3GPP Private LAN Onboarding for Secure Discovery and Handover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Devices with wireless communications capabilities are often sold without pre-provisioned network information, leading to security risks and unnecessary overhead when network identifiers are broadcast, and they cannot maintain simultaneous connections to both private LANs and public cellular networks.
Innovation Solution
Devices receive an invitation to connect to a private LAN, request and authenticate with additional network information, and are provisioned with credentials to securely connect, while allowing efficient discovery and handover between networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a private LAN node broadcasts network identifiers periodically, then device discovery is enabled, but security risks increase and unnecessary overhead is generated
Solution Approach 1:
The patent extracts the network identifier broadcasting function from the private LAN node and relocates it to the public network node. This allows the private LAN to remain secure without broadcasting identifiers, while still enabling device discovery through the public network's broadcast of available private networks.
Solution Approach 2:
The public network acts as an intermediary between devices and private LANs. It receives device registration requests, matches them with appropriate private LANs based on broadcast identifiers, and facilitates connection without the private LAN needing to broadcast its own identifiers publicly.
2Speed
If a device is provisioned with pre-configured network information, then connection speed is improved, but device complexity and manufacturing costs increase
Solution Approach 1:
The patent implements preliminary registration where devices register with the public network in advance, providing their identifiers and supported private LAN identifiers. This pre-provisioning enables faster connection establishment later without requiring complex manufacturing-time configuration.
Solution Approach 2:
Devices perform self-registration with the public network by broadcasting their identifiers and receiving automatic provisioning information. This eliminates the need for manual configuration or complex pre-provisioning during manufacturing, allowing devices to provision themselves autonomously.
3Adaptability or versatility
If a RAN node provides connectivity to both private LAN and public cellular network, then network versatility is improved, but connection management complexity increases
Solution Approach 1:
The patent segments connection management into two separate functions: the public network node handles device registration, authentication, and private LAN matching; the private LAN node handles actual data communication. This segmentation allows dual connectivity without requiring the device to manage both connections simultaneously through a single node.
Solution Approach 2:
The public network node serves as an intermediary that manages the complexity of dual connectivity. It maintains device registration information and private LAN availability, facilitating seamless switching between public and private networks without requiring the device to directly manage the complexity of both connections.
Data Source
AI summary
Methods and apparatuses are described herein for securely connecting to a private local area network (LAN). In accordance with one embodiment, an apparatus may receive, from a private LAN that has been provisioned with first identifying information associated with the apparatus, a first broadcast message comprising an invitation to connect to the private LAN and the first identifying information. The apparatus may send, based on the first broadcast message comprising the first identifying information, a request for system information and second identifying information associated with the apparatus. The apparatus may receive, from the private LAN, the requested system information. The apparatus may send, based on the requested system information, a registration request and third identifying information associated with the apparatus. The apparatus may receive, from the private LAN, acceptance of the registration request.