Expeto Platform Overview⚓︎

The Expeto Platform is a software extension to a mobile operator's core network. It lets the operator offer private mobile networking to its enterprise customers on the operator's own SIMs: the same subscriber identity works on the public macro network and on private radios at the customer's site, and in both cases the device arrives on the enterprise's own IT network as an ordinary endpoint, with a private address, the customer's subnets, and the customer's security policy.

The Expeto Platform is licensed to and hosted by the mobile operator, or by the operator's enterprise customer for the on-site elements. The operator is Expeto's customer; the enterprise is the operator's customer.

Product groups and component names⚓︎

Expeto's commercial material uses three product group names. The software and this documentation use the component names. This table describes the mapping:

How the pieces fit together⚓︎

A subscriber reaches its enterprise network by one of two access paths.

Public radio. The device attaches to the operator's macro network: 4G, 5G non-standalone, which is anchored on the 4G core, or 3G. The operator's core hands the session to xRouter over standard 3GPP interfaces. xRouter authenticates the subscriber against its own HSS and forwards the user plane to the customer's dedicated xCore over a secure link. The link is provided by the operator and carries user-plane traffic only; signaling and authentication are handled at xRouter and never traverse it. The implementation of the link is the operator's choice; IPsec is one option where a customer's accreditation requires it.

Private radio. The device attaches to radios on the customer's site, which connect directly to xCore. The entire path, including authentication against a local HSS or UDM inside xCore, stays inside the customer's trust domain. xRouter is not involved, and the site continues to operate if its backhaul is lost.

On both paths the user plane terminates in xCore and is delivered to the enterprise's corporate subnets, where the customer's own firewall, DLP, inspection and SIEM apply. Employee, IoT and application traffic can be segmented into separate subnets from the same xCore.

Management. xControl reaches every xCore and xRouter through a software agent that opens an outbound TLS connection on port 443 from the managed component. That channel carries configuration and policy down, and call detail records and metrics up. It is a management channel, separate from the 3GPP control plane: if xControl is unreachable, xCore keeps authenticating devices, attaching sessions and carrying traffic, queues its metrics, and reconciles when the connection returns. Emergency changes during an extended outage can be made from a CLI on xCore directly.

Hosting and deployment⚓︎

All components run on Kubernetes. xRouter, xControl and xView are deployed in the operator's data center on the container platform the operator already runs (Red Hat OpenShift, VMware Tanzu, Canonical MicroK8s, or a managed Kubernetes service); geographic redundancy is a second cluster. xCore is deployed per customer in one of three places: the customer's data center, a customer-controlled cloud, or the operator's environment as a managed service. When the operator hosts xCore, customer instances are logically separate and may share physical infrastructure. Deployment is infrastructure-as-code: Expeto ships Helm charts and operators that carry the operational knowledge, the operator or its hardware partner installs the cluster, and the core is deployed jointly.

How this documentation is organized⚓︎

The remaining sections are written per component, using the component names throughout.