Convida Wireless, LLC

Verizon Patent and Licensing Inc.

Interdigital Patent Holdings, Inc.

Ipla Holdings Inc.

Vinod Kumar Choyi

Zhuo Chen

Quang Ly

Dale N Seed

Shamim Akbar Rahman

Michael F Starsinic

William Robert Flynn, Iv

Yogendra C Shah

Chonggang Wang

Rocco Di Girolamo

Catalina Mihaela Mladin

Xu Li

Sudhakar Reddy Patil

Lijun Dong

Yousif Targali

Qing Li

Hongkun Li

Hossein M Ahmadi

Mahmoud Watfa

Guang Lu

Shoshana Loeb

Michael A Gallagher

Gregory S Sternberg

Maqbool Chauhan

Jerry Steben

David Taft

Alexander Reznik

Alpaslan Demir

Kristen Sydney Young

Parry Cornell Booker

Louis J Guccione

Andreas Leicher

Amith Vikram Chincholi

Ahmed Mohamed

Shanthala Kuravangi-Thammaiah

Sanjay Goyal

Robert Avanes

Michael Victor Meyerstein

Dolores F Howry

Minbao Li

Samita Chakrabarti

Jayesh Kumar Laad

David Robert Lenrow

Eldad M Zeira

Ravikumar V Pragada

Kalyani Bogineni

Balaji B Raghothaman

Angelo A Cuffaro

Paul L Russell, Jr

Deepa Jagannatha

Xavier De Foy

Kiran K Vanganuru

Phillip Brown

Nicholas J Podias

Scott C Hergenhan

Kenneth F Lynch

Alec Brusilovsky

Myron Eugene Bagwell

Donald Alfred Fleck

Richard P Gorman

Jeffrey Melrose

William Robert Iv Flynn

Samir Ferdi

Saad Ahmad

Rocco Digirolamo

Catalina Mihaela Mlandin

Michael F Starsnic

Shamin Akbar Rahman

IoT service layer capabilities may be employed to automate and simplify the service enrollment process for IoT service subscribers/enrollees. These capabilities enable virtualization of a service subscriber and the physical IoT devices, applications, data and authorized users of the subscriber into a software profile that is representative of the subscriber. Once virtualized, a service subscriber may then delegate the complexities and burden of service enrollment to an automated IoT service enrollment software function.

Automated service enrollment in a machine-to-machine communications network

A system described herein may monitor information associated with a set of User Equipment ('UEs') associated with a first network, and may receive an access request, for access to a first UE of the set of UEs, from a second UE associated with a second network. The system may obtain, based on the access request and from the second network, monitored information associated with the second UE. The system may identify monitored information associated with the first UE and a particular access policy that is associated with the first UE and the second UE. The system may identify, based on the particular access policy, the monitored information associated with the first UE, and the monitored information associated with the second UE, whether to grant or deny the access request. The system may output, in response to the access request, an indication of whether the access request is granted or denied.

Systems and methods for dynamic authorization of external devices for network access

Existing approaches to security within network, for instance oneM2M networks, are limited. For example, content might only be protected while the content is in transit between entities that trust each other. Here, the integrity and the confidentiality of content in an M2M network are protected. Such content may be 'at rest,' such that the content is stored at a hosting node. Only authorized entities may store and retrieve the data that is stored at the hosting node, and the data may be protected from a confidentiality perspective and an integrity perspective.

Content security at service layer

In some implementations, a policy control function (PCF) device may receive a PCF device key uniquely associated with a user equipment (UE). The PCF device may generate an integrity key and an encryption key based on the PCF device key and an identifier of the PCF device. The PCF device may generate, based on the integrity key, integrity data associated with policy information related to the UE. The PCF device may encrypt, based on the encryption key, the policy information to generate encrypted policy information. The PCF device may send, for the UE, a UE policy message indicating the integrity data, the encrypted policy information, and the identifier of the PCF device.

Systems and methods for secure policy messaging

A computer device may include a memory storing instructions and processor configured to execute the instructions to host a network function container that implements a microservice for a network function in a wireless communications network, wherein the network function container is deployed by a container orchestration platform; host a service proxy container associated with the network function container, wherein the service proxy container is deployed by the container orchestration platform; and configure the hosted service proxy container to apply a wireless network policy to the microservice for the network function. The processor may be further configured to intercept messages associated with the microservice for the network function using the configured service proxy container; and apply the wireless network policy to the intercepted messages using the configured service proxy container.

Wireless network policy manager for a service mesh

In some implementations, a service communication proxy (SCP) network function device may receive, from a first network function device, a service request associated with a second network function device. The SCP network function device may transmit an access token request to a network repository function (NRF) network function device. The SCP network function device may receive, based on the access token request, an access token associated with the first network function device. The SCP network function device may transmit the service request to the second network function device, wherein the service request is transmitted to the second network function device with an indication of the access token.

Systems and methods for service authorization in a delegated discovery deployment

Systems and methods enable the provisioning of security as a service for network slices. A network device stores definitions of multiple security assurance levels for network slices based on security parameters of assets used in the network slices. The network device stores multiple network slice templates, wherein the multiple network slice templates have different security assurance levels, of the multiple security assurance levels, for a Network Service Descriptor (NSD). The network device receives a request for a network slice with a requested security assurance level, of the multiple security assurance levels, for the NSD, and deploys the network slice using one of the network slice templates that has a security assurance level that corresponds to the requested security assurance level. The network device monitors the security parameters of the assets of the network slice for changes to the security assurance level of the deployed network slice.

Methods and systems for 5G slicing based on dynamic security properties

Disclosed are embodiments for injecting sidecar proxy capabilities into non-sidecar applications, allowing such non-sidecar applications to communicate with a service mesh architecture. In an embodiment, a method comprises receiving a request to instantiate a proxy for a non-sidecar application at a service mesh gateway (SMG). The SMG then instantiates the proxy in response to the request and broadcasts network information of the non-sidecar application to a mesh controller deployed in a containerized environment. Finally, the SMG (via the proxy) transmits data over a control plane that is communicatively coupled to the mesh controller.

Sidecar proxy as a service

Described herein are complete lifecycle management processes for IoT/M2M devices. In an example, devices are commissioned and de-commissioned in a given system without requiring a user/human administrator. A delegated life-cycle management process is described, wherein devices rely upon a delegatee, which may have more computing and battery resources than the devices, to perform complete or partial lifecycle management operations on behalf of the devices. The delegatee may be a trusted entity that may belong to the same domain as the devices. Further, a Trust Enabling Infrastructure (TEI) is described herein, which may belong to a different trusted domain than the given device and its delegatee.

Security lifecycle management of devices in a communications network

In some implementations, a device of a network may receive, from a user equipment (UE), a request associated with enabling the UE to access a network, wherein the request includes a first routing indicator. The device may identify an authentication manager, of the network, that is mapped to the first routing indicator in an entry of a routing table of the network. The device may route the request to the authentication manager of the network to permit the authentication manager to authenticate the UE. The device may purge, based on the request being routed to the authentication manager, the entry to remove the first routing indicator from the routing table. The device may store, after purging the entry, a second routing indicator in the entry to map the second routing indicator to the authentication manager, wherein the second routing indicator is different from the first routing indicator.

Systems and methods for using a unique routing indicator to connect to a network

Systems and methods described herein provide for User Equipment (UE)-initiated authentication and authorization updates to Network Slice-Specific Authentication and Authorization (NSSAA). A network device in a core network receives a message from a user device outside of the core network, wherein the message includes a request to initiate a NSSAA procedure. The network device initiates the NSSAA procedure in response to the request. The systems and methods also provide for UE-initiated authorization revocation of NSSAA.

Systems and methods for UE-initiated NSSAA procedures

One or more devices may include a credentials server. The credentials server may be configured to: receive primary Standalone Non-Public Network (SNPN) credentials for a User Equipment device (UE) and SNPN information. The primary SNPN credentials and the SNPN information are associated with the UE and an SNPN. The devices may be configured to generate temporary SNPN credentials based on the primary SNPN credentials and the SNPNN information. The devices may forward the temporary SNPN credentials to the SNPN.

Systems and methods for secure access to 5G non-public networks using mobile network operator credentials

Systems and methods leverage trust anchors to generate tokens which can then be used by network functions (NFs). A virtualization infrastructure manager (VIM) for a virtualized platform receives a NF software package and a certificate request token (CRT) from a management function. The NF is a virtual NF, a containerized NF, or another virtual entity (xNF) to be deployed. The CRT is digitally signed by the management function and includes a network address of a trust anchor platform and a NF profile. The VIM deploys the NF and provides the CRT to the NF. The NF obtains from the CRT the network address of the trust anchor platform, generates a certificate signing request (CSR) for a digital certificate, and submits the CSR and the CRT to the trust anchor platform. The NF receives a digital certificate from the trust anchor platform based on validation of both the CSR and CRT.

System and method for establishing dynamic trust credentials for network functions

Methods, system, and apparatuses may support end-to-end (E2E) quality of service (QoS) through the use of service layer (SL) sessions. For example, an application can communicate with a targeted device based on application specified schedule, latency, jitter, error rate, throughput, level of security, and cost requirements.

Internet of things end-to-end service layer quality of service management

Growing community of inventors

Conshohocken, PA, United States of America

Vinod Kumar Choyi