Cisco Technology, Inc.

Ico Services Limited

Mark Grayson

Srinath Gundavelli

Santosh Ramrao Patil

Jerome Henry

Bart A Brinckman

Gangadharan Byju Pularikkal

Anton Okmyanskiy

Rajesh S Pazhyannur

Kevin Shatzkamer

Jayaraman R Iyer

Louis Gwyn Samuel

Malcolm Muir Smith

Eric Philippe Hamel

Anand K Oswal

Oliver James Bull

Timothy Peter Stammers

Indermeet Singh Gandhi

Mickael James Graham

Swaminathan A Anantha

Desmond Joseph O'Connor

Vimal Srivastava

Ramanathan T Jagadeesan

Bich Nguyen

Arun G Khanna

Sangram Kishore Lakkaraju

Matthew Stephen MacPherson

Jonathan David Rosenberg

Steven Robert Donovan

Sudhir Kumar Jain

Mukesh Taneja

Ziv Nuss

Sourav Chakraborty

Dennis Roy Mullins

Richard Kyle Forster

Robert E Barton

Flemming Andreasen

Chris O'Rourke

Christopher Edwin Pearce

Shree N Murthy

Akram Ismail Sheriff

Shailender Potharaju

Biswaranjan Panda

Kedar Krishnanand Gaonkar

Andrew C Chung

Carlos M Pignataro

Nagendra Kumar Nainar

Hang Jin

Kent Kinchu Leung

Robert Edgar Barton

Frank Brockners

Francois Le Faucheur

Sandro Grech

Alon Ben Ami

Andrea Giustina

Daniel Wee

Marco Cesare Centemeri

Horia Miclea

Mark Allen Webb

Allaukik Abhishek

David Lake

Navan Narang

Thomas Goerke

Santhalingam Balasekar

Pascal Thubert

David Delano Ward

Patrick Wetterwald

Hendrikus G P Bosch

Sanjay Kumar

Louis F Menditto

Robert Michael Batz

Fred Jay Anderson

Ian McDowell Campbell

Rajeev Koodli

Humberto Jose La Roche

Irfan Ali

Andrew Frederick Myles

Richard Mandfred Pruss

Leigh M Chinitz

Arun C Alex

Amit S Phadnis

Vojislav Vucetic

Vinodh Kumar Ravindranath

Rajesh P Velandy

James Paul Seymour

Jagdish Venkata Sonti

Navneet Agarwal

Madhusudan Nanjanagud

Simon Dyke

Robert M Broberg

Ashish A Chandwadkar

Matthew Lawrence King

David Lindert

Richard Wyrwas

Yuyong Zhang

Rafael Mantilla Montalvo

Laurent Montini

Gaetan Feige

Mantha Ravi Sankar

Raghavaiah Avula

The presently claimed disclosure is directed to methods that may be implemented at a computer. Methods and systems consistent with the present disclosure may include extending protocols associated with authenticating client (i.e. supplicant) devices and with authorizing those supplicant devices to access a wireless network. These methods may include sending data relating to the failure of an authentication and/or an authorization process to a supplicant device attempting to access a wireless network. Methods discussed within may include securely sending failure codes or reasons to a supplicant device that identify why an authentication or authorization process failed. These methods may include sending messages between a supplicant device, an authenticator device, and an authentication and authorization server. After a first failure, the supplicant device may be able to access the wireless network after a reason or code of that failure has been reported to the supplicant device.

Openroaming augmentation method for EAP failures

Techniques for network communications are disclosed. These techniques include receiving a cryptographically generated device identifier (CGDI) and a public key relating to a wireless station (STA). The techniques further include determining a first hash based on decrypting the CGDI using the public key, and validating the first hash for an access network. The techniques further include identifying the STA in the access network using the CGDI based on binding the CGDI to a session associated with the STA and the access network.

Cryptographically generated device identifiers

Systems, methods, and computer-readable media are disclosed for facilitating bi-directional edge proxy-to-edge proxy communications across an enterprise firewall in 5G service-based architecture. In one aspect, a method includes receiving a subscription request from a user device to operate on a visited private network; determining that the user device is associated with a home network; and establishing a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, wherein the communication protocol enables bi-directional exchange of roaming signals between the visited private network and the home network while user device is operating on the visited private network.

Bi-directional communication protocol for private networks

Presented herein are techniques associated with providing an alternative network indication to a client device in a wireless local area network (WLAN) roaming federation. In one example a method is provided that may include obtaining access network information for each of a plurality of access networks that neighbor a first access network through connection of a client device with the first access network involving a first identity provider profile; determining an alternative access network with which the client device is recommended to seek connection or an alternative identity provider profiles with which the client device is recommended to connect to the first access network; and enabling the client device to initiate a connection with the alternative access network or to re-initiate a connection with the first access network utilizing the alternative identity provider profile.

Providing an alternative access network indication to a client device in a wireless local area network roaming federation

Presented herein are techniques associated with replicating an OpenRoaming™ policy federation in a Third Generation Partnership Project (3GPP) network environment. For example, techniques herein provide a roaming policy federation architecture for a 3GPP network environment. In one example a method is provided that may include encoding at least one multi-bit roaming policy for an identity provider and a plurality of bit-wise combinatorial permutations of the at least one multi-bit roaming policy within each of a plurality of multi-bit 3GPP broadcast identifiers, wherein the at least one multi-bit roaming policy includes bit-wise roaming policy information for the identity provider and configuring the multi-bit 3GPP broadcast identifiers for a mobile device associated with the identity provider, wherein the multi-bit 3GPP broadcast identifiers indicate that the mobile device is to connect to a visited radio access network associated with a local Internet Protocol (IP) access service or a home routed access service.

Providing a roaming policy federation in a third generation partnership project (3GPP) network environment

Presented herein are techniques to facilitate fast roaming between a mobile network operator-public (MNO-public) wireless wide area (WWA) access network and an enterprise private WWA access network. In one example, a method is provided that may include generating, by an authentication node, authentication material for a user equipment (UE) based on the UE being connected to a public WWA access network, wherein the public WWA access network is associated with a mobile network operator, and the authentication node and the UE are associated with an enterprise entity; obtaining, by the authentication node, an indication that the UE is attempting to access a private WWA access network associated with the enterprise entity; and providing, by the authentication node, the authentication material for the UE, wherein the authentication material facilitates connection establishment between the UE and the private WWA access network.

Techniques to facilitate fast roaming between a mobile network operator public wireless wide area access network and an enterprise private wireless wide area access network

The disclosed technology relates to a process of evaluating any number of different identity providers (IDPs) and their respective set of credentials that are used to authenticate corresponding users to assist with the onboarding of the different IDPs in connection with Wi-Fi identity federations. In particular, the process allows a person's electronic identity and attributes (stored across one or more IDPs) to be determined once using a standard. Once trust has been established for the user, that trust can then be utilized across a number of different systems (e.g., Single-sign on). The same trust determination can be used without the need for the authenticity of the user identity to be re-evaluated with each new access request.

Wireless LAN (WLAN) public identity federation trust architecture

Presented herein are techniques to facilitate wireless wide area (WWA) virtualized Radio Access Network (vRAN) (e.g., 5G) to wireless local area (WLA) RAN (e.g., Wi-Fi) steering or WLA RAN to WWA vRAN steering for one or more UE. In one example, a method may include obtaining first performance metrics associated with links of a WWA vRAN (e.g., fronthaul, midhaul, and backhaul links); obtaining second performance metrics associated with links WLA RAN (e.g., backhaul links); and in response to determining that one of the WWA vRAN is experiencing degraded performance based on the first performance metrics or the WLA RAN the second performance metrics, activating a steering event that causes, at least in part, an indication to be communicated to a UE to cause the UE to connect to the WWA vRAN or the WLA RAN that is not experiencing degraded performance.

User equipment steering across a wireless wide area disaggregated virtualized radio access network and a wireless local area radio access network

System, methods, and computer-readable media for validating and committing a shared O-RU configuration via a shared O-RU Operator. The shared O-RU Operator validates a partitioned configuration received from a tenant operator, with the ability to indicate to the tenant operator that the partitioned configuration is conformant to agreed-upon sharing rules and then commits the shared configuration to the shared O-RU. The shared O-RU operator shares the outcome of the commit operation to the tenant operator via defined operational-data that can be read by the tenant operator. A single radio in O-RAN is shared by multiple different operators and enables a neutral host to deploy a radio unit and then have that attached to different operators networks.

Open radio access network neutral host

Presented herein are techniques to facilitate dual-connectivity support for a user equipment (UE) in a hybrid cell virtualized Radio Access Network (vRAN) architecture. In one example, a method may include obtaining, by a node of a mobile network via a first cell of a RAN, a request for a UE to connect to the mobile network via the first cell in which the RAN includes at least one shared cell and at least one unique cell; determining that the UE is allowed for dual-connectivity operation; and providing a policy to the UE, wherein the policy identifies, for each of one or more applications, one of a shared cell operating mode or a unique cell operating mode that the UE is to utilize for each of the one or more applications.

Dual-connectivity support for user equipment in a hybrid cell virtualized radio access network architecture

Dynamic Open Radio Access Network Radio Unit (O-RU) sharing between multiple tenant Open RAN Distributed Units (O-DU) may be provided. A Near Real Time RAN Intelligent Controller (nRT-RIC) may receive tenant policies for a first tenant and a second tenant. The nRT-RIC may then determine initial sharing templates for the first tenant and the second tenant based on the tenant policies. The nRT-RIC may send the initial sharing templates to a first tenant Distributed Unit (DU) and a second tenant DU. The nRT-RIC may receive operating metrics from the first tenant DU and the second tenant DU. The nRT-RIC may then determine operational factors based on the operating metrics. The nRT-RIC may alter an allocation of resources between the first tenant and the second tenant based on the operational factors. Finally, the nRT-RIC may send the altered allocation of resources to the first tenant DU and the second tenant DU.

Dynamic open radio access network radio unit sharing between multiple tenant open radio access network distributed units

Techniques for dynamically negotiating a service legal agreement (SLA) between a roaming device and a visited network (VN) in an identity federation. An identity profile provided to a user device by an identity provider (IDP) is accessed by the user device. The identity profile includes a first SLA criteria. An advertisement from the VN indicating one or more SLAs supported by the VN is received at the user device. The advertisement is received before the user device has associated with the VN. The IDP and the VN are part of a same identity federation. It is determined that the SLA supported by the VN satisfies the first SLA criteria. Upon that determination, an acceptance is transmitted by the user device to the VN, and the user device is associated with the VN.

Implementing service level agreements in an identity federation

Presented herein are techniques to support handovers in hybrid cell configuration environments. In one example, a method may include determining that a user equipment (UE) is connected to a first shared cell or a first unique cell of a radio access network; and causing a handover for the UE to a second shared cell or a second unique cell of the radio access network based on whether the UE is connected to the first shared cell or the first unique cell, wherein the handover is performed between one of the first shared cell and the second shared cell or the first unique cell and the second unique cell.

Supporting handovers in hybrid cell configuration environments

Federation policy exchange is provided in response to receiving a sharing query from an Access Point (AP) indicating that an associated wireless network supports federated identities with data sharing, determining whether the sharing query is within sharing preferences; and in response to determining that the sharing query is within the sharing preferences, transmitting, to the AP, a positive response for identity sharing that authorizes collection and sharing of identity data with at least one entity identified in a sharing policy for the associated wireless network. In various embodiments, federation policy exchange includes transmitting a support notification, via an AP, indicating support for federated identities with data sharing within a wireless network associated with the AP; and in response to receiving a first identify sharing preference from a User Equipment (UE) that indicates that negotiation is preferred, transmitting a sharing policy for the wireless network to the UE.

Federation policy exchange

Growing community of inventors

Maidenhead, United Kingdom

Mark Grayson