Interdigital Patent Holdings, Inc.

Verizon Patent and Licensing Inc.

T-mobile Usa, Inc.

Yousif Targali

Guodong Zhang

Lei Wang

Xiaofei Wang

Sudheer A Grandhi

Vinod Kumar Choyi

Yogendra C Shah

Robert L Olesen

Sudhakar Reddy Patil

Inhyok Cha

Louis J Guccione

Andreas U Schmidt

Ronald Murias

Andreas Leicher

Michael A Gallagher

Kamel M Shaheen

Alpaslan Demir

Hang Liu

Kristen Sydney Young

Osama Lotfallah

Lawrence Loren Case

Amith Vikram Chincholi

Xavier De Foy

Bjorn Hjelm

Milan Patel

Kent William Hughes

Sanjay Goyal

Gerardo S Libunao

Dolores F Howry

Alexander Reznik

Kalyani Bogineni

Angelo A Cuffaro

Deepa Jagannatha

Salvador Mendoza

Samir M Hodroj

Shanthala Kuravangi-Thammaiah

Scott C Hergenhan

Kenneth F Lynch

David Robert Lenrow

Matthew Kirchberg

Jeffrey Melrose

Ronald G Murias

A method, a network device, and a non-transitory computer-readable storage medium are described in relation to an application authorization service. The application authorization service may be performed at an end device and invoked responsive to the launching of an application. The application authorization service may include validating an application certificate associated with the application, validating an attestation value, and validating a token provided by the application. The application may provide a request that includes an application identifier and a token. The application may be granted access to a network or denied access depending on the outcome of the validation procedures. The granted access may include assignment of a network slice. The application certificate, a secured token, and a secured attestation value may be stored in a secure environment at the end device and used for validation procedures.

Method and system for application authorization for network slices

In some implementations, a policy control function (PCF) device may receive a PCF device key uniquely associated with a user equipment (UE). The PCF device may generate an integrity key and an encryption key based on the PCF device key and an identifier of the PCF device. The PCF device may generate, based on the integrity key, integrity data associated with policy information related to the UE. The PCF device may encrypt, based on the encryption key, the policy information to generate encrypted policy information. The PCF device may send, for the UE, a UE policy message indicating the integrity data, the encrypted policy information, and the identifier of the PCF device.

Systems and methods for secure policy messaging

A method performed by a STA may comprise receiving a frame, from a first AP including an indication of a configuration change counter (CCC) associated with a second AP. The CCC may be an unsigned integer that increments when an update to one or more AP parameters of the second AP has occurred. The method may further comprise establishing a first wireless link with the first AP and establishing a master key via at least the first wireless link.

Station and method for receiving a frame comprising a configuration change counter corresponding to another access point

Systems and methods enable the provisioning of security as a service for network slices. A network device stores definitions of multiple security assurance levels for network slices based on security parameters of assets used in the network slices. The network device stores multiple network slice templates, wherein the multiple network slice templates have different security assurance levels, of the multiple security assurance levels, for a Network Service Descriptor (NSD). The network device receives a request for a network slice with a requested security assurance level, of the multiple security assurance levels, for the NSD, and deploys the network slice using one of the network slice templates that has a security assurance level that corresponds to the requested security assurance level. The network device monitors the security parameters of the assets of the network slice for changes to the security assurance level of the deployed network slice.

Methods and systems for 5G slicing based on dynamic security properties

A method may include receiving, at a network device, a registration request that comprises a subscription concealed identifier (SUCI) associated with a particular user equipment (UE) device. The network device determines whether the SUCI indicates a request for null-scheme network access; and retrieves a scheme authorization parameter for the UE device when it is determined that the SUCI indicates a request for null-scheme network access. The scheme authorization parameter indicates whether the UE device is authorized for null-scheme access to a service provider network. The network device determines whether the UE device is authorized for null-scheme network access based on the retrieved scheme authorization parameter and performs processing associated with null-scheme network access when it is determined that the particular UE device is authorized for null-scheme network access.

Systems and methods for null-scheme access authorization

Systems and methods described herein enforce access controls for network slices via proxy in a secure enclave of a user equipment (UE) device. A UE device executes, in a rich execution environment (REE), a function or application designated for using one or more secure network slices of a telecommunications network. The UE device executes, in a trusted execution environment (TEE), a slice admission control proxy (SACP) to perform admission control for the one or more secure network slices, and forces network traffic for the function or application through the SACP.

Provider proxy for controlling network slice access by user equipment

A network terminal, e.g., LTE or 5G, can connect to a home network via a serving network. The terminal can have a terminal identifier (TID), such as an IMEI or other PEI, and a network subscriber can have a subscriber identifier (SID), such as an IMSI or other SUPI. In some nonlimiting examples, a network node can determine that a SID and a TID are authorized for joint use and, in response, transmit authorization information. In some nonlimiting examples, a network node can receive an attach request having verification data and encrypted identification data. The network node can receive decrypted identity data and determine that the identity data corresponds with the verification data. In some nonlimiting examples, the terminal can send an attach request comprising encrypted SID and TID data, and a cryptographic hash, to a network node.

Identifier-based access control in mobile networks

A device may receive, from a network device, a user equipment (UE) parameter update request notification indicating an update to a UE parameter of a universal subscriber identity module (USIM), and may generate an encrypted UE parameter update request. The device may cause the encrypted UE parameter update request to be provided to the USIM to cause the USIM to update the UE parameter and to generate an encrypted UE parameter update response. The device may receive, from the network device, the encrypted UE parameter update response, and may verify an authenticity of content of the encrypted UE parameter update response based on whether the encrypted UE parameter update response is signed by the USIM. The device may provide, to the network device, a result indicating whether the UE parameter is updated and whether the authenticity of the content of the encrypted UE parameter update response is verified.

Systems and methods for securely updating and managing universal subscriber identity module information

A telecommunications network includes a serving network and a home network. In some examples the serving network receives, from the home network, identity data associated with a network terminal. The serving network determines a tied key using a tying key derivation function (TKDF) based on the identity data, then prepares an authentication request based on the tied key and sends the request to the terminal. In some examples, the home network receives the identity data from the access network and determines a tied key using a TKDF. The home network then determines a confirmation message based on the first tied key. In some examples, the serving network receives the identity data from the home network, and receives a network-slice selector associated with the network terminal. The serving network determines a tied key using a TKDF based on the identity data and the network-slice selector.

Key-derivation verification in telecommunications network

Systems and methods for provisioning user privacy parameters necessary for network security in 5G telecommunication networks are provided, such as the subscriber permanent identifier (SUPI), the routing indicator, the protection scheme identifier, or the home network key. In order to protect the user privacy parameters, the techniques disclosed herein use private and public key encryption, as well as integrity protection offered by 5G telecommunications protocols. Such techniques use registration response messages, update location requests, or update notification request messages to provide end-to-end or end-to-middle security in the provisioning process. Unlike existing over-the-air (OTA) techniques, the techniques described herein provision user privacy parameters or other similar data in a secure and verifiable manner.

Secure privacy provisioning in 5G networks

The systems, devices, and methods discussed herein are directed to a portable communication device, or a user equipment (UE), for obtaining cellular network services with an unassociated cellular network with assistance from a wireless local area network (WLAN). The UE registers with the WLAN, discovers the unassociated cellular network, sends request to a WLAN service provider of the WLAN to obtain cellular network services with the unassociated cellular network, and obtains cellular network services with the unassociated cellular network.

WLAN assisted cellular network discovery and selection

Growing community of inventors

Sammamish, WA, United States of America

Yousif Targali