Sprint Communications Comapny L.p.

Nortel Networks Corporation

T-mobile Innovations LLC

Sprint Spectrum L.p.

T-mobile Usa, Inc.

Clearwire IP Holdings L.l.c.

Future Wei Technologies, Inc.

Northern Telecom Limited

Clear Wireless LLC

Serge M Manning

Marouane Balmakhtar

Jeremy Richard Breau

Gregory David Schumacher

Frederick Carl Rogers

C Brent Hirschman

John H Bennett, Iii

Charles Brent Hirschman

Mark Alan Lipford

Chung-Ching Wang

Alberto Gutierrez

Greg Schumacher

Lyle Thomas Bertz

Ronald R Marquardt

Pallavur Ananthakrishnan Sankaranaraynan

Arun Santharam

Roger Danforth Bartlett

Bejoy Pankajakshan

Sanjoy K Sen

Kim T Chang

Peter W Wenzel

Ihab Amin Guirguis

Lyle W Paczkowski

Ahmad Jalali

John Michael Everson

Tracy Lee Nelson

Kuntal Chowdhury

Manish Mangal

Zhixian Xiang

Mark Richard Bales

Hinghung Anthony Chan

Jerry Louis Mizell

Shingara Singh Dhanoa

Khosrow Tony Saboorian

Chenhong Huang

Reza Jafari

John Matthew Kaippallimalil

David J Lauson

Mohammed Ghouse Mohiuddin

David S McGinniss

Roy Leo Spitzer

Pierre Boulos

Brent B Hirschman

Farhan Ali

Cecil L Taylor

Ibrahim Ghaleb

Jianping Jiang

Kim Chang

A method for configuring a network of a communication system to secure applications executable on user equipment (UE) connectable to the network. The method includes receiving a predefined first traffic signature corresponding to a first application, and configuring a network traffic monitoring tool to detect an activation of the first application executing on the UE. The method additionally includes configuring the network traffic monitoring tool to monitor active traffic manifested on the network associated with the first application, configuring a traffic signature comparison tool to detect a security breach associated with the first application, and configuring an alarm tool issue an alarm and/or act against the first application.

Systems and methods for securing applications executed on communication systems

Systems, methods, and devices are disclosed herein to identify and deploy policy changes from a policy source in a wireless communication network to enforcement points in the network based on trends identified by the policy source in KPIs reported by the enforcement points. In an implementation, enforcement points in the network report KPIs to the policy source. The KPIs are related to authorization attempts made by user equipment in the network. The policy source, upon receiving the KPIs, identifies a trend in the KPIs and identifies a policy change based on the KPIs. The policy source then deploys the policy change to the enforcement points. In various implementations, the policy source is a Policy Decision Point (PDP), and the enforcement points are Policy Enforcement Points (PEPs).

Quality of trust framework for wireless communication networks

A method of testing a communication system implementing a zero trust architecture. The method comprises sending a request by a test equipment platform to access a microsegment to a policy enforcement point (PEP); sending an authorization request by the PEP to a policy decision point (PDP); authorizing access of the test equipment platform to the microsegment by the PDP; sending authorization of access of the test equipment platform to the microsegment by the PDP to the PEP; establishing a secure tunnel by the PEP between the test equipment platform and the microsegment; sending a command to provide test data by the test equipment platform via the secure tunnel to a probe in the microsegment; analyzing the test data by the test equipment platform; and producing a test result by the test equipment platform based on analyzing the test data.

Testing network communication within a zero trust security model

Systems and methods are provided for rapid user equipment route selection policy rule processing. A method includes determining an applicable routing policy based on user equipment route selection policy (URSP) rules for an established protocol data unit (PDU) session and storing PDU session information with the established uplink PDU session in a cache. The method further includes examining subsequent uplink packets for PDU session information and checking the cache for an established PDU session with matching uplink PDU session information. The method additionally includes routing the subsequent uplink packets to the established PDU session having the matching PDU session information, causing the subsequent uplink packet to be processed in accordance with the applicable routing policy as previously determined based on the URSP rules.

Rapid user equipment route selection policy rule processing

A method of user equipment (UE) implemented network slice security protection is disclosed. The method comprises the UE receiving a request to initialize an application, querying a UE Route Selection Policy (URSP) stored on the UE, and receiving traffic descriptors and security descriptors in response to the querying. The traffic descriptors identify a network slice for the application. The security descriptors comprise a security flag and a virtualization container ID. The method also comprises the UE initiating the application within a virtualization container corresponding to the virtualization container ID based on the security flag indicating that the network slice is secure and binding traffic for the application in the virtualization container to a PDU session based on the traffic descriptors. The method further comprises communicating, by the application executing within the virtualization container, with a core network over the PDU session via the network slice bound to the virtualization container.

5G network slice device security protection

A method comprises receiving, by a threat level engine (TLE) in the network, security data from a plurality of different sources, wherein the security data comprises data regarding traffic related to a security threat occurring in the network, determining, by the TLE, a security related event indicating a security threat occurring at network elements in the network based on security key performance indicators and the security data, when a threat impact level of the security related event exceeds a threshold, determining, by the TLE, a remediation action for the security related event based on the threat impact level, transmitting, by the TLE to a policy decision point, an instruction to generate and store a rule based on the remediation action for the security related event, and transmitting, to a policy enforcement point, an authorization to create the secure tunnel between the one or more network elements and another endpoint.

Security threat mitigations in a zero trust network architecture

A system includes a policy control function (PCF) that receives an indication from a mobile device in a wireless cellular network that indicates a secure connection between the mobile device and an endpoint in the wireless cellular network. The secure connection is associated with a security policy that includes a first set of parameters and operates at a first level of granularity and a routing policy that includes a second set of parameters and operates at a second level of granularity. The PCF then determines a mapping between the first set of parameters and the second set of parameters that aligns the first level of granularity with the second level of granularity. In an example, the alignment improves the utilization of network resources in the wireless cellular network. The mapping is then transmitted to the mobile device, which enables the mobile device to use the secure connection.

Integrating security and routing policies in wireless telecommunication networks

A home network serves a wireless service to visiting User Equipment (UEs) affiliated with visited networks and authorizes the wireless service for home UEs that are visiting the visited networks. A gateway transfers home context to a distributed ledger and receives visited context from the distributed ledger. The gateway transfers the visited context to a controller. The controller exchanges authorization data with the visited networks based on the visited context and the home context. The controller authorizes the wireless data service for the home UEs and the visiting UEs responsive to the exchange of the authorization data. The controller transfers session signaling to wireless access nodes responsive to the authorization of the wireless data service for the visiting UEs. The controller transfers authorization signaling to the visited networks responsive to the authorization of the wireless service for the home UEs.

Wireless communication network authorization of home user equipment and visiting user equipment

Systems and methods for providing multi-factor authentication based on visual objects associated with an out of band shared secret delivery channel and at least one user device of a telecommunication network include an access point communicatively coupled to an authentication system. The authentication system is structured to generate a set of visual objects, cause the set of visual objects to be output by a first user device, transmit, via an out of band shared secret delivery channel, a visual object request to cause a secondary user device to output one or more out of band visual objects, receive an indication of object selection from the set of visual objects, determine that the indication of the object selection is associated with a visual selection match among the set of visual objects, and based on the visual selection match, authenticate access to an application associated with the authentication system.

Multimedia message (MMS) object sequences as multi-factor authentication (MFA) for user identification in 5G

Systems, methods, and processing nodes for managing a wireless communication session perform and/or comprise: receiving a privacy enable request from an application associated with a wireless communication device; masking an application identifier corresponding to the application, thereby to generate a masked application identifier; receiving an application attribute request from a route selection manager, the application attribute request including a request for the application identifier; and in response to the privacy enable request and the application attribute request, returning an application attribute request response to the route selection manager, the application attribute request including the masked application identifier.

System and method for masking user application usage

Techniques, devices, and systems for implementing a Priority Data Transport Service (PDTS) are disclosed. The PDTS provides authorized devices and/or authorized users with on-demand, priority data transport (e.g., priority Internet access). For example, the PDTS allows authorized devices and/or authorized users to access the Internet, use mobile applications, and/or send and receive image data, video data, and text data in a prioritized manner, as compared to the regular (non-priority) Internet access that is provided to non-subscribers of the PDTS over commercial telecommunications networks. An authorized user may activate and deactivate the PDTS on demand. For instance, the PDTS may be activated during an emergency or crisis situation when networks may be congested, thereby providing the user with priority data transport (e.g., priority Internet access) in an emergency or crisis situation when a telecommunications network may be overloaded.

Priority data transport service

A method of testing a communication network. The method comprises providing network communication service to communication service subscribers by a first set of computing resources that are part of a communication network, replicating communication data packets, directing the replicated communication data packets to the first set of computing resources and to a second set of computing resources that are part of the communication network but which do not provide network communication service to communication service subscribers, introducing a random error into the second set of computing resources, capturing by a testing application executing on a server computer the outputs from the second set of computing resources after processing the replicated communication data packets in the context of the random error, analyzing the captured outputs by the testing application, determining that the captured outputs indicate a failure by the testing application, and taking action by the testing application.

Rolling production test

A method of testing production server applications. The method comprises monitoring a production server that is executing a first version of a production application by an agent application executing on the production server, recording changes made on the production server by the agent application in a reporting file on the production server, launching a test application on a test server, wherein the test application is associated with a second version of the production application, in response to launching the test application, reading the reporting file by a script executing on the test server, determining by the script that changes were made on the production server based on reading the reporting file, and sending by the script a notification about the changes made on the production server, whereby a tester testing the second version of the production application is made aware of changes that have been made on the production server.

Software production load and software test load synchronization feedback system

A wireless network control system facilitates a handover of User Equipment (UE) from a source network slice to a target network slice. The source slice delivers an internet-access service to the UE using a Quality-of-Service level and access restrictions. The UE detects a handover trigger and exchanges handover signaling with the source network slice. A hardware-trust controller verifies a hardware identification code embedded in the UE responsive to the handover signaling. A distributed ledger generates a slice template to implement the QoS and access restrictions for the UE in the target network slice in response to the handover signaling and the hardware-trust verification. The signaling circuitry transfers the slice template to the target slice. The target slice delivers internet-access service to the UE using the QoS and the restrictions in response to the slice template.

Wireless communication device handovers between wireless communication network slices

Growing community of inventors

Plano, TX, United States of America

Serge M Manning