IMS Roaming Service Policy Enforcement via Pre-Encryption DPI
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The S8 Home Routed (S8HR) VoLTE roaming architecture lacks service awareness for visited public mobile networks (VPMN), limiting roaming policies and service enforcement due to reliance on IMSI and encrypted IMS transactions, which are insufficient for implementing comprehensive roaming agreements.
Innovation Solution
Implementing roaming profiles and policies based on identifiers and service requests within the home public mobile network (HPMN) to control service access for roaming stations, using Diameter and SIP messaging to determine and enforce allowed services, and involving Application Servers for subscriber-aware decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If S8 Home Routed architecture is used, then roaming call routing is simplified through centralized HPMN control, but service awareness at VPMN level is lost due to encrypted IMS transactions
Solution Approach 1:
The VPMN performs DPI of SIP messages before encryption during the initial attachment phase, extracting service information (MBMS, CIoT, eMBMS capabilities) and storing it in a local database. This preliminary extraction of information before encryption occurs enables the VPMN to make service-aware routing decisions without requiring decryption of subsequent IMS transactions.
Solution Approach 2:
A local database acts as an intermediary between the encrypted IMS transactions and the VPMN's routing decisions. The database stores pre-extracted service information from SIP messages, allowing the VPMN to query service capabilities without directly accessing encrypted IMS traffic, thus maintaining both security and service awareness.
2Loss of information
If Deep Packet Inspection of encrypted IMS transactions is performed, then service awareness may be achieved, but reliability is compromised due to encryption
Solution Approach 1:
Service information is extracted from SIP messages before the IMS transactions become encrypted. The VPMN performs DPI on unencrypted SIP signaling during attachment, capturing service capabilities and storing them locally. This timing ensures both reliability of information extraction and maintains encryption security for subsequent transactions.
3Ease of manufacture
If roaming policies are based only on IMSI, APN, and QCI, then implementation is simple, but precision of roaming agreement enforcement is insufficient
Solution Approach 1:
The policy decision function is enhanced to evaluate multiple parameters simultaneously: traditional IMSI/APN/QCI information combined with newly extracted service capability information (MBMS, CIoT, eMBMS). This multi-functional approach allows a single policy engine to handle both simple connectivity decisions and complex service-specific roaming agreements, maintaining ease of implementation while increasing enforcement precision.
Solution Approach 2:
The policy enforcement parameters are expanded from basic connectivity identifiers (IMSI, APN, QCI) to include service capability parameters (MBMS support, CIoT support, eMBMS support). This parameter enrichment enables more precise matching of roaming agreements to specific service types while maintaining the same policy decision architecture.
Data Source
AI summary
A method including receiving, at a CSCF (Call Session Control Function) portion of a home network in which a mobile station is subscribed, an IMS (IP Multimedia Subsystem) registration request from the mobile station via a visited network to which the mobile station is attached; establishing an SIP (Session Initiation Protocol) session between the mobile station and the CSCF server in response to the received IMS registration request; receiving, at the CSCF server, a SIP INVITE message from the mobile station during the SIP session, wherein the SIP INVITE requests use of a service; obtaining an identifier for the visited network; obtaining, in response to receiving the SIP INVITE message, a first roaming policy based on the identifier for the visited network; determining whether the SIP INVITE message is acceptable based on the obtained first roaming policy and the service requested by the SIP INVITE message; and sending a response for the SIP INVITE message to the mobile station, wherein the response is based on the determination whether the SIP INVITE message is acceptable.