How does Apple manage Private Networks in iOS17?
So Apple on iOS typically manages cellular networks via a system of operator bundles, i.e. plist files with key values. Back in the glory days you could upload your own profile with iTunes using a shift-click trick but iOS3 started to sign those bundles, preventing modifications by the user, and iOS4 introduced OTA updates for that via some servers from Apple, like the old phobos.apple.com.
Back to iOS17. Apple announced Private Networks official support with a list of compatible PLMNs (999-XXX, German 262-98, Swedish 240-41/49 and US CBRS 315-010) and a functionality of Geofencing via MDM profiles (i.e. enterprise provisioning files) to basically override WiFi preference and optimize battery life to have the device looking for the actual private networks only when on premises, anticipating a problem that the industry has probably yet to rediscover.
But then, what kind of default settings is using Apple on those networks ? Turns out, they did not use external profiles downloadable via OTA (i.e. visible via a script like IPCC-downloader), but they actually shipped with the phone firmware under the System/Library/Carrier Bundles/iPhone folder under the name NonPublicNetwork.bundle.
So to fetch it, in a nutshell:
- find your target phone firmware on ipsw.me
- unpack the ipsw as a zip file
- mount the DMG under OS or using APFS Fuse on Linux
and then look for the bundle.
So in that version (17.03):
- no IMS/voice activated by default
- 5G SA is activable
- 4G cannot be disabled
- emergency called are banned from those networks
- default carrier name “Non-Public Network”
- geofencing is enabled
I welcome the support of private networks in iOS, but to be honest, the choice of shipping the bundle via OS updates and the lack of “quick forcing” capabilities with COTS devices is still a bummer to experiment with Private Networks - again, this will leave trials in lab to Android devices with root capabilities and flexible VoLTE/VoWiFi stack like Xiaomi devices. sXGP market in Japan is looking at replace DECT via a private networks with VoLTE support, so Apple devices are not yet ready for this out of the box. Nevertheless, Apple’s move is really going to help the private network industry in the short term by facilitating the use of their devices with CBRS networks in US. Now let’s hope European regulators can move forward and open the gates, and other regions to follow.