T-Mobile USA, Inc.

Andrew Lee Watts

Eric W Yocam

Ahmad Arash Obaidi

Shawn David Corey

Homer Nicolas B Filart

Mark McDiarmid

Raymond Thomas Ball

Michael A Bishop

Paul Farag

Jose R Mendoza, Jr

Systems, methods, and devices can be utilized to verify wireless local area networks (WLANs) using fingerprints. An example method includes identifying a received fingerprint comprised in an advertisement message that is received by a user equipment (UE) at a time and within a coverage area. A source of the advertisement message is determined to be a rogue WLAN by determining that the received fingerprint is different than a verified fingerprint transmitted by an authorized WLAN at the time and in the coverage area. The UE outputs an alert indicating the rogue WLAN.

Wireless network verification using fingerprints

The present disclosure describes techniques that facilitate the encryption of data communications between a home and VPLMN, along with the verification of a content and origin of encrypted messages at each end of a data communication. In one non-limiting example, the process of verifying the content and origin of an encrypted message is facilitated partly by an exchange of network public keys between the HPLMN and VPLMNs. In another example, a network certificate aggregator (NCA) may act as a certificate authority (CA) by verifying the identities of interacting home and VPLMNs. The NCA may facilitate and exchange public keys between a home and VPLMN, whereby the HPLMN and VPLMNs need only trust and verify an identity of the NCA. Alternatively, the NCA may act as a conduit for data communications between the HPLMN and VPLMN.

End-to-end security for roaming 5G-NR communications

An Autonomous System (AS) may receive an AS route update from a remote AS at an isolated border gateway (BGW) router of an AS. The AS may analyze a data traffic routing path in the AS route update to determine whether the AS route update is a problematic update, the data traffic routing path for routing data traffic through a plurality of ASs that include the AS. In response to determining that the AS route update is a non-problematic update, the AS may implement the AS route update into the one or more operational BGW routers of the AS to route the data traffic between the plurality of ASs. In response to determining that the AS route update is a problematic update, the AS may designate the AS route update from the remote AS as unsuitable for implementation into one or more operational BGW routers of the AS.

Problematic autonomous system routing detection

A network hub may be field programmable (e.g., upgradeable). A network hub may be operated with first settings for a configurable software defined radio (SDR) when the network hub receives an update from a server computer over a computer network. Upon installing the update, and rebooting the network hub, settings of the configurable SDR may be changed from the first settings to second, different settings, the second, different settings causing the network hub to operate using a second cellular-based radio technology that is different from a first cellular-based radio technology enabled by the first settings of the configurable SDR.

Field programmable network hub with software defined radio

Technologies for using edge devices in a cellular network as compute nodes to participate in a blockchain network are described. A cellular network may provision one or more edge devices in communication with the cellular network to instantiate a virtual machine on the edge device to act as a compute node. The cellular network may submit a bid to solve a blockchain hash function using the compute nodes and may instruct the edge to solve the blockchain hash function.

Provisioning edge devices in a mobile carrier network as compute nodes in a blockchain network

A Secure Telephony Identity (STI) proxy server is described for intercepting incoming Voice over Internet Protocol (VoIP) communication requests for the purpose of mitigating an effect of fraudulent and nuisance VoIP communications. The STI proxy server may facilitate an STI verification server in verifying an authenticity of an originating network associated with an incoming call request. In one example, the STI proxy server may verify that the visited network is permitted to interact with the home network, based on a list of permissible networks. In addition, the STI proxy server may determine whether public STI certificates associated with an originating network have expired or set to expire within a predetermined time interval. In response to an actual o impending expiration, the STI proxy server may facilitate retrieval of a superseding, new public STI certificate for use by an STI authentication server to digitally sign an outgoing SIP INVITE messages.

Secure telephone identity (STI) certificate management system

Systems and techniques are provided for detecting rogue base stations and preventing malicious actors from intercepting and stealing data traffic from mobile devices through rogue base stations. Upon connecting to a newly detected base station for a cellular network service, a mobile device attempts to validate the cellular base station with a validation server before any data is transmitted over the new connection. If the mobile device does not receive a confirmation of validity from the validation server, the mobile device would identify the cellular base station as a rogue base station, disconnect from the rogue base station, and search for a valid base station for connection to the cellular network.

Network assisted validation of secure connection to cellular infrastructure

A network hub may be configured to dynamically select a desired frequency (among available licensed spectrum holdings of a carrier) at which to operate. A network hub may send a current geographic location of the network hub to a server computer, and, in response, the network hub may receive, from the server computer, multiple available frequencies at which a configurable software defined radio (SDR) of the network hub can be configured to operate. The network hub may perform a network scan to determine respective current conditions of individual frequencies of the multiple available frequencies, select a particular frequency based at least in part on the current conditions of the individual frequencies, and configure the configurable SDR to operate at the selected frequency.

Dynamic frequency selection for network hub with software defined radio

A network hub may be configured to implement a firewall policy in order to restrict access by designated applications executing on the network hub to particular Internet of Things (IoT) data from designated IoT devices. A network hub may receive data packets from an IoT device, analyze the data packets against a firewall policy stored in memory of the network hub to determine whether an application executing on the network hub is allowed to receive at least a portion of data within the data packets, and allow or deny the application access to at least some of the data based at least in part on the firewall policy.

Internet of things (IoT) device firewalling

A network hub may be unlockable into a development environment at various levels of access to implement tiered unlocking. A network hub may send a request to a server computer for a device-specific certificate that is usable to unlock the network hub, the request including (i) a requested level of access, and (ii) a device identifier (ID) associated with the network hub. The network hub may receive the certificate from the server computer, reboot, determine whether the certificate is associated with a trusted entity, and, if so, unlock the network hub at the requested level of access as an unlocked network hub. The unlocked network hub allows for particular development activities (e.g., flashing custom software), but depending on the requested level of access, may or may not allow a user to change settings of a configurable software defined radio (SDR) of the network hub and/or flash custom firmware.

Tiered developer unlock of network hub with software defined radio protection

A method of selecting a virtual machine (VM) on a mobile device within a wireless communication network based upon context of an incoming event. For example, a virtual intelligence engine can select a VM to handle an incoming phone call based upon the context of the phone call. If the phone call is work-related, then the virtual intelligence engine may select a first VM, while if the incoming phone call is a personal phone call, then the virtual intelligence engine may select a second VM different from the first VM. The VMs can utilize different operating systems.

Selecting a virtual machine on a mobile device based upon context of an incoming event

System and method of geo-fencing. A user equipment (UE) defines a geo-fence for an asset by tracking location coordinates of the UE with at least one sensor element, as the UE is moved around a perimeter of an area. The location coordinates of the geo-fence are transferred to a location aware device (LAD) attached to the asset. Upon determining, by the at least one sensor, that the LAD crossed the geo-fence, a notification is sent to a warning server operative to trigger a warning message to one or more recipients.

Growing community of inventors

Seattle, WA, United States of America

Andrew Lee Watts