Abstract: A device may comprise a processor. The processor may be configured to determine, based on secure space information associated with the secure space, whether the device has entered the secure space. If the processor determines that the device has entered the secure space, the processor may disable an ability of the device to communicate wirelessly with networks other than a private network; enable an ability of the device to communicate wirelessly with the private network; connect the device wirelessly to the private network; and run an application hosted on the private network.

Abstract: A method, a device, and a non-transitory storage medium are described in which a dynamic C-DRX provisioning service is provided. The service may disable or enable discontinuous reception on a per end device application or network slice basis. The service may invoke an end device capability procedure to modify a discontinuous reception configuration of a network. The service may store information that correlates an application or network slice to a discontinuous reception setting.

Abstract: A device may receive a request to establish a virtualized environment to support a session for a client device in communication with the computing device over a network. The device may instantiate the virtualized environment in a trusted execution environment of the device, wherein the trusted execution environment may include one or more hardware resources that isolate the virtualized environment from a rich execution environment associated with the device. The device may cause a hardware security module associated with the device to obtain one or more cryptographic keys by communicating with a secure element of the client device, and the device may secure communication between a local operating system executing on the client device and the virtualized environment instantiated in the trusted execution environment using the one or more cryptographic keys.

Abstract: A method, a device, and a non-transitory storage medium are described in which a dynamic C-DRX provisioning service is provided. The service may disable or enable discontinuous reception on a per end device application or network slice basis. The service may invoke an end device capability procedure to modify a discontinuous reception configuration of a network. The service may store information that correlates an application or network slice to a discontinuous reception setting.

Abstract: A method, a device, and a non-transitory storage medium are described in which a security service of end device profiles is provided. The service may include obtaining a profile for a card of an end device from a third party device in which the profile includes first and second executables. For example, the first and second executables may each include a subscriber identification module. The first executable may initialize and subsequently perform a switching procedure that enables the second executable to replace the use of the first executable. The first executable may also generate a key that can be used to provision the second executable on the end device.

Abstract: Systems and methods described herein provide a network-based solution to efficiently transition private network subscribers from a macro network to a private network. A network device in the macro network stores a neighbor list identifying a private network that has overlapping coverage with a cell for the macro network. The network device detects that a user equipment (UE) device connected to the network device has a subscription to the private network and, in response to the detecting, sends, a release message to the UE device. The release message includes a redirection to the private network.

Abstract: A device comprises a processor that may be configured to obtain a Public Land Mobile Network (PLMN) identifier (ID) from a signal broadcast by a network and determine whether the obtained PLMN ID is an original preferred PLMN ID of the device. When the processor determines that the obtained PLMN ID is the original preferred PLMN ID, the processor may attempt to attach to the network over a wireless link. When the attempt to attach to the network fails, the processor may rewrite, in a list of PLMN IDs, a non-preferred PLMN ID as a new preferred PLMN ID.

Abstract: A method, a device, and a non-transitory storage medium are described in which a third party subscription management of end device profiles service is provided. The service may include obtaining a profile for a card of an end device from a third party device in which the profile includes a temporary element. For example, the temporary element may be a temporary keyset or a temporary USIM. During initial connectivity and activation with a core network, the card logic may obtain and update the profile with a permanent element for registration and activation procedures with the core network. In this way, security exposure with a third party device relating to a profile may be eliminated or minimized.

Abstract: A device may obtain, from a pool of subscription identifiers allocated for sharing, a subscription identifier for a target device to be onboarded onto a wireless network. The device may generate a derived subscriber identification module (SIM) profile that includes the subscription identifier and a derived set of credentials. The derived set of credentials may be based on an existing set of credentials associated with the device. The device may cause the derived SIM profile to be provided to the target device to enable the target device to obtain access to the wireless network.

Abstract: In some implementations, a first network device may receive an authorization request associated with a user device connecting to a network associated with first network device. The first network device may redirect the authorization request toward a second network device associated with a second service provider. The first network device may determine, based on a response to the authorization request, that the user device is subscribed to a service provided by the second service provider and that the user device is not authorized to connect to the network. The first network device may provide a temporary service to the user device to enable the user device to connect to the network for a limited period based on the user device being subscribed to the service provided by the second service provider and the user device not being authorized to connect to the network.

Abstract: A user device may receive information indicating that a universal integrated circuit card has been installed in the user device, where the universal integrated circuit card may store a default table that includes network slice selection assistance information used to route data from the user device to correct slices of a network. The user device may execute an application stored in the user device based on receiving a selection of the application, where execution of the application may cause data to be generated. The user device may identify a slice of the network to which to route the data based on the network slice selection assistance information included in the default table. The user device may cause the data to be routed to the slice of the network identified based on the network slice selection assistance information included in the default table.

Abstract: A user equipment (UE), comprising at least one processor may be configured to transmit a first attach request to a first wireless network based on a first universal subscriber identity module (USIM). The UE may receive a rejection from the first wireless network and may switch from the first USIM to a second USIM based on the rejection. The UE may transmit a second attach request to the first wireless network based on the second USIM.

Abstract: In some implementations, a first network device may receive an authorization request associated with a user device connecting to a network associated with first network device. The first network device may redirect the authorization request toward a second network device associated with a second service provider. The first network device may determine, based on a response to the authorization request, that the user device is subscribed to a service provided by the second service provider and that the user device is not authorized to connect to the network. The first network device may provide a temporary service to the user device to enable the user device to connect to the network for a limited period based on the user device being subscribed to the service provided by the second service provider and the user device not being authorized to connect to the network.

Abstract: A method, a device, and a non-transitory storage medium are described in which a dynamic C-DRX provisioning service is provided. The service may disable or enable discontinuous reception on a per end device application or network slice basis. The service may invoke an end device capability procedure to modify a discontinuous reception configuration of a network. The service may store information that correlates an application or network slice to a discontinuous reception setting.

Abstract: A device may obtain, from a pool of subscription identifiers allocated for sharing, a subscription identifier for a target device to be onboarded onto a wireless network. The device may generate a derived subscriber identification module (SIM) profile that includes the subscription identifier and a derived set of credentials. The derived set of credentials may be based on an existing set of credentials associated with the device. The device may cause the derived SIM profile to be provided to the target device to enable the target device to obtain access to the wireless network.

Abstract: A first user device may provide, to a provisioning device, a request for a subscriber identity module (SIM) swap that causes provisioning data to be provided to a first SIM card of the first user device and from a second SIM card of a second user device. The first user device may generate a first encrypted token based on a first identifier associated with the first SIM card. The first user device may provide, to the provisioning device, the first encrypted token and a user identifier. The first user device may selectively receive the provisioning data when the first encrypted token matches a second encrypted token generated by the second user device based on a second identifier associated with the second SIM card, or receive a message indicating that the first user device cannot be provisioned, when the first encrypted token fails to match the second encrypted token.

Abstract: A device may obtain, from a remote SIM provisioning (RSP) platform associated with a wireless network, a subscription identifier for a target device to be onboarded onto the wireless network. The device may generate a derived set of credentials for the target device based on an existing set of credentials in a SIM profile associated with the device. The device may generate a derived SIM profile that includes the subscription identifier obtained from the RSP platform and the derived set of credentials, and the device may cause the derived SIM profile to be provisioned onto an embedded Universal Integrated Circuit Card (eUICC) of the target device. Accordingly, the derived SIM profile may enable the target device to use the derived set of credentials to obtain authenticated access to the wireless network.

Abstract: A first user device may provide, to a provisioning device, a request for a subscriber identity module (SIM) swap that causes provisioning data to be provided to a first SIM card of the first user device and from a second SIM card of a second user device. The first user device may generate a first encrypted token based on a first identifier associated with the first SIM card. The first user device may provide, to the provisioning device, the first encrypted token and a user identifier. The first user device may selectively receive the provisioning data when the first encrypted token matches a second encrypted token generated by the second user device based on a second identifier associated with the second SIM card, or receive a message indicating that the first user device cannot be provisioned, when the first encrypted token fails to match the second encrypted token.

Abstract: A device may receive a request to establish a virtualized environment to support a session for a client device in communication with the computing device over a network. The device may instantiate the virtualized environment in a trusted execution environment of the device, wherein the trusted execution environment may include one or more hardware resources that isolate the virtualized environment from a rich execution environment associated with the device. The device may cause a hardware security module associated with the device to obtain one or more cryptographic keys by communicating with a secure element of the client device, and the device may secure communication between a local operating system executing on the client device and the virtualized environment instantiated in the trusted execution environment using the one or more cryptographic keys.

Abstract: An orchestration device may receive a request to register available multi-access edge computing (MEC) resources to be shared with a network operator. For example, the available MEC resources may be provided by a provider operating a MEC host located in an edge region of a radio access network (RAN) associated with the network operator. The orchestration device may receive information related to a requested MEC session to support an application workload for a user equipment in communication with a base station located in the edge region of the RAN and assign at least a portion of the application workload to the MEC host based on a profile for the MEC host and a service level agreement specifying one or more performance requirements associated with the application workload. Accordingly, the orchestration device may cause the portion of the application workload to be transmitted to the MEC host.