Abstract: A method and core network element of a primary network operator (NO) are described for supporting roaming connection signaling messages between a user equipment communicating via a secondary MNO and core network components of a mobile virtual network operator (MVNO) to which an international mobile subscriber identity (IMSI) block has been leased by the primary network operator. The user equipment has a leased IMSI value within a range of IMSI values of the IMSI block, and a roaming services arrangement exists between the primary MNO and the secondary MNO for supporting roaming connectivity of user equipment specifying IMSI values of the primary MNO. The core network element generates an updated connection signaling message by inserting a new destination realm value in a destination field of a received connection signaling message in accordance with a leased IMSI block arrangement between the primary network operator and the MVNO.

Abstract: A system and method are described that are carried out by a core network element of a primary network operator (NO) to manage agreement-based limited usage of roaming mobile wireless data services of a secondary mobile network operator (MNO) by roaming user equipment (UE) devices of a mobile virtual network operator (MVNO) in accordance with usage limiting terms arising from an agreement between the primary NO and the MVNO. The method includes maintaining a roaming usage filter definition arising from the agreement between the primary NO and the MVNO. The core network element receives a connection request message from the secondary MNO for a roaming UE device for which the agreement is applicable.

Abstract: A method, carried out by a mobile network operator (MNO) core component, is described for supporting connection signaling between a user equipment and core network components of a mobile virtual network operator (MVNO). The method includes receiving an update location answer (ULA) message that specifies a leased IMSI value of the user equipment. The MNO core component determines that the leased IMSI value of the user equipment falls within a range of the IMSI block allocated to the MVNO. The MNO core component generates a modified ULA including a changed access point name (APN). The modified ULA is forwarded to a mobility management entity (MME) component that uses the modified ULA to generate a create session request (CSR) message, and the changed APN of the modified ULA causes the MME component to send the CSR message to a GPRS tunneling protocol (GTP) proxy of the primary MNO.

Abstract: A method, carried out by a private mobile wireless terminal, is described. The private mobile wireless terminal comprises a subscriber identification module applet, for persisting a connectivity preference for a home mobile wireless network that is a private mobile wireless network. The private mobile wireless terminal operates in a mobile wireless environment comprising a primarily mobile network provider including a sponsored roaming application server (SRAS). After losing the connection to the private mobile wireless network and connecting to an alternative mobile network, further operations are carried out to restore a persisted connectivity preference for connecting to the private mobile wireless network after service is restored following a service outage of the private mobile wireless network.

Abstract: A method and core network element of a primary network operator (NO) are described for supporting roaming connection signaling messages between a user equipment communicating via a secondary MNO and core network components of a mobile virtual network operator (MVNO) to which an international mobile subscriber identity (IMSI) block has been leased by the primary network operator. The user equipment has a leased IMSI value within a range of IMSI values of the IMSI block, and a roaming services arrangement exists between the primary MNO and the secondary MNO for supporting roaming connectivity of user equipment specifying IMSI values of the primary MNO. The core network element generates an updated connection signaling message by inserting a new destination realm value in a destination field of a received connection signaling message in accordance with a leased IMSI block arrangement between the primary network operator and the MVNO.

Abstract: A system and method are described that are carried out by a core network element of a primary network operator (NO) to manage agreement-based limited usage of roaming mobile wireless data services of a secondary mobile network operator (MNO) by roaming user equipment (UE) devices of a mobile virtual network operator (MVNO) in accordance with usage limiting terms arising from an agreement between the primary NO and the MVNO. The method includes maintaining a roaming usage filter definition arising from the agreement between the primary NO and the MVNO. The core network element receives a connection request message from the secondary MNO for a roaming UE device for which the agreement is applicable.

Abstract: A system and method are described that are carried out by a core network element of a host mobile carrier core network to perform an access point name resolution to facilitate establishing a session between a user equipment and a target packet gateway (PGW) of a mobile virtual network operator (MVNO). The method includes receiving a connection request from a user equipment identified as falling within particular ranges of mobile subscriber identity number (MSIN) values corresponding to user equipment of hosted MVNOs. The connection request includes: an international mobile subscriber identity (IMSI), and an access point name (APN). The method further includes establishing an MVNO identifier from the provided IMSI and thereafter generating an MVNO-specific APN by appending the MVNO identifier to the APN. The method further includes submitting a name resolution request including the MVNO-specific APN to a naming service server.

Abstract: A method (400) of automatically generating policies and/or roles for role based access (RBAC). The method can include presenting a policy or policy generation table (300) identifying scripts (304) and roles (302) to which the scripts correspond to an operator, and receiving at least one operator input selecting a plurality of desired scripts to be associated with a desired policy or role. The method also can include parsing the scripts to identify corresponding verb-switches (204), and comparing the parsed verb-switches to existing policies or roles (114). When there is at least one of the parsed verb-switches that does not correspond to at least one existing policy, the parsed verb-switch that does not correspond to at least one existing policy can be identified and a policy (106) that includes the identified verb-switch can be generated.

Abstract: A method (400) of automatically generating policies and/or roles for role based access (RBAC). The method can include presenting a policy or policy generation table (300) identifying scripts (304) and roles (302) to which the scripts correspond to an operator, and receiving at least one operator input selecting a plurality of desired scripts to be associated with a desired policy or role. The method also can include parsing the scripts to identify corresponding verb-switches (204), and comparing the parsed verb-switches to existing policies or roles (114). When there is at least one of the parsed verb-switches that does not correspond to at least one existing policy, the parsed verb-switch that does not correspond to at least one existing policy can be identified and a policy (106) that includes the identified verb-switch can be generated.

Abstract: A method for identifying non-orthogonal roles (112, 114, 116, 118) in an access control system (100). The method can include, for at least one policy (Pn,i) defined for a first role (112) in the access control system, automatically determining whether there is at least one policy (Pm,j) defined in a second role that conflicts with the policy defined in the first role. The method also can include, responsive to determining that the policy defined in the second role conflicts with the policy defined in the first role, providing a conflict indicator.