Patent application number | Description | Published |
20090093232 | PROVISIONING COMMUNICATION NODES - Provisioning and access control for communication nodes involves assigning identifiers to sets of nodes where the identifiers may be used to control access to restricted access nodes that provide certain services only to certain defined sets of nodes. In some aspects provisioning a node may involve providing a unique identifier for sets of one or more nodes such as restricted access points and access terminals that are authorized to receive service from the restricted access points. Access control may be provided by operation of a restricted access point and/or a network node. In some aspects, provisioning a node involves providing a preferred roaming list for the node. In some aspects, a node may be provisioned with a preferred roaming list through the use of a bootstrap beacon. | 04-09-2009 |
20090094351 | ACCESS TERMINAL CONFIGURATION AND ACCESS CONTROL - Provisioning and access control for communication nodes involves assigning identifiers to sets of nodes where the identifiers may be used to control access to restricted access nodes that provide certain services only to certain defined sets of nodes. In some aspects provisioning a node may involve providing a unique identifier for sets of one or more nodes such as restricted access points and access terminals that are authorized to receive service from the restricted access points. Access control may be provided by operation of a restricted access point and/or a network node. In some aspects, provisioning a node involves providing a preferred roaming list for the node. In some aspects, a node may be provisioned with a preferred roaming list through the use of a bootstrap beacon. | 04-09-2009 |
20090094680 | ACCESS MANAGEMENT FOR WIRELESS COMMUNICATION - Provisioning and access control for communication nodes involves assigning identifiers to sets of nodes where the identifiers may be used to control access to restricted access nodes that provide certain services only to certain defined sets of nodes. In some aspects provisioning a node may involve providing a unique identifier for sets of one or more nodes such as restricted access points and access terminals that are authorized to receive service from the restricted access points. Access control may be provided by operation of a restricted access point and/or a network node. In some aspects, provisioning a node involves providing a preferred roaming list for the node. In some aspects, a node may be provisioned with a preferred roaming list through the use of a bootstrap beacon. | 04-09-2009 |
20100124228 | REMOTE ACCESS TO LOCAL NETWORK - Multiple protocol tunnels (e.g., IPsec tunnels) are deployed to enable an access terminal that is connected to a network to access a local network associated with a femto access point. A first protocol tunnel is established between a security gateway and the femto access point. A second protocol tunnel is then established in either of two ways. In some implementations the second protocol tunnel is established between the access terminal and the security gateway. In other implementations the second protocol tunnel is established between the access terminal and the femto access point, whereby a portion of the tunnel is routed through the first tunnel. | 05-20-2010 |
20100125899 | REMOTE ACCESS TO LOCAL NETWORK VIA SECURITY GATEWAY - Multiple protocol tunnels (e.g., IPsec tunnels) are deployed to enable an access terminal that is connected to a network to access a local network associated with a femto access point. A first protocol tunnel is established between a security gateway and the femto access point. A second protocol tunnel is then established in either of two ways. In some implementations the second protocol tunnel is established between the access terminal and the security gateway. In other implementations the second protocol tunnel is established between the access terminal and the femto access point, whereby a portion of the tunnel is routed through the first tunnel. | 05-20-2010 |
20100130171 | METHOD AND APPARATUS TO PERFORM SECURE REGISTRATION OF FEMTO ACCESS POINTS - Methods, apparatus, and systems to perform secure registration of a femto access point for trusted access to an operator-controlled network element. Method steps include establishing a security association for at least one said femto access point, making a request using the security association to an operator-controlled network element, which requests a secure registration credential from an authorizing component. The operator-controlled network element constructs a secure registration credential and sends the secure registration credential to the requesting femto access point, thus authorizing trusted access by the requesting femto access point to access operator-controlled network elements. Embodiments include establishing a security association via an IPsec security association received from a security gateway which is within an operator-controlled domain and using an operator-controlled database of IPsec inner addresses. In some embodiments the femto access point conducts message exchanges using one or more IMS protocols and components, including call session control function elements, which elements in turn may authorize a femto access point within the IMS domain, may or access non-IMS network elements for authorization. | 05-27-2010 |
20100284304 | METHOD AND APPARATUS TO ESTABLISH TRUST AND SECURE CONNECTION VIA A MUTUALLY TRUSTED INTERMEDIARY - Systems and methods for establishing secure communications between two network elements through a trusted intermediary when no direct communication path is available. Separate secure communication links are established between the network elements and the trusted intermediary to facilitate secure end to end communication. | 11-11-2010 |
20110119492 | Apparatus and Method for Over-the-Air (OTA) Provisioning of Authentication and Key Agreement (AKA) Credentials Between Two Access Systems - A method and apparatus for over-the-air provisioning of authentication credentials at an access device via a first access system, wherein the authentication credentials are for a second access system lacking an over-the-air provisioning procedure. For example, the second access system may be a 3GPP system using AKA authentication methods. The first access system may be CDMA, using an OTASP or IOTA procedure. Provisioning the authentication credentials may include provisioning any of a 3GPP AKA authentication root key (K), AKA authentication related parameters, an AKA authentication algorithm to be used in the 3GPP authentication, or authentication algorithm customization parameters. | 05-19-2011 |
20110134837 | FEMTOCELL ACCESS CONTROL - Access by a mobile station to a femto access point (FAP) of a wireless communication system is controlled by an enforcement point in response to mobile station authorization data provided from a storage point that is remote from the FAP. The authorization data is provided in response to FAP authentication data. The authentication data may include a FAP identifier and a message authenticator that the FAP generates by hashing shared secret information. The storage point may provide the authorization data in response to determining that the message authenticator is a hash of the shared secret information. | 06-09-2011 |
20110159841 | SYSTEMS, APPARATUS AND METHODS TO FACILITATE HANDOVER SECURITY - Systems, methods and apparatus for facilitating handover security are provided. In some embodiments, the method can include deriving a key value for handover from a GERAN/UTRAN system to an E-UTRAN system using a first input value. The method can also include deriving a key value for a connection establishment using a second input value, wherein the first input value is different from the second input value and is different from input values derived subsequent to the second input value, and wherein the first input value, the second input value and the input values derived subsequent to the second input value are configured to be input to a same key derivation function configured to output a key for use between a network entity and user equipment. | 06-30-2011 |
20110185397 | Method And Apparatus For Securing Wireless Relay Nodes - In order to mitigate the security risk posed by the insertion of a relay node within a communication network, both device authentication and subscriber authentication are performed on the relay node. Device and subscriber authentication may be bound together so that a relay node is granted access to operate within the network only if both device and subscriber authentication are successful. Additionally, a communication network (or authentication node) may further verify that a subscriber identifier (received as part of subscriber authentication) is associated with the corresponding device type (identified by the device identifier in the corresponding device authentication) as part of the subscriber authentication process. | 07-28-2011 |
20110191835 | METHOD AND APPARATUS FOR IDENTITY REUSE FOR COMMUNICATIONS DEVICES - An apparatus and method for identity reuse operable in a communications system, the method comprising selecting an identity value for a device; registering the device onto a network with the selected identity value; determining if the registration of the device is successful; and establishing a communication session for the device and deregistering the selected identity value upon termination of the communication session if the registration is successful, or determining whether to try a different identity value if the registration is not successful. In one aspect, the apparatus and method further comprising waiting a predetermined time period before either re-registering with the selected identity value or registering with the different identity value. | 08-04-2011 |
20110249636 | APPARATUS AND METHOD FOR CONNECTION ESTABLISHMENT IN A COMMUNICATIONS NETWORK - An apparatus and method for establishing a connection including reserving a common connection for use by more than one access terminal (AT); associating the common connection with a network identifier corresponding to the AT; deleting a network identifier-related context while maintaining the network identifier; and transmitting a message, based on a call to the AT, via the common connection and based on the network identifier, wherein a specific connection for carrying the call is based on a response to the message. In one example, the apparatus and method include conducting a registration session with a wireless communications network; obtaining a network identifier corresponding to the AT based on the registration session; deleting a network identifier-related context for the AT while maintaining the network identifier; receiving a message indicating a call destined for the AT; and establishing, based on the message, a specific connection for carrying the call. | 10-13-2011 |
20110255691 | APPARATUS AND METHOD FOR TRANSITIONING ENHANCED SECURITY CONTEXT FROM A UTRAN-BASED SERVING NETWORK TO A GERAN-BASED SERVING NETWORK - Disclosed is a method for transitioning an enhanced security context from a UTRAN-based serving network to a GERAN-based serving network. In the method, the remote station the remote station generates first and second session keys, in accordance with the enhanced security context, using an enhanced security context root key and a first information element. The remote station receives a first message from the UTRAN-based serving network. The first message includes a second information element signaling to the remote station to generate third and fourth session keys for use with the GERAN-based serving network. The remote station generates, in response to the first message, the third and fourth session keys using the second information element and the first and second session keys. The remote station protects wireless communications, on the GERAN-based serving network, based on the third and fourth session keys. | 10-20-2011 |
20110255693 | Apparatus and method for transitioning from a serving network node that supports an enhanced security context to a legacy serving network node - Disclosed is a method for transitioning a remote station from a current serving network node having an enhanced security context to a new serving network node. In the method, the remote station provides at least one legacy key, and generates at least one session key based on an information element associated with the enhanced security context. The remote station forwards a first message having the information element to the new serving network node. The remote station receives a second message, from the new serving network node, having a response based on either the legacy key or the session key. The remote station determines that the new serving network node does not support the enhanced security context if the response of the second message is based on the legacy key. Accordingly, the remote station protects communications based on the legacy key upon determining that the enhanced security context is not supported. | 10-20-2011 |
20110258445 | Apparatus and method for signaling enhanced security context for session encryption and integrity keys - Disclosed is a method for establishing an enhanced security context between a remote station and a serving network. In the method, the remote station forwards a first message to the serving network, wherein the first message includes an information element signaling that the remote station supports an enhanced security context. The remote station generates at least one session key, in accordance with the enhanced security context, using the information element. The remote station receives, in response to the first message, a second message having an indication that the serving network supports the enhanced security context. The remote station, in response to the second message, has wireless communications protected by the at least one session key. | 10-20-2011 |
20110263225 | METHOD AND APPARATUS FOR NETWORK PERSONALIZATION OF SUBSCRIBER DEVICES - A method and apparatus are provided for a subsidizing service provider entity to personalize a subscriber device to ensure the subscriber device cannot be used in a network of a different service provider entity. As the service provider entity subsidizes the subscriber device, it desires to ensure that subscriber device is personalized such that the subscriber device may operate only in its network and not a network of a different service provider entity. The subscriber device is pre-configured with a plurality of provider-specific and/or unassociated root certificates by the manufacturer of the subscriber device. A communication service is established between the service provider entity and the subscriber device allowing for the mutual authentication of the subscriber device and the service provider entity. After mutual authentication, the service provider entity sends a command to the subscriber device to disable/delete some/all root certificates that are unassociated with the service provider entity. | 10-27-2011 |
20110311053 | Apparatus and method for transitioning enhanced security context from a UTRAN/GERAN-based serving network to an E-UTRAN-based serving network - Disclosed is a method for transitioning an enhanced security context from a UTRAN/GERAN-based serving network to an E-UTRAN-based serving network. In the method, the remote station the remote station generates first and second session keys, in accordance with the enhanced security context, using a first enhanced security context root key associated with a UTRAN/GERAN-based serving network and a first information element. The remote station receives a first message from the E-UTRAN-based serving network. The first message signals to the remote station to generate a second enhanced security context root key for use with the E-UTRAN-based serving network. The remote station generates, in response to the first message, the second enhanced security context root key from the first enhanced security context root key using the s first and second session keys as inputs. The remote station protects wireless communications, on the E-UTRAN-based serving network, based on the second enhanced security context root key. | 12-22-2011 |
20110314287 | Method and apparatus for binding subscriber authentication and device authentication in communication systems - An authentication method is provided between a device (e.g., a client device or access terminal) and a network entity. A removable storage device may be coupled to the device and stores a subscriber-specific key that may be used for subscriber authentication. A secure storage device may be coupled to the device and stores a device-specific key used for device authentication. Subscriber authentication may be performed between the device and a network entity. Device authentication may also be performed of the device with the network entity. A security key may then be generated that binds the subscriber authentication and the device authentication. The security key may be used to secure communications between the device and a serving network. | 12-22-2011 |
20110314522 | Method and apparatus for relay node management and authorization - Methods and apparatuses are provided for deploying relay nodes in a communication network. A relay node can initially be wirelessly authenticated to a network entity using initial security credentials. In response to a successful authentication, the relay node is authorized to wirelessly communicate with the communication network for a limited purpose of configuring the relay node for relay device operations. The relay node can receive new security credentials from the communication network, and is subsequently re-authenticated to the network entity using the new security credentials. In response to a successful re-authentication, the relay node is authorized by the network to operate as a relay device for conveying traffic between one or more access terminals and the communication network. | 12-22-2011 |
20120100832 | Authentication of access terminal identities in roaming networks - Various methods of authenticating an access terminal are presented in the case where the access terminal is roaming within a visited network. An access terminal sends a device authentication message to a visited validation server or a home validation server, where the device authentication message includes an access terminal identifier and authentication data generated at least in part using the validation key. In some embodiments, the authentication data may include a digital signature by a validation key associated with the access terminal identifier. Such a signature can be authenticated by either the visited validation server or the home validation server. In other embodiments, the authentication data may include an access terminal authentication token sent to the visited validation server. The visited validation server can authenticate the device authentication message by comparing the access terminal authentication token with an access terminal authentication token obtained from the home validation server. | 04-26-2012 |
20120127956 | APPARATUS AND METHOD FOR ENHANCED NON OPTIMIZED HANDOVER - This disclosure provides systems, methods and apparatus for non-optimized handoffs for wireless communication. For example, the disclosure may be applied to enhance non-optimized handoff from a long-term evolution (LTE) network to an evolved high rate packet data (eHRPD) network. Systems, methods, and apparatus for reducing the interruption gap during handoffs from an LTE radio access network to an eHRPD network are also discussed. In one aspect, a method is provided for communicating information associated with a handoff of a wireless device from a source network to a target network. The method includes fetching a context for a device communicating via a first radio access system of a first network based in part on a unique identifier from a second radio access system of a second network. | 05-24-2012 |
20120188980 | SYSTEMS AND METHODS FOR NON-OPTIMIZED HANDOFF - Systems, methods and apparatus for non-optimized handoffs for wireless communication are provided. For example, the disclosure may be applied to enhance non-optimized handoff from a long-term evolution (LTE) network to an evolved high rate packet data (eHRPD) network. Systems, methods, and apparatus for reducing the interruption gap during handoffs from an LTE radio access network to an eHRPD network are also discussed. In one aspect, a method is provided for communicating information associated with a handoff of a wireless device from a source network to a target network. The method includes, during a period of data inactivity, attaching to a first network and creating a context therewith, the first network being a non-preferred network as compared to a second network. The method also include connecting to the second network based on the context created with the first network and while maintaining at least a partial context with the first network. | 07-26-2012 |
20120233685 | METHOD FOR AUTHENTICATION OF A REMOTE STATION USING A SECURE ELEMENT - Disclosed is a method for authentication of a remote station by a management station using a secure element. In the method, the remote station receives an identity request from the secure element. The identity request includes a first challenge provided to the secure element by the management station. The remote station forwards an identity response to the secure element. The identity response includes a response to the first challenge that is signed by a key of the remote station, and the signed response to the first challenge is for use by the management station to authenticate the remote station. | 09-13-2012 |
20130081113 | METHODS OF AND SYSTEMS FOR REMOTELY CONFIGURING A WIRELESS DEVICE - A particular method includes transmitting a message from a first device to a second device. The message includes first information associated with identification of the first device. The first information enables the second device to obtain access data. The method also includes establishing a first communication link between the first device and the second device based on the access data. The method further includes receiving, via the first communication link, second information associated with establishment of a second communication link between the first device and a third device. The method also includes configuring the first device to establish the second communication link between the first device and the third device based on the second information. | 03-28-2013 |
20130117820 | ENABLING ACCESS TO KEY LIFETIMES FOR WIRELESS LINK SETUP - A particular method includes performing a bootstrapped extensible authentication protocol (EAP) re-authentication protocol (ERP) re-authentication at a mobile device after performing an EAP authentication with the access point prior to expiration of a master session key (MSK) associated with the EAP authentication. Another particular method includes performing, at an access point, a bootstrapped ERP re-authentication of a mobile device without interrupting a flow of data packets with respect to the mobile device. | 05-09-2013 |
20130117843 | Methods, Devices, And Systems For Detecting Return-Oriented Programming Exploits - Methods, devices, and systems for detecting return-oriented programming (ROP) exploits are disclosed. A system includes a processor, a main memory, and a cache memory. A cache monitor develops an instruction loading profile by monitoring accesses to cached instructions found in the cache memory and misses to instructions not currently in the cache memory. A remedial action unit terminates execution of one or more of the valid code sequences if the instruction loading profile is indicative of execution of an ROP exploit involving one or more valid code sequences. The instruction loading profile may be a hit/miss ratio derived from monitoring cache hits relative to cache misses. The ROP exploits may include code snippets that each include an executable instruction and a return instruction from valid code sequences. | 05-09-2013 |
20130132734 | Computing device integrity protection - A method of operating a computer system includes: obtaining, at the computer system, verification-input information associated with each of multiple hardware components of the computer system; cryptographically processing, at the computer system, the verification-input information to obtain a cryptographic result; and determining, at the computer system, whether to allow or inhibit, depending upon a comparison of the cryptographic result with a verification value, further operation of at least one of the hardware components. | 05-23-2013 |
20130142118 | SYSTEMS AND METHODS FOR MACHINE TO MACHINE DEVICE CONTROL AND TRIGGERING - Systems and methods for control and triggering of machine to machine (M2M) devices (e.g., smart meters). More specifically how to allow an M2M service provider (e.g., utility company) to use an operator's network to communicate with the M2M device connected with a UE/GW associated with the operator's network. The M2M service provider may receive identification of the UE/GW, but not for the M2M device. By transmitting an identifier for the M2M device along with an identifier for the UE/GW, the network operator may define establish and maintain a communication path specific to M2M devices. Similar techniques may be incorporated to allow the M2M service provider to locate and trigger the M2M device. | 06-06-2013 |
20130185792 | DYNAMIC EXECUTION PREVENTION TO INHIBIT RETURN-ORIENTED PROGRAMMING - A method, apparatus, and/or system for execution prevention is provided. A state indicator for a first subset of a plurality of memory pages of executable code in a memory device is set to a non-executable state. A state indicator for a second subset of the plurality of memory pages is set to an executable state, where the second subset of the plurality of memory pages includes indirection stubs to functions in the first subset of the plurality of memory pages. Upon execution of an application, a function call is directed to a corresponding indirection stub in the second subset of the plurality of memory pages which modifies the state indicator for a corresponding function in the first subset of the plurality of memory pages prior to directing execution of the called function from the first subset of the plurality of memory pages. | 07-18-2013 |
20130247150 | WIRELESS COMMUNICATION USING CONCURRENT RE-AUTHENTICATION AND CONNECTION SETUP - A method includes generating at least one of a re-authorization request or a re-authentication with an extensible authentication protocol. The method also includes generating an upper layer message. The method further includes bundling the upper layer message and the least one of the re-authorization request or the re-authentication request as an association request. The method further includes transmitting the association request to an access point. | 09-19-2013 |
20130254519 | NETWORK SECURITY CONFIGURATION USING SHORT-RANGE WIRELESS COMMUNICATION - A configuration device is disclosed for configuring a network device in a communication network. The configuration device initiates pairing operations with the network device via a short-range communication connection. The configuration device determines whether the network device is in a registered state or an unregistered state. If the configuration device determines that the network device is in the unregistered state, the configuration device establishes a secure short-range communication channel between the configuration device and the network device. The configuration device transmits a network key to the network device via the secure short-range communication channel for configuring the network device to communicatively connect to the communication network. If the configuration device determines that the network device is in the registered state, the configuration device determines whether to unregister the network device. | 09-26-2013 |
20130258944 | Method for configuring a home node with a secure address for an operator network node - Disclosed is a method for configuring a home node with a secure address for an operator network node. In the method, the home node receives, from a removable smartcard, an initial address for an initial serving network node. The home node establishes communication with the initial serving network node using the initial address. The home node receives the secure address from the initial serving network node. The home node communicates with the operator network node using the secure address. | 10-03-2013 |
20130267202 | SECURE RECEPTION REPORTING - In a first configuration, a UE receives, from a service provider, a certificate authority list. The certificate authority list is at least one of integrity protected or encrypted based on a credential known by the UE and the service provider and stored on a smartcard in the UE. The UE authenticates a server using the received certificate authority list. In a second configuration, the UE receives a user service discovery/announcement including a reception report configuration and an address of a server. The UE sends a protected reception report to the server based on the reception report configuration. In a third configuration, the UE receives a protected broadcast announcement and communicates based on the broadcast announcement. The broadcast announcement is at least one of integrity protected or encrypted based on a credential known by the UE and stored on a smartcard in the UE. | 10-10-2013 |
20130275760 | Method for configuring an internal entity of a remote station with a certificate - Disclosed is a method for configuring an internal entity of a WiFi-enabled remote station with a certificate. In the method, the remote station receives the certificate in at least one message from a registrar acting as a certificate authority. The remote station provides the certificate to the internal entity. The internal entity securely communicates with an external entity based on the certificate. | 10-17-2013 |
20130281060 | METHOD AND APPARATUS FOR NETWORK PERSONALIZATION OF SUBSCRIBER DEVICES - A method and apparatus are provided for a subsidizing service provider entity to personalize a subscriber device to ensure the subscriber device cannot be used in a network of a different service provider entity. As the service provider entity subsidizes the subscriber device, it desires to ensure that subscriber device is personalized such that the subscriber device may operate only in its network and not a network of a different service provider entity. The subscriber device is pre-configured with a plurality of provider-specific and/or unassociated root certificates by the manufacturer of the subscriber device. A communication service is established between the service provider entity and the subscriber device allowing for the mutual authentication of the subscriber device and the service provider entity. After mutual authentication, the service provider entity sends a command to the subscriber device to disable/delete some/all root certificates that are unassociated with the service provider entity. | 10-24-2013 |
20130305330 | SYSTEMS AND METHODS FOR REMOTE CREDENTIALS MANAGEMENT - The present application relates generally to wireless communication systems and more specifically to systems, methods, and devices for remote credentials management within wireless communication systems. In one aspect, a method of obtaining provisioning information via a service provider network, such as a cellular network, for a device is provided. The method includes transmitting an attach request via the service provider network for provisioning service, the attach request including device vendor information which includes a unique identifier for the device. The method further includes receiving provisioning information from the service provider upon authentication of the device vendor information. In other aspects, systems and methods for providing provisioning information are described. | 11-14-2013 |
20140053281 | CONFIGURATION OF A NEW ENROLLEE DEVICE FOR USE IN A COMMUNICATION NETWORK - An electronic device obtains a device password associated with the new enrollee device to be configured for a communication network. The device password is provided to a network registrar to cause the network registrar to configure the new enrollee device for the communication network. The network registrar performs an enrollment process based upon the device password and provides feedback to the electronic device to indicate whether or not the new enrollee device was successfully added to the communication network. Alternatively, when an electronic device detects the presence of a new enrollee device to be configured for the communication network, the electronic device generates a device password for the new enrollee device and provides the device password to the new enrollee device and to the network registrar, thereby causing the network registrar to initiate an enrollment process for the new enrollee device based upon the device password. | 02-20-2014 |
20140101368 | Binding microprocessor to memory chips to prevent re-use of microprocessor - A processor is provided that binds itself to a circuit such that the processor cannot be subsequently reused in other circuits. On a first startup of the processor, a memory segment of an external volatile memory device is read to obtain information prior to initialization of the memory segment. An original/initial identifier may be generated from the information read from the memory segment. The original/initial identifier may then be stored in a non-volatile storage of the processor. On subsequent startups of the processor, it verifies that the processor is still coupled to the same external volatile memory device by using the stored identifier. For instance, on a subsequent startup, the processor again reads the same memory segment of the external memory device and generates a new identifier. If the identifier matches the previously stored identifier, then the processor may continue its operations; otherwise the processor is disabled/halted. | 04-10-2014 |
20140181904 | DERIVING A WLAN SECURITY CONTEXT FROM A WWAN SECURITY CONTEXT - Techniques for deriving a WLAN security context from an existing WWAN security context are provided. According to certain aspects, a user equipment (UE) establishes a secure connection with a wireless wide area network (WWAN). The UE may receive from the WWAN an indication of a wireless local area network (WLAN) for which to derive a security context. The UE then derives the security context for the WLAN, based on a security context for the WWAN obtained while establishing the secure connection with the WWAN and establishes a secure connection with the WLAN using the derived security context for the WLAN. This permits the UE to establish a Robust Security Network Association (RSNA) with the WLAN while avoiding lengthy authentication procedures with an AAA server, thus speeding up the association process. | 06-26-2014 |
20140310402 | APPLICATION TRAFFIC PAIRING - Systems, devices, and methods for reporting information in real time about traffic generated by each application for a device are described. In one aspect, the network can configure a list of applications user equipment (UE) devices need to report traffic information for and then when one of these applications starts a communication, the UE may send traffic descriptor(s) describing the traffic generated by the application. In this way the network can accurately identify the traffic and take actions based on UE report and local policy or subscription. | 10-16-2014 |
20140372701 | METHODS, DEVICES, AND SYSTEMS FOR DETECTING RETURN ORIENTED PROGRAMMING EXPLOITS - Methods, devices, and systems for detecting return-oriented programming (ROP) exploits are disclosed. A system includes a processor, a main memory, and a cache memory. A cache monitor develops an instruction loading profile by monitoring accesses to cached instructions found in the cache memory and misses to instructions not currently in the cache memory. A remedial action unit terminates execution of one or more of the valid code sequences if the instruction loading profile is indicative of execution of an ROP exploit involving one or more valid code sequences. The instruction loading profile may be a hit/miss ratio derived from monitoring cache hits relative to cache misses. The ROP exploits may include code snippets that each include an executable instruction and a return instruction from valid code sequences. | 12-18-2014 |
20150033021 | REMOTE ACCESS TO LOCAL NETWORK VIA SECURITY GATEWAY - Multiple protocol tunnels (e.g., IPsec tunnels) are deployed to enable an access terminal that is connected to a network to access a local network associated with a femto access point. A first protocol tunnel is established between a security gateway and the femto access point. A second protocol tunnel is then established in either of two ways. In some implementations the second protocol tunnel is established between the access terminal and the security gateway. In other implementations the second protocol tunnel is established between the access terminal and the femto access point, whereby a portion of the tunnel is routed through the first tunnel. | 01-29-2015 |
20150043734 | APPARATUS AND METHOD FOR TRANSITIONING FROM A SERVING NETWORK NODE THAT SUPPORTS AN ENHANCED SECURITY CONTEXT TO A LEGACY SERVING NETWORK NODE - Disclosed is a method for transitioning a remote station from a current serving network node having an enhanced security context to a new serving network node. In the method, the remote station provides at least one legacy key, and generates at least one session key based on a calculation using a root key and using an information element associated with the enhanced security context. The remote station forwards a first message having the information element to the new serving network node. The remote station receives a second message, from the new serving network node, having a response based on either the legacy key or the session key. The remote station determines that the new serving network node does not support the enhanced security context if the response of the second message is based on the legacy key. Accordingly, the remote station protects communications based on the legacy key upon determining that the enhanced security context is not supported. | 02-12-2015 |
20150087271 | SECURE RECEPTION REPORTING - In a first configuration, a UE receives, from a service provider, a certificate authority list. The certificate authority list is at least one of integrity protected or encrypted based on a credential known by the UE and the service provider and stored on a smartcard in the UE. The UE authenticates a server using the received certificate authority list. In a second configuration, the UE receives a user service discovery/announcement including a reception report configuration and an address of a server. The UE sends a protected reception report to the server based on the reception report configuration. In a third configuration, the UE receives a protected broadcast announcement and communicates based on the broadcast announcement. The broadcast announcement is at least one of integrity protected or encrypted based on a credential known by the UE and stored on a smartcard in the UE. | 03-26-2015 |