Verizon Patent and Licensing Inc.

Equinix, Inc.

Cellco Partnership

Oleg Berzin

Yueping Zhang

Douglas M Pasko

James Kempf

Arvind Aggarwal

Imam Sheikh

Robert J Huey

Chris M Okoniewski

Rafael Lean De Vera Ansay

James Mathison

Praveen Venkataramu

Raymond So

Ashish Rajkumar Gandhi

Andrew G Malis

Chen Xi

Jeffrey John Blasinski

Jean G Dodard

Doron Hendel

Richard Janocko

This disclosure describes systems, methods, and apparatus for network slicing with programmable data-plane pipelines, comprising creating slice contexts, where creating the slice contexts comprises creating control-plane and data-plane data for each of a plurality of network slices, and storing the control-plane and the data-plane data to produce slice contexts, mapping resources of network switch hardware to the slice contexts to create a resource mapping, instantiating the plurality of network slices on the network switch hardware using the resource mapping, receiving frames from one or more external sources, identifying a network slice corresponding to each frame, and enriching a header of each of the frames, based upon the identification of the network slice for each frame, to direct each frame to a data-plane pipeline.

Deep network slicing with virtualized programmable data-plane pipelines

Techniques are described for a network providing application workload routing and application workload interworking. For example, a controller may move or replicate an application workload hosted on an original edge compute to a different edge compute in a different edge data center that is locally accessible by the device and route the network traffic to the new edge compute using paths mapped to respective traffic classes.

Application workload routing and interworking for network defined edge routing

In general, this disclosure describes an IoT access control exchange for IoT devices. Verifiable credentials can be generated and used to grant access to IoT devices definitively identified using a Decentralized Identifier (DID). DIDs for IoT devices are registered by the IoT exchange hub acting as an Identity Hub. An organization interested in obtaining data from a collection of devices, the IoT Access Customer, contacts the IoT device owner agent via their mutual agents and obtains a verifiable credential with a request for access. The access request is submitted to the IoT exchange hub. The IoT exchange hub either enforces the access request itself if the devices do not have enough resources or submits the verifiable credential with the access request to the devices for them to enforce access. The IoT access customer agent, IoT device owner agent, and IoT exchange hub similarly identify themselves and prove authentication using DIDs.

Controlling access to internet of things devices using verifiable credentials

Techniques for a secure device registration and software update using Decentralized Identifiers (DIDs). For example, a method includes sending, by a device and to a data store, a request for a software update published by a software publisher, wherein the request includes a verifiable credential for the device including a DID of the device; receiving, by the device and from the data store, a verifiable credential for the software update, wherein the verifiable credential includes a DID of the software publisher; determining, by the device, whether the software update is newer than software on the device; obtaining, by the device, the software update from the software publisher from a location specified by the verifiable credential; verifying, by the device, the software update based on the verifiable credential; and in response to verifying the software update based on the verifiable credential, installing, by the device, the software update.

Decentralized identifiers for securing device registration and software updates

Techniques are described for a network providing network defined edge routing for an application workload. For example, a controller receives element registration information for each module hosted on a set of interconnected edge data centers and for one or more network devices that interconnect the modules in the network; obtain one or more routing metrics of the network; compute, based on the element registration information and the one or more routing metrics, one or more paths mapped to respective traffic classes to route traffic via the set of interconnected edge data centers; receive a request to route traffic according to a traffic class; and in response, send, to the set of interconnected edge data centers, a response specifying a path of the one or more paths that is mapped to the traffic class to cause the set of interconnected edge data centers to route traffic according to the traffic class.

Network defined edge routing for an application workload

Techniques are described for a centralized, neutral system for Internet of Things (IoT) device activation and automatic onboarding on an end-to-end basis, and for establishing secure communication between IoT devices and the IoT platforms. For example, a method includes receiving an activation request message from an IoT device to activate the IoT device on an IoT core network of a plurality of IoT core networks, wherein the plurality of IoT core networks and a plurality of IoT edge devices are co-located within the co-location facilities, and wherein the plurality of IoT edge devices are connected to one or more IoT platforms; authenticating the IoT device for connection to the IoT core network; and in response to authenticating the IoT device, provisioning a connection between the IoT core network and the plurality of IoT edge devices to provide the IoT device access to the one or more IoT platforms.

Interconnection and activation for internet of things devices in multi-tenant data center facilities

RAN events associated with IoT devices may be monitored and tracked. Profiles may be defined for different IoT devices. The profiles may specify resource limits for the IoT devices, including resource limits based on the RAN events. The IoT profiles may also define policy responses based on the occurrence of the RAN events. The policy responses may include charging rules, network access control rules, or other rules based on the resource usage of the IoT devices.

IoT profiles and network usage tracking and charging based on RAN events

A first device may receive data from one or more sensors associated with the first device. The data may indicate movements of the first device. The first device may be associated with a user. The first device may determine a state of the user indicated by the movements of the first device. The first device may determine whether the data is associated with the movements of the user inside one or more structures. The first device may generate a map for a structure, of the one or more structures, by combining the data received from the one or more sensors. The first device may provide the map for the structure for display and the data toward one or more second devices.

Generating an indoor map for a structure using data gathered by a user device

An exemplary security key bootstrapping system determines an application layer session security keyset uniquely associated with a client device and based on a subscriber identity master security credential. The subscriber identity master security credential is permanently stored within a component of the client device and is also stored on a subscriber identity management server associated with a provider network by which the client device is communicatively coupled with an application server system. The security key bootstrapping system uses the application layer session security keyset as a credential to provide end-to-end security for an application layer session between the client device and the application server system over the provider network. Neither the component of the client device nor the subscriber identity management server obtains the subscriber identity master security credential from an exchange of the subscriber identity master security credential over the provider network.

Methods and systems for bootstrapping an end-to-end application layer session security keyset based on a subscriber identity master security credential

A server device may store inter-layer quality of service ('QoS') information, indicating a set of link layer QoS levels that are associated with a particular device, a set of network layer QoS levels that are associated with the set of link layer QoS levels, and a set of MPLS QoS levels that are associated with the set of link layer QoS levels. A network device may establish a set of bearers, that correspond to the set of link layer QoS levels, with a particular device; output information regarding the set of network layer QoS levels that are associated with the set of link layer QoS levels, to allow the particular device to select a bearer, of the set of bearers, via which to output traffic to the network device; receive, from the particular device, traffic via the bearer; and determine a particular MPLS QoS level associated with the received traffic.

Inter-layer quality of service preservation

A provisioning system may receive requests, such as from third party service providers, to provision dedicated bearers for traffic associated with the service providers. For example, a service provider may request a particular quality of service ('QoS') level for traffic sent between the service provider and one or more user devices. This QoS level may be higher than a 'normal' QoS level that is ordinarily provided. The provisioning system may establish a bearer, such as a dedicated non-guaranteed bitrate (&#x201c;non-GBR&#x201d;) bearer between a packet data network (&#x201c;PDN&#x201d;) gateway (&#x201c;PGW&#x201d;) and the user device, and may transmit traffic, associated with the service provider, via the dedicated non-GBR bearer. A QoS agent, installed at the user device, may ensure that traffic, associated with the service provider, is sent from the user device via the dedicated non-GBR bearer (e.g., as opposed to another bearer with a lower QoS level).

Third party interface for provisioning bearers according to a quality of service subscription

A method comprising receiving, from a first node, a first packet at a network application server via a first local area network (LAN); receiving, from a second node, a second packet at the network application server via a second LAN; associating the first packet with a first VPN based on receiving the first packet via the first LAN; and associating the second packet with a second VPN based on reception of the second packet via the second LAN, wherein the first VPN and the second VPN include overlapping network address spaces.

Multiprotocol label switching (MPLS) interface with virtual private network (VPN) application

A system establishes a communication path between a mobile node and a first label edge router, registers the mobile node at the first label edge router, and creates a mobility binding at the first label edge router. The system also establishes a label switched path between the first label edge router and a second label edge router by propagating the mobility binding in the system, and establishes communication between the mobile node and a corresponding node over the label switched path. The system further maintains the communication between the mobile node and the corresponding node over the system when the mobile node moves from one physical location to another physical location and causes a handoff of the mobile node between two layer 2 grooming networks.

Handoffs in a hierarchical mobility label-based network

An approach is provided for extending private enterprise networking to wireless interconnecting domains. A home agent maintains a first routing table for a first wireless router configured to route according to a first address space. The home agent also maintains a second routing table for a second wireless router configured to route according to a second address space. The first address space and the second address space are overlapping.

System and method for providing network mobility

A system is configured to receive, from an enterprise device, a request to access a network domain, and is configured to determine whether the network domain is associated with a wireless service provider service. Based on determining that the network domain is not associated with the wireless service provider service, the system is configured to route the request to a private network associated with the enterprise device. Based on determining that the network domain is associated with the wireless service provider service, the system is configured to route the request to a domain name system server associated with the wireless service provider, receive a domain name system response to the request, the domain name system response identifying a network address, and route the domain name system response to the enterprise device.

Growing community of inventors

Huntingdon Valley, PA, United States of America

Oleg Berzin