Kineto Wireless, Inc.

Fortinet, Inc.

Aeris Communications, Inc.

Amit K Khetawat

Michael Douglas Gallagher

Patrick Tao

Rajeev Gupta

Milan Markovic

Rajesh I Balay

Sachin Desai

Chandramouli Sargor

Francois Lemarchand

Swaran Singh Sethi

Drew S Johnson

Milan Markovle

Rajeey Gupta

Karan Kapoor

Asit Goel

A computer-implemented method, system and computer program product for providing secure access to devices enabled for connectivity using access control are disclosed. The computer-implemented method for providing secure access to devices enabled for connectivity comprises dynamically associating each of the one or more devices to at least one user account; assigning an IP address to each of the one or more devices enabled for connectivity; dynamically generating at least one access-control list (ACL) for each of the one or more devices associated with the at least one user account; and restricting access only to the at least one user account via ACL generated for the one or more devices.

Method and system for providing secure access to IoT devices using access control

Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a connection for a subscriber is created based on a service context of the subscriber. A connection request is received from a subscriber of a network service delivery environment. The subscriber is associated with a first-level profile identifier indicative of a service context for the subscriber. One or more other subscribers can be associated with the first-level profile identifier. Lower-level profile identifiers are determined using the first-level profile identifier. The lower-level profile identifiers indicate a set of services that is available to the subscriber during the connection. Creating a connection for the subscriber that enables forwarding of packets based on the lower-level profile identifiers.

Managing hierarchically organized subscriber profiles

Some embodiments are implemented in a communication system that includes a first wireless communication system and a second wireless communication system that includes a Femtocell access point (FAP) and a network controller that can communicatively couple the FAP to the first wireless communication system. In some embodiments, the network controller can communicatively couple to the first wireless communication system through a UTRAN Iu interface. In some embodiments, the FAP can communicatively couple to a user equipment using a short-range licensed wireless frequency. Some embodiments provide a method of performing a user equipment (UE) registration. The method establishes a unique connection dedicated to the UE between the FAP and the network controller. The method receives a register request message at the network controller from the FAP through the dedicated connection.

Method and apparatus for user equipment registration

Some embodiments are implemented in a communication system that includes a first wireless communication system and a second wireless communication system that includes a Femtocell access point (FAP) and a network controller that can communicatively couple the FAP to the first wireless communication system. In some embodiments, the network controller can communicatively couple to the first wireless communication system through a UTRAN Iu interface. Some embodiments provide a resource management method that determines that a user equipment (UE) has roved in a region serviced by the FAP. The FAP includes a generic access resource control (GA-RC) protocol sub-layer. The method creates a separate GA-RC state dedicated to the UE in the GA-RC protocol sub-layer. The method also sets the GA-RC state dedicated to the UE to a deregistered state to indicate that the UE is not registered to use the services of the second wireless communication system.

Method and apparatus for establishing transport channels for a femtocell

Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a policy engine of a VR defines services available to subscribers in terms of profile identifiers. A scalable subscriber profile database is established having a memory requirement dependent upon the number of available service contexts by hierarchically organizing profile identifiers as leaf profile identifiers, which explicitly define services, and intermediate profile identifiers, which indirectly represent services. The policy engine receives a first-level profile identifier and determines whether it is among those stored in the database. If not, then it obtains service profile information associated with the first-level profile identifier. If the first-level profile identifier is an intermediate profile identifier having leaf profile identifiers, then it further obtains them and associated profile information and stores this information in the database. The first-level profile identifier and the associated service profile information are also stored in the database.

Some embodiments are implemented in a communication system that includes a first wireless communication system and a second wireless communication system that includes a Femtocell access point (FAP) and a network controller that can communicatively couple the FAP to the first wireless communication system. In some embodiments, the network controller can communicatively couple to the first wireless communication system through a UTRAN Iu interface. In some embodiments, the FAP can communicatively couple to a user equipment using a short-range licensed wireless frequency. Some embodiments provide method of securing communication between the FAP and the network controller. The method establishes a secure tunnel between the FAP and the network controller. The method communicatively couples the FAP and several user equipments (UEs) to the network controller by using the secure tunnel. The UEs are communicatively coupled to the FAP through an air interface.

Method and apparatus for securing communication between an access point and a network controller

Some embodiments are implemented in a communication system that includes a first communication system comprised of a licensed wireless radio access network and a core network, and a second communication system comprising a plurality of user hosted access points and a network controller. In some embodiments, each access point operates using short range licensed wireless frequencies to establish a service region. In some embodiments, the network controller communicatively couples the core network to the plurality of access points. The method enables an unauthorized user equipment to call from an access point it is not allowed to use for emergency purposes. The method receives at an access point a service request from an unauthorized user equipment with an establishment cause of emergency call. The method sends a registration request to the network controller. The method sends a message to the core network indicating the location of the user equipment.

Method and apparatus for routing of emergency services for unauthorized user equipment in a home Node B system

Some embodiments are implemented in a communication system that includes a first wireless communication system that includes a Femtocell access point (FAP) and a network controller that can communicatively couple the FAP to a second wireless communication system. In some embodiments, the network controller can communicatively couple to the second wireless communication system through a UTRAN Iu interface. In some embodiments, the FAP can communicatively couple to a user equipment using a short-range licensed wireless frequency. Some embodiments provide method that determines whether a user equipment (UE) has roved-out of the first wireless communication system. The method receives a periodic message at the FAP from the UE. When the FAP fails to receive a pre-determined number of the periodic messages, the method sends a deregister message to the network controller over a unique connection dedicated to the UE and releases the dedicated connection.

Method and apparatus for determining rove-out

Some embodiments of the invention provide a communication system that includes a first communication network, a second communication network, and a core network. The second communication network includes a network controller and a group of two or more access areas that are communicatively coupled to the core network by the network controller. Some embodiments service the second network access areas by providing access area identifiers to each access area while communicating with the first network or core network using a single are identifier assigned to the network controller. Some embodiments provide access control by sending a series of invalid messages to a user equipment (UE) that is not authorized to access services of the second network to reject the UE. Some embodiments reject the UE by sending a message to ban a UE from an access area with a particular access area identifier.

Femtocell integration into the macro network

Some embodiments provide a method of registering a user equipment (UE) in a communication system that includes a licensed wireless communication system and a generic access network (GAN) that has a generic access network controller (GANC). The method sends a register request message from the UE to the GANC that indicates a GAN mode capability of A/Gb only for the UE. When the GANC has a GAN mode capability of A/Gb, the GANC registers the UE with the GAN. When the GANC has a GAN mode capability of Iu only, the GANC rejects the register request message. When the GANC has a GAN mode capability of both A/Gb and Iu, the GANC registers the UE based on a set of GANC mode selection rules that the GANC applies for registering UEs with the GAN.

Method and apparatus for activating transport channels in a packet switched communication system

A method of preventing theft of service in a communication system that includes a first wireless communication system and a second wireless communication system that includes a Femtocell access point (FAP) and a network controller that can communicatively couple the FAP to the first wireless communication system. The method creates an authorized session that includes a session identify for a first user equipment (UE). The UE is recognized by the first communication as an authorized UE to use the FAP. The method rejects a request by the FAP to register a second UE when the identity of the second UE does not match any identity in the set of first UE identities. The rejected request includes the session identity of the authorized session and the identity of the second UE. The second UE is not recognized by the first communication system as an authorized UE to use the FAP.

Method and apparatus for preventing theft of service in a communication system

Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment of the present invention, a subscriber connection is created with a virtual router operable within a telecommunications system of a service provider. A connection request is received from a subscriber of multiple subscribers of the service provider at a subscriber manager of the virtual router. The virtual router maintains a database of hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected by (i) explicitly defining the subscriber services or (ii) referring to one or more of the multiple lower-level profile identifiers. If the subscriber is successfully authenticated, a connection is created by creating and configuring a virtual interface within the virtual router for the subscriber connection based on the subscriber's first-level profile identifier.

Some embodiments provide a method of activating a packet transport channel (PTC) in a communication system that includes a first licensed wireless communication system and a second generic access network (GAN) that has a generic access network controller (GANC). The GANC is communicatively coupled to the first communication system through a universal mobile telecommunication system (UMTS) terrestrial radio access network (UTRAN) Iu interface. The method sends a GA-PSR activate PTC request message from the GANC to a user equipment (UE). The message comprises a terminal endpoint identifier (TEID) that the GANC assigns to the UE. The message also receives a GA-PSR activate PTC acknowledge message from the UE at the GANC.

Generic access to the Iu interface

Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment, subscriber services are modified without requiring a change to the subscriber's first-level profile identifier and without requiring the subscriber to reestablish a connection with the service provider. A database of hierarchically organized profile identifiers, including multiple lower-level profile identifiers, explicitly defining subscriber services, and multiple first-level profile identifiers, defining service contexts representing combinations of services available to subscribers by (i) explicitly defining the subscriber services or (ii) referring to one or more of the lower-level profile identifiers, are maintained within a virtual router operable within a telecommunications system of the service provider. Updated service profile information, representing a change to the subscriber's service context, is received. Responsive the updated service profile information, lower-level profile identifiers currently associated with the subscriber's first-level profile identifier are replaced with lower-level profile identifiers corresponding to the updated service profile information.

Apparatus are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a router includes a subscriber manager, a database and a virtual interface. The subscriber manager is operable to receive a connection request from a subscriber of a service provider. The database has stored therein hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers. The virtual interface defines a subscriber connection between the router and the subscriber and is created and configured responsive to the connection request based on a first-level profile identifier that is associated with the subscriber.

Growing community of inventors

San Jose, CA, United States of America

Amit K Khetawat