of output mechanisms known to those skilled in the art. In some cases, a multimodal system may allow a user to provide multiple types of input / output to communicate with the computing system 700. The computing system 700 may also include a communication interface 740, which may generally control and manage user input and system output. There is no constraint on operating with a particular hardware arrangement, and therefore the basic features herein may be easily replaced as improved hardware or firmware arrangements are developed.

[0088]

[0090] Storage device 730 may be a non-volatile memory device or may be a hard disk or other type of computer-readable medium capable of storing data accessible by a computer, such as a magnetic cassette, a flash memory card, a solid-state memory device, a digital versatile disk, a cartridge, a random access memory (RAM), a read-only memory (ROM), and / or any combination of these devices.

[0089]

[0091] Storage device 730 may include software services, servers, services, etc., where code defining such software, when executed by processor 710, causes the system to perform a function. In some embodiments, hardware services that perform a particular function may include software components stored in a computer-readable medium in association with the necessary hardware components, such as processor 710, connections 705, output devices 735, etc., to perform the function.

[0090]

[0092] For clarity of explanation, in some cases, the technology may be presented as including individual functional blocks, including devices, device components, steps or routines in a software-implemented method, or functional blocks including a combination of hardware and software.

[0091]

[0093] In summary, a system, method, and computer-readable medium are disclosed for facilitating bidirectional edge proxy-to-edge proxy communication across an enterprise firewall in a 5G service-based architecture. In an aspect, the method includes receiving a subscription request from a user device to operate on a visited private network, determining that the user device is associated with a home network, and establishing a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, the communication protocol enabling exchange of bidirectional roaming signals between the visited private network and the home network while the user device is operating on the visited private network.

[0092]

[0094] Any of the steps, operations, functions, or processes described herein may be performed or implemented by hardware and software services or a combination of services, alone or in combination with other devices. In some embodiments, a service may be software that resides in memory of one or more servers of a client device and / or a content management system and performs one or more functions when a processor executes the software associated with the service. In some embodiments, a service is a program or group of programs that perform a particular function. In some embodiments, a service may be considered a server. Memory may be a non-transitory computer-readable medium.

[0093]

[0095] In some embodiments, computer readable storage devices, media, and memories may include cable or wireless signals containing bit streams, etc. However, when referred to, non-transitory computer readable storage media explicitly excludes media such as energy, carrier signals, electromagnetic waves, and the signals themselves.

[0094]

[0096] Methods according to the above examples can be implemented using computer-executable instructions stored or otherwise available from a computer-readable medium. Such instructions may include, for example, instructions and data that cause a general-purpose computer, a special-purpose computer, or a special-purpose processing device to perform a particular function or group of functions, or that otherwise configure a general-purpose computer, a special-purpose computer, or a special-purpose processing device to perform a particular function or group of functions. Some of the computer resources used may be accessible over a network. The computer-executable instructions may be, for example, binaries, intermediate format instructions such as assembly language, firmware, or source code. Examples of computer-readable media that may be used to store instructions, information used, and / or information created during methods according to the described examples include magnetic or optical disks, solid-state memory devices, flash memories, USB devices with non-volatile memory, networked storage devices, and the like.

[0095]

[0097] Devices implementing methods according to these disclosures may include hardware, firmware, and / or software and may adopt any of a variety of form factors. Typical examples of such form factors include servers, laptops, smart phones, small form factor personal computers, personal digital assistants, etc. The functionality described herein may also be embodied in peripherals or add-in cards. Such functionality may also be implemented on a circuit board among different chips or different processes executed on a single device, as further examples.

[0096]

[0098] The instructions, media for carrying such instructions, computing resources for executing them, and other structures for supporting such computing resources are means for providing the functionality described in these disclosures.

[0097]

[0099] Although aspects within the appended claims have been described using various examples and other information, no limitation of the claims based on the specific features or arrangements of such examples should be implied, as those skilled in the art may use these examples to derive a wide variety of implementations. Moreover, while certain subject matter may have been described in language specific to example structural features and / or method steps, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to these described features or acts. For example, such functionality may be distributed differently or performed in other components than those identified herein. Rather, the described features and steps are disclosed as example components of systems and methods within the appended claims.

[0098]

[0100] Claim language or other language stating "at least one of" a set and / or "one or more" of a set indicates that one member of a set or multiple members of a set (in any combination) satisfy a claim. For example, claim language stating "at least one of A and B" or "at least one of A or B" means A, B, or A and B. In another example, claim language stating "at least one of A, B, and C" or "at least one of A, B, or C" means A, B, C, or A and B, or A and C, or B and C, or A and B and C. The language stating "at least one of" a set and / or "one or more" of a set does not limit the set to the items listed in the set. For example, claim language stating "at least one of A and B" or "at least one of A or B" may mean A, B, or A and B, and may further include items not listed in the set of A and B.

Claims

1. receiving a subscription request from a user device to operate on a visited private network; determining that the user device is associated with a home network; establishing a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, the communication protocol enabling bidirectional exchange of roaming signals between the visited private network and the home network while a user device is operating on the visited private network; A method comprising:

2. 2. The method of claim 1, further comprising: rewriting a callback Uniform Resource Identifier (URI) signaled by a network function of the visited private network and received by the security edge protection proxy of the home network to a URI that resolves to the security edge protection proxy of the home network.

3. 3. The method of claim 1 or 2, further comprising recovering Diameter origin host and origin information from the subscription request and updating routing information in the home network to enable routing of server-initiated messages originated in the home network towards the visited private network.

4. determining that a subscription of the user device to the visited private network has terminated; terminating the communication protocol between the security edge protection proxy of the home network and the security edge protection proxy of the visited private network; The method of any one of claims 1 to 3, further comprising:

5. determining that a timer has expired, the timer defining a period of the communication protocol; upon determining that the timer has expired, terminating the communication protocol between the home network and the visited private network; and The method of any one of claims 1 to 4, further comprising:

6. The method according to any one of claims 1 to 5, wherein when the visited private network is a private 5G network, a bidirectional N32 interface is used to transfer signals between the visited private network and the home network according to the communication protocol.

7. The method according to any one of claims 1 to 6, wherein if the visited private network is a private LTE network, an S6a interface is used to transfer signals between the visited private network and the home network according to the communication protocol.

8. determining that there is at least one outstanding subscription to the visited private network, the outstanding subscription being for a second user device associated with the home network; maintaining the communication protocol between the security edge protection proxy of the home network and the security edge protection proxy of the visited private network while the at least one outstanding subscription is valid; The method of any one of claims 1 to 7, further comprising:

9. one or more memories storing computer readable instructions; Executing the computer readable instructions, receiving a subscription request from a user device to operate on a visited private network; determining that the user device is associated with a home network; establishing a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, the communication protocol enabling bidirectional exchange of roaming signals between the visited private network and the home network while a user device is operating on the visited private network; one or more processors configured to: Network components, including:

10. 10. The network component of claim 9, wherein the one or more processors are further configured to execute the computer-readable instructions to rewrite a callback Uniform Resource Identifier (URI) signaled by a network function of the visited private network and received by the security edge protected proxy of the home network to a URI that resolves to the security edge protected proxy of the home network.

11. 11. The network component of claim 9 or 10, wherein the one or more processors are further configured to execute the computer-readable instructions to recover Diameter origin host and origin information from the subscription request and to update routing information in the home network to enable routing of server-initiated messages originated in the home network toward the visited private network.

12. The one or more processors execute the computer readable instructions to determining that a subscription of the user device to the visited private network has terminated; terminating the communication protocol between the security edge protection proxy of the home network and the security edge protection proxy of the visited private network; The network component according to any one of claims 9 to 11, further configured to:

13. The one or more processors execute the computer readable instructions to determining that a timer has expired, the timer defining a period of the communication protocol; upon determining that the timer has expired, terminating the communication protocol between the home network and the visited private network; and The network component according to any one of claims 9 to 12, further configured to:

14. When the visited private network is a private 5G network, using a bidirectional N32 interface to transfer signals between the visited private network and the home network according to the communication protocol; A network component according to any one of claims 9 to 13, further comprising an S6a interface for transferring signals between the visited private network and the home network according to the communication protocol, if the visited private network is a private LTE network.

15. One or more non-transitory computer-readable media containing computer-readable instructions that, when executed by one or more processors of a network component, cause the network component to: receiving a subscription request from a user device to operate on a visited private network; determining that the user device is associated with a home network; establishing a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, the communication protocol enabling bidirectional exchange of roaming signals between the visited private network and the home network while a user device is operating on the visited private network; One or more non-transitory computer-readable media that cause

16. 16. The one or more non-transitory computer-readable media of claim 15, wherein the execution of the computer-readable instructions by the one or more processors further causes the one or more processors to rewrite a callback Uniform Resource Identifier (URI) signaled by a network function of the visited private network and received by the security edge protected proxy of the home network to a URI that resolves to the security edge protected proxy of the home network.

17. 17. The one or more non-transitory computer-readable media of claim 15 or 16, wherein the execution of the computer-readable instructions by the one or more processors further causes the one or more processors to recover Diameter origin host and origin information from the subscription request and update routing information in the home network to enable routing of server-initiated messages originated in the home network toward the visited private network.

18. said execution of said computer readable instructions by said one or more processors further comprising: determining that a subscription of the user device to the visited private network has terminated; terminating the communication protocol between the security edge protection proxy of the home network and the security edge protection proxy of the visited private network; 18. The one or more non-transitory computer-readable media of claim 15, further causing the one or more processors to:

19. said execution of said computer readable instructions by said one or more processors further comprising: determining that a timer has expired, the timer defining a period of the communication protocol; upon determining that the timer has expired, terminating the communication protocol between the home network and the visited private network; and 19. The one or more non-transitory computer-readable media of claim 15, further causing the one or more processors to:

20. When the visited private network is a private 5G network, using a bidirectional N32 interface to transfer signals between the visited private network and the home network according to the communication protocol; 20. The one or more non-transitory computer-readable media of any one of claims 15 to 19, wherein if the visited private network is a private LTE network, an S6a interface is used to transfer signals between the visited private network and the home network according to the communication protocol.

21. means for receiving, from a user device, a subscription request to operate on a visited private network; means for determining that the user device is associated with a home network; means for establishing a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network; Including, The apparatus, wherein the communication protocol enables bidirectional exchange of roaming signals between the visited private network and the home network while a user device is operating on the visited private network.

22. Apparatus according to claim 21, further comprising means for carrying out the method according to any one of claims 2 to 8.

23. A computer program, computer program product or computer readable medium comprising instructions which, when executed by a computer, cause the computer to carry out the steps of the method according to any one of claims 1 to 8.

Images