Abstract: Disclosed are various embodiments for customer-managed authentication in radio-based networks. In one embodiment, a radio-based network is managed for an organization. The radio-based network includes a radio access network and an associated core network. A request is received from the organization to configure one or more parameters affecting primary keys in the associated core network. The primary keys correspond to pre-shared keys of client devices permitted to access the radio-based network. Storage of the primary keys is customized in the associated core network based at least in part on the one or more parameters in response to the request.

Abstract: A first extension resource group (ERG) of a provider network, comprising a radio-based application pipeline processing server with a network accelerator card, is configured at an external premise. A first set of network functions of a radio-based application is executed at the card. A second ERG is configured at the premise, and a second set of network functions of the radio-based application is executed at the second ERG.

Abstract: A portion of a radio-based application (RBA) is executed at a first runtime environment (RTE) launched at a server. The first RTE includes a software program for processing messages between a pair of layers of the RBA. In response to determining that the portion of the RBA is to be executed at a second RTE, at least a subset of state information pertaining to the inter-layer messages is transferred to the second RTE without pausing the RBA. After the state information is transferred, the portion of the RBA is run at the second RTE.

Abstract: Disclosed are various embodiments for mobility between radio-based networks operated by communication service providers and private radio-based networks. In one embodiment, first data is sent or received via a private radio-based network using a wireless network connection in a user equipment (UE) device. It is determined to switch the wireless network connection in the UE device from the private radio-based network to a communication service provider (CSP)-operated radio-based network. The private radio-based network and the CSP-operated radio-based network utilize a cellular network standard. The wireless network connection switches from the private radio-based network to the CSP-operated radio-based network. Second data is sent or received via the CSP-operated radio-based network using the wireless network connection in the UE device.

Abstract: Disclosed are various embodiments for integrating communication service provider (CSP)-operated radio-based networks with existing private networks. In one embodiment, one or more parameters for provisioning a private radio-based network for an organization are received via an interface. Network information regarding an existing network of the organization is received via the interface. A configuration for a network element in the existing network is generated in order to interconnect the private radio-based network with the existing network.

Abstract: Disclosed are various embodiments for intelligently selecting private radio-based networks or communication service provider (CSP)-operated radio-based networks. In one embodiment, it is determined that a particular application executed in a user equipment (UE) device requests to send data via a wireless network connection. It is determined to switch the wireless network connection in the UE device from a CSP-operated radio-based network to a private radio-based network based at least in part on the particular application or the data to be sent by the particular application. The wireless network connection is switched from the CSP-operated radio-based network to the private radio-based network. The data is sent via the wireless network connection using the private radio-based network.

Abstract: Disclosed are various embodiments for managing simultaneous use of private wireless local area networks (WLANs) and cellular radio-based networks. In one embodiment, a user equipment (UE) device authenticates for access to a cellular radio-based network using a profile in an electronic subscriber identity module (eSIM). The UE device determines to transfer data via a WLAN rather than the cellular radio-based network. The UE device requests an access credential for the WLAN from the cellular radio-based network. The UE device uses the access credential to connect to the WLAN to transfer the data.

Abstract: Disclosed are various embodiments for customer-defined capacity limit plans in communication networks. In one embodiment, a request for a service from a radio-based network is received from a first client device. A network function in the radio-based network is determined to be at a capacity limit. Service from the network function to a second client device to the network function is suspended in response to determining that the network function in the radio-based network is at the capacity limit and based at least in part on a rule set specific to the radio-based network. The first client device is provided access to the network function instead of the second client device.

Abstract: Disclosed are various embodiments for configurable security policies in radio-based networks. In one embodiment, a security event detection rule or a security event mitigation rule for a radio-based network is accessed. The radio-based network includes a radio access network and an associated core network. At least a portion of the radio-based network is operated by a cloud provider on behalf of an organization. A security event is detected based at least in part on the security event detection rule. At least one action is performed in response to the security event based at least in part on the security event mitigation rule.

Abstract: At a radio-based application pipeline processing server at which a portion of a distributed unit (DU) of a radio-based application is implemented, a particular networking hardware device is selected from among several devices (which include least one device incorporated within a network function accelerator card and at least one device which is not part of an accelerator card) for transmission of at least a portion of mid-haul traffic to a centralized unit (CU). The mid-haul traffic is transmitted to the CU via the selected device. At least a portion of front-haul traffic is transmitted to a radio unit (RU) via a networking hardware device incorporated within a network function accelerator card of the server.

Abstract: Disclosed are various embodiments for customer-defined capacity limit plans in communication networks. In one embodiment, a request for a service from a radio-based network is received from a first client device. A network function in the radio-based network is determined to be at a capacity limit. Service from the network function to a second client device to the network function is suspended in response to determining that the network function in the radio-based network is at the capacity limit and based at least in part on a rule set specific to the radio-based network. The first client device is provided access to the network function instead of the second client device.

Abstract: A first security rule set for traffic of a compute instance run at a virtualization server is stored in response to a programmatic request. A second security rule set for traffic of a network function accelerator of the virtualization server is stored in response to another programmatic request. Prior to delivery of network messages to the compute instance or from the accelerator, compliance with the applicable security rule set is verified.

Abstract: Techniques for customer-initiated virtual machine resource allocation sharing are described. A hardware virtualization service of a cloud provider network receives a request to launch a first virtual machine, wherein the first virtual machine is of a first virtual machine type, the first virtual machine type having a resource amount allocated to virtual machines of the first virtual machine type. The hardware virtualization service causes a launch of the first virtual machine on a host computer system of the cloud provider network. The host computer system shares an allocation of the resource amount from a corresponding resource of the host computer system between the first virtual machine and a second virtual machine, wherein the second virtual machine is of the first virtual machine type.

Abstract: Systems and methods are described for implementing a distributed unit in a radio access network that executes code on behalf of mobile devices. A distributed unit may be implemented on an edge server that is in close physical proximity to a radio unit, with few or no intervening devices. The edge server may thus provide services to mobile devices, such as executing code on behalf of a mobile device in an execution environment on the edge server, at significantly lower latency than more distant cloud-based servers. The edge server may preload computing environments with code for which a mobile device is likely to request execution (e.g., because a particular application is executing on the mobile device), and may determine whether to execute code on the edge server or on a cloud provider network.

Abstract: Disclosed are various embodiments for a distributed and synchronized core in a radio-based network. In one embodiment, a first radio access network (RAN)-enabled edge server at a first edge location is configured to perform a set of distributed unit (DU) functions for a radio-based network. The first RAN-enabled edge server is also configured to perform a set of core network functions and a set of centralized unit (CU) functions for the radio-based network. State associated with the set of core network functions and the set of CU functions is synchronized between the first RAN-enabled edge server and another server.

Abstract: State information of a radio-based application, used to process messages of the application, is made accessible from a first compute instance and a second compute instance at a virtualization server. The first instance is assigned to process a first portion of a workload of the application, including a message which comprises a result of a network function executed at a network function accelerator of the server. In response to determining that a condition for migrating workload from the first compute instance has been met, an additional message of the first portion is directed to the second compute instance. The second compute instance processes the additional message using the state information.

Abstract: At a radio-based application pipeline processing server at which a portion of a distributed unit (DU) of a radio-based application is implemented, a particular networking hardware device is selected from among several devices (which include least one device incorporated within a network function accelerator card and at least one device which is not part of an accelerator card) for transmission of at least a portion of mid-haul traffic to a centralized unit (CU). The mid-haul traffic is transmitted to the CU via the selected device. At least a portion of front-haul traffic is transmitted to a radio unit (RU) via a networking hardware device incorporated within a network function accelerator card of the server.

Abstract: Disclosed are various embodiments for integrating multiple access technologies in a radio-based network. In one embodiment, first data is received from a first wireless device connected to a radio-based network via a first access technology. Second data is received from a second wireless device connected to the radio-based network via a second access technology. The first access technology and the second access technology use a different physical layer and a different media access control layer but use a network layer that is in common. The first data and the second data are processed at the network layer in the radio-based network using a common processing element.

Abstract: A first security rule set for traffic of a compute instance run at a virtualization server is stored in response to a programmatic request. A second security rule set for traffic of a network function accelerator of the virtualization server is stored in response to another programmatic request. Prior to delivery of network messages to the compute instance or from the accelerator, compliance with the applicable security rule set is verified.

Abstract: Respective network addresses are assigned to a networking hardware device and a network function accelerator incorporated within an offloading card of a virtualization server by a control plane server of a virtualized computing service. A compute instance is launched at the virtualization server using a virtualization controller of the offloading card. The compute instance executes a network function of a radio-based application in response to a request received using the network address assigned to the hardware device, and requests execution of a second network function at the accelerator. The result of the second network function is sent to a radio unit of the application using the address assigned to the accelerator.