Method and apparatus for MOCN GW and X2 GW realizations for enterprise deployments

Systems and methods for a communications system architecture having a base station/access points, a multiple operator core Gateway/X2 Gateway, a plurality of Mobile Network Operator core networks and an enterprise core network are present. A first secure tunnel is provided for communicating user-plane traffic between the base station/access points and the multiple operator core Gateway/X2 Gateway. A second secure tunnel is provided for communicating control-plane traffic between the base station/access points and the enterprise core network. Additional secure tunnels are provided for communications between the multiple operator core Gateway/X2 Gateway and each Mobile Network Operator core.

BACKGROUND

(1) Technical Field

The disclosed method and apparatus generally relate to establishing a communication link to a communications network. In particular, the disclosed method and apparatus relate to assisting user equipment (UE) to communicate with a local enterprise network, one or more third party networks, and a Mobile Network Operator (MNO) network.

FIG.1shows a basic configuration for a communication network100, such as a “4G LTE” (fourth generation Long-Term Evolution) or “5G NR” (fifth generation New Radio) network, in which user equipment (UE)101communicates with a base station/access point (BS/AP)103. The term UE refers to a wide array of devices having wireless connectivity, such as a cellular mobile phone, Internet of Things (IoT) device, virtual reality googles, robotic device, autonomous driving machine, smart barcode scanner, and communications equipment. Communications equipment includes desktop computers, laptop computers, tablets and other types of personal communications devices.

Throughout this disclosure, the term BS/AP is used broadly to include at least an eNB (Evolved Node B or E-UTRAN Node B) of a 4G network or gNB (5G node B) of an LTE/5G network, a cellular base station (BS), a Citizens Broadband Radio Service Device (CBSD), a WiFi access node, a Local Area Network (LAN) access point, a Wide Area Network (WAN) access point, etc. and should also be understood to include other network receiving hubs that provide wireless access to a network via a plurality of wireless transceivers.

In some cases, a UE101uses a BS/AP103to gain access to a plurality of networks that in turn provide access of other devices and services. These networks may consist of public and enterprise networks. The industry standards that define 5G technology support both public networks and enterprise networks. Public networks include networks that are open to any subscriber, such as cellular networks. Enterprise networks are typically networks for which access is restricted to members of a particular organization or “enterprise”, thus the name. Network administrators typically determine whether a particular UE has access to the network. In many such cases, access is controlled by allowing only UEs to whom proper credentials have been provided by the network administrator. Often, the credentials comprise a digital code that is encrypted on a Subscriber Identification Module (SIM) card. The BS/AP103is coupled to a core network (hereafter “core”)105that manages traffic through the BS/AP103and connectivity (i.e., access) to resources, such as the internet107.

FIG.2is an illustration of a larger network204, such as a 5G cellular network operated by an MNO, sometimes referred to as a wireless service provider. Within the geographic operating area of the MNO network204, an enterprise network208may be established by a private network operator, such as an enterprise network operator (ENO). BS/APs103aof the MNO network204may service a plurality of UEs101. Each may be present within a coverage area of the MNO network204that operates on a first frequency f1. In some cases, the enterprise network208is located within the geographic footprint of the MNO network204. In such cases, one or more enterprise network BS/APs103may provide connectivity over a second frequency, f2to allow UEs101within the geographic footprint to access the enterprise network208.

In addition to MNOs and ENOs, Mobile Virtual Network Operators (MVNOs) provide a “virtual” network that uses both the BS/APs and the network infrastructure operated by MNOs to provide access for an MVNO subscriber UE (hereafter, simply referred to as a “MVNO UE”) to services. Still further, there are services that use an MNO BS/AP, but that route packets through that MNO BS/AP to their own network Evolved Packet Core (EPC). For the purposes of this disclosure, these networks are referred to as “Third-Party” (TP) networks. Throughout this disclosure, communications are discussed in which “packets” are “routed”, “transmitted” and “received”. However, packets are merely one example of communications and embodiments are not limited to packets, as communications may take other forms as well.

FIG.3shows a configuration in which a UE302within the coverage area of an MNO network can communicate with the MNO network and a TP network through an MNO BS/AP (i.e., eNB). Some TP networks305provide a communication service that allows their subscribers to establish a communication link to the TP network's infrastructure (e.g., an enterprise core network306, such as an enterprise EPC) through the physical radio infrastructure of another network (e.g., the MNO303). An architecture in which more than one core network (hereafter “core”)306,307can be accessed through the same BS/AP is commonly referred to as a Multi-Operator Core (MOCN). In some embodiments, the BS/AP is an eNB (Evolved Node B or alternatively E-UTRAN Node B)304. In such cases, a gateway, such as a MOCN gateway309, resides between the eNB304and one or more cores, each of which can be accessed by a UE302through the eNB304. The MOCN gateway directs packets that flow from the UE302through the eNB304to the appropriate core306. While only one such core306is shown, it should be understood that there may be other such cores as well. A TP network subscriber UE (hereafter, simply referred to as a “TP UE”)302within the coverage area of an MNO network303may be connected to the MNO eNB304. The MNO eNB304is part of the MNO network303; but is connected to the TP network305through the MOCN gateway309. Accordingly, the MNO eNB304can be used to connect the UE302to the TP network's EPC306.

FIG.4is a simplified block diagram of the components of an EPC, such as the MNO EPC307shown inFIG.3. The EPC307comprises an MME (Mobility Management Entity)402, SGW (Serving Gateway)404, at least one PGW (Packet Gateway)406, HSS (Home Subscriber Server)408, ePDG (evolved Packet Data Gateway)410, etc. The SGW routes UE302data packets to a Packet Data Network (PDN)412. Accordingly, the MNO EPC307can establish a connection to an outside PDN412and thus provide connectivity to the internet308or to other external services. That is, while the TP network305uses the MNO's eNB304, the TP network305provides its own EPC306to allow the TP network305to control data flows through the MNO's eNB304.

In most network architectures, secure communications between the BS/AP and each of the networks is important. For architectures in which there are several possible sources and destinations for communications to and from the BS/AP, there is a need for a method and apparatus to manage the information flows.

SUMMARY

Various embodiments of a communications system architecture are disclosed in which a user equipment (UE) can gain access to various networks through one more gateways and secure tunnels.

In a first embodiment of the disclosed communications system architecture, base station/access points (BS/APs), a multiple operator core Gateway/X2 Gateway (MGXG), a plurality of Mobile Network Operator (MNO) core networks (hereafter “MNO cores”) and an enterprise core network (hereafter “E-core”) are present. A first secure tunnel is provided for communicating user-plane traffic between the BS/APs and the MGXG. A second secure tunnel is provided for communicating control-plane traffic between the BS/APs and the E-core. Additional secure tunnels are provided for communications between the MGXG and each MNO core.

A second architecture is disclosed in which a third party core network (hereafter “TP core”) is accessible through the MGXG. Packets to be locally offloaded are detected at the BS/APs and communicated over an MNO secure tunnel between the B S/AP and the MGXG. The MGXG routes those offloaded packets to the TP core.

In a third disclosed architecture, a MGXG has an MOCN Gateway Module (MGM) and an integrated X2 Gateway Module (XGM). The XGM performs X2 mobility functional for both the MNO network traffic and for the enterprise network traffic.

A fourth architecture has at least one TP core with which the MGXG can communicate Local Traffic Offload (LTO) traffic. The MGM in the MGXG determines whether packets are LTO traffic and sends them to a portal of the MGXG that accesses a secure tunnel to the TP core.

A fifth architecture is disclosed in which X2 mobility functionality for an enterprise network is provided by an XGM within an E-core with an Integrated X2 GW (ECXG). In this architecture, a separate secure tunnel is not required for enterprise network X2 mobility traffic. Rather, such traffic is communicated through the same secure tunnel between the BS/AP and the E-core that is used to communicate control-plane traffic and user-plane traffic between the BS/AP and the E-core. Since the X2 mobility functionality is performed by the XGM within the E-core, no additional secure tunnel is necessary to perform all desired X2 mobility functions.

In a sixth architecture, a discrete Unified X2 Gateway (UXG) is provided independent of the cores to perform X2 mobility functions, thus simplifying the MOCN GW and E-core (which, accordingly, do not have to perform such X2 mobility functions). The UXG performs the X2 mobility functions for both the MNO network and the enterprise network.

In a seventh architecture, an MNO X2 GW (MXG) is provided for mobility functionality related to the MNO network traffic. Mobility functionality related to the enterprise network traffic is managed by an X2 GW integrated into an ECXG.

In an eighth architecture, a UXG manages and coordinates X2 functionality for both an MNO network and an enterprise network and each BS/AP has an MNO Secure Tunnel (MST) for MNO traffic and an Enterprise Secure Tunnel (EST) for enterprise traffic to and from the BS/AP.

The figures are not intended to be exhaustive or to limit the claimed invention to the precise form disclosed. It should be understood that the disclosed method and apparatus can be practiced with modification and alteration, and that the invention should be limited only by the claims and the equivalents thereof.

DETAILED DESCRIPTION

FIG.5is an illustration of an architecture500in accordance with one embodiment of the disclosed method and apparatus. The architecture500comprises several components, including base station/access points (BS/APs)502a,502b, a multiple operator core (MOCN) Gateway (GW)/X2 GW504, one or more Mobile Network Operator (MNO) cores506(hereafter referred to simply as the “MNO core”) and an enterprise core508(hereafter referred to simply as the “E-core”).

Secure tunnels510,512,514,516allow secure communication to be established between components502,504,506,508of the architecture500, as will be discussed in detail below. An MNO (also known as a wireless service provider, wireless carrier, cellular company, or mobile network carrier) is a provider of wireless communications services that owns or controls all the elements necessary to sell and deliver services to an end user including radio spectrum allocation, wireless network infrastructure (including an MNO core), back haul infrastructure, billing, customer care, provisioning computer systems (which may reside in the MNO core) and marketing and repair organizations.

It should be noted that throughout this disclosure, reference indicators used in the figures may include numeric characters followed by an alphabetic character, such as502ain which the numeric characters “502” are followed by the alphabetic character “a”. Reference indicators having the same numeric characters refer to features of the figures that are similar in their function. For example, the MNO cores506a,506bperform similar functions, however each MNO core506may be associated with a different MNO. Furthermore, similar features may be referenced collectively using only the numeric characters of the reference indicator. For example, in the present disclosure, “MNO core506” refers to the MNO cores506a,506band any other such similar MNO cores.

It should be further noted that ellipses are shown between MOCN GW Secure Tunnels (MGSTs)510to indicate that additional MNO cores506similar to the two shown, as well as additional associated secure tunnels510, may be present in the architecture500. Each of the secure tunnels will be discussed in greater detail below. Similarly, ellipses are shown between BS/APs502and secure tunnels512,514to indicate that additional BS/APs502and secure tunnels512,514may be present in the architecture500. In some embodiments, the BS/APs502are multiple sector eNodeBs, such as are commonly used in 4G and 5G networks.

As noted previously, throughout this disclosure, the term BS/AP is used broadly to refer to one or more of the following: an eNB (Evolved Node B or E-UTRAN Node B) of a 4G network or gNB (5G node B) of an LTE/5G network; a cellular base station (BS); a Citizens Broadband Radio Service Device (CBSD); a WiFi access node a Local Area Network (LAN) access point; a Wide Area Network (WAN) access point; etc. This term may also be used to refer to any other type of network receiving hub that provides wireless access by a plurality of wireless transceivers to a network. User equipment (UE)101, communicates wirelessly through the BS/AP502to one or more of the cores506,508.

Also noted above, the term UE is used to refer to a wide array of devices having wireless connectivity, such as a cellular mobile phone, Internet of Things (IoT) device, virtual reality googles, robotic device, autonomous driving machine, smart barcode scanner, and communications equipment. Communications equipment includes desktop computers, laptop computers, tablets and other types of personal communications devices.

When a UE101enters the coverage area of a BS/AP502, radio contact is established between the UE101and the BS/AP502. Typically, a relatively rigorous authentication process occurs in which a mobility management entity (MME)520within a core506,508ensures that the UE101has the required “credentials” to access the resources available through the core506,508. The details of this process are well known and not relevant to the architecture500disclosed.

However, what is relevant is that a secure interface between the BS/AP502and the cores506,508allows a UE101to establish a secure communication link to the core506,508through which the UE can take advantage of the resources that the network has to offer (i.e., communicate through a SWG534and associated Packet Gateway (PGW) not shown for simplicity, but maintained within the cores506,508). The interface between the BS/AP502and the core506,508is commonly known as an S1 interface.

As defined by industry standards, the S1 interface has a user-plane and a control-plane component. The user-plane is commonly referred to as S1-U and carries all user data as well as application layer signaling (such as session initiation protocol (SIP) or real-time transport protocol (RTP) and real-time transport control protocol (RTCP) packets). The control-plane is commonly referred to as S1-C and handles all messages and procedures related to the radio interface supported features. An example of the control-plane messages is the control messages for handover management or bearer establishment. A “bearer” is a communication channel that carries call content (as opposed to carrying signaling). In the common-channel signaling scheme for telecommunications, signaling is sent out-of-band, while all other traffic rides bearer channels.

Different “tunneling protocols” are used across different interfaces. A 3GPP-specific tunneling protocol called “GPRS tunneling protocol (GTP)” is used over the S1 interface for both user-plane and control-plane traffic in embodiments conforming to the 3GPP standards. 3GPP is the 3rd Generation Partnership Project, an umbrella term for a number of standards organizations that develop protocols for mobile telecommunications.

To establish a bearer with a particular network, communication with the core506,508has to be directed to the appropriate network. A UE in accordance with one embodiment of the disclosed method and apparatus has at least one System Identification Module (SIM) card310(seeFIG.3) that carries credentials that allow an UE302to be authenticated by at least one of the networks (i.e., by an MME in one of the cores506,508, such as the MME520shown in the MNO core506a). In some embodiments of the disclosed method and apparatus, the MOCN GW/X2 GW (MGXG)504has several Base Station (BS) Portals518, each configured to receive communications from, and transmit communications to, one BS/AP502through one MNO Secure Tunnel (MST)512. In some embodiments, each of the MSTs512has a one-to-one correspondence with a unique MNO Portal530of one of the BS/APs502. Accordingly, the BS/AP502a(and more particularly, an MNO Portal of the BS/AP502), the MST512aand the BS Portal518define a “Secure Channel”. In this case, they define a “MMB Secure Channel”519, MMB being an acronym for M(GXG)M(ST)M(S/AP), i.e., the three components of the MMB Secure Channel519.

In the architecture500, each MMB Secure Channel519provides a secure communication path for control-plane and user-plane traffic between one MNO Portal530of one of the BS/APs502and the MGXG504. In addition, the BS/AP502has an Enterprise Portal532coupled to a “enterprise secure tunnel” (EST)514. The BS/AP502has the ability to determine whether traffic received from a UE101is intended for the MNO core506or the E-network508. The BS/AP502routes MNO traffic522(i.e., traffic that is intended for one of the MNO cores506) through the MST512. The MST512provides secure communications between the BS/AP502and the MGXG504. Note that red arrows indicate MNO traffic522, including both uplink traffic from the UE101and downlink traffic to the UE101. In addition, enterprise network traffic524(traffic between the UE101and the core of an enterprise network) is color coded blue and is routed to a “enterprise secure tunnel” EST514a. The EST514aprovides a secure communication path between the BS/AP502aand the E-core508. Furthermore, dashed red arrows signify the path for MNO X2 traffic, which is discussed further below, while dashed blue arrows signify the path for enterprise network X2 traffic.

The MGXG504has a MOCN GW Module (MGM)526and an X2 GW Module (XGM)538. For uplink traffic, the MGM526receives MNO communications (i.e., traffic intended for the MNO core506) from a transmitting BS/AP502. The MNO core intended communications are sent from the BS/AP502through an MST512dedicated to communicating secure communications from the BS/AP502to the MGM526through the BS Portal518of the MGXG504. The MNO core intended communications are coupled from the BS Portal518to the MGM526. The MGM526routes such received MNO core intended communications to an intended MNO core506through an MMM (MNO core-MGST-MGXG) Secure Channel543. The MMM Secure Channel543comprises an MNO Portal528, an MGST510an associated MOCN GW Portal544of a MNO core506. There is a one-to-one correspondence between the three elements of the MMM Secure Channel, such that the MNO Portal528is associated with only one MGST510and only one MOCN GW Portal544. Similarly, the MGST510is associated with only one MNO Portal528and only one MOCN GW Portal544. Likewise, the MOCN GW Portal544is associated with only one MNO Portal528and only one MGST510. Communications are sent based on information contained within the packets, as determined by the MGM526. The MMM Secure Channel543provides a secure communication link between the MGXG504and the MNO core506.

It should be noted that in the architecture500, both user-plane and control-plane traffic traverse the same route from the BS/AP502to the MNO core506. Distinctions between user-plane and control-plane communications at the MNO core506cause the user control traffic to be directed to the MME520and the user-plane traffic to a serving gate way (SGW)534within the MNO core506. It should also be noted that multiple such MNO cores506can be coupled to the MGXG504through different MNO Portals528, each coupled to a unique and secure MGST510. The MGM526determines which MNO core506the traffic is intended for and routes the traffic to the appropriate MNO Portal528.

Having MNO Portals530that are distinct from the Enterprise Portals532at the BS/AP502allows separate secure communication to the MNO core506and to the E-core508through different secure tunnels. It should be noted that in the architecture500the BS/APs502can be owned by an MNO, by the enterprise network or jointly owned by both. In all cases, the BS/AP502has access to both the E-core508and the MNO core506.

Downlink traffic traverses a similar path, but in reverse. That is, downlink MNO traffic originates at the MNO core506. The MNO core506is places the traffic onto the MGST510to be communicated securely to the MNO Portal528of the MGXG504. The MNO Portal528provides the traffic to the MGM526. The MGM526determines to which UE101(and accordingly with the assistance of the HSS, to which BS/AP502) the traffic is intended to be routed. The MGM526routes the traffic to the appropriate BS Portal518of the MGXG504. The traffic then flows through the MST512associated with that BS Portal518and arrives securely at the BS/AP502through the dedicated MNO Portal530of the BS/AP502.

When a UE101is attempting to access resources within an enterprise network through a BS/AP502, the BS/AP502detects that the intent of the UE101is to communicate with the E-core508. Both user-plane and the control-plane traffic from the UE101are routed by the BS/AP502through the Enterprise Portal532of the BS/AP502to the EST514. The EST514provides a secure communication channel from the BS/AP502to the E-core508. A BS Portal518in the E-core508is coupled to the EST514to receive the secure from the BS/AP502. An EEB Secure Channel536is defined by the combination of the E-core BS Portal518, associated EST514and associated BS/AP Enterprise Portal532. Accordingly, EEB is an acronym for the three components (E-core/EST/BS/AP) that comprise the EEB Secure Channel536. In some embodiments, the two portals518,532and the EST514have an exclusive one to one correspondence, such that for each Enterprise Portal532in the BS/AP502, there is one and only one associated EST514and one and only one associated BS Portal518in the E-core508. Once user-plane traffic and control-plane traffic are received by the E-core508through the BS Portal518, the user-plane traffic is routed to the SWG (not shown) within the E-core508and control-plane traffic is routed to the MME (not shown) within the E-core508.

Similarly, downlink traffic originating at the E-core508intended for a particular UE101is routed through the EEB Secure Channel536from the E-core508to the particular BS/AP502to which the UE101is attached through the BS Portal518of the E-core508. The BS Portal518of the MGXG504is coupled to the EST514which securely routes the traffic to the BS/AP Enterprise Portal532of the BS/AP502. The BS/AP502then transmits the traffic over the air to the UE101for which the traffic is intended.

In addition to control plan and user plan traffic that flows between the BS/AP502and the cores network506,508, X2 mobility traffic flows between the BS/APs502and the XGM538within the MGXG504. X2 mobility traffic is used to communicate control messages related to managing which BS/AP502a UE101will use when communicating with an MNO network and/or an enterprise network. In the architecture500shown inFIG.5, an integrated XGM538within the MGXG504manages which BS/AP502a UE101will use to communicate with for both the MNO core506and the E-core508.

In the architecture500, X2 mobility traffic related to the MNO network originating or terminating at a BS/AP502flows through the MMB Secure channel519. The BS Portal518in the MGXG504is coupled to both the MGM526and the XGM538. In the case of X2 mobility traffic, the traffic is coupled to the XGM538. Similar MMB Secure Channels between the MGXG504and other BS/APs502allow the XGM538to coordinate which BS/AP502traffic will flow through for each particular UE101when communicating with the various networks (i.e., cores network506,508).

For enterprise network X2 mobility traffic originating and terminating in the BS/AP502, the traffic flows through the EEB Secure Channel536between the BS/AP502and the E-Core508. Once received through the BS Portal518, the E-core408routes the X2 traffic to an X2 Portal540of the E-Core508. The X2 Portal540is coupled to an X2 Secure Tunnel (XST)516. The XST516allows secure communications to pass between the X2 Portal540of the E-Core and the XGM538through an X2 Portal542in the MGXG504. Similar EEB Secure Channels to other BS/APs502allow X2 traffic to flow to the E-Core508, and through to the XGM538to allow the XGM538to coordinate between the BS/AP502and the cores network506,508to determine through which BS/AP502each particular UE101communicates with the various networks (i.e., cores network506,508). Since there is no direct secure tunnel for enterprise related X2 traffic between the BS/APs502and the XGM538within the MGXG504, the combination of the EEB Secure Channel536and the XST enable X2 traffic to be securely communicated between the BS/APs502and the XGM538.

FIG.6shows a configuration600in which a third party core (TP core)602is accessible through the MGXG504. In this configuration, in addition to the BS/AP502having the ability to distinguish between traffic intended for the MNO core506and traffic intended for the E-core508, the BS/AP502has the ability to detect attempts by a UE101to access services provided by a third party, such as Google Fi, that use the network infrastructure of an MNO and possibly of the enterprise network to gain access a TP core. In such cases, the BS/AP502detects that the UE is a third party subscriber. Third party intended communications (TIC) that originate at a BS/AP502(i.e., communications the sending UE101intended to send to the TP core602) are sent from the BS/AP502through the MST512to the BS Portal518of the MGXG504that is associated with the transmitting BS/AP502. Upon receipt at the MGXG504, the TIC is provided to the MGM526. The MGM526provides the TIC to a third party (TP) Portal606. The TP Portal606is associated with a unique third party secure tunnel (TPST)604and corresponding MGXG Portal608in the TP core602. Accordingly, the TIC is routed from the MGXG504to the TP core602through the TPST604to allow the TIC traffic to gain access to the TP core602. In some cases in which a third party subscriber is granted access to services provided by the enterprise network or the MNO network, traffic originating at a third party UE may be selectively routed by the BS/AP502to the E-core508to allow the UE to gain access to resources provided through the E-core508or to the MNO core506, while routing some of the remaining packets to the TP core602. Such splitting of packets between the third party network and the enterprise network is referred to as Local Traffic Offload (LTO).

FIG.7shows another architecture700in which a MGXG702has an MGM704and an integrated XGM706. The MGM704receives all traffic from BS/APs708through Common Secure Tunnels (CSTs)710, each CTS710being dedicated to traffic from one BS/AP708. Accordingly, both MNO traffic and enterprise traffic flows through the CST710servicing the BS/AP710that a particular UE101is using to access either the MNO network, the enterprise network or both.

For traffic originating at the UE101, the traffic is transmitted wirelessly over the air to the BS/AP708. The BS/AP708routes all of the traffic received from the UE101to a MOCN GW Portal716in the BS/AP708. The MOCN GW Portal716is in communication with the BS Portal718of the MGXG702via the CST710. Each MOCN GW Portal716is associated with a unique CST710and a unique BS Portal718in a one-to-one relationship to form a MCB Secure Channel719for communications between the MGXG702and one of the BS/APs502. The MGXG702routes user-plane and control-plane traffic received through the BS Portal718to an MGM704.

The MGM704determines whether the traffic is intended to for the MNO core506or E-core508. If it is MNO traffic, the MGM704further determines for which particular MNO network the traffic is intended. The MGM704routes the MNO traffic to an MNO Portal722in the MGXG702that provides access to a MOCN GW Secure Tunnel (MGST)712that allows the MNO traffic to be securely communicated from the MGXG702to the MNO core506of the intended MNO network. Once received at the MNO core506, user-plane traffic is routed to the SGW534and control-plane traffic is routed to the MME520(seeFIG.5).

If, however, the MGM704determines that the traffic is intended for the enterprise network (i.e., the E-core508), the MGM704routes the traffic to Enterprise Portal724of the MGXG702. In some embodiments there may be more than one enterprise network to which the MGXG702can route traffic. In such embodiments, there is one Enterprise Portal724associated with each one corresponding E-core508. The Enterprise Portal724provides access to the E-core508via an EST714. The MGM704detects to which network the traffic is intended to be communicated and routes the traffic appropriately to the proper Portal722,724. Once the traffic is received at the intended core506,508, user-plane traffic is routed to the SGW534and control-plane traffic is routed to the MME520.

In the architecture700, X2 mobility traffic is routed directly from the BS/AP Portal718of the MGXG702to an integrated XGM726that is responsible for managing mobility for both the MNO network and the enterprise network. Accordingly, the XGM726can monitor the BS/AP708to determine and manage which is most appropriate to carry traffic to and from each particular UE101.

FIG.8illustrates an architecture800similar to the architecture700ofFIG.7. However, the architecture800also includes at least one TP core602. In the architecture800, a UE101can access the TP core602through the MGXG802. As noted with regard to the architecture600ofFIG.6, an LTO can be performed to detect portions of traffic (i.e., packets) that originate within a third party UE101, but that are intended for the E-core508or for the MNO core506. In this architecture600, the LTO functionality can be provided in either the BS/AP708or the MGM720. LTO functionality includes authenticating the UE101to ensure that the UE101has the necessary credentials to gain access to the TP network.

In addition, addresses are assigned and managed to allow packets to properly routed to and from the particular features within the TP network. That is, when a UE101attempts to gain access to features of the TP network, or when the TP network attempts to send packets to the UE101, the addresses of the UE101and the particular features being accessed by the UE must be maintained so that proper routing of the packets can be performed by the device performing the LTO functionality. In either case, when that portion of the traffic that is intended for the third party network reaches the MGM720, the MGM routes that portion of the traffic to the TP Portal803based on the addresses established when the UE101is authenticated by the TP core602. The TP Portal803provides access to a TP Secure Tunnel (TPST)804. The TPST804provides secure communications from the MGXG802to the TP core602. Alternatively, when portions of the traffic are intended for either the E-core or the MNO core, the packets are routed to the appropriate Portal of the MGXG802to ensure that they arrive securely at the appropriate core506,508.

FIG.9is an illustration of an architecture900in which the X2 mobility functionality for the enterprise network is provided by an XGM902within an E-core with Integrated X2 GW (ECXG)904. In this architecture900, user-plane and control-plane traffic for both the MNO network and the enterprise network flow in the same way as in the architecture500shown inFIG.5, as does X2 mobility traffic for the MNO network. However, X2 mobility traffic for the enterprise network, while sent from the BS/AP502to the BS Portal906of the ECXG904through the EEB Secure Channel514, the X2 traffic is sent to the XGM902within the ECXG904, rather than to the XGM908in the MGXG910. In some embodiments, the XGM902processes one or more X2 packets contained in the X2 traffic and determines whether to send one or more X2 packets to one of the other BS/APs502in the architecture900. In some embodiments, this decision is based on whether there is to be a change in the BS/AP502through which a UE101will communicate with the various cores in the architecture900or to otherwise manage and/or control X2 mobility among the BS/APs502. In some embodiments, the packets sent to from a first BS/AP502are simply relayed on to the second BS/AP502. Alternatively, the XGM902in the ECXG904generates new X2 packets to send to the second BS/AP502. In any case, this architecture900reduces the need for a secure tunnel from the E-core to the MGXG910, but requires the E-core to have an integrated XGM, thus increasing the complexity of the E-core. Such tradeoffs will provide benefits that depend upon the particular use case and the users.

FIG.10illustrates an architecture1000in which a discrete Unified X2 Gateway (UXG)1002is provided independent of the cores. All communications between a BS/AP1006and the UXG1002occur through a UCB (UXG-CTS-BS/AP) secure channel1011. A Common Portal1008of the BS/AP1006, a Common Secure Tunnel (CST)1004and a BS Portal1010of the UXG1002form the UCB Secure Channel1011. The Common Portal1008, CST1004and BS Portal1010of one UCB Secure Channel have a one-to-one correspondence such that each is associated with only one of each of the other two. For example, in the UCB Secure Channel1011b, the common portal1008bis only associated with the CST1004band the BS Portal1010b, each of which is only associated with the common portal1008band with the other. In some embodiments in which the BS/AP1006has only one Common Portal1008, the UCB Secure Channel1011can be said to comprise the BS/AP502, associated CST1004and associated BS Portal1010in a one-to-one correspondence.

The UXG1002determines whether packets received at each BS Portal1010are intended for an E-core508or an MNO core506(i.e., are enterprise traffic or MNO traffic). Upon making the determination, the UXG1002sends user-plane (S1-U) MNO traffic to a U-Portal1012, MNO control-plane (S1-C) traffic to an S1-C Portal1014of the UXG1002, and enterprise traffic (both S1-C and S1-U) to a Enterprise Portal1016of the UXG1002.

The U-Portal1012, an MNO S1-U Secure Tunnel (MUST)1018and an MUST Portal1023form a UMM (UXG-MUST-MNO core) Secure Channel1025for MNO S1-U traffic between the UXG1002and the MNO core1021. In particular, the Secure Channel1025establishes secure communications with a Serving Gateway (SGW)1019within an MNO core1021. Accordingly, the MUST Portal1023is coupled to the SGW1019. For user-plane packets, a bearer has been established, therefore the packets are simply routed to the SGW1019over the established bearer which flows through the MUST1018. Therefore, no consolidation of traffic occurs. Accordingly, the user-plane traffic from the UXG1002can be sent directly through the MUST1018to the SGW1019.

The S1-C Portal1014, an MNO S1-C Secure Tunnel (MCST)1020and a MCST Portal1027of a MOCN GW1024form an MGMU (MOCN GW-MCTS-UXG) Secure Channel1030between the UXG1002and the MOCN GW1024to ensure secure communication for MNO S1-C traffic. Unlike the user-plane packets, control-plane packets can be consolidated by the MOCN GW1024. That is, packets arriving from different BS/APs1006that are intended to be received by the same MME1026can be sent by the MOCN GW1024in the same capsule through an MME Secure Tunnel (MMEST)1028. The MOCN GW1024determines to which, from among a plurality of MNO networks and MMEs1026within each MNO core1021, to send control-plane packets.

Upon making the determination, the MOCN GW1024sends the packets together with any other packets for that MME1026on an MMMG Secure Channel1033, each MMMG Secure Channel comprising one MNO Portal1035of an MOCN GW1024, one MMEST1028and one MOCN GW Portal1037of an MNO core1021. In some embodiments, the MOCN GW1024has a plurality of MNO Portals1035, each dedicated to providing an interface to one MNO MME1026. Furthermore, in some embodiments, the MNO core1021has a plurality of MOCN GW Portals1037, each of which provide an interface through which traffic sent over an associated MMMG Secure Channel1033can be provided to one MNO MME1026from among a plurality of MMEs1026within the MNO core1021. In the example shown, three such MNO MMEs1026are shown. Accordingly, each MNO MME1026has a unique dedicated MMMG Secure Channel1033. It should be noted that since the MOCN GW1024determines to which MME1026particular packets are to be sent, the BS/AP1006is relieved of that function. Thus, the same capsule can be used to send all of MNO control-plane packets from the BS/AP1006to the MOCN GW1024regardless of the particular MNO core and MME in which the packets are intended to be received.

In addition, an EEU (E-core-EST-UXG) Secure Channel1031comprises an Enterprise Portal1016within the UXG1002an EST1022and a BS Portal518of the E-core508. The EST1022carries enterprise traffic (both S1-C and S1-U). The user-plane and control-plane traffic are both terminated/originated at the E-core that receives/transmits traffic through a BS Portal518of the E-core508. Each Enterprise Portal1016is associated with a unique EST1022and BS Portal518in a one-to-one relationship to form the EEU Secure Channel1031for communications between the UXG1002and the MNO Core1021.

X2 mobility traffic for both the MNO network and the enterprise network flow through the UCB Secure Channel1011. The UXG1002provides management and control of mobility for both the MNO network and the enterprise network. X2 mobility traffic flows between each BS/AP1006and the UXG102through the particular CST1004associated with the BS/AP1006through which a UE101is currently communicating. The UXG1002can provide all necessary communications to any other BS/AP1006involved in a mobility function, such as changing the BS/AP1006through which a UE101is communicating. The path between the BS/AP1006and the UXG1002is shown by a broken black line1032. The line1032illustrates that a packet originating in one BS/AP1006acan be communicated securely through the CST1004ato the SB Portal1010aof the UXG1002. The UXG1002then sends that packet (either with or without processing the packet information) to through the BS Portal1010bof the UXG1002to another BS/AP1006bthrough the CST1004b. In some embodiments, the packet that originated at the first BS/AP1006amay not be the packet that is sent to the second BS/AP1006b. That is, the UXG1002may receive and process the packet that originated at the first BS/AP1006aand send a different packet to the second BS/AP1006b. In some such embodiments, the packet that the UXG1002sends to the second BS/AP1006bincludes instructions for the operation of the BS/AP1006bduring a mobility function that the UXG1002is performing involving the two BS/APs1006. In some embodiments, the X2 packet that is sent by the UXG1002is generated in response to the X2 packet that was received by the UXG1002.

FIG.11is an illustration of another architecture1100in accordance with an embodiment of the disclosure method and apparatus. In the architecture1100, an MNO X2 GW (MXG)1102is provided for mobility functionality related to the MNO network traffic. However, mobility functionality related to the enterprise network traffic is managed by an X2 GW902that is integrated into an ECXG904similar to the ECXG904disclosed above with respect toFIG.9. In this architecture1100, the MNO packets flow as noted with respect to the architecture1000described above, but enterprise packets flow as noted with respect to the architecture900described above. This is true for both user-plane traffic, control-plane traffic and X2 mobility traffic.

FIG.12is an illustration of an architecture1200in which a UXG1202manages and coordinates X2 functionality for both the MNO network and for the enterprise network, similar to the case in the architecture1000ofFIG.10. However, in contrast to the architecture1000shown inFIG.10, each BS/AP502in the architecture1200has an MST512for MNO traffic and an EST514for enterprise traffic to and from the BS/AP502. MNO traffic (i.e., user-plane traffic, control-plane traffic and X2 mobility traffic) between the BS/APs502and the UXG1202flows essentially the same as the MNO traffic that flows through the architecture500. In addition, enterprise traffic between the BS/APs502and the E-core508(i.e., user-plane traffic, control-plane traffic and X2 mobility traffic) flows essentially the same as the enterprise traffic described above with respect to the architecture500. Packets originating at a BS/AP502are securely communicated to the UXG1202over a UMB (UXG-MST-BS/AP) Secure Channel1214. Each UMB Secure Channel1214comprises one MNO Portal530in one of the BS/APs502, an associated MST512and an associated BS Portal1210of the UXG1202. Each UMB Secure Channel1214allows secure communications to occur between one BS/AP502and the UXG1202.

Packets communicated from a BS/AP502to the UXG1202are sent to an MNO Distribution Module1206within the UXG1202. The MNO Distribution Module1206determines whether the packets are part of a user-plane flow or a control-plane flow. The MNO distribution Module1206directs user-plane packets to a U-Portal1208of the UXG1202. One U-Portal1208, one MUST1018and one MUST Portal1023of the MNO core1021form a UMM (UXG-MUST-MNO core) Secure Channel1218. The UMM Secure Channel allows secure communications to be send between the UXG1202and the MNO core1023. User-plane packets arriving at the MNO core1023via the UMM Secure Channel are sent to a MNO SGW1019within the MNO core1021.

Control-plane packets are directed to a C-Portal1212of the UXG1202. The C-Portal1212of the UXG1202, the MCST1020and a MCST Portal1029in the MOCN GW1024form a UMMG Secure Channel for the control-plane traffic to the MNO core1021. The MOCN GW1024consolidates control-plane packets that are intended for the same MNO MME1026and sends them through the appropriate MMEST1028to securely communicate them to the MNO MME1026.

For enterprise network X2 mobility traffic, there is a need for an XST1204to establish secure communications between the E-core508and the MXG1102. The enterprise X2 mobility traffic flows between the E-core508and the UXG1202through an XST516, similar to the X2 mobility traffic in the architecture500.

In the architecture1200, the UXG1202has an MNO Distribution Module1206that sends the MNO user-plane traffic to, and receives user-plane traffic from, a U-Portal1208of the UXG1202. The U-Portal1208provides access to an MUST1018. The MUST1018establishes secure communications between the UXG1202and the MNO SGW1019within the MNO core1021.

The MNO Distribution Module1206also sends control-plane traffic to a MCST1020that established secure communications between the UXG1202and a MOCN GW1024. The MOCN GW1024determines which MNO MME1026to send packets to and securely communicates with MNO MMEs1026within the MNO core1021through a MMEST1028. Packets received from the MNO MMEs1026that are intended for the same BS/AP502are consolidated within the MOCN GW1024and sent back through the MCST1020to the UXG1202. Those packets are then sent through a BS Portal1210of the UXG1202. Each BS Portal1210is configured to communicate through a unique MST512to provide secure communications to a corresponding one of the BS/APs502.

Although the disclosed method and apparatus is described above in terms of various examples of embodiments and implementations, it should be understood that the particular features, aspects and functionality described in one or more of the individual embodiments are not limited in their applicability to the particular embodiment with which they are described. Thus, the breadth and scope of the claimed invention should not be limited by any of the examples provided in describing the above disclosed embodiments.