Wireless Credential Policy Enforcement for UE-Specific Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless user equipment (UE) with removable network credentials can lead to unauthorized access and mismatched Quality of Service (QoS) requirements, causing network load and user experience issues due to the same credentials being used across different UE types.
Innovation Solution
A UE-credential policy system (UCPS) enforces policies associating specific UEs with network credentials based on device identifiers, location, time, and traffic attributes, using AI/ML models to monitor and manage network monitoring information, and initiate remedial measures for policy violations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If removable SIM cards are allowed to be installed in different UEs, then device flexibility and ease of operation are improved, but network security and service quality deteriorate due to unauthorized access and mismatched QoS requirements
Solution Approach 1:
The system performs preliminary binding between UEs and network credentials before actual network access. The UCPS binds device identifiers (IMEI) with network credentials (SUPI) in advance, creating authorized UE-credential pairs. When a UE attempts to access the network, the system checks whether the current device-credential combination matches the pre-bound pairs, preventing unauthorized access before it can occur.
Solution Approach 2:
The system implements continuous monitoring and verification feedback loops. The UCPS monitors network access requests, verifies UE-credential bindings, and provides feedback to the core network about policy compliance. When violations are detected, the system sends notifications and remediation requests to restore policy compliance, creating a closed-loop control system that maintains network security.
2Adaptability or versatility
If the same network credentials are used across different UE types, then credential versatility is improved, but network load and service quality deteriorate due to mismatched QoS requirements
Solution Approach 1:
The system applies differentiated quality attributes to different UE-credential pairs based on their specific requirements. Instead of treating all credentials uniformly, the UCPS binds credentials with device-specific QoS profiles, device types, and service requirements. This allows the network to apply appropriate quality of service, pricing, and resource allocation policies tailored to each local context, preventing mismatched QoS from causing network load issues.
3Measurement precision
If AI/ML models are deployed for policy enforcement, then detection precision is improved, but device complexity and computational requirements increase
Solution Approach 1:
The patent introduces a dedicated intermediary component called the UE-credential policy system (UCPS) that acts as a mediator between UEs and the core network. This separate policy enforcement entity handles the complexity of AI/ML-based monitoring, binding verification, and violation detection, while presenting a simplified interface to both UEs and core network elements. The intermediary absorbs the computational complexity, preventing it from propagating to other system components.
Data Source
AI summary
A system described herein may maintain policy information associating a plurality of network credentials with respective device identifiers of User Equipment (“UEs”) that are authorized to use respective network credentials to access a network. The system may receive network monitoring information indicating that a particular UE, associated with a particular device identifier, is accessing the network using a particular network credential; compare the particular device identifier and the particular network credential to the policy information; determine, based on comparing the particular device identifier and the particular network credential to the policy information, that the particular UE is not authorized to use the particular network credential; and output a notification to the network that the particular UE is not authorized to use the particular network credential to access the network, wherein the network suspends the particular network credential based on the notification.