Geofenced In-Band MEC Customer Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile edge computing (MEC) customer management lacks secure and cost-effective methods for enterprise customers to manage their services, as existing solutions often rely on out-of-band provisioning and traverse the public internet, which is insecure and costly.
Innovation Solution
Implementing geofenced in-band customer management for MEC services using a private access point name (APN) that connects directly to the MEC operations center through the mobile network, avoiding the public internet and utilizing tracking area codes to secure and manage MEC services within the customer premises.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If out-of-band provisioning is used for MEC customer management, then service management capability is provided, but security is compromised and operational costs increase
Solution Approach 1:
The patent merges the management plane and user plane into a single in-band communication channel over the 5G air interface. This consolidation eliminates the need for separate out-of-band provisioning systems, reducing overall system complexity while improving security by keeping all management traffic within the encrypted 5G network infrastructure.
Solution Approach 2:
The patent introduces a service management function (SMF) as an intermediary that handles customer management operations through the 5G core network. This mediator enables secure in-band management by routing all management traffic through authenticated 5G network paths, eliminating direct public internet exposure while maintaining full management capability.
2Ease of operation
If management traffic traverses the public internet, then accessibility is improved, but security risks and operational costs increase
Solution Approach 1:
The 5G air interface is designed to serve multiple functions simultaneously: it carries both user data traffic and service management traffic through the same encrypted channel. This multi-functionality maintains full management accessibility while eliminating the need for separate public internet paths, as the 5G network itself provides universal access to both data and management planes.
Solution Approach 2:
The patent creates a secure managed environment by confining all management traffic within the encrypted 5G network infrastructure. This 'inert atmosphere' isolates management operations from the public internet, preventing external attacks while maintaining full operational accessibility through authenticated 5G connections.
3Reliability
If geofenced in-band management is implemented, then security and cost-effectiveness are improved, but system complexity increases
Solution Approach 1:
The patent implements dynamic geofencing capabilities where service management access is automatically enabled or disabled based on the user equipment's real-time location relative to configured geographic boundaries. This dynamic approach simplifies network configuration by replacing complex static access control rules with location-based automatic authorization, reducing the burden on network operators while maintaining high security.
Solution Approach 2:
The system enables self-service geofenced management where customer premises automatically receive appropriate management access based on their registered location. The network autonomously enforces geofencing policies without requiring manual configuration for each customer, reducing operational complexity while providing secure location-based access control.
4Reliability
If tracking area codes are used for geofencing, then location-based security is achieved, but signaling overhead increases
Solution Approach 1:
The patent applies geofencing selectively only to service management traffic rather than all network communications. By partially applying location-based restrictions only where needed for security, the system achieves location-based security for critical operations while minimizing unnecessary signaling overhead for regular data traffic.
Solution Approach 2:
The system performs preliminary geofence validation during the initial 5G attachment and registration phases. By pre-establishing location-based authorization before service activation, the system avoids continuous location verification signaling, reducing overall signaling overhead while maintaining security. The tracking area code checks are performed once during setup rather than continuously during operation.
Data Source
AI summary
A mobile edge computing (MEC) service area can comprise radio cells/antennas connected to baseband units that are connected to service gateway (SGW) and/or packet data network gateway (PGW) user planes at a customer premises. The radio cells can be tagged with evolved universal mobile telecommunications system terrestrial radio access (E-UTRAN) cell global identifiers (EGCIs) offering traceability to user equipment (UE) that camp on them. The radio cells for MEC can be assigned tracking area codes (TACs) such that when a UE is registered and provisioned for a MEC service area based on an international mobile subscriber identity (IMSI) assigned to a subscriber identity module (SIM) of the UE, the UE can be determined to be at a geofenced area.