Abstract: Disclosed are various embodiments for extending cloud-based virtual private networks to user equipment on radio-based networks. In one embodiment, a request is received from a client device for service from a radio-based network. The client device is provided with access to a virtual private cloud network through the radio-based network in response to receiving the request from the client device for service from the radio-based network. Encapsulated network traffic is forwarded from the client device to the virtual private cloud network via a network link between the radio-based network and a cloud provider network that hosts one or more resources on the virtual private cloud network.

Abstract: An endpoint for accessing a group of cloud resources from a set of client devices outside the cloud is established. In response to detecting that, as a result of a configuration change, a particular cloud resource has joined the group, addressing information for the particular cloud resource is generated. An access verifier associated with the endpoint receives a packet directed from a client device using the addressing information. In response to determining, based on user identity metadata of the user and based on device status metadata of the client device, that the packet satisfies a security requirement, the packet is delivered to the particular cloud resource.

Abstract: An intermediary device is assigned for transmitting control plane messages between a RAN node of an application and a set of virtualized network functions of a core network of the application. In response to detecting that a condition has been satisfied, a configuration change is performed at the set of virtualized network functions, without causing a change to configuration of the RAN node.

Abstract: Various embodiments are provided for dynamically reconfiguring radio access network (RAN) functionality between edge and cloud computing environments. A RAN-enabled edge server deployed at an edge location is configured to perform a set of distributed unit (DU) functions for a radio-based network, while a server hosted at a regional data center of a cloud provider network is configured to perform a set of core network functions for the radio-based network. The system monitors availability of the core network functions at the edge location and determines that the set of core network functions provided by the server at the regional data center is unavailable. In response to determining that the core network functions are unavailable, the RAN-enabled edge server is dynamically reconfigured to perform the set of core network functions.

Abstract: Systems and methods are described for implementing a distributed unit in a radio access network that executes code on behalf of mobile devices. A distributed unit may be implemented on an edge server that is in close physical proximity to a radio unit, with few or no intervening devices. The edge server may thus provide services to mobile devices, such as executing code on behalf of a mobile device in an execution environment on the edge server, at significantly lower latency than more distant cloud-based servers. The edge server may preload computing environments with code for which a mobile device is likely to request execution (e.g., because a particular application is executing on the mobile device), and may determine whether to execute code on the edge server or on a cloud provider network.

Abstract: Disclosed are various embodiments for a distributed and synchronized core in a radio-based network. In one embodiment, a first radio access network (RAN)-enabled edge server at a first edge location is configured to perform a set of distributed unit (DU) functions for a radio-based network. The first RAN-enabled edge server is also configured to perform a set of core network functions and a set of centralized unit (CU) functions for the radio-based network. State associated with the set of core network functions and the set of CU functions is synchronized between the first RAN-enabled edge server and another server.

Abstract: Disclosed are various embodiments for automated deployment and management of distributed units (DUs) in a radio-based network. In one embodiment, it is determined to deploy a radio-based network at least partially using infrastructure of a cloud provider network. A radio access network (RAN)-enabled edge server of the cloud provider network is deployed to a physical location of the radio-based network. The RAN-enabled edge server is configured to perform a set of distributed unit (DU) functions for the radio-based network.

Abstract: Respective network addresses are assigned to a networking hardware device and a network function accelerator incorporated within an offloading card of a virtualization server by a control plane server of a virtualized computing service. A compute instance is launched at the virtualization server using a virtualization controller of the offloading card. The compute instance executes a network function of a radio-based application in response to a request received using the network address assigned to the hardware device, and requests execution of a second network function at the accelerator. The result of the second network function is sent to a radio unit of the application using the address assigned to the accelerator.

Abstract: At a radio-based application pipeline processing server at which a portion of a distributed unit (DU) of a radio-based application is implemented, a particular networking hardware device is selected from among several devices (which include least one device incorporated within a network function accelerator card and at least one device which is not part of an accelerator card) for transmission of at least a portion of mid-haul traffic to a centralized unit (CU). The mid-haul traffic is transmitted to the CU via the selected device. At least a portion of front-haul traffic is transmitted to a radio unit (RU) via a networking hardware device incorporated within a network function accelerator card of the server.

Abstract: Systems and methods are described for implementing an event tracing system for an open radio access network (“RAN”). A RAN implementation may be distributed across multiple components, including both special-purpose components such as radio units and general purpose components such as local or cloud-based servers. A RAN event tracing system may thus be used to troubleshoot issues with the RAN implementation by collecting information from distributed components regarding events that occur on these components during the translation of data into radio signals and vice versa. The RAN event tracing system may be used to search for events associated with a particular identifier, such as a radio network temporary identifier, and to display representations of radio frames that were generated by the components and display information regarding the events that led to the placement of particular resource elements onto the radio frames.

Abstract: Disclosed are various embodiments for customer-managed authentication in radio-based networks. In one embodiment, a radio-based network is managed for an organization. The radio-based network includes a radio access network and an associated core network. A request is received from the organization to configure one or more parameters affecting primary keys in the associated core network. The primary keys correspond to pre-shared keys of client devices permitted to access the radio-based network. Storage of the primary keys is customized in the associated core network based at least in part on the one or more parameters in response to the request.

Abstract: A first extension resource group (ERG) of a provider network, comprising a radio-based application pipeline processing server with a network accelerator card, is configured at an external premise. A first set of network functions of a radio-based application is executed at the card. A second ERG is configured at the premise, and a second set of network functions of the radio-based application is executed at the second ERG.

Abstract: A portion of a radio-based application (RBA) is executed at a first runtime environment (RTE) launched at a server. The first RTE includes a software program for processing messages between a pair of layers of the RBA. In response to determining that the portion of the RBA is to be executed at a second RTE, at least a subset of state information pertaining to the inter-layer messages is transferred to the second RTE without pausing the RBA. After the state information is transferred, the portion of the RBA is run at the second RTE.

Abstract: Disclosed are various embodiments for intelligently selecting private radio-based networks or communication service provider (CSP)-operated radio-based networks. In one embodiment, it is determined that a particular application executed in a user equipment (UE) device requests to send data via a wireless network connection. It is determined to switch the wireless network connection in the UE device from a CSP-operated radio-based network to a private radio-based network based at least in part on the particular application or the data to be sent by the particular application. The wireless network connection is switched from the CSP-operated radio-based network to the private radio-based network. The data is sent via the wireless network connection using the private radio-based network.

Abstract: Disclosed are various embodiments for integrating communication service provider (CSP)-operated radio-based networks with existing private networks. In one embodiment, one or more parameters for provisioning a private radio-based network for an organization are received via an interface. Network information regarding an existing network of the organization is received via the interface. A configuration for a network element in the existing network is generated in order to interconnect the private radio-based network with the existing network.

Abstract: Disclosed are various embodiments for mobility between radio-based networks operated by communication service providers and private radio-based networks. In one embodiment, first data is sent or received via a private radio-based network using a wireless network connection in a user equipment (UE) device. It is determined to switch the wireless network connection in the UE device from the private radio-based network to a communication service provider (CSP)-operated radio-based network. The private radio-based network and the CSP-operated radio-based network utilize a cellular network standard. The wireless network connection switches from the private radio-based network to the CSP-operated radio-based network. Second data is sent or received via the CSP-operated radio-based network using the wireless network connection in the UE device.

Abstract: Disclosed are various embodiments for managing simultaneous use of private wireless local area networks (WLANs) and cellular radio-based networks. In one embodiment, a user equipment (UE) device authenticates for access to a cellular radio-based network using a profile in an electronic subscriber identity module (eSIM). The UE device determines to transfer data via a WLAN rather than the cellular radio-based network. The UE device requests an access credential for the WLAN from the cellular radio-based network. The UE device uses the access credential to connect to the WLAN to transfer the data.

Abstract: Disclosed are various embodiments for customer-defined capacity limit plans in communication networks. In one embodiment, a request for a service from a radio-based network is received from a first client device. A network function in the radio-based network is determined to be at a capacity limit. Service from the network function to a second client device to the network function is suspended in response to determining that the network function in the radio-based network is at the capacity limit and based at least in part on a rule set specific to the radio-based network. The first client device is provided access to the network function instead of the second client device.

Abstract: Disclosed are various embodiments for configurable security policies in radio-based networks. In one embodiment, a security event detection rule or a security event mitigation rule for a radio-based network is accessed. The radio-based network includes a radio access network and an associated core network. At least a portion of the radio-based network is operated by a cloud provider on behalf of an organization. A security event is detected based at least in part on the security event detection rule. At least one action is performed in response to the security event based at least in part on the security event mitigation rule.

Abstract: At a radio-based application pipeline processing server at which a portion of a distributed unit (DU) of a radio-based application is implemented, a particular networking hardware device is selected from among several devices (which include least one device incorporated within a network function accelerator card and at least one device which is not part of an accelerator card) for transmission of at least a portion of mid-haul traffic to a centralized unit (CU). The mid-haul traffic is transmitted to the CU via the selected device. At least a portion of front-haul traffic is transmitted to a radio unit (RU) via a networking hardware device incorporated within a network function accelerator card of the server.