Cisco Technology, Inc.

Ico Services Limited

Mark Grayson

Srinath Gundavelli

Jerome Henry

Santosh Ramrao Patil

Bart A Brinckman

Gangadharan Byju Pularikkal

Anton Okmyanskiy

Rajesh S Pazhyannur

Kevin Shatzkamer

Jayaraman R Iyer

Louis Gwyn Samuel

Malcolm Muir Smith

Eric Philippe Hamel

Anand K Oswal

Indermeet Singh Gandhi

Oliver James Bull

Timothy Peter Stammers

Mickael James Graham

Swaminathan A Anantha

Arun G Khanna

Desmond Joseph O'Connor

Vimal Srivastava

Ramanathan T Jagadeesan

Bich Nguyen

Sangram Kishore Lakkaraju

Matthew Stephen MacPherson

Robert E Barton

Jonathan David Rosenberg

Sudhir Kumar Jain

Steven Robert Donovan

Mukesh Taneja

Ziv Nuss

Sourav Chakraborty

Dennis Roy Mullins

Richard Kyle Forster

Carlos M Pignataro

Nagendra Kumar Nainar

Flemming Andreasen

Chris O'Rourke

Christopher Edwin Pearce

Shree N Murthy

Akram Ismail Sheriff

Shailender Potharaju

Biswaranjan Panda

Kedar Krishnanand Gaonkar

Andrew C Chung

Pascal Thubert

Hang Jin

Kent Kinchu Leung

Robert Edgar Barton

Frank Brockners

Francois Le Faucheur

Sandro Grech

Alon Ben Ami

Andrea Giustina

Daniel Wee

Marco Cesare Centemeri

Horia Miclea

Mark Allen Webb

Allaukik Abhishek

David Lake

Navan Narang

Thomas Goerke

Santhalingam Balasekar

David Delano Ward

Patrick Wetterwald

Hendrikus G P Bosch

Sanjay Kumar

Fred Jay Anderson

Louis F Menditto

Robert Michael Batz

Rajeev Koodli

Ian McDowell Campbell

Humberto Jose La Roche

Irfan Ali

Andrew Frederick Myles

Leigh M Chinitz

Richard Mandfred Pruss

Arun C Alex

Amit S Phadnis

Vojislav Vucetic

Sri Gundavelli

Vinodh Kumar Ravindranath

Rajesh P Velandy

James Paul Seymour

Jagdish Venkata Sonti

Navneet Agarwal

Madhusudan Nanjanagud

Simon Dyke

Robert M Broberg

Ashish A Chandwadkar

Matthew Lawrence King

David Lindert

Richard Wyrwas

Yuyong Zhang

Rafael Mantilla Montalvo

Laurent Montini

Gaetan Feige

Mantha Ravi Sankar

Differentiated service in a federation-based access network is provided by receiving a set of credentials from a User Equipment (UE) for a wireless network offering a plurality of service levels. In response to determining that the set of credentials indicate a realm associated with a given service level, network access is provided to the UE according to the given service level. In response to determining that the given service level is not a highest service level in the wireless network, a list of one or more preferred realms is transmitted to the UE, where each realm of the list of one or more preferred realms is associated with one or more higher service levels than the given service level.

Differentiated service in a federation-based access network

The present disclosure relates to simultaneous operation of Wi-Fi access points in a super cell mode and a standalone mode and controlling connectivity of end terminals thereto. In one aspect, a method includes receiving a configuration for a group of access points operating within a network, the configuration allowing each access point of the group to operate in a super cell mode over a shared frequency channel and a standalone mode over a non-shared frequency channel. The method further includes determining, for an end terminal, whether the end terminal is to connect to the network over the shared frequency channel or the non-shared frequency channel based on a network policy to yield a determination; and controlling connectivity of the end terminal to at least one access point of the group of access points over the shared frequency channel or the non-shared frequency channel based on the determination.

Dual mode Wi-Fi operation in shared and non-shared channels

The presently claimed disclosure is directed to methods that may be implemented at a computer. Methods and systems consistent with the present disclosure may include extending protocols associated with authenticating client (i.e. supplicant) devices and with authorizing those supplicant devices to access a wireless network. These methods may include sending data relating to the failure of an authentication and/or an authorization process to a supplicant device attempting to access a wireless network. Methods discussed within may include securely sending failure codes or reasons to a supplicant device that identify why an authentication or authorization process failed. These methods may include sending messages between a supplicant device, an authenticator device, and an authentication and authorization server. After a first failure, the supplicant device may be able to access the wireless network after a reason or code of that failure has been reported to the supplicant device.

Openroaming augmentation method for EAP failures

Techniques for network communications are disclosed. These techniques include receiving a cryptographically generated device identifier (CGDI) and a public key relating to a wireless station (STA). The techniques further include determining a first hash based on decrypting the CGDI using the public key, and validating the first hash for an access network. The techniques further include identifying the STA in the access network using the CGDI based on binding the CGDI to a session associated with the STA and the access network.

Cryptographically generated device identifiers

Systems, methods, and computer-readable media are disclosed for facilitating bi-directional edge proxy-to-edge proxy communications across an enterprise firewall in 5G service-based architecture. In one aspect, a method includes receiving a subscription request from a user device to operate on a visited private network; determining that the user device is associated with a home network; and establishing a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, wherein the communication protocol enables bi-directional exchange of roaming signals between the visited private network and the home network while user device is operating on the visited private network.

Bi-directional communication protocol for private networks

Presented herein are techniques associated with providing an alternative network indication to a client device in a wireless local area network (WLAN) roaming federation. In one example a method is provided that may include obtaining access network information for each of a plurality of access networks that neighbor a first access network through connection of a client device with the first access network involving a first identity provider profile; determining an alternative access network with which the client device is recommended to seek connection or an alternative identity provider profiles with which the client device is recommended to connect to the first access network; and enabling the client device to initiate a connection with the alternative access network or to re-initiate a connection with the first access network utilizing the alternative identity provider profile.

Providing an alternative access network indication to a client device in a wireless local area network roaming federation

Presented herein are techniques associated with replicating an OpenRoaming™ policy federation in a Third Generation Partnership Project (3GPP) network environment. For example, techniques herein provide a roaming policy federation architecture for a 3GPP network environment. In one example a method is provided that may include encoding at least one multi-bit roaming policy for an identity provider and a plurality of bit-wise combinatorial permutations of the at least one multi-bit roaming policy within each of a plurality of multi-bit 3GPP broadcast identifiers, wherein the at least one multi-bit roaming policy includes bit-wise roaming policy information for the identity provider and configuring the multi-bit 3GPP broadcast identifiers for a mobile device associated with the identity provider, wherein the multi-bit 3GPP broadcast identifiers indicate that the mobile device is to connect to a visited radio access network associated with a local Internet Protocol (IP) access service or a home routed access service.

Providing a roaming policy federation in a third generation partnership project (3GPP) network environment

Presented herein are techniques to facilitate fast roaming between a mobile network operator-public (MNO-public) wireless wide area (WWA) access network and an enterprise private WWA access network. In one example, a method is provided that may include generating, by an authentication node, authentication material for a user equipment (UE) based on the UE being connected to a public WWA access network, wherein the public WWA access network is associated with a mobile network operator, and the authentication node and the UE are associated with an enterprise entity; obtaining, by the authentication node, an indication that the UE is attempting to access a private WWA access network associated with the enterprise entity; and providing, by the authentication node, the authentication material for the UE, wherein the authentication material facilitates connection establishment between the UE and the private WWA access network.

Techniques to facilitate fast roaming between a mobile network operator public wireless wide area access network and an enterprise private wireless wide area access network

The disclosed technology relates to a process of evaluating any number of different identity providers (IDPs) and their respective set of credentials that are used to authenticate corresponding users to assist with the onboarding of the different IDPs in connection with Wi-Fi identity federations. In particular, the process allows a person's electronic identity and attributes (stored across one or more IDPs) to be determined once using a standard. Once trust has been established for the user, that trust can then be utilized across a number of different systems (e.g., Single-sign on). The same trust determination can be used without the need for the authenticity of the user identity to be re-evaluated with each new access request.

Wireless LAN (WLAN) public identity federation trust architecture

Presented herein are techniques to facilitate wireless wide area (WWA) virtualized Radio Access Network (vRAN) (e.g., 5G) to wireless local area (WLA) RAN (e.g., Wi-Fi) steering or WLA RAN to WWA vRAN steering for one or more UE. In one example, a method may include obtaining first performance metrics associated with links of a WWA vRAN (e.g., fronthaul, midhaul, and backhaul links); obtaining second performance metrics associated with links WLA RAN (e.g., backhaul links); and in response to determining that one of the WWA vRAN is experiencing degraded performance based on the first performance metrics or the WLA RAN the second performance metrics, activating a steering event that causes, at least in part, an indication to be communicated to a UE to cause the UE to connect to the WWA vRAN or the WLA RAN that is not experiencing degraded performance.

User equipment steering across a wireless wide area disaggregated virtualized radio access network and a wireless local area radio access network

System, methods, and computer-readable media for validating and committing a shared O-RU configuration via a shared O-RU Operator. The shared O-RU Operator validates a partitioned configuration received from a tenant operator, with the ability to indicate to the tenant operator that the partitioned configuration is conformant to agreed-upon sharing rules and then commits the shared configuration to the shared O-RU. The shared O-RU operator shares the outcome of the commit operation to the tenant operator via defined operational-data that can be read by the tenant operator. A single radio in O-RAN is shared by multiple different operators and enables a neutral host to deploy a radio unit and then have that attached to different operators networks.

Open radio access network neutral host

Presented herein are techniques to facilitate dual-connectivity support for a user equipment (UE) in a hybrid cell virtualized Radio Access Network (vRAN) architecture. In one example, a method may include obtaining, by a node of a mobile network via a first cell of a RAN, a request for a UE to connect to the mobile network via the first cell in which the RAN includes at least one shared cell and at least one unique cell; determining that the UE is allowed for dual-connectivity operation; and providing a policy to the UE, wherein the policy identifies, for each of one or more applications, one of a shared cell operating mode or a unique cell operating mode that the UE is to utilize for each of the one or more applications.

Dual-connectivity support for user equipment in a hybrid cell virtualized radio access network architecture

Dynamic Open Radio Access Network Radio Unit (O-RU) sharing between multiple tenant Open RAN Distributed Units (O-DU) may be provided. A Near Real Time RAN Intelligent Controller (nRT-RIC) may receive tenant policies for a first tenant and a second tenant. The nRT-RIC may then determine initial sharing templates for the first tenant and the second tenant based on the tenant policies. The nRT-RIC may send the initial sharing templates to a first tenant Distributed Unit (DU) and a second tenant DU. The nRT-RIC may receive operating metrics from the first tenant DU and the second tenant DU. The nRT-RIC may then determine operational factors based on the operating metrics. The nRT-RIC may alter an allocation of resources between the first tenant and the second tenant based on the operational factors. Finally, the nRT-RIC may send the altered allocation of resources to the first tenant DU and the second tenant DU.

Dynamic open radio access network radio unit sharing between multiple tenant open radio access network distributed units

Techniques for dynamically negotiating a service legal agreement (SLA) between a roaming device and a visited network (VN) in an identity federation. An identity profile provided to a user device by an identity provider (IDP) is accessed by the user device. The identity profile includes a first SLA criteria. An advertisement from the VN indicating one or more SLAs supported by the VN is received at the user device. The advertisement is received before the user device has associated with the VN. The IDP and the VN are part of a same identity federation. It is determined that the SLA supported by the VN satisfies the first SLA criteria. Upon that determination, an acceptance is transmitted by the user device to the VN, and the user device is associated with the VN.

Implementing service level agreements in an identity federation

Growing community of inventors

Maidenhead, United Kingdom

Mark Grayson