Method and apparatus for managing a mobile embedded security platform - Patents.com

Abstract

A method is provided that is executed by a computer-implemented controller and includes receiving a request to manage one or more user equipment (UE), obtaining a user-specific security profile from a first service provider, obtaining a subscriber identity module (SIM) profile from a network node or a second service provider, obtaining a set of secure access service edge (SASE) instances from the network node, building one or more UE-specific bootstrap configurations based on the user-specific security profile, the SIM profile, and the set of SASE instances, and transmitting the one or more UE-specific bootstrap configurations to a third service provider. The one or more UE-specific bootstrap configurations are retrievable by the one or more UEs to establish a secure wireless communication channel through the zero-trusted network.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS: This application is a continuation of U.S. Provisional Patent Application No. 63 / 331,719, filed April 15, 2022, entitled "Mobile Embedded System Ma No. 6,399,363, filed on Oct. 13, 2003, and claims priority to "Method and Apparatus for Managing a Managed Security Platform (MESYP)," the contents of which are incorporated herein by reference in their entirety for all purposes.

[0002] The present disclosure relates generally to communication systems, and more particularly to a mobile embedded system for establishing secure enterprise communications over public and / or private wireless or mobile networks. Ma The present invention relates to a method and system for managing a managed security platform (MESyP). [Background technology]

[0003] Remote users rely on Virtual Private Network (VPN) technology to access corporate information technology (IT) services. For this purpose, a VPN tunnel is set up between the user's device (e.g., laptop, tablet, terminal device, and user equipment (UE)) and a remote-dedicated VPN gateway (GW). The VPN GW is deployed behind the corporate firewall. In such a configuration, it is difficult for the corporate IT department to obtain the desired visibility into the activities of remote users. That is, it is difficult for the IT department to obtain the same level of visibility as when the user (e.g., an employee of the company) is working in the office.

[0004] To improve visibility into remote working users' activities, IT departments often collect logs from different corporate applications. Collecting logs from different applications may not be a trivial task. Furthermore, from an IT perspective, it is desirable to have dynamic granularity of access control for different users, different applications, different times, and different locations. For example, IT departments may want to dynamically control "who can access what, from where, and when." Summary of the Invention

[0005] This disclosure describes various computer-implemented systems, methods, and manufacturer's products for mitigating radio resource management (RRM) measurements.

[0006] According to one embodiment, a method is provided that is executed by a computer-implemented controller, the method including receiving a request to manage one or more user equipment (UE), obtaining a user-specific security profile from a first service provider, obtaining a subscriber identity module (SIM) profile from a network node or a second service provider, obtaining a set of secure access service edge (SASE) instances from the network node, building one or more UE-specific bootstrap configurations based on the user-specific security profile, the SIM profile, and the set of SASE instances, and transmitting the one or more UE-specific bootstrap configurations to a third service provider. The one or more UE-specific bootstrap configurations are retrievable by the one or more UEs to establish a secure wireless communication channel through the zero-trusted network.

[0007] According to one embodiment, there is provided a method performed by a user equipment. The method includes connecting to a wireless network. The method further includes, upon connecting to the wireless network, obtaining one or more UE-specific bootstrap configurations from a mobile device management (MDM) service provider. The one or more UE-specific bootstrap configurations are based on a set of a user-specific security profile, a subscriber identity module (SIM) profile, and a SASE instance. The method further includes obtaining user credentials and establishing a secure wireless communication channel with a network node over a zero-trusted network based on the one or more UE-specific bootstrap configurations, the user credentials, and the SIM profile.

[0008] According to the above embodiment, UE Embodiments of a network node and a wireless communication system are also provided. [Brief description of the drawings]

[0009] For a better understanding of the various described embodiments, the following detailed description should be referenced in conjunction with the following drawings, in which like reference numerals refer to corresponding parts throughout.

[0010] [Figure 1] 1 illustrates an exemplary wireless network in accordance with some embodiments.

[0011] [Diagram 2] 1 illustrates an exemplary user device according to some embodiments.

[0012] [Diagram 3] 1 illustrates an exemplary virtualization environment in accordance with some embodiments.

[0013] [Figure 4]1 illustrates an exemplary telecommunications network connected to a host computer through an intermediate network, according to some embodiments.

[0014] [Diagram 5] 1 illustrates an exemplary host computer that communicates with user equipment via a base station over a partially wireless connection, according to some embodiments.

[0015] [Figure 6] 1 illustrates an exemplary method implemented in a communications system including a host computer, a base station, and a user equipment, according to some embodiments.

[0016] [Figure 7] 1 illustrates an exemplary computer-implemented MESyP controller that can be configured to interact with various service providers, according to some embodiments.

[0017] [Figure 8A] 1 illustrates a signal sequence diagram between a MESyP controller, various service providers, and a UE in accordance with some embodiments. [Figure 8B] 1 illustrates a signal sequence diagram between a MESyP controller, various service providers, and a UE in accordance with some embodiments.

[0018] [Figure 9] 4 is a flowchart illustrating a method performed by a MESyP controller, according to some embodiments.

[0019] [Figure 10] 4 is a flowchart illustrating a method performed by a user device according to some embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0020] In order to provide a more thorough understanding of the present invention, the following description sets forth numerous specific details, such as specific configurations, parameters, examples, etc. vinegar It should be appreciated, however, that such description is not intended to limit the scope of the present invention, but rather to provide a better understanding of exemplary embodiments.

[0021] Throughout the specification and claims, the following terms take the meanings explicitly associated therewith, unless the context clearly dictates otherwise.

[0022] As used herein, the phrase "according to one embodiment" does not necessarily refer to the same embodiment, but may, and thus various embodiments of the invention can be readily combined without departing from the scope or spirit of the invention, as described below.

[0023] As used herein, the term "or" is an inclusive "or" operator and is equivalent to the term "and / or," unless context clearly dictates otherwise.

[0024] The term "based on" is not exclusive and allows for based on additional unrecited factors, unless the context clearly dictates otherwise.

[0025] As used herein, unless the context dictates otherwise, the term "coupled to" is intended to include both direct coupling (where the two elements coupled to each other are in contact with each other) and indirect coupling (where at least one additional element is located between the two elements). Thus, the terms "coupled to" and "coupled with" are used synonymously. Within the context of a networked environment in which two or more components or devices can exchange data, the terms "coupled to" and "coupled with" are also used to mean "communicatively coupled to," possibly via one or more intermediate devices.

[0026] Additionally, throughout this specification, the meanings of "a," "an," and "the" include plural references, and the meaning of "in" includes "in" and "on."

[0027] Although some of the various embodiments presented herein constitute a single combination of the elements of the invention, it should be appreciated that the subject matter of the invention is considered to include all possible combinations of the disclosed elements. Thus, if one embodiment includes elements A, B, and C, and another embodiment includes elements B and D, the subject matter of the invention is considered to include other remaining combinations of A, B, C, or D, even if not explicitly discussed herein. Furthermore, the transitional term "comprising" means having as a part or member, or being a part or member thereof. As used herein, the transitional term "comprising" is inclusive or open-ended and does not exclude additional, unrecited elements or method steps.

[0028] Many IT departments manage their IT devices through Mobile Device Management (MDM) applications that are reachable from the Internet and have the ability to configure devices according to corporate policies by connecting to remote databases or resources (e.g., databases or resources in the "cloud"). Each operating system producer may provide its own MDM application. As mentioned above, corporate IT departments often collect logs from different corporate applications to improve visibility into the activities of remote working users. Collecting logs from different applications may not be a trivial task. Furthermore, from the IT department's perspective, it is desirable to have dynamic granularity of access control with respect to different users, different applications, different times, and different locations.

[0029] Thus, currently, certain challenges exist for the aforementioned means of gaining visibility. Many enterprise IT departments are increasingly demanding enterprise networks that can simply leverage public and / or private networks with the appropriate security level and management capabilities (e.g., the same level of visibility as when a user is working in an office). Currently, there are no commercial and technical solutions to such demands. To provide a solution, several parties may need to be involved, and these parties may need to implement various functions. For example, communication service providers may need to integrate a secure access service edge (SASE) within their networks. The UE's operating system may need to support generic bootstrapping architecture and authentication key management for applications (GBA / AKMA) along with the subscriber identity module (SIM), embedded subscriber identity module (eSIM), and / or integrated subscriber identity module (iSIM). Additionally, the UE's operating system needs to support cryptographic routing tables. Some service providers, such as MDMs, MESyP controllers, may need to support the SASE control plane to implement enterprise network policies. Additionally, the MDM system may need to support multiple Subscription Manager Data Preparation+ (SM-DP+) providers and Communication Service Providers (CSPs), which shall support GBA / AKMA in their eSIM / iSIM profiles, and a MESyP controller may need to be implemented to stitch all the aforementioned pieces together.

[0030] Certain aspects of the present disclosure and their embodiments may provide solutions to the problems discussed above. According to various embodiments, the devices, apparatus, systems, and methods described herein may be used to facilitate cellular-enabled devices (e.g., fourth generation or LTE (4G) and fifth generation (5G) enabled devices) to create reliable and secure connectivity over public and / or private networks, focusing on secure connectivity within cellular networks. The embodiments described herein may include various protocols including GSMA (Group Special Mobile Association) eSIM (Embedded Subscriber Identity Module) interface, 3GPP® Generic Bootstrapping Application (GBA), 3GPP® Authentication and Key Management for Applications (AKMA), and eSIM management (e.g., based on Local Profile Assistant or LPA).

[0031] The embodiments of the present disclosure enable secure enterprise networks by using only public and / or private networks with end-to-end encryption that can be centrally supervised using several novel technologies such as GBA / AKMA and SASE. The embodiments of the present disclosure identify the use cases, the architecture that needs to be implemented, the interfaces involved, and the required parties involved to enable the required standards or protocols. Furthermore, the embodiments of the present disclosure reduce or eliminate gaps in existing technologies.

[0032] Specifically, based on various embodiments of the present disclosure, a controller (e.g., MESyP controller) and / or MDM system can manage a GBA / AKMA server, an SM-DP+ profile order including GBA / AKMA information, a SASE instance from a network provider (private or public), a VPN control plane and their encryption tables (for each target enterprise), and multiple CSPs and multiple SM-DP+ providers. Correspondingly, the UE's operating system supports the GBA / AKMA server and the SASE control plane encryption table. Also, the SM-DP+ provider supports the GBA / AKMA information included in the SM-DP+ profile. Thus, according to some embodiments of the present disclosure, a controller can manage all of these components to enable a solution to the aforementioned technical problem.

[0033] Various embodiments of the present disclosure implement techniques that are not implemented in or different from existing techniques. For example, GBA / AKMA standards may be included in the eSIM / iSIM profile. Since the eSIM / iSIM profile is trusted by the GSMA organization, the eSIM / iSIM profile may therefore be trusted to include GBA / AKMA rational information such as the GBA / AKMA BSF (Bootstrapping Server Function) URL. In this situation, the following entities may be involved to support the GBA / AKMA BSF URL: For example, the MESyP controller may order the eSIM / iSIM profile by also providing the GBA / AKMA URL through its interface. Furthermore, the SM-DP+ provider may receive an order including the GBA / AKMA URL from the MESyP controller through its interface and store it in the actual profile. The UE's operating system may support GBA / AKMA key management, and the device LPA and the eSIM / iSIM may expose new APIs to provide the GBA / AKMA keys. These above mentioned functions and interfaces may not exist in current technology.

[0034] According to some embodiments of the present disclosure, user equipment (e.g., user end device) may support a VPN controller. The UE consumes GBA / AKMA keys to download enterprise encryption keys and tables (and obtains the corresponding SASE instance), so that the UE can host new applications (e.g., VPN control plane clients) to connect to the VPN controller. This functionality may not even exist in current technology.

[0035] According to some embodiments of the present disclosure, CSPs can integrate an eUPF (Enterprise User Plane Function) into their networks. According to various embodiments, SASE functionality is embedded within the UPF functionality to securely manage device VPNs. As a result, the Serving CSP can include a new component in its network, called eUPF, to serve the enterprise IT department. There can be one or many instances of eUPF in the Serving CSP's network. Thus, the Serving CSP can provide a new interface towards the VPN controller, allowing it to manage the SASE functionality per UE. The Serving CSP can also provide a new set of APIs (Application Programming Interfaces) to the MESyP controller to create an inventory of available SASE instances and allow the MESyP controller to configure the appropriate SASE instance towards the VPN controller. Such functionality and interfaces may also not exist in current technology.

[0036] Various embodiments of the present disclosure may provide one or more of the following technical advantages. First, users (e.g., employees) do not need to use QR codes to manage eSIM profiles because the QR codes of eSIM profiles are managed by the associated MDM in the bootstrap and operational stages. Second, users do not need to copy / paste corporate certificates or add or select appropriate SASE configurations because base certificates are derived from GBA / AKMA certificates and used to instantiate VPN for SASE and all required applications. Third, traffic to and from the UE is fully regulated by the VPN control plane component, which is configured with appropriate cryptographic routing tables by the corporate IT department. As a result, the corporate IT department can obtain high granularity of control of all device traffic rules.

[0037] Now, some of the embodiments contemplated herein teeth The present invention will now be described more fully with reference to the accompanying drawings. The embodiments are provided as examples to convey the scope of the subject matter to those skilled in the art. It should also be appreciated that the following description is not intended as an extensive overview, and thus concepts may be simplified for clarity and conciseness.

[0038] Although the subject matter described herein may be implemented in any suitable type of system using any suitable components, the embodiments disclosed herein are described in the context of a wireless network, such as the exemplary wireless network shown in FIG.

[0039] FIG. 1 illustrates an example communication system 100 according to some embodiments.

[0040] According to an example, the communications system 100 includes a telecommunications network 102 including an access network 104, such as a radio access network (RAN), and a core network 106 including one or more core network nodes 108. The access network 104 includes one or more access network nodes, such as network nodes 110a and 110b (one or more of which may be generally referred to as network nodes 110), or any other similar Third Generation Partnership Project (3GPP®) access nodes or non-3GPP® access points. The network nodes 110 enable direct or indirect connectivity of user equipment (UE), such as by connecting UEs 112a, 112b, 112c, and 112d (one or more of which may be generally referred to as UEs 112) to the core network 106 via one or more wireless connections.

[0041] Exemplary wireless communications over wireless connections include transmitting and / or receiving wireless signals using electromagnetic waves, radio waves, infrared, and / or other types of signals suitable for conveying information without the use of wires, cables, or other data conductors. Moreover, in various embodiments, communications system 100 may include any number of wired or wireless networks, network nodes, UEs, and / or any other components or systems that may facilitate or participate in the communication of data and / or signals, whether through wired or wireless connections. Communications system 100 may include and / or interface with any type of communications, telecommunications, data, cellular, wireless networks, and / or other similar types of systems. - You may face it.

[0042] The UE 112 is adapted to wirelessly communicate with the network node 110 and other communication devices. arrangementThe network node 110 may be any of a wide variety of communications devices, including wireless devices that are configured, operable, and / or capable of communicating with the UEs 112 and / or other network nodes or devices in the telecommunications network 102, directly or indirectly, to enable and / or provide network access, such as wireless network access, and / or to perform other functions, such as management in the telecommunications network 102.

[0043] According to the illustrated embodiment, the core network 106 connects the network node 110 to one or more hosts, such as the host 116. The connections may be direct or indirect via one or more intermediate networks or devices. In other examples, the network nodes may be directly coupled to the hosts. The core network 106 includes one or more core network nodes (e.g., the core network node 108) that are comprised of hardware and software components. The functionality of those components may be substantially similar to that described with respect to the UEs, network nodes, and / or hosts, and thus those descriptions are generally applicable to the corresponding components of the core network node 108. Exemplary core network nodes include one or more of a Mobile Switching Center (MSC), a Mobility Management Entity (MME), a Home Subscriber Server (HSS), an Access and Mobility Management Function (AMF), a Session Management Function (SMF), an Authentication Server Function (AUSF), a Subscription Identifier Deciphering Function (SIDF), a Unified Data Management (UDM), a Security Edge Protection Proxy (SEPP), a Network Publication Function (NEF), and / or a User Plane Function (UPF).

[0044] The host 116 may be under the ownership or control of, and may be operated by or on behalf of, a service provider other than the operator or provider of the access network 104 and / or the telecommunications network 102. The host 116 may host various applications to provide one or more services. Examples of such applications include live and pre-recorded audio / video content, data collection services such as acquiring and compiling data regarding various ambient conditions sensed by multiple UEs, analytics functionality, social media, functionality for controlling or otherwise interacting with remote devices, functionality for alarm and monitoring centers, or any other such functionality performed by a server.

[0045] 1 enables connectivity between UEs, network nodes, and hosts. In that sense, the communication system may be configured to operate according to predefined rules or procedures, such as, but not limited to, Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), Long Term Evolution (LTE), and / or other suitable 2G, 3G, 4G, 5G standards, or any applicable future generation standard (e.g., 6G), wireless local area network (WLAN) standards, such as the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard (Wi-Fi), and / or any other suitable wireless communication standard, such as Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, Near Field Communication (NFC), ZigBee, LiFi, and / or any low power wide area network (LPWAN) standard, such as LoRa and Sigfox.

[0046] In some examples, the telecommunications network 102 is a cellular network implementing 3GPP standardized features. Thus, the telecommunications network 102 may support network slicing to provide different logical networks to different devices connected to the telecommunications network 102. For example, the telecommunications network 102 may provide Ultra-Reliable Low Latency Communication (URLLC) services to some UEs, while providing enhanced Mobile Broadband (eMBB) services to other UEs, and massive machine type communication (mMTC) / massive IoT services to additional UEs.

[0047] In some examples, the UE 112 is configured to transmit and / or receive information without direct human interaction. For example, the UE may be designed to transmit information to the access network 104 on a predefined schedule, when triggered by an internal or external event, or in response to a request from the access network 104. Additionally, the UE may be configured to operate in a single or multi-RAT or multi-standard mode. For example, the UE may operate in any one or combination of Wi-Fi, NR (New Radio), and LTE, i.e., configured for Multi-Radio Dual Connectivity (MR-DC), such as E-UTRAN (Evolved UMTS Terrestrial Radio Access Network) New Radio Dual Connectivity (EN-DC).

[0048] According to an example, the hub 114 communicates with the access network 104 to facilitate indirect communication between one or more UEs (e.g., UEs 112c and / or 112d) and a network node (e.g., network node 110b). In some examples, the hub 114 may be a controller, a router, a content source, and analytics, or any of the other communication devices described herein with respect to a UE. For example, the hub 114 may be a broadband router that enables access to the core network 106 for the UE. As another example, the hub 114 may be a controller that sends commands or instructions to one or more actuators in the UE. The commands or instructions may be received from the UE or the network node 110 or may be accepted by executable code, scripts, processes, or other instructions in the hub 114. As another example, the hub 114 may be a data collector that acts as a temporary storage for data for the UE and may perform analysis or other processing of that data according to some embodiments. As another example, the hub 114 may be a content source. For example, in the case of a UE that is a VR headset, display, loudspeaker or other media distribution device, the hub 114 may retrieve, via the network node, data related to the VR asset, video, audio, or other media or sensory information, and the hub 114 may then: directly, Either after performing local processing and / or adding additional local content, U E. In yet another example, the hub 114 acts as a proxy server or orchestrator for the UEs, especially if one or more of the UEs are low energy IoT devices.

[0049] The hub 114 may have a constant / persistent or intermittent connection to the network node 110b. The hub 114 may also enable other communication schemes and / or schedules between the hub 114 and the UEs (e.g., UEs 112c and / or 112d) and between the hub 114 and the core network 106. According to other embodiments, the hub 114 is connected to the core network 106 and / or one or more UEs via a wired connection. Additionally, the hub 114 may be configured to connect to an M2M service provider via the access network 104 and / or to another UE via a direct connection. In some scenarios, a UE may establish a wireless connection with the network node 110 while still being connected via the hub 114 via a wired or wireless connection. According to some embodiments, the hub 114 may be a dedicated hub, i.e., a hub that is connected to the network node 110b via a dedicated hub, i.e., a hub that is connected to the network node 110c via ... To UE / U E to network node 110b According to other embodiments, the hub 114 may be a non-dedicated hub, i.e., a device that is operable to route communications between the UE and the network node 110b, but that is further operable as a communication origination and / or termination point for a particular data channel.

[0050] FIG. 2 illustrates a UE 200 according to some embodiments. As used herein, a UE refers to a device capable of wirelessly communicating with a network node and / or other UEs and configured, arranged, and / or operable to do so. A UE may include, but is not limited to, a smartphone, a mobile phone, a cell phone, a voice-over-IP (VoIP) phone, a wireless local loop phone, a desktop computer, a personal digital assistant (PDA), a wireless camera, a gaming console or device, a music storage device, a playback appliance, a wearable device, a wireless endpoint, a mobile station, a tablet, a laptop, a laptop embedded equipment (LEE), a laptop mounted equipment (LME), a smart device, a wireless customer premises equipment (CPE), a vehicle mounted or embedded / integrated wireless device, and the like. Other examples include any UE identified by the Third Generation Partnership Project (3GPP), including a Narrowband Internet of Things (NB-IoT) UE, a Machine Type Communication (MTC) UE, and / or an enhanced MTC (eMTC) UE.

[0051] A UE may support device-to-device (D2D) communications, for example, by implementing 3GPP standards for sidelink communications, dedicated short-range communications (DSRC), vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), or vehicle-to-everything (V2X). In other examples, a UE may not necessarily have a user in the sense of a human user who owns and / or operates the associated device. Instead, a UE may represent a device that is intended for sale to or operation by a human user, but may or may not initially be associated with a particular human user (e.g., a smart sprinkler controller). Alternatively, a UE may represent a device that is not intended for sale to or operation by an end user, but may be associated with or operated for a user (e.g., a smart power meter).

[0052] The UE 200 includes a processing circuit 202 operatively coupled to an input / output interface 206, a power source 208, a memory 210, a communication interface 212, and / or any other components, or any combination thereof, via a bus 204. Some UEs may utilize all or a subset of the components shown in FIG. 2. The level of integration between components may vary from one UE to another. Additionally, some UEs may include multiple instances of a component, such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0053] The processing circuitry 202 is configured to process instructions and data and may be configured to implement any sequential state machine operable to execute instructions stored as a machine-readable computer program in the memory 210. The processing circuitry 202 may be implemented as one or more hardware implemented state machines (e.g., discrete logic, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), etc.), programmable logic with appropriate firmware, one or more stored computer programs such as a microprocessor or digital signal processor (DSP) with appropriate software, a general purpose processor, or any combination of the above. For example, the processing circuitry 202 may include multiple central processing units (CPUs).

[0054] In this example, the input / output interface 206 may be configured to provide an interface to an input device, an output device, or one or more input and / or output devices. Examples of output devices include speakers, sound cards, video cards, displays, monitors, printers, actuators, emitters, smart cards, other output devices, or any combination thereof. An input device may enable a user to capture information for the UE 200. Examples of input devices include touch-sensitive or presence-sensitive displays, cameras (e.g., digital cameras, digital video cameras, webcams, etc.), microphones, sensors, mice, trackballs, directional input pads, trackpads, scroll wheels, smart cards, and the like. A presence-sensitive display may be configured to provide an interface to a user, such as a touch-sensitive or presence-sensitive display, a camera (e.g., digital camera, digital video camera, webcam, etc.), a microphone, a sensor, a mouse, a trackball, a directional input pad, a trackpad, a scroll wheel, a smart card, and the like. stomach The unit may include a capacitive or resistive touch sensor to sense input from a user. The sensor may be, for example, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetic sensor, an optical sensor, a proximity sensor, a biometric sensor, etc., or any combination thereof. The output device may use the same type of interface port as the input device. For example, a Universal Serial Bus (USB) port may be used to provide an input device and an output device.

[0055] According to some embodiments, the power source 208 is configured as a battery or battery pack. Other types of power sources may also be used, such as an external power source (e.g., an electrical outlet), a photovoltaic device, or a battery. The power source 208 may further include a power circuit for delivering power to various parts of the UE 200 from the power source 208 itself and / or from an external power source via an interface, such as an input circuit or a power cable. The transfer of power may be for charging the power source 208, for example. The power circuit may perform some shaping, conversion, or other modification of the power from the power source 208 to make it suitable for the respective component of the UE 200 that it is powering.

[0056] The memory 210 may be or be configured to include memory such as random access memory (RAM), read only memory (ROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), magnetic disk, optical disk, hard disk, removable cartridge, flash drive, etc. According to one embodiment, the memory 210 includes one or more application programs 214, such as an operating system, a web browser application, widgets, gadget engine, or other applications, and corresponding data 216. The memory 210 may store any of a variety of operating systems or combinations of operating systems for use by the UE 200.

[0057] The memory 210 may be configured to include a number of physical drives, such as a redundant array of independent disks (RAID), flash memory, a USB flash drive, an external hard disk drive, a thumb drive, a pen drive, a key drive, a high density digital versatile disk (HD-DVD) optical disk drive, an internal hard disk drive, a Blu-ray optical disk drive, a holographic digital data storage (HDDS) optical disk drive, an external mini dual in-line memory module (DIMM), a synchronous dynamic random access memory (SDRAM), an external micro-DIMM SDRAM, a smart card memory, such as a tamper-resistant module in the form of a universal integrated circuit card (UICC) including one or more subscriber identity modules (SIMs), e.g., a USIM and / or an ISIM, other memory, or any combination thereof. The UICC may be, e.g., an embedded UICC (eUICC), an integrated UICC (iUICC), or a removable UICC commonly known as a "SIM card." The memory 210 may enable the UE 200 to access instructions and application programs, etc., stored in a temporary or non-transitory storage medium to offload data or upload data. An article of manufacture, such as one that utilizes a communications system, may be a device-readable storage medium or may be tangibly embodied as or in memory 210, which may include a device-readable storage medium.

[0058] The processing circuit 202 may be configured to communicate with an access network or other networks using a communication interface 212. The communication interface 212 may comprise one or more communication subsystems and may include or be communicatively coupled to an antenna 222. The communication interface 212 may include one or more transceivers used to communicate, such as by communicating with one or more remote transceivers of another device capable of wireless communication (e.g., another UE or a network node in the access network). Each transceiver may include a transmitter 218 and / or a receiver 220 suitable for providing network communication (e.g., optical, electrical, frequency allocation, etc.). Additionally, the transmitter 218 and receiver 220 may be coupled to one or more antennas (e.g., antenna 222) and may share circuit components, software or firmware or may be implemented separately.

[0059] According to the illustrated embodiment, the communication capabilities of the communication interface 212 may include cellular communications, Wi-Fi communications, LPWAN communications, data communications, voice communications, multimedia communications, short-range communications such as Bluetooth, close-range communications, location-based communications such as using the Global Positioning System (GPS) to determine location, another like communication capability, or any combination thereof. Communications may be implemented according to one or more communications protocols and / or standards, such as, for example, IEEE 802.11, Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), GSM, LTE, New Radio (NR), UMTS, WiMax, Ethernet, Transmission Control Protocol / Internet Protocol (TCP / IP), Synchronous Optical Networking (SONET), Asynchronous Transfer Mode (ATM), QUIC, Hypertext Transfer Protocol (HTTP), etc.

[0060] Regardless of the type of sensor, the UE can provide data output captured by its sensors to a network node via a wireless connection via its communications interface 212. Data captured by the UE's sensors may be communicated via other UEs to the network node via wireless connections. The output may be periodic (e.g., once every 15 minutes when reporting sensed temperature), random (e.g., to balance the load of notifications from multiple sensors), in response to a triggering event (e.g., moisture is detected and an alert is sent), on demand (e.g., a user initiated request), or as a continuous stream (e.g., a live video feed of a patient).

[0061] As another example, the UE includes an actuator, motor, or switch associated with a communication interface configured to receive wireless input from a network node over a wireless connection. In response to the received wireless input, the actuator, motor, or switch may change state. For example, the UE may include a motor that adjusts a control wing or rotor of a drone in flight in accordance with the received input, or a robotic arm that performs a medical procedure in accordance with the received input.

[0062] The UE, when forming an Internet of Things (IoT) device, may be a device for use in one or more application domains, including, but not limited to, urban wearable technology, extended industrial applications, and healthcare. Non-limiting examples of such IoT devices may be on or embedded in a connected refrigerator or freezer, a TV, a connected lighting device, an electric meter, a robotic vacuum cleaner, a voice-controlled smart speaker, a home security camera, a motion detector, a thermostat, a smoke detector, a door / window sensor, a flood / moisture sensor, an electric door lock, a connected doorbell, an air conditioning system such as a heat pump, an autonomous vehicle, a surveillance system, a weather monitoring device, a vehicle parking monitoring device, an electric vehicle charging station, a smart watch, a fitness tracker, a head mounted display for augmented reality (AR) or virtual reality (VR), a wearable for haptic or sensory augmentation, a water sprinkler, an animal or item tracking device, a sensor for monitoring an animal or plant, an industrial robot, an unmanned aerial vehicle (UAV), and any kind of medical device such as a heart rate monitor or a remote operated surgical robot. A UE in the form of an IoT device comprises circuitry and / or software depending on the intended application of the IoT device, in addition to other components as described in relation to UE 200 shown in FIG. 2 .

[0063] As yet another specific example, in an IoT scenario, a UE may represent a machine or other device that performs monitoring and / or measurements and transmits results of such monitoring and / or measurements to another UE and / or a network node. The UE in this case may be an M2M device, which may be referred to as an MTC device in the 3GPP context. As one example, the UE may implement the 3GPP NB-IoT standard. In other scenarios, the UE may represent a car, truck, ship or aircraft, or other equipment that can monitor and / or report on its operating status or other functionality associated with its operation.

[0064] In fact, any number of UEs may be used together for a single use case. For example, a first UE may be a drone or be integrated into a drone and provide speed information of the drone (obtained through a speed sensor) to a second UE that is a remote controller that operates the drone. When a user issues a change command from the remote controller, the first UE may adjust a throttle on the drone (e.g., by controlling an actuator) to increase or decrease the drone's speed. The first and / or second UE may also include more than one of the functions described above. For example, a UE may include a sensor and an actuator and handle communication of data for both the speed sensor and the actuator.

[0065] 3 illustrates a network node 300 according to some embodiments. As used herein, a network node refers to a device capable of, configured, arranged, and / or operable to communicate directly or indirectly with UEs and / or other network nodes or devices in a telecommunications network. Examples of network nodes include, but are not limited to, access points (APs) (e.g., wireless access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs), and NR Node Bs (gNBs)).

[0066] Base stations may be categorized based on the size of the coverage they provide (or, in other words, their transmit power levels) and may therefore be referred to as femto, pico, micro or macro base stations depending on the size of the coverage provided. A base station may be a relay node or a relay donor node that controls a relay. A network node may also include one or more (or all) parts of a distributed radio base station such as a centralized digital unit and / or a remote radio unit (RRU), sometimes referred to as a remote radio head (RRH). Such remote radio units may or may not be integrated with an antenna as an antenna integrated radio. Some of the distributed radio base stations may also be referred to as nodes in a distributed antenna system (DAS).

[0067] Other examples of network nodes include a multi-transmission point (multi-TRP) 5G access node, a multi-standard radio (MSR) equipment such as an MSR BS, a network controller such as a radio network controller (RNC) or a base station controller (BSC), a base transceiver station (BTS), a transmission point, a transmitting node, a multi-cell / multicast coordination entity (MCE), an operation and maintenance (O&M) node, an operation support system (OSS) node, a self-organizing network (SON) node, a positioning node (e.g., an evolved serving mobile location center (E-SMLC)), and / or a minimization of drive testing (MDT).

[0068] The network node 300 includes a processing circuit 302, a memory 304, a communication interface 306, and a power source 308. The network node 300 may be comprised of multiple physically separate components (e.g., a Node B component and an RNC component, or a BTS component and a BSC component, etc.), each of which may have its own respective components. In certain situations where the network node 300 includes multiple separate components (e.g., a BTS and a BSC component), one or more separate components may be shared among multiple network nodes. For example, a single RNC may control multiple Node Bs. In such a scenario, each unique Node B and RNC pair may possibly be considered as a single individual network node. In some embodiments, the network node 300 may be configured to support multiple radio access technologies (RATs). In such embodiments, some components may be redundant (e.g., separate memories 304 for different RATs) and some components may be reused (e.g., the same antenna 310 may be shared by different RATs). Network node 300 may also include multiple sets of the various illustrated components for the various wireless technologies integrated into network node 300, e.g., GSM, WCDMA, LTE, NR, WiFi, Zigbee, Z-Wave, LoRaWAN, Radio Frequency Identification (RFID), or Bluetooth wireless technologies. These wireless technologies may be integrated into the same or different chips or chipsets and other components within network node 300.

[0069] The processing circuit 302 is a microprocessor 、It may include one or more combinations of controllers, microcontrollers, central processing units, digital signal processors, application specific integrated circuits, field programmable gate arrays, or any other suitable computing devices, resources, or combinations of hardware, software and / or coded logic, which combinations are operable, alone or in conjunction with other network node 300 components, such as memory 304, to provide the network node 300 functionality.

[0070] According to some embodiments, the processing circuitry 302 comprises a system on a chip (SOC). According to some embodiments, the processing circuitry 302 includes one or more of a radio frequency (RF) transceiver circuitry 312 and a baseband processing circuitry 314. In some embodiments, the radio frequency (RF) transceiver circuitry 312 and the baseband processing circuitry 314 may be on separate chips (or chipsets), boards, or units, such as a radio unit and a digital unit. In alternative embodiments, some or all of the RF transceiver circuitry 312 and the baseband processing circuitry 314 may be on the same chip or chipset, board, or unit.

[0071] The memory 304 may comprise any form of volatile or non-volatile computer readable memory, including, but not limited to, persistent storage, solid state memory, remotely mounted memory, magnetic media, optical media, random access memory (RAM), read only memory (ROM), mass storage media (e.g., hard disk), removable storage media (e.g., flash drive, compact disk (CD) or digital video disk (DVD)), and / or any other volatile or non-volatile, non-transitory device readable and / or computer executable memory device that stores information, data, and / or instructions that can be used by the processing circuit 302. The memory 304 may store any suitable instructions, data, or information, including applications including one or more of computer programs, software, logic, rules, code, tables, and / or other instructions that can be executed by the processing circuit 302 and utilized by the network node 300. The memory 304 may be used to store any operations performed by the processing circuit 302 and / or any data received via the communications interface 306. In some embodiments, the processing circuitry 302 and the memory 304 are integrated.

[0072] The communication interface 306 is used for wired or wireless communication of signaling and / or data between network nodes, access networks, and / or UEs. -The interface 306 includes a port / terminal 316 for transmitting and receiving data to and from a network, for example, over a wired connection. The communication interface 306 also includes a radio front-end circuit 318 that may be coupled to the antenna 310 or to a portion thereof according to an embodiment. The radio front-end circuit 318 comprises a filter 320 and an amplifier 322. The radio front-end circuit 318 may be connected to the antenna 310 and the processing circuit 302. The radio front-end circuit may be configured to condition signals communicated between the antenna 310 and the processing circuit 302. The radio front-end circuit 318 may receive digital data to be sent to other network nodes or UEs via a wireless connection. The radio front-end circuit 318 may use a combination of the filter 320 and / or the amplifier 322 to convert the digital data into a wireless signal having appropriate channel and bandwidth parameters. The wireless signal may then be transmitted via the antenna 310. Similarly, when receiving data, the antenna 310 may collect a wireless signal that is converted into digital data by the radio front-end circuit 318. The digital data may be passed to the processing circuitry 302. In another embodiment, the communication interface - A face may include different components and / or different combinations of components.

[0073] According to certain alternative embodiments, the network node 300 does not include a separate radio front-end circuit 318; instead, the processing circuit 302 includes the radio front-end circuitry and is connected to the antenna 310. Similarly, in some embodiments, all or some of the RF transceiver circuitry 312 may be coupled to a communications interface. - According to yet another embodiment, the communication interface 306 includes one or more ports or terminals 316, radio front-end circuitry 318, and RF transceiver circuitry 312 as part of a radio unit (not shown), and the communication interface 306 communicates with baseband processing circuitry 314 that is part of a digital unit (not shown).

[0074] The antenna 310 may include one or more antennas or an antenna array configured to transmit and / or receive wireless signals. The antenna 310 may be coupled to the radio front-end circuitry 318 and may be any type of antenna capable of wirelessly transmitting and receiving data and / or signals. According to an embodiment, the antenna 310 is separate from the network node 300 and may be connectable to the network node 300 through an interface or port.

[0075] The antenna 310, the communication interface 306, and / or the processing circuit 302 may be configured to perform any receiving operation and / or some obtaining operation described herein as being performed by a network node. Any information, data, and / or signals may be received from a UE, another network node, and / or any other network equipment. Similarly, the antenna 310, the communication interface 306, and / or the processing circuit 302 may be configured to perform any receiving operation and / or some obtaining operation described herein as being performed by a network node. - The interface 306 and / or the processing circuit 302 may be configured to perform any transmission operations described herein as being performed by a network node, such as any information, data, and / or signals that may be transmitted to a UE, another network node, and / or any other network equipment.

[0076] The power source 308 provides power to the various components of the network node 300 in a form appropriate for each component (e.g., at the voltage and current levels required by each component). The power source 308 may include or be coupled to power management circuitry for providing power to the components of the network node 300 to perform the functionality described herein. For example, the network node 300 may be connected to an input circuit or interface, such as an electrical cable, for example. -The power supply 308 may be connectable to an external power source (e.g., a power grid, an electrical outlet) via an interface, whereby the external power source provides power to a power circuit of the power supply 308. As a further example, the power supply 308 may include a power source in the form of a battery or battery pack connected to or integrated into the power circuit. In the event that the external power source fails, the battery may provide backup power.

[0077] Embodiments of network node 300 may include additional components beyond those shown in Figure 3 to provide particular aspects of network node functionality, including any of the functionality described herein and / or any functionality essential to support the subject matter described herein. For example, network node 300 may include user interface devices that enable input of information into network node 300 and output of information from network node 300, so that a user may perform diagnostics, maintenance, repair, and other management functions of network node 300.

[0078] 4 is a block diagram of a host 400, which may be an embodiment of the host 116 of FIG. 1 in accordance with various aspects described herein. As used herein, the host 400 may be or include hardware and / or software in various combinations, including a standalone server, a blade server, a cloud-implemented server, a distributed server, a virtual machine, a container, or processing resources in a server farm. The host 400 may provide one or more services to one or more UEs.

[0079] The host 400 includes a processing circuit 402 operably coupled to an input / output interface 406, a network interface 408, a power source 410, and a memory 412 via a bus 404. In other embodiments, other components may be included, whose functions may be substantially similar to those described with respect to the devices in previous figures, such as Figures 2 and 3, and thus those descriptions are generally applicable to the corresponding components of the host 400.

[0080] The memory 412 may include one or more computer programs including one or more host application programs 414 and data 416, which may include user data, e.g., data generated by the UE for the host 400 or data generated by the host 400 for the UE. An embodiment of the host 400 may utilize only a subset or all of the illustrated components. The host application programs 414 may be implemented in a container-based architecture and may provide support for video codecs (e.g., VVC (Versatile Video Coding), High Efficiency Video Coding (HEVC), Advanced Video Coding (AVC), MPEG, VP9) and audio codecs (e.g., FLAC, Advanced Audio Coding (AAC), MPEG, G.711), including transcoding for multiple different classes, types, or implementations of UEs (e.g., handsets, desktop computers, wearable display systems, heads-up display systems). The host application program 414 may also provide user authentication and license checks, and may periodically report health, route, and content availability to a central node, such as a device in or at the edge of the core network. Thus, the host 400 may select and / or point to different hosts for over-the-top services for the UE. The host application program 414 may support a variety of protocols, such as HTTP Live Streaming (HLS) protocol, Real-Time Messaging Protocol (RTMP), Real-Time Streaming Protocol (RTSP), Dynamic Adaptive Streaming over HTTP (MPEG-DASH), etc.

[0081] FIG. 5 is a block diagram illustrating a virtualization environment 500 in which functionality implemented by some embodiments may be virtualized. In this context, virtualization refers to creating a virtual version of a device or device, including virtualizing a hardware platform, storage, and network resources. As used herein, virtualization may apply to any device or component thereof described herein and relates to implementations in which at least a portion of its functionality is implemented as one or more virtual components. Some or all of the functionality described herein may be implemented as virtual components executed by one or more virtual machines (VMs) implemented in one or more virtual environments 500 hosted by one or more hardware nodes, such as a network node, a UE, a core network node, or a hardware computing device acting as a host. Furthermore, in embodiments in which a virtual node does not require wireless connectivity (e.g., a core network node or a host), the node may be virtualized in its entirety.

[0082] An application 502 (which may alternatively be referred to as a software instance, a virtual appliance, a network function, a virtual node, a virtual network function, etc.) executes in the virtualization environment Q400 to implement some of the features, functions, and / or advantages of some of the embodiments disclosed herein.

[0083] The hardware 504 includes processing circuitry, memory that stores software and / or instructions executable by the hardware processing circuitry, and / or other hardware devices described herein, such as network interfaces, input / output interfaces, etc. Software may be executed by the processing circuitry to instantiate one or more virtualization layers 506 (also referred to as a hypervisor or virtual machine monitor (VMM)), provide VMs 508a and 508b (one or more of which may be generally referred to as VMs 508), and / or perform any of the functions, features, and / or benefits described in connection with some embodiments described herein. The virtualization layer 506 may present a virtual operating platform that appears to be networking hardware to the VMs 508.

[0084] A VM 508 may comprise virtual processing, virtual memory, virtual networking or interfaces, and virtual storage, and may be executed by a corresponding virtualization layer 506. Various embodiments of an instance of a virtual appliance 502 may be implemented in one or more of the VMs 508, and may be implemented in a variety of ways. Hardware virtualization occurs in some contexts, referred to as network function virtualization (NFV). NFV may be used to consolidate many network equipment types with industry-standard high-volume server hardware, physical switches, and physical storage that may be located in a data center, as well as customer premises equipment.

[0085] In the context of NFV, VMs 508 may be software implementations of physical machines that execute programs as if they were running on a physical, non-virtualized machine. Each VM 508 and the portion of the hardware 504 on which it runs, whether the hardware is dedicated to that VM and / or shared by that VM with other VMs, forms a separate virtual network element. Also in the context of NFV, a virtual network function is responsible for handling specific network functions running in one or more VMs 508 on top of the hardware 504 and corresponds to the applications 502.

[0086] The hardware 504 may be implemented in a standalone network node having generic or specific components. The hardware 504 may implement some functions via virtualization. Alternatively, the hardware 504 may be part of a larger hardware cluster (e.g., in a data center or CPE) where many hardware nodes work together and are managed via a management and orchestration 510 that oversees, among other things, the lifecycle management of the application 502. In some embodiments, the hardware 504 is coupled to one or more radio units, each including one or more transmitters and one or more receivers, which may be coupled to one or more antennas. The radio units may communicate with one or more appropriate network interfaces. - The hardware nodes may communicate directly with other hardware nodes via interfaces, or may be used in combination with virtual components to provide wireless capabilities to the virtual nodes, such as wireless access nodes or base stations. In some embodiments, some signaling may be provided with the use of the control system 512, which may alternatively be used for communication between the hardware nodes and the wireless units.

[0087] Figure 6 illustrates a communication diagram of a host 602 communicating via a network node 604 with a UE 606 over a partial wireless connection, according to some embodiments. Exemplary embodiments of a UE (such as the UE 112a of Figure 1 and / or the UE 200 of Figure 2), a network node (such as the network node 110a of Figure 1 and / or the network node 300 of Figure 3), and a host (such as the host 116 of Figure 1 and / or the host 400 of Figure 4) described in the previous paragraph, according to various embodiments, are described with reference to Figure 6.

[0088] Similar to host 400, an embodiment of host 602 includes hardware such as communications interfaces, processing circuitry, and memory. Host 602 also includes software stored on or accessible by host 602 and executable by the processing circuitry. This software includes host applications that may be operable to provide services to remote users, such as UE 606, that connect via an over-the-top (OTT) connection 650 extending between UE 606 and host 602. In providing services to remote users, the host applications may provide user data that is transmitted using OTT connection 650.

[0089] The network node 604 includes hardware for communicating with the host 602 and the UE 606. The connection 660 includes: Either directly or A core network (such as core network 106 of FIG. 1) and / or one or more other intermediate networks, such as one or more public, private, or hosted networks. General For example, the intermediate network may be a backbone network or the Internet.

[0090] The UE 606 includes hardware and software that is stored on or accessible by the UE 606 and executable by the processing circuitry of the UE. The software includes a client application, such as a web browser or an operator-specific "app," that may be operable to provide services to a human or non-human user via the UE 606 with the support of the host 602. A host application running on the host 602 may communicate with a client application running on the host 602 via the UE 606 and an OTT connection 650 that terminates on the host 602. During the provision of services to the user, the client application on the UE may receive request data from the host application on the host and provide user data in response to the request data. The OTT connection 650 may transport both request data and user data. The client application on the UE may interact with the user to generate user data that it provides to the host application through the OTT connection 650.

[0091] The OTT connection 650 may extend through a connection 660 between the host 602 and a network node 604, and through a wireless connection 670 between the network node 604 and the UE 606, to provide a connection between the host 602 and the UE 606. The connection 660 and the wireless connection 670 over which the OTT connection 650 may be provided are depicted abstractly to illustrate communication between the host 602 and the UE 606 through the network node 604 without explicit reference to any intermediate devices and the precise routing of messages through those devices.

[0092] As an example of transmitting data over the OTT connection 650, in step 608, the host 602 provides user data that may be executed by executing a host application. In some embodiments, the user data is associated with a particular human user interacting with the UE 606. In other embodiments, the user data is associated with the UE 606 sharing data with the host 602 without explicit human interaction. In step 610, the host 602 initiates a transmission to the UE 606 carrying user data. The host 602 may initiate the transmission in response to a request transmitted by the UE 606. The request may be triggered by human interaction with the UE 606 or by the operation of a client application executing on the UE 606. The transmission may pass through the network node 604 in accordance with the teachings of the embodiments described throughout this disclosure. In response, in step 612, the network node 604 transmits the user data carried in the host 602 initiated transmission to the UE 606 in accordance with the teachings of the embodiments described throughout this disclosure. In step 614 , the UE 606 receives user data carried in the transmission, which may be executed by a client application executing on the UE 606 associated with a host application executed by the host 602 .

[0093] In some examples, the UE 606 executes a client application that provides user data to the host 602. The user data may be provided in reaction or response to receiving data from the host 602. In response, in step 616, the UE 606 may provide the user data, which may be done by executing the client application. During the provision of user data, the client application receives data from the user via an input / output interface of the UE 606. -The method may further take into account user input received via the UE 606 interface. Regardless of the specific manner in which the user data is provided, the UE 606 initiates transmission of the user data to the host 602 via the network node 604 at step 618. At step 620, the network node 604 receives the user data from the UE 606 and initiates transmission of the received user data to the host 602 in accordance with the teachings of embodiments described throughout this disclosure. At step 622, the host 602 receives the user data carried in the transmission initiated by the UE 606.

[0094] One or more of the various embodiments improve the performance of the OTT service provided to the UE 606 using the OTT connection 650, of which the wireless connection 670 forms the final leg. More precisely, the teachings of these embodiments can improve data rates, latency, and power consumption, thereby providing benefits such as reduced user latency, relaxed file size limitations, improved content resolution, increased responsiveness, and extended battery life.

[0095] In an exemplary scenario, factory status information may be collected and analyzed by the host 602. As another example, the host 602 may process audio and video data, which may have been obtained from UEs, for use in generating maps. As another example, the host 602 may collect and analyze real-time data to support vehicular congestion control (e.g., traffic light control). As another example, the host 602 may store surveillance video uploaded by UEs. As another example, the host 602 may store or control access to media content, such as video, audio, VR or AR, that may be broadcast, multicast or unicast to UEs. As another example, the host 602 may be used for energy pricing, remote control of non-time-critical power loads for balancing power generation needs, location services, presentation services (such as compiling diagrams from data collected from remote devices), or any other function that collects, acquires, stores, analyzes and / or transmits data.

[0096] In some examples, measurement procedures may be provided to monitor data rates, latencies, and other factors that one or more embodiments improve. There may also be optional network functionality to reconfigure the OTT connection 650 between the host 602 and the UE 606 in response to measurement variations. The measurement procedures and / or network functionality to reconfigure the OTT connection may be implemented in software or hardware in the host 602 and / or the UE 606. In some embodiments, sensors (not shown) may be deployed in or associated with other devices through which the OTT connection 650 passes, and may participate in the measurement procedures by providing values ​​for the monitored quantities exemplified above or other physical quantities from which the monitored quantities may be calculated or estimated by the software. Reconfiguration of the OTT connection 650 may include message formats, retransmission settings, preferred routing, etc., and need not directly change the operation of the network node 604. Such procedures and functionality may be known and practiced in the art. In one embodiment, the measurements may include proprietary UE signaling to facilitate measurements by the host 602 of throughput, propagation time, latency, etc. The measurements may be implemented by software sending messages over the OTT connection 650, specifically empty or "dummy" messages, while monitoring propagation times, errors, etc.

[0097] Although the computing devices (e.g., UE, network node, host) described herein may include the illustrated combination of hardware components, other embodiments may include computing devices having various combinations of components. It should be understood that the computing devices may include any suitable combination of hardware and / or software required to perform the tasks, features, functions, and methods disclosed herein. The determining, calculating, obtaining, or similar operations described herein may be performed by a processing circuit that may process information, for example, by transforming the obtained information into other information, comparing the obtained or transformed information with information stored in the network node, and / or performing one or more operations based on the obtained or transformed information, and making a decision as a result of the processing. Moreover, while the components are depicted as a single box located within a larger box or nested within multiple boxes, in reality the computing device may include multiple different physical components that make up the illustrated single component, and functionality may be partitioned among the separate components. For example, a communication interface may be used to communicate with a network node, a network node, or a network node. - The interface may be configured to include any of the components described herein, the functionality of which may be achieved through processing circuitry and communication interfaces. - In other examples, the computationally non-heavy functions of any of such components may be implemented in software or firmware, and the computationally heavy functions may be implemented in hardware.

[0098] According to some embodiments, some or all of the functionality described herein may be provided by a processing circuit executing instructions stored in a memory, which according to some embodiments may be a computer program product in the form of a non-transitory computer-readable storage medium. In alternative embodiments, some or all of the functionality may be provided by the processing circuit, such as in a hardwired manner, without executing instructions stored in a separate or discrete device-readable storage medium. In any of these specific embodiments, the processing circuit may be configured to perform the described functionality, regardless of whether it executes instructions stored in a non-transitory computer-readable storage medium. The benefits provided by such functionality are enjoyed by the computing device as a whole and / or by end users and wireless networks in general, and not limited to just the processing circuit or other components of the computing device.

[0099] FIG. 7 illustrates an exemplary controller 702 that deploys or combines several services including, for example, GBA / AKMA, SASE, SM-DP+, bootstrap and configuration services, etc. The controller 702 may also be referred to as a MESyP controller 702. As shown in FIG. 7, according to some embodiments, the controller 702 includes an orchestrator 706, a northbound interface (NBI), a southbound interface (SBI), and an IT inventory 704. The orchestrator 706 may communicate with the NBI, SBI, and IT inventory 704 to deploy or combine one or more of the aforementioned services to achieve a desired effect or functionality. According to some embodiments, the NBI includes a MESyP portal 708 and an enterprise IT portal 712. The SBI includes one or more adapters 716, 718 for interfacing with bootstrap and configuration services 728, 732. The SBI may further include an SM adapter 720 for interfacing with an SM service provider 736. The SBI may further include a GBA adapter 722 for interfacing with a GBA service provider 744. The SBI may further include a CP adapter 724 for interfacing with an enterprise control plane 758. The SBI may further include a network adapter 726 for interfacing with a public and / or private network 762.

[0100] 7, users of the MESyP controller 702 can include a MESyP operations team 710 and an enterprise IT portal client 714. The MESyP operations team 710 can include one or more enterprise IT users whose devices interact with the MESyP portal 708. The MESyP portal 708 provides a user interface through which the MESyP controller 702 can provide one or more of the following services in response to one or more requests from the enterprise IT users' devices: For example, in response to a request received by the portal 708, the orchestrator 706 of the controller 702 can be configured to perform various operations as described below. While the operations described below can be based on a request or interaction received via the portal 708, it should be understood that the orchestrator 706 can be configured to perform operations based on specific internal rules or policies and may not require a request to be received by the portal 708.

[0101] As an example, via the portal 708, the orchestrator 706 of the controller 702 may be configured to add, remove, read, and / or update the identities of enterprise users in an internal identity manager. The internal identity manager may store the identities of enterprise users in the IT inventory 704. Alternatively, the identities of enterprise users may be managed by an external identity manager (e.g., a remote cloud-based database accessible by the controller 702).

[0102] As another example, via the portal 708, the orchestrator 706 of the controller 702 may be configured to add, remove, read, and / or update corporate devices (including device IDs and serial numbers), add, remove, read, and / or update eSIM profile codes configured for specific devices, and / or add, remove, read, and / or update configuration bootstrapping service accounts. For example, each corporate device may be managed by such a service to centrally push desired device configurations. Additionally, the service may also be used to monitor devices (e.g., to check software compliance). Depending on corporate IT preferences, corporate devices may be managed by different device providers, such as different device manufacturers. Device manufacturers may operate different MDMs.

[0103] According to some embodiments, via the portal 708, the orchestrator 706 of the controller 702 may be configured to add, delete, read, and / or update SM-DP+ provider accounts. SM-DP+ services may be provided by several providers. This functionality allows the controller 702 to interact with different SM-DP+ providers (e.g., provider 736) to manage eSIM profiles. Interaction with SM service providers is described in more detail below.

[0104] As another example, via the portal 708, the orchestrator 706 of the controller 702 may be configured to request and / or revoke eSIM profiles and provision GBA / AKMA service profiles. The orchestrator 706 of the controller 702 may also be configured to add, delete, read, and / or update CSP accounts. Depending on the enterprise's IT preferences and service offerings, each enterprise may decide to offer one or more CSPs. These CSPs may offer their services via BSS (Business Support System), OSS (Operational Support System), or some other exposure layer.

[0105] According to some embodiments, via the portal 708, the orchestrator 706 of the controller 702 can be configured to perform lifecycle activities related to setting up the controller 702. These lifecycle activities can include, for example, system backups, system restores, system upgrades, etc.

[0106] Continuing with reference to FIG. 7, the enterprise IT portal 712 can be configured to provide operations that are not delegated or partially delegated to the MESyP portal 708. Such operations can include, for example, monitoring UEs and their users, such as their compliance status and / or traffic usage. Operations can also include encryption Te The encryption table may include configuring tables, keys, and rules. The encryption table is used to configure user application authorization data to indicate, for example, which users can access which enterprise applications. Thus, the controller 702 not only enables the IT department to establish end-to-end encryption from the UE to the enterprise network, but also enables the IT department to configure which enterprise applications can be accessed by each UE.

[0107] 7, the controller 702 has a southbound interface (SBI) that includes one or more adapters 716, 718, 720, 722, 724, 726. These adapters can be standard and / or proprietary interfaces configured to interact with the involved service providers. For example, the adapters 716, 718 can be configured to interact with an MDM1 application provided by a configuration / bootstrap service provider 728 and an MDM2 application provided by a configuration / bootstrap service provider 732, respectively. For example, the service provider 728 can provide a bootstrap service 730 to the controller 702 by interacting directly with the adapter 716 (e.g., by sending a device configuration in response to a request from the controller 702). As another example, the service provider 732 can provide a bootstrap service 734 to the controller 702 by interacting with the adapter 718 via an MDM2 portal 735. For example, the controller 702 can send a request for a desired device configuration to the MDM2 portal 735 of the service provider 732 via the adapter 718. The service provider 732 can respond to the adapter 718 via the MDM2 portal 735 with the requested device configuration.

[0108] 7, the bootstrap service 734 of the service provider 732 may also communicate with one or more UEs 756 via, for example, the HTTPS protocol (Hypertext Transfer Protocol Secure). For example, when a particular UE 756 connects to a network, it sends a request to the bootstrap service 734 of the service provider 732 to obtain a bootstrap configuration. The bootstrap service 734 can then send the bootstrap configuration to the device operating system of the particular UE 736. Depending on the type of UE 756 (e.g., a type of managed enterprise device) and their operating system, there may be several different service providers for managing the device start-up procedures and their configuration, or MDM.

[0109] FIG. 7 also shows that the controller 702 includes an SM adapter 720 that may be configured to interact with an SM service provider 736 or multiple SM service providers. The SM service provider 736 is a Subscription Manager Service Provider (or SM-DP+ service provider). The SM or SM-DP+ service is a GSMA trusted service that can push eSIM / iSIM profiles to the UE's eSIM / iSIM microchip. As shown in FIG. 7, the SM service provider 736 may provide a SM-DP+ (Subscription Manager Data Preparation+) service 740, a SM-DS (Subscription Manager Discovery Server) service 742, and an SM portal 738. The SM-DP+ service 740 is responsible for creating, downloading, remotely managing (e.g., enabling, disabling, updating, deleting), and protecting network operator profiles. The network operator profiles include operator credentials and, optionally, operator or third-party SIM-based applications. Using a wireless network, the profile can be remotely downloaded, for example, to an embedded SIM (eSIM) of the UE 756. According to some embodiments, the UE 756 has a Local Profile Assistant (LPA) to provide the ability to download the encryption profile to the eSIM. The SM-DS service 742 allows the SM-DP+ service 740 to reach the eSIM of the UE 756 without needing to know which network the UE 756 is connected to.

[0110] The SM-DS service 742 allows the SM-DP+ service 740 to post alerts to a secure notification board and for the UE 756 to extract those alerts. This is used to notify the LPA when profile data is available for download to the eSIM. Notifications are sent from the SM-DP+ service 740 to the SM-DS service 742. The LPA in the UE 756 polls the SM-DS for notifications when needed. According to some embodiments, the SM service provider 736 can support GBA / AKMA in its eSIM / iSIM profile. For example, the SM-DP+ profile order can include GBA / AKMA information.

[0111] 7, according to some embodiments, the controller 702 includes a GBA adapter 722 configured to interact with a GBA service provider 744, for example, via a GBA portal 746. The interaction between the controller 702 and the GBA service provider 744 is described in more detail below using signal sequence figures 8A and 8B. In this disclosure, the term "GBA" is used interchangeably with "GBA and / or AKMA" or "GBA / AKMA". That is, the term "GBA" is used for simplicity, but can also include AKMA. For example, the GBA service provider 744 may also be referred to as the GBA / AKMA service provider 744. The GBA service is a service that manages the BSF (Bootstrap Server Function) 748 according to the GBA standard. The BSF 748 can interact with the Home Subscriber Server (HSS) 750 via a Zh interface based on the Diameter protocol. The Zh interface is an interface that allows the BSF 748 to fetch an authentication vector (authentication information) and a user's security settings (GUSS) from the HSS. In some instances, a first secure connection needs to be established from the UE 756 to its corresponding enhanced user plane function (eUPF). An example E-UPF 766 is located within a public and / or private network 762, as shown in FIG.

[0112] The UPF (e.g., UPF 770) is a function that connects the actual data coming through the radio area network (RAN) to the Internet. The enhanced user plane function (E-UPF) 766 can combine the functions of the UPF 770 with the functions of the SASE instance 768. According to some embodiments, the UPF 770 can support minimal functions for security (e.g., deep packet inspection) but may not have advanced firewall or virtual private network (VPN) gateway (GW) functions. By combining the functions of the SASE instance 768 with the UPF 770, these additional security functions can become part of the enhanced UPF (eUPF) 766. Furthermore, according to some embodiments, the GBA / AKMA platform can be integrated with the SASE functions. For example, a computer-implemented controller can be used to implement the SASE instance. The controller can combine at least some functions of the SASE instance 768 with the functions of the UPF 770. The SASE instance 768 can use key exchange with the UE 756 and / or specific applications in the enterprise network to establish secure communications. According to some embodiments of the present disclosure, the shared key can be calculated and distributed using the GBA / AKMA provided by the GBA service provider 744.

[0113] As shown in FIG. 7, the GBA service provider 744 can interact with the NAF (Network Application Function) 752 via the Zn interface. The NAF 752 is a network application function defined in the GBA standard. When the GBA is used, the UE 756 and the BSF 748 can authenticate each other via the 3GPP protocol. Furthermore, the BSF 748 sends a related query to the HSS 750, for example, via the Zh interface. The UE 756 and the BSF 748 then agree on a session key that is used to exchange encrypted data with the application server (NAF 752). When the UE 756 reconnects to the NAF 752 (e.g., via the Ua interface), the NAF 752 can obtain the session key and user-specific data from the BSF 748 and can start exchanging data with the UE 756 using the related session key for encryption. The UE 756 can communicate with the BSF 748 via the Ub interface.

[0114] With further reference to FIG. 7 , in some examples, the controller 702 includes a control plane (CP) adapter 724 configured to interact with an enterprise control plane 758 that provides a VPN control plane 760. In some examples, the UE 756 can obtain configuration (e.g., cryptographic routing tables and SASE / SSE IP addresses) from the VPN control plane 760. The VPN control plane 760 can be located in or provided by a back-end server of a telecommunications equipment provider. As shown in FIG. 7 , the VPN control plane 760 can facilitate the establishment of a VPN (e.g., a GBA / AKMA-based VPN) between the UE 756 and a SASE instance 768 of the eUPF 766 in a public / private network 762. The enterprise control plane 758 can interact with the controller 702, for example, via the CP adapter 724. As described in more detail below, using the CP adapter 724, the controller 702 can register the UE with the VPN control plane 760 (corresponding to the VPN controller 814 shown in FIG. 8A ).

[0115] FIG. 7 further illustrates that the controller 702 includes a network adapter 726 configured to interact with multiple CSPs providing one or more public and / or private networks. The one or more public and / or private networks are collectively referred to as a public / private network 762. The public / private network 762 is responsible for providing cellular (e.g., 4G, 5G, or any other generation) connectivity from the RAN to a packet core that includes at least one SASE service. SASE is a network architecture that combines wide area network (WAN) capabilities with cloud native security capabilities such as secure web gateways, cloud access security brokers, firewalls, zero trust network access, etc. These capabilities are offered as a service by SASE service providers. In some examples, SASE capabilities are incorporated within the UPF capabilities to securely manage device VPNs (e.g., the eUPF 766 combines the capabilities of the SASE instance 768 and the UPF 770, as described above). Thus, the serving CSP includes the eUPF 766 for serving the enterprise IT department. 7 shows only one eUPF 766, it is understood that there can be many instances of eUPF. The Serving CSP can provide an interface to the VPN control plane 760, allowing it to manage the SASE functionality per UE 756. The Serving CSP can also provide a new set of APIs (application programming interfaces) towards the controller 702, allowing it to create an inventory of available SASE instances, and allowing the controller 702 to configure the VPN control plane 760 with the appropriate SASE instance.

[0116] As also shown in FIG. 7, the CSP may also be a BSS, an OSS, or some other type of ExposureLayer 772 may provide those services. In some examples, the CSP may also provide services using the HSS 764.

[0117] As mentioned above, the controller 702 may be configured to interact with various service providers via respective adapters 716, 718, 720, 722, 724, and 726 in the southbound interface. The various adapters 716, 718, 720, 722, 724, and 726 may interact with the orchestrator 706. Data, configurations, and requests may be passed between the orchestrator 706 and the adapters. According to some embodiments, the controller 702 may utilize the inventory system 704 to implement exposed functionality for various services by managing not only the services connected via the SBI, but also the information that should be exchanged between them to achieve their end goals. For example, components associated with the controller 702 include UEs such as managed enterprise devices (MEDs), eSIM (or iSIM) profiles, keys, and rules. A MED is a device that can connect to a zero-trusted network. An eSIM (or iSIM) profile is a profile that is loaded into a MED to connect to a zero-trusted network. The keys and rules are used to configure the cryptographic routing table on the SASE instance.

[0118] As shown in FIG. 7, each of the service providers connected to the SBI may be connected through an adapter (optional) to prevent the controller 702 from being dependent on their interface model.

[0119] 8A and 8B show signal sequence diagrams between the controller 804, various service providers 806, 808, 810, 812, 814, and a UE 816 according to some embodiments. It should be understood that the UE 816 is an example device only, and the following description of the sequence diagrams may apply to multiple UEs. As described in more detail below, FIG. 8A shows a first stage in which the enterprise IT portal client 802 interacts with the controller 804 to configure a UE (e.g., an enterprise device). The first stage is also referred to as a pre-provisioning stage, including steps 1-18, as shown in FIG. 8A. FIG. 8B shows a second stage in which the UE connects to the network after the pre-provisioning stage. The second stage is also referred to as a UE startup stage, including steps 19-37. According to some embodiments, there may be another phase, for example, an operational phase, in which the enterprise IT portal client 802 can modify and monitor the enterprise device, or simply modify the current setup.

[0120] In Figures 8A and 8B, the enterprise IT portal client 802, controller 804, GBA service provider 806, public / private network provider 808, SM service provider 810, configuration and bootstrap service provider 812, VPN controller 814, and UE 816 may be substantially the same as the enterprise IT portal client 714, controller 702, GBA service provider 744, CSP of public / private network 762, SM service provider 736, configuration and bootstrap service provider 732, VPN control plane 760, and UE 756, respectively, and therefore will not be described repeatedly.

[0121] 8A and 8B may be single elements or multiple elements. For example, the public / private network provider 808 and the SM service provider 810 may each be a single provider or multiple providers. Similarly, the UE 816 may be a single UE or multiple UEs.

[0122] Referring to FIG. 8A, in the pre-provisioning stage (first stage), the process can start at step 1, where an enterprise IT portal client 802 (e.g., a user in the enterprise IT department) can use a device to interact with the controller 804 via the enterprise IT portal (e.g., portal 712) to obtain user-related data in the system. Such a user may be, for example, a new employee or a colleague of the enterprise organization. The process related to obtaining user-related data may also be referred to as provisioning user. In this user provisioning process, a user's device (e.g., a laptop computer) may be obtained. The user's device may receive initial inputs that enable it to fetch necessary configurations and parameters. The user's username and password may also be set to enable the user to log in to the device and the enterprise network. In step 1 shown in FIG. 8A, the enterprise IT portal client 802 can send a request to the controller 804 via the device to obtain user-related data. In step 2, the controller 804 outputs a set of user identifiers (e.g., name, employee ID, etc.) and other user attributes (e.g., title, department, type of device required, etc.) and can optionally send them back to the device used by the enterprise IT portal client 802.

[0123] In step 3 of the process shown in FIG. 8A, the enterprise IT portal client 802 can pre-order equipment (e.g., a mobile device) or reactively purchase equipment for a new user. Each device has identifiers for its internal components. For example, a laptop has its own serial number, its internal Wi-Fi card has its own MAC address, its internal cellular modem has its own IMEI identifier, etc. According to some embodiments, step 3 may optionally include registering the identification information. All of these identifiers may be registered as part of the device inventory (e.g., the inventory contained in the controller 804 and / or the configuration and bootstrap service provider 812).

[0124] In step 4 of the process, based on previous data from the UE (e.g., purchased equipment), the enterprise IT portal client 802, via the device, sends a request to the controller 804 to manage one or more UEs.

[0125] Based on the request received from the enterprise IT portal client 802, the controller 804 performs the following steps to enable one or more UEs to establish trusted communication over the zero trust network. In step 5 of the process shown in FIG. 8A, for each user, based on user-related data (e.g., their roles and responsibilities), the controller 804 generates a set of rules (e.g., cryptography tables) and keys (security keys) for establishing trusted communication over the zero trust network. The controller 804 can exchange the rules and / or security keys with the GBA service provider 806. Based on the rules and keys, the GBA service provider 806 provides a set of GBA services, one per user. The GBA service, when executed, provides a set of rules and security keys for a particular user. In step 6, the GBA service provider 806 sends the GBA service back to the controller 804.

[0126] 8A, for each UE to be assigned to a user, in step 7, the controller 804 orders an eSIM profile by sending a request to a public / private network provider 808. The eSIM profile can enable the UE to connect to a cellular network (e.g., 4G / 5G / 6G or any other generation). In step 8, if an SM service provider is not available in the network provider 808, the network provider 808 passes the request with the required network properties (e.g., network identifier, network encryption key, etc.) to the SM service provider 810.

[0127] In step 9, the SM service provider 810 sends an eSIM profile reference corresponding to the requested eSIM profile or profiles to the network provider 808. According to some embodiments, the eSIM profile or profiles include credentials that the GBA service can use to generate additional security credentials that can be shared with a particular NAF. In step 10, the eSIM profile reference is passed from the network provider 808 to the controller 804.

[0128] In step 11 of the process shown in FIG. 8A, the controller 804 sends a request to the network provider 808 to obtain a reference to a set of SASE instances. The set of SASE instances can include one or many SASE instances. In some examples, the network provider 808 is also responsible for SASE services available in its network (e.g., SASE services that are combined with the UPF to form the eUPF as described above). In step 12, the controller 804 obtains a reference to an interface of the set of SASE instances from the network provider 808 to configure the cryptographic tables for each user as / when needed. In this disclosure, when the term "SASE" is used, it can also refer to or include SSE (Security Services Edge). SSE is a "scaled down" version of SASE and can include fewer functions than SASE. Based on the reference to the SASE interface, the set of SASE instances is provided to the controller 804.

[0129] 8A, the controller 804 builds one or more UE-specific bootstrap configurations for each UE associated with the user (e.g., UE 816) based on the data collected in the previous steps (e.g., eSIM profile, GBA service, SASE instance, etc.). In step 13, the controller 804 sends the UE-specific configuration built for each UE to the configuration and bootstrap service provider 812. The configuration and bootstrap service provider 812 returns an indication to indicate that the desired UE configuration is stored in its inventory system (step 14).

[0130] According to some embodiments, controller 804 may also register the UE with VPN controller 814 in step 15. When registering the UE with VPN controller 814, MESyP controller 804 may send necessary data (e.g., device identification information) to VPN controller 814, thereby enabling VPN controller 814 to recognize the UE as a secure device. In step 16, if registration is successful, VPN controller 814 sends an indication to MESyP controller 804 that registration is complete.

[0131] According to some embodiments, the resulting UE-specific bootstrap configuration is stored in an inventory system of the MESyP controller 804 and may optionally be returned to the enterprise IT portal client 802 device (step 17). This interaction with the enterprise IT portal client 802 device may be performed asynchronously (via sequence management). In step 18, the UE (e.g., enterprise device) is distributed to the corresponding user (e.g., employee).

[0132] 8B, which is a sequence diagram illustrating a process for establishing a secure communication channel through a zero-trusted network for one or more UEs (e.g., UE 816). In step 19, the UE 816 powers up. For example, a user 818 may press a power button on the UE 816 to initialize the UE 816.

[0133] FIG. 8B shows two optional steps 20 and 21 that are performed if a temporary cellular profile is not configured for the UE 816 (so the UE 816 may need to first establish some kind of connection). In step 20, for example, the UE 816 (e.g., a laptop) checks for a connected wired network. If a wired network is not found or is unavailable, the UE 816 checks for a Wi-Fi network. If a Wi-Fi network is available, the UE 816 requests Wi-Fi credentials to connect. In step 21, the user 818 provides the Wi-Fi credentials to the UE 816, thereby enabling the UE 816 to connect to the Wi-Fi network.

[0134] In step 22, after establishing a network connection (wired or Wi-Fi), the UE 816 sends a request to the configuration and bootstrap service provider 812 to obtain one or more UE-specific bootstrap configurations. As described above, the MESyP controller 804 has performed one or more steps shown in FIG. 8A and sent the UE-specific configuration to the configuration and bootstrap service provider 812. As a result, the UE-specific configuration for the UE 816 is available at the configuration and bootstrap service provider 812. Thus, the service provider 812 provides the UE-specific configuration to the UE 816 in step 23.

[0135] Continuing with the process shown in FIG. 8B, in steps 24 and 25, the UE 816 performs a start-up procedure by obtaining a UE-specific configuration including an eSIM profile reference (e.g., obtaining an actual profile from an SM-DP+ service provider). In particular, in step 24, the UE 816 sends a request to the configuration and bootstrap service provider 812 to obtain a configuration including an eSIM profile reference. In step 25, the configuration and bootstrap service provider 812 sends the eSIM profile reference to the UE 816. According to some embodiments, the eSIM profile reference can be used to obtain one or more eSIM profiles. As described below, the UE 816 obtains one or more eSIM profiles based on the eSIM profile reference. The one or more eSIM profiles include credentials that the GBA service can use to generate additional security credentials, which can be shared with a particular NAF. The GBA service is executed after the UE 816 obtains the one or more eSIM profiles.

[0136] Based on the eSIM profile reference, the eSIM of the UE 816 sends a request to the SM service provider 810 (step 26) and obtains the eSIM profile from the SM service provider 810 (e.g., from the SM-DP+ service) (step 27).

[0137] Based on the downloaded eSIM profile, the eSIM of the UE 816 activates the new profile (step 28). Once activated, a modem (e.g., a 4G or 5G modem) in the UE 816 establishes connectivity with a network node of the public / private network provider 808 (step 29). In some instances, the network provider 808 can send an indication back to the UE 816 that the UE 816 is connected (step 30).

[0138] In step 31, the UE 816 communicates with the VPN controller 814 to request establishment of a VPN. As described above, in step 15, the controller 804 can register the UE 816 with the VPN controller 814. As a result, the VPN controller 814 recognizes the UE 816 as a secure device (step 32) and sends one or more tokens to establish a VPN (e.g., a GBA / AKMA-based VPN) between the UE 816 and the SASE instance of the public / private network provider 808.

[0139] In step 33, based on the credentials included in the one or more eSIM profiles obtained in the previous step, the UE 816 sends a request to the GBA service provider 806 to obtain a GBA service. In step 34, the GBA service is provided to the UE 816. For example, the GBA service may use the credentials stored in a particular eSIM profile to generate additional security credentials that can be shared with a particular NAF. At this point, the UE 816 has established a secure connection over the zero-trusted network.

[0140] According to some embodiments, the UE 816 may be an enterprise device. Thus, the UE-specific configuration also sets up an access management system that requires credentials. In this case, the UE 816 may request the user 818 to provide the enterprise credentials (step 35). Once the user 818 provides the credentials to the UE 816 (step 36), the credentials may be used to sign on to the access management system (step 37). In some instances, such as shown in FIG. 8B, the access management system may be within the configuration and bootstrap service provider 812.

[0141] 9 is a flow chart illustrating a method 900 implemented by a computer-implemented controller (e.g., controller 702 or 804 described above). The method 900 may begin at step 902, where the controller receives a request to manage one or more UEs (e.g., UE 756 or 816). For example, the request may be sent to the controller from an enterprise IT portal client (e.g., portal client 714 or 802).

[0142] According to some embodiments, the controller obtains one or more identifiers associated with one or more components of one or more UEs. As described above, the one or more identifiers may include a mobile device serial number, an embedded Wi-Fi card MAC address, an IMEI identifier, etc. These identifiers may be registered as part of a device inventory included with the controller and / or a configuration and bootstrap service provider. For example, the controller stores the one or more identifiers in the controller's device inventory. The controller may also send the one or more identifiers to a service provider, such as a configuration and bootstrap service provider (e.g., an MDM service provider).

[0143] At step 904 of method 900, the controller obtains a user-specific security profile from a first service provider. For example, the controller generates a set of user-specific rules (e.g., cryptographic tables) and exchanges security keys with the first service provider (e.g., a GBA service provider). The first service provider may output a set of user-specific security profiles (e.g., provided by a GBA service). The user-specific security profile includes a set of user-specific rules and a security key. The user-specific security profile is configured to facilitate a configuration and bootstrap service provider to authenticate the UE.

[0144] In step 906 of method 900, the controller obtains a SIM profile from a network node or another service provider. For example, the controller sends a request to a network node of a public network and / or a private network to obtain a SIM profile and receives the SIM profile from the network node. The SIM profile is configured to facilitate the UE to establish cellular communication. According to some embodiments, the SIM profile may not be available at the network node. In this case, the network node obtains the SIM profile from the SM service provider and provides the obtained SIM profile to the controller via the network node.

[0145] At step 908 of method 900, the controller obtains a set of SASE instances from a network node. For example, the controller can obtain a reference to a SASE interface and receive the set of SASE instances based on the reference to the SASE interface. The set of SASE instances may be received from a network node of a network provider. In some examples, the controller configures a set of user-specific rules based on the set of SASE instances. The user-specific rules can be cryptographic tables.

[0146] At step 910 of method 900, the controller constructs one or more UE-specific bootstrap configurations based on a user-specific set of security profiles, SIM profiles, and SASE instances.

[0147] At step 912 of method 900, the controller sends the UE-specific bootstrap configuration to a configuration and bootstrap service provider. The one or more UE-specific bootstrap configurations are retrievable by the one or more UEs to establish a secure wireless communication channel through the zero-trusted network. In some examples, the controller stores the UE-specific bootstrap configuration in a device inventory of the controller. The controller may also provide a representation of the UE-specific bootstrap configuration to an MDM service provider for storage and receive confirmation from the MDM service provider that the one or more UE-specific bootstrap configurations have been stored. The MDM service may be provided by the configuration and bootstrap service provider.

[0148] In some examples, the method 900 may further include a step (not shown) of the controller sending a request to register one or more UEs with a virtual private network (VPN) controller and receiving a confirmation from the VPN controller that the one or more UEs are registered. In this manner, the VPN controller recognizes the UE as a secure device.

[0149] FIG. 10 shows a flowchart of a method 1000 performed by a UE. The method 1000 is an example flow performed by a UE to support GBA / AKMA and VPN control plane. As shown in FIG. 10, in step 1002, the UE connects to a wireless network. For example, the UE may request connectivity to a wireless network (e.g., a Wi-Fi network). The UE may also connect to a wired network using an Ethernet cable.

[0150] In step 1004, upon connecting to the wireless network, the UE obtains one or more UE-specific bootstrap configurations from a mobile device management (MDM) service provider. The MDM service provider may be a bootstrap and configuration service provider. For example, upon connecting, the UE sends a request to the MDM service provider. The MDM service provider may forward the UE's connection request to a single sign-on URL. Once the UE is signed in, the UE obtains the UE-specific bootstrap configuration from the service provider's MDM server. The particular MDM service provider is specific to the user and the enterprise with which the user is associated.

[0151] As described above, one or more UE-specific bootstrap configurations may be generated based on a user-specific security profile, a Subscriber Identity Module (SIM) profile, and a set of SASE instances. The UE-specific bootstrap configuration may include a user-specific security profile, a Subscriber Identity Module (SIM) profile, and a set of SASE instances. vinegar one or more configurations of To improve security VPN controller URL and optionally one or more of the VPN controller certificates ,thing Disable the physical SIM Things to do , select a primary eSIM profile (e.g. based on your current location) Things to do Disable adding new eSIM profiles Things to do Enables the ability to switch eSIM profiles To do , and / or have not yet chosen 5G as their primary connection Including .

[0152] 10, in step 1006, the UE may obtain user credentials. As mentioned above, the user may be an enterprise user, so the enterprise user's credentials are required to log in to the access management system.

[0153] In step 1008, the UE establishes a secure wireless communication channel with the network node through the zero trusted network based on one or more UE-specific bootstrap configurations, user credentials, and SIM profile. For example, based on the eSIM / iSIM reference configuration included in the UE-specific bootstrap configuration, the LPA of the UE obtains the SM-DP+profile code (URL+ID) and downloads the corresponding eSIM / iSIM profile. When the eSIM / iSIM profile is loaded into the UE, the UE activates a cellular network (e.g., a 5G network) based on the eSIM / iSIM profile. In some instances, data traffic can continue to flow through the Wi-Fi connection. Thus, the activated cellular network may be different from the wireless network to which the UE originally connected.

[0154] According to some embodiments, a VPN client running on the OS of the UE connects to the VPN controller and obtains encryption keys, tables, and SASE IP addresses (for both cellular and Wi-Fi networks) (mutual TLS authentication). Related As explained above, the VPN controller has already configured one or more SASE instances for the UE. As a result, the UE can establish a VPN to the relevant SASE instance. If the cellular network is reachable, the VPN client connects to the eUPF in the network node via the cellular connection (SASE side) via the VPN based on the previous encryption key. If the cellular network is not reachable, the VPN client connects to the SASE IP configured for the Wi-Fi connection (the CSP must have configured the SASE server). of (This may be the same if you consent to posting it on the Internet.)

[0155] According to some embodiments, all Wi-Fi connectivity can be deprioritized except for enterprise Wi-Fi, which is then prioritized over the cellular network. If coverage is not good, the user can manually switch eSIM profiles. vinegar (Or the system can check a coverage map and select the best eSIM profile, or IT can direct the switch via a portal.)

[0156] Additionally, the GBA / AKMA key of the device operating system obtained in the previous sequence can be refreshed on demand. This action is timeout based or triggered from the MESyP controller NBI. When it is required to refresh the key, the MESyP controller sends a request to the UE via the MDM to refresh it, and the UE's operating system requests new keys from the eSIM.

[0157] According to some embodiments, both the MESyP controller and the MDM service are deployed in a cloud reachable at a global level from the Internet, thereby making it possible to manage enterprises in different countries via different CSPs.

[0158] The foregoing specification should be understood in all respects as illustrative and exemplary, and not restrictive, and the scope of the invention disclosed herein should be determined not from the specification, but rather from the claims, interpreted in accordance with the full scope permitted by patent law. It will be understood that the embodiments shown and described herein are merely illustrative of the principles of the invention, and that various modifications can be made by those skilled in the art without departing from the scope and spirit of the invention. Those skilled in the art can implement various other feature combinations without departing from the scope and spirit of the invention.

Claims

1. 1. A method performed by a computer-implemented controller, the method comprising: Receiving a request to manage one or more user equipment units (UEs); Obtaining a user-specific security profile from a first service provider; Obtaining a subscriber identity module (SIM) profile from a network node or a second service provider; Obtaining a set of Secure Access Service Edge (SASE) instances from the network nodes; constructing one or more UE-specific bootstrap configurations based on the user-specific security profile, the SIM profile, and the set of SASE instances; and transmitting the one or more UE-specific bootstrap configurations to a third service provider, the one or more UE-specific bootstrap configurations being retrievable by the one or more UEs for establishing a secure wireless communication channel over a zero trusted network.

2. 2. The method of claim 1, further comprising, for each UE of the one or more UEs: obtaining one or more identifiers associated with one or more components of the UE; storing the one or more identifiers in a device inventory of the controller; transmitting the one or more identifiers to the third service provider; A method comprising:

3. 3. The method of claim 1, wherein obtaining the user-specific security profile from the first service provider comprises: generating a set of user-specific rules; exchanging a security key with the first service provider, wherein the user-specific security profile includes the set of user-specific rules and the security key, the user-specific security profile configured to facilitate the third service provider authenticating a UE of the one or more UEs.

4. 4. The method according to claim 1, wherein obtaining the SIM profile from the network provider or the second service provider comprises: sending a request to the network node to obtain the SIM profile; and receiving the SIM profile from the network node, the SIM profile configured to facilitate a UE of the one or more UEs establishing cellular communication.

5. 5. The method according to claim 1, wherein the second service provider is a Service Manager (SM) service provider, and the SIM profile is provided to the controller from the SM service provider via the network node.

6. 6. The method according to claim 1, wherein obtaining the set of SASE instances from the network provider comprises: Obtaining a reference to a SASE interface; receiving the set of SASE instances based on the reference to the SASE interface; A method comprising:

7. 7. The method of claim 6, further comprising: constructing a set of user-specific rules based on the set of SASE instances; A method comprising:

8. 8. The method of claim 1, wherein the first service provider comprises at least one of a Generic Bootstrapping Architecture (GBA) service provider or an Authentication Key Management for Applications (AKMA) service provider, the second service provider comprises an SM service provider, and the third service provider comprises a Mobile Device Management (MDM) service provider.

9. The method according to any one of claims 1 to 8, further comprising: storing the one or more UE-specific bootstrap configurations in a device inventory of the computer implemented controller; providing a representation of the one or more UE-specific bootstrap configurations to an MDM service provider for storage; receiving a confirmation from the MDM service provider that the one or more UE-specific bootstrap configurations have been stored; A method comprising:

10. The method according to any one of claims 1 to 9, further comprising: sending a request to register the one or more UEs with a virtual private network (VPN) controller; receiving a confirmation from the VPN controller that the one or more UEs are registered; A method comprising:

11. 1. A method performed by a user equipment, the method comprising: Connecting to a wireless network; Upon connecting to the wireless network, obtaining one or more UE-specific bootstrap configurations from a Mobile Device Management (MDM) service provider, where the one or more UE-specific bootstrap configurations are based on a user-specific security profile, a Subscriber Identity Module (SIM) profile, and a set of SASE instances; Obtaining user credentials; establishing a secure wireless communication channel with a network node over a zero trusted network based on the one or more UE specific bootstrap configurations, the user credentials, and the SIM profile; A method comprising:

12. 12. The method of claim 11, wherein the one or more UE-specific bootstrap configurations comprise: an embedded subscriber identity module or integrated subscriber identity module (eSIM / iSIM) profile reference; one or more of a VPN (Virtual Private Network) controller URL (Uniform Resource Link) and a VPN controller certificate; Deactivating the physical SIM; Selecting a primary eSIM profile; Disabling the addition of new eSIM profiles; and Enabling a feature to switch eSIM profiles; The method includes a configuration associated with the

13. 13. The method according to claim 11, wherein establishing the secure wireless communication channel with the network node via the zero trust network comprises: obtaining an eSIM / iSIM profile from a Service Manager (SM) service provider based on an eSIM / iSIM reference configuration included in the one or more UE-specific bootstrap configurations; activating the UE to connect to a cellular network based on the eSIM / iSIM profile; A method comprising:

14. The method of claim 13 , wherein the cellular network is different from the wireless network.

15. The method according to any one of claims 13 to 14, further comprising: connecting to at least one of a Generic Bootstrapping Architecture (GBA) service provider or an Authenticated Key Management for Applications (AKMA) service provider to obtain one or more encryption keys; connecting to a Virtual Private Network (VPN) controller via a VPN client of the UE to obtain a set of user-specific rules, encryption keys, and a SASE IP address; establishing a VPN connection between the UE and one or more SASE instances based on the user-specific rules, the one or more encryption keys, and the set of SASE IP addresses; A method comprising:

16. 16. The method of claim 15, wherein establishing a VPN connection between the UE and one or more SASE instances comprises: establishing the VPN connection to the one or more SASE instances based on the encryption key in accordance with a determination that the UE is connected to the cellular network; establishing the VPN connection to the one or more SASE instances based on the SASE IP address configured for the wireless network in accordance with a determination that the UE is not connected to the cellular network; A method comprising:

17. 1. A computer implemented controller for managing a mobile embedded security platform, the controller comprising: a transceiver, a processor, and a memory, the memory including instructions executable by the processor, whereby the controller: Obtaining a user-specific security profile from a first service provider; Obtaining a subscriber identity module (SIM) profile from a network node or a second service provider; Obtaining a set of Secure Access Service Edge (SASE) instances from the network nodes; constructing one or more UE-specific bootstrap configurations based on the user-specific security profile, the SIM profile, and the set of SASE instances; sending the one or more UE specific bootstrap configurations to a third service provider; wherein the one or more UE specific bootstrap configurations are retrievable by the one or more UEs to establish a secure wireless communication channel through a zero trusted network.

18. 20. The computer implemented controller of claim 17, further comprising, for each UE of the one or more UEs: obtaining one or more identifiers associated with one or more components of the UE; storing one or more identifiers in a device inventory of the controller; transmitting the one or more identifiers to the third service provider; A computer-implemented controller operable to execute the steps of:

19. 19. The computer implemented controller of claim 17, wherein obtaining a user specific security profile from the first service provider comprises: generating a set of user-specific rules; and exchanging a security key with the first service provider, the user-specific security profile including the set of user-specific rules and the security key, the user-specific security profile configured to facilitate the third service provider authenticating a UE of the one or more UEs.

20. 20. The computer implemented controller of claim 17, wherein obtaining the SIM profile from the network provider or the second service provider comprises: sending a request to the network node to obtain the SIM profile; and receiving the SIM profile from the network node, the SIM profile configured to facilitate a UE of the one or more UEs establishing cellular communication.

21. 21. The computer implemented controller of claim 17, wherein the second service provider is a Service Manager (SM) service provider, and the SIM profile is provided to the controller from the SM service provider via the network node.

22. 22. The computer implemented controller of claim 17, wherein obtaining the set of SASE instances from the network provider comprises: Obtaining a reference to a SASE interface; receiving the set of SASE instances based on the reference to the SASE interface; a computer implemented controller comprising:

23. 23. The computer implemented controller of claim 22, further comprising: constructing a set of user-specific rules based on the set of SASE instances; A computer-implemented controller operable to execute the steps of:

24. 24. The computer implemented controller of claim 17, wherein the first service provider comprises at least one of a Generic Bootstrapping Architecture (GBA) service provider or an Authentication Key Management for Applications (AKMA) service provider, the second service provider comprises an SM service provider, and the third service provider comprises a Mobile Device Management (MDM) service provider.

25. The computer-implemented controller according to any one of claims 17 to 24, further comprising: storing the one or more UE-specific bootstrap configurations in a device inventory of the controller; providing a representation of the one or more UE-specific bootstrap configurations to an MDM service provider for storage; receiving a confirmation from the MDM service provider that the one or more UE-specific bootstrap configurations have been stored; A computer-implemented controller operable to execute the steps of:

26. The computer-implemented controller according to any one of claims 17 to 25, further comprising: sending a request to register the one or more UEs with a Virtual Private Network (VPN) Controller; receiving a confirmation from the VPN controller that the one or more UEs are registered; A computer-implemented controller operable to execute the steps of:

27. A user equipment (UE) for establishing a secure connection based on a mobile embedded security platform, comprising: a transceiver, a processor, and a memory, the memory including instructions executable by the processor, whereby the UE: Connecting to a wireless network; Upon connecting to the wireless network, obtaining one or more UE-specific bootstrap configurations from a Mobile Device Management (MDM) service provider, where the one or more UE-specific bootstrap configurations are based on a user-specific security profile, a Subscriber Identity Module (SIM) profile, and a set of SASE instances; Obtaining user credentials; establishing a secure wireless communication channel with a network node over a zero trusted network based on the one or more UE specific bootstrap configurations, the user credentials, and the SIM profile; The UE is operable to perform the following:

28. 28. The UE of claim 27, wherein the one or more UE specific bootstrap configurations further comprise: an embedded subscriber identity module or integrated subscriber identity module (eSIM / iSIM) profile reference; one or more of a VPN (Virtual Private Network) controller URL (Uniform Resource Link) and a VPN controller certificate; Deactivating the physical SIM; Selecting a primary eSIM profile; Disabling the addition of new eSIM profiles; and Enabling a feature to switch eSIM profiles; The UE includes a configuration associated with the

29. 29. The UE according to claim 27, wherein establishing the secure wireless communication channel with the network node via the zero trust network comprises: obtaining an eSIM / iSIM profile from a Service Manager (SM) service provider based on an eSIM / iSIM reference configuration included in the one or more UE-specific bootstrap configurations; activating the UE to connect to a cellular network based on the eSIM / iSIM profile; Including a UE.

30. 30. The UE of claim 29, wherein the cellular network is different from the wireless network.

31. The UE according to any one of claims 29 to 30, further comprising: connecting to at least one of a Generic Bootstrapping Architecture (GBA) service provider or an Authenticated Key Management for Applications (AKMA) service provider to obtain one or more encryption keys; connecting to a Virtual Private Network (VPN) controller via a VPN client of the UE to obtain a set of user-specific rules, encryption keys, and a SASE IP address; establishing a VPN connection between the UE and the one or more SASE instances based on the user-specific rules, the one or more encryption keys, and the set of SASE IP addresses; The UE is operable to perform the following:

32. 32. The UE of claim 31, wherein establishing a VPN connection between the UE and one or more SASE instances comprises: establishing the VPN connection to the one or more SASE instances based on the encryption key in accordance with a determination that the UE is connected to the cellular network; establishing the VPN connection to the one or more SASE instances based on the SASE IP address configured for the wireless network in accordance with a determination that the UE is not connected to the cellular network; Including a UE.

Images