T-mobile Innovations LLC

Sprint Communications Comapny L.p.

T-mobile Usa, Inc.

Sprint Spectrum L.p.

Priority Call Management, Inc.

Gregory David Schumacher

Marouane Balmakhtar

Serge M Manning

Geoffrey Todd Gibson

Patrick John MeLampy

Robert F Penfield

Kun Lu

John W Davis

Bonnie Chen

A wireless communication network serves a Network Exposure Function (NEF) slice to User Equipment (UE). An Access and Mobility Management Function (AMF) selects a NEF slice for the UE. A Session Management Function (SMF) selects a NEF address for the NEF slice for the UE. A User Plane Function (UPF) exchanges Application Programming Interface (API) calls and responses between the UE and a NEF based on the NEF address. The NEF exchanges the API messages with the UE over the UPF. The NEF slice may comprise an edge NEF slice that is selected based on the geographic location of the UE and that features a local NEF element that is coupled to a core NEF element.

Network exposure function (NEF) slice in a wireless communication network

A wireless communication network serves random data integrity protection to a User Equipment (UE). A network controller selects the random data integrity protection for a UE session based on UE context. The network control signals the random integrity protection for the UE session to a wireless access node which signals the UE. A wireless access node generates data units for an interval. The wireless access node randomly selects ones of the data units to reach a downlink amount for the interval. The wireless access node converts the selected data units into integrity-protected units. The wireless access node wirelessly transfers the unprotected data units and the integrity-protected units to the UE. The UE determines the amount of the integrity-protected data units for the interval. The UE determines data integrity of the unprotected data units based on the amount of the integrity-protected units for the interval.

Random data integrity protection in a wireless communication network

Systems and methods are provided for rapid user equipment route selection policy rule processing. A method includes determining an applicable routing policy based on user equipment route selection policy (URSP) rules for an established protocol data unit (PDU) session and storing PDU session information with the established uplink PDU session in a cache. The method further includes examining subsequent uplink packets for PDU session information and checking the cache for an established PDU session with matching uplink PDU session information. The method additionally includes routing the subsequent uplink packets to the established PDU session having the matching PDU session information, causing the subsequent uplink packet to be processed in accordance with the applicable routing policy as previously determined based on the URSP rules.

Rapid user equipment route selection policy rule processing

A method comprises receiving, by a threat level engine (TLE) in the network, security data from a plurality of different sources, wherein the security data comprises data regarding traffic related to a security threat occurring in the network, determining, by the TLE, a security related event indicating a security threat occurring at network elements in the network based on security key performance indicators and the security data, when a threat impact level of the security related event exceeds a threshold, determining, by the TLE, a remediation action for the security related event based on the threat impact level, transmitting, by the TLE to a policy decision point, an instruction to generate and store a rule based on the remediation action for the security related event, and transmitting, to a policy enforcement point, an authorization to create the secure tunnel between the one or more network elements and another endpoint.

Security threat mitigations in a zero trust network architecture

In a wireless communication system, a source access node receives a security policy for a User Equipment (UE) from a wireless network core. The wireless network core and the UE establish security context over the source access node. The wireless network core and the UE exchange user data over the source access node based on the security context. The source access node handsover the wireless UE to a target access node and transfers the security policy for the wireless UE to the target access node. The target access node signals the wireless network core to establish new security context for the wireless UE responsive to the security policy. The wireless network core and the wireless UE establish new security context over the target access node. The wireless network core and the UE exchange additional user data over the target access node based on the new security context.

Wireless data service delivery to a wireless UE based on a security policy for the wireless UE

A system includes a policy control function (PCF) that receives an indication from a mobile device in a wireless cellular network that indicates a secure connection between the mobile device and an endpoint in the wireless cellular network. The secure connection is associated with a security policy that includes a first set of parameters and operates at a first level of granularity and a routing policy that includes a second set of parameters and operates at a second level of granularity. The PCF then determines a mapping between the first set of parameters and the second set of parameters that aligns the first level of granularity with the second level of granularity. In an example, the alignment improves the utilization of network resources in the wireless cellular network. The mapping is then transmitted to the mobile device, which enables the mobile device to use the secure connection.

Integrating security and routing policies in wireless telecommunication networks

A home network serves a wireless service to visiting User Equipment (UEs) affiliated with visited networks and authorizes the wireless service for home UEs that are visiting the visited networks. A gateway transfers home context to a distributed ledger and receives visited context from the distributed ledger. The gateway transfers the visited context to a controller. The controller exchanges authorization data with the visited networks based on the visited context and the home context. The controller authorizes the wireless data service for the home UEs and the visiting UEs responsive to the exchange of the authorization data. The controller transfers session signaling to wireless access nodes responsive to the authorization of the wireless data service for the visiting UEs. The controller transfers authorization signaling to the visited networks responsive to the authorization of the wireless service for the home UEs.

Wireless communication network authorization of home user equipment and visiting user equipment

Systems and methods for providing multi-factor authentication based on visual objects associated with an out of band shared secret delivery channel and at least one user device of a telecommunication network include an access point communicatively coupled to an authentication system. The authentication system is structured to generate a set of visual objects, cause the set of visual objects to be output by a first user device, transmit, via an out of band shared secret delivery channel, a visual object request to cause a secondary user device to output one or more out of band visual objects, receive an indication of object selection from the set of visual objects, determine that the indication of the object selection is associated with a visual selection match among the set of visual objects, and based on the visual selection match, authenticate access to an application associated with the authentication system.

Multimedia message (MMS) object sequences as multi-factor authentication (MFA) for user identification in 5G

Methods and systems for detecting false base stations are provided. A computing device transmits a request for a verification message to a base station. An encrypted verification message comprising a base station identifier and a signature encrypted using an encryption key associated with the base station is received by the computing device. The computing device decrypts the signature included in the encrypted verification message utilizing a decryption key associated with the computer system. Based on the decrypted signature, the computing device determines that the encryption key does not correspond to the decryption key. Based on determining that the encryption key does not correspond to the decryption key, the computing device stores the base station identifier in a data store in association with a false base station indicator.

Cryptographic identification of false base stations

Systems, methods, and processing nodes for managing a wireless communication session perform and/or comprise: receiving a privacy enable request from an application associated with a wireless communication device; masking an application identifier corresponding to the application, thereby to generate a masked application identifier; receiving an application attribute request from a route selection manager, the application attribute request including a request for the application identifier; and in response to the privacy enable request and the application attribute request, returning an application attribute request response to the route selection manager, the application attribute request including the masked application identifier.

System and method for masking user application usage

A wireless User Equipment (UE) delivers a priority communication service. In the UE, circuitry correlates a network Identifier (ID) for a wireless communication network with an instruction for the priority communication service. The circuitry identifies a user request for the priority communication service when the wireless UE is wirelessly attached to the wireless communication network. In response, the circuitry responsively identifies the instruction based on the correlation with the network ID. The circuitry exchanges network signaling with a radio based on the instruction and exchanges user data with the radio responsive to the exchange of the network signaling. The radio exchanges the network signaling and the user data with the UE circuitry and wirelessly exchanges the network signaling and the user data with the wireless communication network. The instruction may direct the circuitry to use an encoded public Uniform Resource Identifier (URI) to identify the UE to the wireless communication network.

Priority service over wireless communication networks

A token-based security risk assessment service for multi-factor authentication (MFA) is described. An enterprise may utilize the security risk assessment service, and a telecommunication service provider may provide the security risk assessment service as a network-based service. The security risk assessment service may be configured to monitor identifiers (IDs) of elements associated with users associated with an enterprise to determine if any have changed. Any changes may be factored into an adjustment to the user's security profile. Furthermore, the enterprise can utilize the security risk assessment service to implement a token-based MFA scheme where Short Message Service (SMS) is used as an authentication factor.

Token-based security risk assessment for multi-factor authentication

Systems and methods are provided for dynamically generating intelligent alerts at a network edge based on coverage area characteristics. A central alert orchestrator within the network determines target edge locations and forwards alerts to regional alert systems at the target edge locations. The regional alert systems modify either content of the alert or the alert metadata or both based on characteristics of the alerts and the coverage area.

Dynamic intelligent alert edge computing system and method

System and method for creating a secure enclave for User Equipment Route Selection Policy (URSP) rules in User Equipment (UE) in 5G to prevent malicious tampering and modification of the URSP rules. When the URSP rules are changed, a request is sent to receive a new set of URSP rules or receive an update of the URSP rules.

Secure enclave of UE route selection policy rules in the 5G device or network slicing

Techniques, devices, and systems for implementing a Priority Data Transport Service (PDTS) are disclosed. The PDTS provides authorized devices and/or authorized users with on-demand, priority data transport (e.g., priority Internet access). For example, the PDTS allows authorized devices and/or authorized users to access the Internet, use mobile applications, and/or send and receive image data, video data, and text data in a prioritized manner, as compared to the regular (non-priority) Internet access that is provided to non-subscribers of the PDTS over commercial telecommunications networks. An authorized user may activate and deactivate the PDTS on demand. For instance, the PDTS may be activated during an emergency or crisis situation when networks may be congested, thereby providing the user with priority data transport (e.g., priority Internet access) in an emergency or crisis situation when a telecommunications network may be overloaded.

Growing community of inventors

Holliston, MA, United States of America

Gregory David Schumacher