Cisco Technology, Inc.

Timothy Peter Stammers

Jayaraman R Iyer

Srinath Gundavelli

Kent Kinchu Leung

Vimal Srivastava

Flemming Andreasen

Anand K Oswal

Parviz Yegani

Michel Khouderchah

Mark Grayson

Sangram Kishore Lakkaraju

Louis Gwyn Samuel

Aeneas Sean Dodd-Noble

Indermeet Singh Gandhi

Carlos M Pignataro

Jonathan David Rosenberg

Fabio Rodolfo Maino

Humberto Jose La Roche

Alberto Rodriguez Natal

Biswaranjan Panda

Nagendra Kumar Nainar

Robert Michael Batz

Michael David Geller

Robert Glenn Smith

Suraj Sharad Mody

Bart A Brinckman

Vinay Saini

Oliver James Bull

Malcolm M Smith

Robert A Mackie

Bhaskar Bhupalam

Arun C Alex

Sri Gundavelli

Desmond Joseph O'Connor

Snezana Mitrovic

Hy Quoc Pham

Gary B Mahaffey

Robert E Barton

Hendrikus G P Bosch

David John Zacks

Chris O'Rourke

Pradeep Kumar Kathail

Kevin Shatzkamer

Louis F Menditto

Arun G Khanna

Ian McDowell Campbell

Konstantin Livanos

John A Schlack

Ravi Kiran Guntupalli

Rajesh Indira Viswambharan

Stephan Edward Friedl

Sape Jurrien Mullender

Michael Lindsay Shannon

Marco Cesare Centemeri

Vineet Gupta

Robert M Broberg

Hervé Muyal

Manoj Kumar Kushwaha

Dusko Zgonjanin

Michael A Wright

Irfan Ali

Vivek Kansal

Rafael Mantilla Montalvo

Marcelo Yannuzzi Sanchez

Varsha Clare

Richard Alan Galatioto

Solomon Ayyankulankara Kunjan

Suvitha Kesavan

Azita Ebrahimi Kia

Charles C Wolfinger

Richard Christopher Hayes

Anthony Fajri

Gautam Mohanlal Borkar

Patrick Jean Marc Grossetete

Rajpal Bhoria

Praveen Joseph

Lakshmi Thiyagarajan

Nicholas Butler

Purval Prakash Shah

Rutuja Ravindra Shivde

Gopal Pralhadrao Jorapur

Jinpei Qiang

Mehdi RaisGhasem

Eren Kudsi Gonen

Bobby Wayne Hoosang Richardson

Bhavik Adhvaryu

In one embodiment, a device receives a request from a client to remotely access an endpoint in a local network. The device instantiates a network slice having a remote access function in a cellular network. The device causes the endpoint to communicate a particular type of traffic via the network slice and the remote access function. The device configures a virtual private network tunnel between the client and the remote access function. The client and endpoint communicate with one another via a connection that comprises the network slice and the virtual private network tunnel.

Secure remote access for devices using private cellular connections

An enterprise device identity proxy between an SMF and an Enterprise's device profile store supports N7 protocol for enterprise policy delivery between a central management service (CMS) and an enterprise policy service. In particular, when a user equipment (UE) requests a data service, the enterprise device identity proxy receives AAA transactions from the SMF running the enterprise policy service over a secondary authentication interface, stores the results in a data store, and uses business rules set forth by the CMS to transform Remote Authentication Dial-In User Service (RADIUS) Attribute Value Pairs (AVPs) into a valid N7 response to the SMF. The enterprise device identity proxy enables an enterprise to treat a device with cellular connectivity using the same rules that would apply to other access/connection types without the complexity and cost of deploying a 3GPP policy service to support N7 protocol for policy delivery.

Enterprise device identity proxy for extending enterprise device profile

A private cellular management system detects that a device has connected to a private cellular network. The device is part of a device group that is associated with a policy applicable within an enterprise network and the private cellular network. The private cellular management system generates a determination corresponding to a policy effectiveness associated with the access policy based on different versions of the policy implemented in the enterprise and private cellular networks. The private cellular management system obtains an update to the access policy and applies this update for the device and other devices associated with the device group.

Method and apparatus for policy attributes exchange between security policy management platforms and 5G as a service platforms

A system and method of performing multi-layer client assurance in a private cellular network includes a plurality of assurance points within the network. The method includes receiving, by a network entity, a plurality of parameter sets from the plurality of assurance points. Each of the plurality of assurance points can be configured to obtain measurements from a portion of the private cellular network corresponding to a client assurance layer in a client assurance stack. The method can include combining a first parameter set from the plurality of parameter sets with a second parameter set from the plurality of parameter sets. The first parameter set can be associated with a first client assurance layer and the second parameter set is associated with a second client assurance layer. The method can include determining, based on the combined parameter set, a network service level corresponding to the client device.

Systems and methods for providing multi-layer client assurance architecture for private cellular networking

Presented herein are techniques to facilitate delivering standalone non-public network (SNPN) credentials from an enterprise authentication server to a user equipment (UE) using an Extensible Authentication Protocol (EAP) process. In one example, a method may include determining, by an authentication server of an enterprise, that a UE for the enterprise is to receive credentials to enable the UE to connect to a SNPN of the enterprise in which the determining is performed based, at least in part, on connection of the UE to an access network that is different than the SNPN for the enterprise; and performing an authentication process with the UE by the authentication server in which the authentication process includes providing the credentials to the UE via a first authentication message and obtaining confirmation from the UE via a second authentication message that indicates successful provisioning of the credentials for the UE.

Delivering standalone non-public network (SNPN) credentials from an enterprise authentication server to a user equipment over extensible authentication protocol (EAP)

Systems, methods, and computer-readable media are disclosed for facilitating bi-directional edge proxy-to-edge proxy communications across an enterprise firewall in 5G service-based architecture. In one aspect, a method includes receiving a subscription request from a user device to operate on a visited private network; determining that the user device is associated with a home network; and establishing a communication protocol between a security edge protection proxy of the visited private network and a security edge protection proxy of the home network, wherein the communication protocol enables bi-directional exchange of roaming signals between the visited private network and the home network while user device is operating on the visited private network.

Bi-directional communication protocol for private networks

Presented herein are techniques associated with replicating an OpenRoaming™ policy federation in a Third Generation Partnership Project (3GPP) network environment. For example, techniques herein provide a roaming policy federation architecture for a 3GPP network environment. In one example a method is provided that may include encoding at least one multi-bit roaming policy for an identity provider and a plurality of bit-wise combinatorial permutations of the at least one multi-bit roaming policy within each of a plurality of multi-bit 3GPP broadcast identifiers, wherein the at least one multi-bit roaming policy includes bit-wise roaming policy information for the identity provider and configuring the multi-bit 3GPP broadcast identifiers for a mobile device associated with the identity provider, wherein the multi-bit 3GPP broadcast identifiers indicate that the mobile device is to connect to a visited radio access network associated with a local Internet Protocol (IP) access service or a home routed access service.

Providing a roaming policy federation in a third generation partnership project (3GPP) network environment

Disclosed herein are systems, methods, and computer-readable media for reporting QoE of a UE, as measured and determined from the perspective of the UE to one or more core components of the cellular network to which the UE is attached. The QoE may then be used by the one or more core components for managing and adjusting, if necessary, the cellular services provided to the UE. In one aspect, a method includes determining, at a user device, a quality of experience (QoE) of user device connected to a cellular network and transmitting, via a non-access stratum (NAS) signaling, a value of the QoE from the user device to a core network element of the cellular network, wherein the core network element utilizes the QoE value to manage network access and a quality of service (QoS) of the user device.

Quality of experience reporting over non-access stratum (NAS) signaling

Provided herein are techniques to facilitate multi-level performance tracing for a mobile network environment. In one instance, a method may include obtaining, by a mobile network, a trigger from an enterprise to initiate an underlay-level trace for a wireless device of the enterprise, wherein the trigger includes a correlation identifier that correlates the underlay-level trace with an enterprise-level trace for the wireless device and providing the underlay-level trace for a session of the wireless device by including a first trace flag for IP packets for the session and including a second trace flag for encapsulations of the IP packets for the session in which the first and second trace flag are unique to the session of the wireless device and enable elements of the mobile network to provide underlay trace information for the underlay-level trace for the session of the wireless device to a trace.

Performance tracing for mobile network environments

Presented herein are techniques to provide a network-initiated group disconnect for wireless devices belonging to one or more device group(s). In one example, a method may include determining, by a control element of a network, that at least one device group is to be disconnected from the network, wherein the at least one device group comprises a plurality of wireless devices connected to the network; identifying one or more access network radios through which the plurality of wireless devices are connected to the network; and triggering a disconnect command for the at least one device group to be broadcast from each of the one or more access network radios to trigger the plurality of wireless devices to disconnect from the network.

Network-initiated group disconnect for wireless devices

Systems, methods, and computer-readable media are disclosed for dynamically onboarding a UE between private 5G networks. In one aspect, a private 5G (P5G) federation system can receive a request from a user device for registration with a serving private 5G network, which is part of a P5G federation system. The P5G federation system can further determine that the user device is authenticated with a home private 5G network of the user device, which is also part of the P5G federation system. The P5G federation system can transmit, to the serving private 5G network, a security profile of the user device that is received from the home private 5G network. As follows, the P5G federation system can facilitate onboarding of the user device to the serving private 5G network with the security profile.

Private 5G federation system for dynamic user equipment on-boarding

Systems, methods, and computer-readable media are provided for on-boarding network devices onto a private 5G network. An example method can include discovering a first private 5G network upon the network device being turned on, authenticating, at the network device, the network device, downloading a second network profile from an SM-DP+ server of a second private 5G network, and on-boarding the network device to the second private 5G network.

On-boarding 5G routers to private 5G network

Techniques are described for extending a cellular quality of service bearer through an enterprise fabric network. In one example, a method obtaining, by a first switch of a network, a packet to be delivered to a client connected to the network via a cellular access point; identifying quality of service (QoS) bearer information associated with the packet, wherein the QoS bearer information is associated with a radio access bearer for the client and the QoS bearer information comprises a bearer indicator and a QoS class identifier; providing a fabric tunnel encapsulation for the packet, wherein the bearer indicator and the QoS class identifier are included within the fabric tunnel encapsulation of the packet; and forwarding the packet within the fabric tunnel encapsulation toward a second switch of the network via a fabric tunnel, wherein the cellular access point is connected to the network via the second switch.

Techniques for extending a cellular quality of service bearer through an enterprise fabric

The present technology is generally directed to dynamically adding network resources based on an application function (AF) notification. The present technology can determine, by an AF of a service provider, a network congestion on a network, the network congestion indicating that network resources for servicing a user device using services of the service provider do not meet corresponding Quality of Service (QoS) requirements. Further, the present technology can transmit a notification by the AF to a core network of a network provider to request additional network resources to be allocated for servicing the user device, the network provider providing network connectivity for the user device to receive the services provided by the service provider.

Dynamic addition of network resources based on application function notification

Growing community of inventors

Raleigh, NC, United States of America

Timothy Peter Stammers