Patent Application
20190069162
The present invention generally relates to communications, and more particularly, to network communications and related methods, devices, and network nodes.
In Internet of things (IoT) applications, there may be a need to manage device connectivity to a larger extent than what has been the case previously. Connectivity has generally been managed either through WLAN (Wireless Local Area Network) access points to a fixed access at home, or through connectivity via a mobile cellular subscription to a PLMN (Public Land Mobile Network). In identifying a device in a cellular domain, a SIM (Subscriber Identity Module) card may be used in a device wherein the SIM card provides a cellular identity and a basis for authentication. Use of SIM cards is relatively straight-forward when the number of devices to be managed that have or require internet connectivity is relatively limited in number. In the coming IoT era however, the number of connected devices may drastically increase, and SIM solutions of today may become less feasible.
Partially in response to the coming IoT era, and for other reasons, use of embedded SIMs in the industry is increasing. Embedded SIMs are non-detachable SIMs that may be, for example, soldered in/on a device/chip. One advantage with embedded SIMs is that they may be used to simplify the process where the operator is the center point of provisioning, and instead provisioning of an embedded SIM may be provided after the embedded SIM is “distributed” (i.e., the embedded SIM may come with the device).
Also, other types of credentials (e.g., software based credentials such as soft-SIM's) may be considered. These other types of credentials may include SIMs that are realized through software, rather than through a physical entity such as a SIM card. These software based SIMs may make it possible, for example, to create and load different credentials from different operator authenticators. In some cases, a SIM may be changed to enable access to various PLMNs (Public Land Mobile Networks).
Known methods of providing credentials may not provide efficient solutions as increasing numbers of devices are used by a single user.
According to some embodiments of inventive concepts, a method of operating a network node in a communication network may include receiving a request from a first communication device (also referred to as a primary communication device). The request may be to associate a second communication device (also referred to as a secondary communication device), and the request may include an identification for the second communication device. A definition of a service limitation for the second communication device may be received from the first communication device, and a network access credential may be provided for the second communication device in response to the request from the first communication device. Moreover, communication may be provided for the second communication device in accordance with the definition for the service limitation using the network access credential.
A network access credential is a unique identification that may be associated with a particular communication device. The network access credential may be used by the associated communication device to gain access to a communication network, and the network access credential may be used by the communication network to allow/deny network access for the associated communication device. A service limitation may define a restriction or restrictions regarding how, when, and/or where second communication device is able to use the network. A definition of a service limitation may be any identifier (e.g., index, text/number string, code, etc.) used to identify a particular service limitation in communications between different devices/nodes.
The definition of the service limitation may include at least one of a definition of a geographic service limitation, a definition of a data rate service limitation, a definition of a time of use service limitation, a definition of a data use service limitation, a definition of a network access service limitation, and/or a definition of a service type service limitation.
Responsive to communication usage of the second communication device triggering a notification threshold relative to the definition of the service limitation, a notification may be transmitted to the first communication device. Moreover, a definition of the notification threshold may be received from the first communication device before transmitting the notification, receiving.
The definition of the service limitation may be a definition of a first service limitation. After receiving the definition of the first service limitation and after providing communication for the second communication device in accordance with the definition of the first service limitation, the method may further include receiving a definition of a second service limitation for the second communication device. The definition of the second service limitation may be received from the first communication device. After receiving the definition of the second service limitation, communication for the second communication device may be provided in accordance with the definition of the second service limitation using the network access credential.
The network access credential for the second communication device may include a Subscriber Identity Module (SIM) credential.
The network access credential for the second communication device may include a virtual International Mobile Subscriber Identity (vIMSI).
The network access credential for the second communication device may include a non-SIM credential.
The request may further include a network access credential for the first communication device. The network access credential for the first communication device may include a Subscriber Identity Module (SIM) credential.
According to some other embodiments of inventive concepts, a method of operating a first communication device in a communication network may include transmitting a request to the communication network. The request may be a request to associate a second communication device, and the request may include an identification for the second communication device. A definition of a service limitation for the second communication device may be transmitted from the first communication device to the communication network.
The definition of the service limitation may include at least one of a definition of a geographic service limitation, a definition of a data rate service limitation, a definition of a time of use service limitation, a definition of a data use service limitation, a definition of a network access service limitation, and/or a definition of a service type service limitation.
A notification may be received from the communication network, and the notification may indicate usage of the second communication device exceeding a notification threshold relative to the definition of the service limitation. Before receiving the notification, a definition of the notification threshold may be transmitted from the first communication device to the communication network.
The definition of the service limitation may be a definition of a first service limitation. In addition, a definition of a second service limitation for the second communication device may be transmitted to the communication network after transmitting the definition of the first service limitation.
The request may further include a network access credential for the first communication device. The network access credential for the first communication device may include a Subscriber Identity Module (SIM) credential.
Before transmitting the request, the identification for the second communication device may be received from the second communication device. After transmitting the request, a one-time-use access token may be received from the communication network. The one-time-use access token may be provided to the second communications device.
According to still other embodiments of inventive concepts, a node of a communication network may include a network interface configured to provide communications through a radio access network with wireless communication devices, and a processor coupled with the network interface. The processor may be configured to receive a request from a first communication device through the network interface. The request may be to associate a second communication device, and the request may include an identification for the second communication device. The processor may also be configured to receive a definition of a service limitation for the second communication device, and the definition of the service limitation may be received from the first communication device through the network interface. The processor may be further configured to provide a network access credential for the second communication device through the network interface in response to the request from the first communication device, and to provide communication for the second communication device in accordance with the definition of the service limitation using the network access credential.
According to yet other embodiments of inventive concepts, a node of a communication network may include a request receiving module for receiving a request from a first communication device. The request may be to associate a second communication device, and the request may include an identification for the second communication device. The node may further include a definition receiving module for receiving a definition of a service limitation for the second communication device, and the definition of the service limitation may be received from the first communication device. The node may also include a network access credential provisioning module for providing a network access credential for the second communication device in response to the request from the first communication device, and a communication module for providing communication for the second communication device in accordance with the definition of the service limitation using the network access credential.
According to more embodiments of inventive concepts, a node of a communication network may be adapted to receive a request from a first communication device. The request may be to associate a second communication device, and the request may include an identification for the second communication device. The communication device may also be configured to receive a definition of a service limitation for the second communication device, and the definition of the service limitation may be received from the first communication device. The communication device may also be configured to provide a network access credential for the second communication device in response to the request from the first communication device, and to provide communication for the second communication device in accordance with the definition of the service limitation using the network access credential.
According to still more embodiments of inventive concepts, a first communication device may be adapted for operation in a communication network. The first communication device may include a communication interface configured to provide communications through a radio access network with the communication network, and a processor coupled with the network interface. The processor may be configured to transmit a request to the communication network through the communication interface. The request may be to associate a second communication device, and the request may include an identification for the second communication device. The processor may be further configured to transmit a definition of a service limitation for the second communication device. The definition of the service limitation may be transmitted from the first communication device to the communication network through the communication interface.
According to yet more embodiments of inventive concepts, a first communication device may be adapted for operation in a communication network. The first communication device may include a request transmitting module for transmitting a request to the communication network. The request may be to associate a second communication device, and the request may include an identification for the second communication device. The first communication device may also include a definition transmitting module for transmitting a definition of a service limitation for the second communication device. The definition of the service limitation may be transmitted from the first communication device to the communication network.
According to further embodiments of inventive concepts, a first communication device may be adapted for operation in a communication network. The first communication device may be adapted to transmit a request to the communication network, wherein the request is to associate a second communication device, and wherein the request includes an identification for the second communication device. A definition of a service limitation for the second communication device may be transmitted from the first communication device to the communication network.
According to some embodiments, a first communication device may be used to control operation of a second communication device. In addition, information regarding usage of the second communication device may be provided to the first communication device.
Inventive concepts will now be described more fully hereinafter with reference to the accompanying drawings, in which examples of embodiments of inventive concepts are shown. Inventive concepts may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of present inventive concepts to those skilled in the art. It should also be noted that these embodiments are not mutually exclusive. Components from one embodiment may be tacitly assumed to be present/used in another embodiment.
In enabling access for, e.g., IoT devices in an efficient way, one method is through a so-called Secure Entitlement Server, SES. The “Secure Entitlement Server” (SES) may work to further distribute credentials (which can be SIM based or non-SIM based) through network signaling. Such a solution may rely on building an association between a primary SIM device and one or more secondary non-SIM devices. The primary device uses its SIM (or other credential) to authenticate to the Secure Entitlement Server, and to start an on-boarding procedure to associate a secondary device. This association will indicate to the Secure Entitlement Server that credentials must be allocated to the secondary device.
The secondary device is then provided a one-time-use access token, (e.g., via Quick Response QR code, via Bluetooth, etc.) which can be used to retrieve credentials from the Secure Entitlement Server by the secondary device directly. This may provide a secure distribution of credentials to the secondary device.
In addition to allocating the credential to the secondary device, the Secure Entitlement Server may perform provisioning in the operator network for the secondary device, such as AAA (Authentication, Authorization, and Accounting) provisioning, HSS (Home Subscriber Server) provisioning, and/or IP (Internet Protocol) Multimedia Subsystem IMS Telephony Application Server configuration, if applicable. The nodes which are provisioned/configured by the Secure Entitlement Server may be conditioned on the services to be supported by the secondary device(s).
The diagram of
Operation 100: Primary SIM device 133 may receive a unique device-id (device identification) from the secondary device 131, to be conveyed to the SES 135 at operation 104 (optionally).
Operation 101: Primary SIM device 133 may perform EAP_AKA (Extended Authentication Protocol Authentication Key Arrangement) authentication and validate entitlement to associate a secondary device.
Operation 102: EAP-AKA authentication for primary SIM device 133 may be performed between SES 135 and AAA 141.
Operation 103: SES (Secure Entitlement Server) 135 provides the entitlement response, and the EAP-AKA response to primary SIM device 133.
Operation 104: Primary SIM device 133 performs on-boarding of secondary device 131 to use a specific service: i.e., voice service. An identifier for secondary device 131 may be passed (received in step 100).
Operation 105: SES 135 generates a one-time-use access token AT for secondary device 131.
Operation 106: The one-time-use access token is sent back to primary device 133. The one-time-use access token is encrypted using the unique-identifier for secondary device 131.
The diagram of
Operation 200: The one-time-use access token is transferred from primary device 133 to secondary device 131, for example, using Bluetooth, QR, NFC, etc.
Operation 201: Secondary device 131 authenticates with the Secure Entitlement Server 135, and requests credentials.
Operation 202: A virtual International Mobile Subscriber Identity vIMSI is allocated by SES 135 and returned along with a certificate.
Operation 203: Secondary device 131 generates a Certificate Signing Request CSR toward the Secure Entitlement Server 135.
Operation 204: The certificate is signed by the Certification Authority 139 and returned to SES.
Operation 205: The vIMSI, along with Packet Data Network PDN parameters and the certificate are stored in AAA 141.
Operation 206: The HSS 143 is provisioned with an IMS (IP Multimedia Subsystem) subscription for the vIMSI. The provisioned vIMSI is part of the same Implicit Registration Set IRS in the HSS to associate the primary Mobile Station International Subscriber Directory Number MSISDN (Mobile Station International Subscriber Directory Number) with an MSISDN of secondary device 131. An IMS Private Identification IMPI based on the secondary vIMSI is provisioned along with an IMS Public Identification IMPU allocated to secondary device 131.
Operation 207. The signed certificate is returned, along with the IMS credentials for the secondary device. The secondary device can now access the IMS core through the untrusted Wi-Fi model using the evolved Packet Data Gateway ePDG and the Packet Gateway PGW.
The above use-cases demonstrate operations that may be performed by Secure Entitlement Server 135 to provision a Wi-Fi only device. It may also be possible to leverage Secure Entitlement Server 135 and use it in conjunction with an electronic SIM (eSIM) server to provision an electronic Integrated Circuit Card IDentification eICCID to secondary device 131. The logic may be similar and may be supported by Secure Entitlement Server 135.
Some embodiments of inventive concepts may allow a Secure Entitlement Server to be augmented with additional functionality as described in greater detail below including: an extendible Application Program Interface API exposed by the Secure Entitlement Server; and/or capabilities to provision and configure different network elements in the operator network from the Secure Entitlement Server.
In relation to IoT and secondary devices associated with a user, it may be important to be able to distribute SIM or non-SIM credentials to secondary devices, but it may be even more advantageous if such devices, or rather usage from such devices could be further controlled. According to some embodiments of inventive concepts, further functionality may leverage capabilities of a Secure Entitlement Server SES. Existing methods for SIM and/or non-SIM credential re-distribution and sharing, for example, may not allow the holder of a Primary SIM for a primary SIM device to control and/or obtain information related to usage of Secondary SIM devices using secondary SIMs associated with the primary SIM.
According to some embodiments of inventive concepts, further functionality may be added to a Primary SIM device to allow improved control of usage of the Primary SIM credentials by its Secondary SIM devices.
According to some embodiments of inventive concepts, a Primary SIM device and a number of Secondary SIM devices (i.e., one or more Secondary SIM devices) may define a Primary SIM group. Within this group, the user/holder of the Primary SIM device may be able to control network usage of a Secondary SIM device. A number of aspects of Secondary SIM device operation may be possible to control.
For example, a holder of a Primary SIM of a primary SIM device may be able to control an amount of data that a particular Secondary SIM of a secondary SIM device is valid to use. The holder of the Primary SIM of the primary SIM device may further be able to control limits of bit rates that the Secondary SIM device will be allowed to transmit and/or receive using the credentials.
Further, the holder of the Primary SIM of the primary SIM device may be able to control services that the Secondary SIM device(s) may access, or even internet addresses that the Secondary SIM device(s) may communicate with and/or download information from.
The holder of the Primary SIM of the primary SIM device may be allowed, at the on-boarding of the Secondary device, to configure properties of the secondary device subscription and associated notifications (which can be triggered toward the Primary SIM device should the Secondary SIM device attempt usage that exceeds limitations of its subscription/configuration).
The holder of the Primary SIM of the primary SIM device may be able (through the Secure Entitlement Server) to keep track of the subscription status and the location of each of its associated Secondary SIM devices. When a Secondary device (whether SIM or Non-SIM) is on-boarded and associated with the primary SIM device, policies may be provisioned into the network (both policies that originate from the Primary SIM holder, but also, e.g., operator limitations) to define thresholds for different parameters. When/if these thresholds are exceeded, the primary SIM device may be notified.
According to some embodiments of inventive concepts, further functionality may be added to make available to a Primary SIM holder a controlling functionality for all its Secondary SIM devices. The controlling functionality may be supported by network functions such as SES.
Different devices (of different types) may then be on-boarded, ranging from Machine-to-Machine M2M types of devices to tablets, set-top boxes, in-vehicle communication service devices, etc.
By using an extendible API architecture, it may be possible to introduce a multitude of policies associated with the on-boarded devices depending on their types.
According to some embodiments of present inventive concepts, a Primary SIM device may associate with and trigger generation of credentials for a Secondary device. The primary SIM may, for example, be an embedded SIM that is embedded in the primary SIM device or a physical SIM card that is removably inserted in the primary SIM device. While a SIM is used in some embodiments, inventive concepts may be applicable in any situation when sharing and/or distributing credentials from one device (a primary device) to another (a secondary device). Some embodiments do not require an SIM credential.
The Primary SIM device may share its credentials in a number of different ways. In some embodiments, a secure entitlement server may be used as discussed above with respect to
The Primary SIM device may define service limitations (also referred to as policies) to be enforced for associated secondary devices depending of their types. Definitions of such service limitations may then be based on input from the Primary SIM device and potentially also operator policies for Secondary SIMs of secondary SIM devices, defined in the Secure Entitlement Server. Depending of their content, different network elements can be provisioned or configured, and/or a listener interface may be enabled with the target network elements such as a Policy and Charging Rules Function PCRF. For example:
The policies may be activated at any point in time after activating and associating a secondary SIM device. The policies may be stored in the Secure Entitlement Server, and the policies may be augmented without impacting the deployed devices, as the enforcement may occur in the network.
An existing API defined for the Secure Entitlement Server may be used to enable definition of the policies, and this API can be augmented to define policies associated with different devices types.
The Secure Entitlement Server may also control authorization to enforce policies for the user of the primary device (whether the user has the rights to enforce read and write policies, or whether only read policies are authorized).
In the following description, “network” will indicate that a signal is sent to a corresponding network entity (e.g., the SES) that is capable of either directly (for a non-SIM device) or indirectly (through use of an eSIM server) provisioning secondary credentials.
Generation of a secondary SIM may be done using operations 301 to 314 discussed below with respect to the messaging diagram of
Operation 301: Primary SIM device 333 and Secondary SIM device 331 (for which secondary credentials are to be created) may communicate to provide, for example, a secondary SIM identity (of secondary SIM device 331) from secondary SIM device 331 to Primary SIM device 333 prior to communication with the network via SIM controller 335.
Operations 302 and 303: Primary SIM device 333 may then perform an authentication (EAP-AKA/AKA′) procedure (through the SES 335, AAA 341, and/or HHS/SPR 343) and request a new Secondary SIM credential or to trigger the reservation and binding of an eICCID (when an eSIM based device is used).
Operation 304: Primary SIM device 333 may receive the EAP-AKA and the Request, and possibly, SIM controller 335 may include a list of policies applicable to the type of secondary device being activated.
Operation 305: Primary SIM device 333 may then communicate the preference details defining how the new Secondary SIM of the secondary SIM device 331 should be valid (taking SES-indicated limitations into account). This may include the limitations as described above, e.g., geographic limitations, limitations in bit rates, limitations when the Secondary SIM may be used, etc.
Operation 306: SES controller 335 may check with subscription data at HHS/SPR 343 for the primary SIM of primary SIM device 333, to confirm that it is allowed to set-up a secondary SIM for a secondary SIM device according to the request of operation 305. In some situations, subscriptions for some Primary SIM devices 333 with an operator may have such opportunities while other subscriptions for other SIM devices may not. Checking towards HSS/SPR 343 may allow for operators to allow Secondary SIM's selectively, or for that matter, put operator limitations on how a Secondary SIM device may be valid. This may either be done through subscription data for the Primary SIM device, or through adding policy information to the vIMSI in the step/s below, or both. Further, SIM controller 335 may validate the policies and trigger the provisioning of the applicable nodes to enforce the policies. If notifications are defined, registration of push tokens may take place with SIM controller 335.
Operation 307: Once all the checks are complete and it has been concluded that the request for a secondary SIM device is allowed (according to the request/limitations), SIM controller 335 may issue a one-time-use access token AT and send the one-time-use access token to the Primary SIM device 333. The one-time-use access token will be used by the Secondary SIM device 331 in initial communications with SIM controller 335.
Operation 308: Primary SIM device 333 may forward the one-time-use access token to the Secondary SIM device 331, for example, using a short range wireless/wired communication interface, such as, Bluetooth, Wi-Fi, USB, etc.
Operations 309 and 310: Secondary SIM device 331 may send a request to SIM controller 335, and, dependent on service, may also go through a Certificate Signing Request Procedure (for example, if there are specific services that require a Certificate from a Certificate Authority, e.g., access to ePDG for IMS/VoWiFi).
Operation 311: SIM controller 335 may generate a virtual International Mobile Subscriber Identification vIMSI and add the vIMSI to the AAA 341 for provisioning the Secondary SIM device.
Operation 312: The vIMSI (and more/other “permanent” credentials) may be communicated to Secondary SIM Device 331.
Operation 313: An indication that the Secondary SIM device is now active may be sent to the primary SIM device 333.
Operation 314: At any point in the future, if restrictions (e.g., in service, use, etc.) should be imposed on the traffic to/from the secondary SIM device 331, PCRF 351 may be involved in such policy rules (service limitations), and Policy and Charging Enforcement Function PCEF may be involved in enforcement.
Different functionalities of SIM controller 335 will now be described in greater detail according to some embodiments of inventive concepts. These functionalities will be described using a “Secondary SIM” of Secondary SIM device 331 as an example, but these functionalities may be equally applicable for other credential types, other than e/SIM. Further, in the description below, functionality of the controller may reside in the network, and communication with a controller/connectivity manager can be provided from primary SIM device 333.
Primary SIM device 333 may (when initiating a request for a Secondary SIM of Secondary SIM device 331), through an MMI (Man Machine Interface) or otherwise, set service limitations of a Secondary SIM of secondary SIM device 331. Such service limitations may include one or more of:
Primary SIM device 333 and installed controller may also configure alarm and/or tracker functionality to support keeping track of devices using Secondary SIM credentials.
During initiation and creation of a Secondary SIM for secondary SIM device 331, Primary SIM device 333 will signal the network to request generation of the Secondary SIM for secondary SIM device 331. Associated with the request of the Secondary SIM, a set of criteria may be provided according to operation 305 discussed above.
On the network side, SIM controller 335 may read the details of the request to create a Secondary SIM, along with configured limitations, usage parameters, location functionality, alarms etc., as discussed above, and create a Secondary SIM profile. The Secondary SIM may then be created (e.g., as is described above). It is the network and/or SIM controller 335 that enforce the Secondary SIM parameters and make sure that parameters and limitations related to its use, as configured/requested by the Primary SIM device 333, are followed. One way of enforcing this is through interfacing a Policy Charging and Rules Function PCRF such that usage of network resources related to a certain identity (e.g., Secondary SIM) are associated with its respective profile. The profile can either be kept in SIM controller 335, or in another node, for example, HSS/SPR node 343. In the example above, rules are stored in HSS/SPR 343 and fetched when the credential/Secondary SIM device 331 is in use, e.g., from PCRF.
Enforcement of parameters and limitations for a secondary SIM of a Secondary SIM device, for example, may be managed in a way that is similar the way that limitations of subscriptions (rates, areas, data volumes, etc.) is managed in current networks, through policies and rules that are associated with a certain subscriber and that go through a policy and rules function (PCRF). It may also be the case that SIM controller 335 may have interfaces to radio network nodes or controllers, such that certain limitations (e.g., air interface rate/allocations, delays and/or priority, etc.) may be controlled by SIM controller 335.
Primary SIM device 333 may signal the network, and using the same API as used for the configuration/creation of the Secondary SIM, it may be possible to send a “SSIM status report request”. Primary SIM device 333 may then receive a list of its associated Secondary SIM's, and their respective traffic status. Push notifications could also be configured, such that Primary SIM device 333 will learn, for example, if any of the Secondary SIM devices are about to “run out of” credentials, e.g., time/duration, data amount, etc. Further, a push notification may be relevant if any of the Secondary SIM devices are leaving a certain geographical area. According to some embodiments of present inventive concepts, Primary SIM device 333 may be allowed to configure a name-string associated with a created Secondary SIM, e.g., “My Camera” and associate both the generated credentials and the parameters/limitations configured with this Secondary SIM name. A SSIM status Report sent from SIM controller 335 to Primary SIM device 333, may include additional information.
Further, it may also be possible to change/update the parameters/limitations on an already defined Secondary SIM through SIM controller 335 and/or network, using similar signaling as for Secondary SIM initiation, as discussed above.
To provide the reports and/or push notifications as described, SIM controller 335 may need to interface with the nodes responsible for enforcing the limitations, e.g., PCRF/PCEF, AAA etc.
The For each generated Secondary SIM associated with primary SIM device 333, information similar to that shown above in Table 1 may appear if SIM Controller 335 is active for Primary SIM device 333.
Revocation of a Secondary SIM credential may be initiated by Primary SIM device 333 signaling the network with a revoke message and an associated Secondary SIM identity.
According to other embodiments of present inventive concepts, restrictions may be applied on how many Secondary SIM devices may be allowed for a certain primary SIM of a primary SIM device. Such information may be stored for a certain (Primary SIM) subscriber in Home Subscriber Server Subscriber Profile Repository HSS/SPR 343. Certain subscriptions may or may not be allowed to generate a Secondary SIM and further, some subscriptions may also have restrictions defining policies that are or are not possible to adjust from the Primary SIM holder (i.e., Secondary SIM policies that are partially or fully operator controlled). For example, the network operator may impose restrictions that Secondary SIMs may only be offered at a certain data rate.
According to some embodiments of inventive concepts, more granularly defined policies may be provided for secondary SIM and Non-SIM devices, and further control of 3GPP mobile network access by these secondary SIM and/or non-SIM devices may be provided, instead of allowing an Over-The-Top OTT type of control. Additional embodiments of inventive concepts may allow for primary SIM control over how secondary SIM devices may use credentials and/or for visibility of how secondary SIM devices use credentials. These policies may be leveraged by OTT applications as well, with an advantage of an optimized network level policy enforcement, which can be augmented over time with different policies as new device types and use-cases are introduced.
According to some embodiments of inventive concepts, a method may be provided in a first communication network node 335 (e.g., a SIM controller, which may be a Security Entitlement Server SES) to create a second set of credentials for a second communications device 331 (also referred to as a secondary communication device, which may be a secondary SIM or non-SIM device) and connect/associate these credentials with credentials of a first communications device 333 (also referred to as a primary communication device, which may be a primary SIM device). More particularly, the first communication network node 335 may configure validity of credentials for the second communications device 331 based on input received from the first communication device 333.
The first communication device 333 may trigger creation of the credentials for second communication device 331 by authenticating using a first credential, such as an SIM credential.
In addition, the first communication network node 335 may communicate with at least a second communication network node (e.g., HSS/SPR 343) to provide a set of rules and/or policies associated with the second credential for the second communication device 331.
According to some other embodiments of inventive concepts, a method may be provided in a first communication device 333 (also referred to as a primary communication device, which may be a primary SIM device) to create a second set of credentials for a second communication device 331 (also referred to as a secondary communication device, which may be a secondary SIM or non-SIM device). More particularly, the first communication device 333 may signal to a first network node 335 (e.g., a SIM controller, which may be a Security Entitlement Server SES) at least an indication of service limitations (also referred to as validity conditions) to be associated with the second set of credentials for the second communications device 331.
The service limitations may include conditions defining a geographical area/areas in which the second set of credentials are valid and/or invalid.
The service limitations include conditions defining an air interface bit rate (e.g., a maximum bit rate) that is associated with the second set of credentials.
The service limitations may include conditions defining a service (or services) for which the second set of credentials are valid and/or invalid.
The service limitations may include conditions defining a time-of-day (or times-of-day) for which the second set of credentials are valid and/or invalid.
In addition, the first communication device 333 may send a request to the first network node 335 defining reports that should be regularly sent to the first communications device 335, where the reports relate to usage of the second set of credentials for the second communication device 331.
Processor 401 (also referred to as a processor circuit, processing circuitry, or processor module) may include one or more data processing circuits, such as a general purpose and/or special purpose processor (e.g., microprocessor and/or digital signal processor). Processor 401 may be configured to execute computer program instructions from functional modules in memory 609 (also referred to as a memory circuit, memory circuitry, or memory module), described herein as a computer readable medium, to perform some or all of the operations and methods that are described herein for one or more of the embodiments. Moreover, processor 401 may be defined to include memory so that separate memory 409 may not be required.
When a structure of a particular wireless communication device (i.e., wireless communication device 333 or 331) is described, “a” or “b” may be respectively added to the reference number to designate the particular device. Wireless communication device 333, for example, may be discussed as including processor 401a, user interface 403a (e.g., including one or more of microphone 403-1a, speaker 403-2a, user input device 403-3a, and/or display 403-4a), communication interface 405a (including one or more of cellular RAN interface 405-1a, short range communication interface 405-2a, and/or wired communication interface 405-3a), image capture device 407a, and memory 409a. Similarly, wireless communication device 331, for example, may be discussed as including processor 401b, user interface 403b (e.g., including one or more of microphone 403-1b, speaker 403-2b, user input device 403-3b, and/or display 403-4b), communication interface 405b (including one or more of cellular RAN interface 405-1b, short range communication interface 405-2b, and/or wired communication interface 405-3b), image capture device 407b, and memory 409b.
At block 605 processor 503 may perform authentication as discussed above with respect to message/operation 303 of
At block 609, processor 503 may receive definition of a service limitation for second communication device 331 as discussed above with respect to message/operation 305 of
At block 610, processor 503 may check if a subscription associated with first communication device 333 allows setup for second communication device using service limitations of block 609 (e.g., based on the network access credential for first communication device 333). For example, processor 503 may check using transmission/reception to/from HSS/SPR 343 through communication interface 505. Responsive to determining that the subscription associated with first communication device 333 allows the requested setup, processor 503 may transmit a one-time-use access token AT through communication interface 505 to first communication device 333 at block 611, as discussed above with respect to message/operation 307 of
At operation 613, processor 503 may receive a request for authentication from second communication device 331 through communication interface 505 as discussed above with respect to message/operation 309 of
At operation 619, processor 503 may provide the network access credential (e.g., the vIMSI) for second communication device 331. For example, processor 503 may transmit the network access credential through communication interface 505 to second communication device 331 as discussed above with respect to operation 312. The network access credential may thus be transmitted to second communication device 331 in response to the request of block 603 from first communication device 333. At block 623, processor 503 may transmit an on-boarding notification through communication interface 505 to first communication device 333 as discussed above with respect to message/operation 313.
According to some other embodiments, processor 503 may transmit the network access credential through communication interface 505 to first communication device 333, and first communication device 333 may provide the network access credential to second communication device 331 (e.g., using operations similar to those discussed above with respect to block 611). In such embodiments, one or more operations of blocks 611, 613, 615, 617, and/or 623 may be omitted.
At block 625, processor 503 may provide (e.g., support) communication for the second communication device (331) in accordance with the service limitation(s) of block 609 using the network access credential for second communication device 331 as discussed above with respect to message/operation 315. Providing communication at block 625 may include supporting one or more separate communications (e.g., calls, sessions, etc.) between second communication device 331 and one or more other communication devices over any period of time.
After receiving the initial definition of the service limitation(s) at block 609 and after providing communication for the second communication device in accordance with the initial service limitation(s), processor 503 may receive definition of a subsequent service limitation(s) for second communication device at blocks 627 and 629, with the definition of the subsequent service limitation being received from first communication device 333 through network interface 505. Receiving the definition of the subsequent service limitation(s) may include operations similar to those discussed above with respect to blocks 603, 605, 607, and 609 (e.g., including receiving a request from first communication device 333, authenticating the request, transmitting request for parameters, and receiving the definition). After receiving the definition of the second service limitation, processor 503 may provide communication for second communication device 331 at block 625 in accordance with the subsequent service limitation(s) using the network access credential for second communication device 331.
In addition, operations of block 609 may further include receiving definition of a notification threshold(s) from first communication device 333 through communication interface 505. For a given service limitation, a notification threshold may define criteria relating to the service limitation for second communication device that triggers transmission of a notification to first communication device 333. For a geographical service limitation, a notification threshold may define that a notification is transmitted to first communication device 333: if second communication device crosses a boundary defined by the geographic service limitation; if second communication device attempts a communication outside a boundary defined by the geographic service limitation; etc. For a bit rate service limitation, a notification threshold may define that a notification is transmitted to first communication device 333: if second communication device 331 reaches/exceeds the bit rate service limitation; if second communication device 331 reaches/exceeds a threshold percentage of the bit rate service limitation; etc. For a service limitation that defines valid/invalid services, a notification threshold may define that a notification is transmitted to first communication device 333: if second communication device 331 attempts access to a prohibited service (e.g., a service not included in an allowed list of services, and/or a service included in a prohibited list of services). For a service limitation that defines valid/invalid times-of-use, a notification threshold may define that a notification is transmitted to first communication device 333: if second communication device attempts communication during a prohibited time (e.g., outside an allowed time of use, or during a prohibited time of use). Responsive to communication usage of second communication device 331 triggering a notification threshold relative to the service limitation at block 631, processor 503 may transmit a notification to first communication device 333 at block 633. Moreover, notification thresholds may be updated at blocks 627 and 629 responsive to further definition received from first communication device 333.
Communications between network node 335 and first and second communication devices 333/331, for example, may be provide through one or a combination of a radio access network RAN, a wide area network, the Internet, a local area network LAN, a wireless local area network WLAN, etc. Moreover, a last link to/from the first and/or second communications devices may include a radio air interface, for example, between the first and/or second communication device and a cellular radio access network or a WiFi network.
At block 705, processor 401 may transmit a request to the communication network through communication interface 405 (e.g., through cellular RAN communication interface 405-1) as discussed above with respect to message/operation 302 of
At block 707, processor 401 may receive a request for parameters for second communication device 331 from the communication network through communication interface 405 (e.g., through cellular RAN communication interface 405-1) as discussed above with respect to message/operation 304 of
At block 711, processor 401 may receive a one-time-use access token AT from the communication network through communication interface 405 (e.g., through cellular RAN communication interface) as discussed above with respect to message/operation 307 of
According to some other embodiments, processor 401 may receive a network access credential from the communication network through communication interface 405, and processor 401 may provide the network access credential to second communication device 331 (e.g., using operations similar to those discussed above with respect to blocks 711 and 713). In such embodiments, one or more operations of blocks 711, 713, and/or 715 may be omitted.
After receiving on-boarding notification of block 715, processor 401 may revise service limitations for second communication device at blocks 717 and 719. Responsive to user input through user interface 403, for example, processor 401 may transmit definition of a revised service limitation for second communication device 331 through communication interface 405 (e.g., using RAN interface 405-1) to the communication network at blocks 717 and 719 as discussed above with respect to blocks 627 and 629 of
In addition to service limitations, processor 401 may also transmit definition of a notification threshold(s) through communication interface 405 (e.g., using cellular RAN communication interface 405-1) to the communication network at block 709 as discussed above with respect to
As discussed above, communication device 333 may be adapted for operation in a communication network. With reference to
Communication device 333 may also include notification receiving module 805 for receiving a notification from the communication network wherein the notification indicates usage of second communication device 331 exceeding a notification threshold relative to the definition of the service limitation. Communication device 333 may further include definition transmitting module 807 for transmitting a definition of the notification threshold from first communication device 333 to the communication network before receiving the notification.
In addition, communication device 333 may include identification receiving module 809 for receiving the identification for second communication device 331 from second communication device 331 before transmitting the request, one-time-access token receiving module 811 for receiving a one-time-use access token from the communication network after transmitting the request, and a one-time-use access token providing module 813 for providing the one-time-use access token to second communications device 331.
As discussed above, network node 335 may be provided in a communication network. Network node 335 may include request receiving module 901 for receiving a request from first communication device 333, wherein the request is to associate second communication device 331, and wherein the request includes an identification for second communication device 331. Definition receiving module 903 is for receiving a definition of a service limitation for second communication device 331, wherein the definition of the service limitation is received from first communication device 333. Network access credential provisioning module 905 is for providing a network access credential for second communication device 331 in response to the request from first communication device 333. Communication module 907 is for providing communication for second communication device 331 in accordance with the definition of the service limitation using the network access credential.
In addition, network node 335 may include notification module 909 for transmitting a notification to first communication device 333 responsive to communication usage of second communication device 331 triggering a notification threshold relative to the definition of the service limitation. Moreover, network node 335 may include definition receiving module 911 for receiving a definition of the notification threshold from first communication device 333 before transmitting the notification.
In the above-description of various embodiments of present inventive concepts, it is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of present inventive concepts. Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which present inventive concepts belong. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of this specification and the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.
When an element is referred to as being “connected”, “coupled”, “responsive”, or variants thereof to another element, it can be directly connected, coupled, or responsive to the other element or intervening elements may be present. In contrast, when an element is referred to as being “directly connected”, “directly coupled”, “directly responsive”, or variants thereof to another element, there are no intervening elements present. Like numbers refer to like elements throughout. Furthermore, “coupled”, “connected”, “responsive”, or variants thereof as used herein may include wirelessly coupled, connected, or responsive. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. Well-known functions or constructions may not be described in detail for brevity and/or clarity. The term “and/or” includes any and all combinations of one or more of the associated listed items.
It will be understood that although the terms first, second, third, etc. may be used herein to describe various elements/operations, these elements/operations should not be limited by these terms. These terms are only used to distinguish one element/operation from another element/operation. Thus a first element/operation in some embodiments could be termed a second element/operation in other embodiments without departing from the teachings of present inventive concepts. The same reference numerals or the same reference designators denote the same or similar elements throughout the specification.
As used herein, the terms “comprise”, “comprising”, “comprises”, “include”, “including”, “includes”, “have”, “has”, “having”, or variants thereof are open-ended, and include one or more stated features, integers, elements, steps, components or functions but does not preclude the presence or addition of one or more other features, integers, elements, steps, components, functions or groups thereof. Furthermore, as used herein, the common abbreviation “e.g.”, which derives from the Latin phrase “exempli gratia,” may be used to introduce or specify a general example or examples of a previously mentioned item, and is not intended to be limiting of such item. The common abbreviation “i.e.”, which derives from the Latin phrase “id est,” may be used to specify a particular item from a more general recitation.
Example embodiments are described herein with reference to block diagrams and/or flowchart illustrations of computer-implemented methods, apparatus (systems and/or devices) and/or computer program products. It is understood that a block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by computer program instructions that are performed by one or more computer circuits. These computer program instructions may be provided to a processor circuit of a general purpose computer circuit, special purpose computer circuit, and/or other programmable data processing circuit to produce a machine, such that the instructions, which execute via the processor of the computer and/or other programmable data processing apparatus, transform and control transistors, values stored in memory locations, and other hardware components within such circuitry to implement the functions/acts specified in the block diagrams and/or flowchart block or blocks, and thereby create means (functionality) and/or structure for implementing the functions/acts specified in the block diagrams and/or flowchart block(s).
These computer program instructions may also be stored in a tangible computer-readable medium that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable medium produce an article of manufacture including instructions which implement the functions/acts specified in the block diagrams and/or flowchart block or blocks. Accordingly, embodiments of present inventive concepts may be embodied in hardware and/or in software (including firmware, resident software, micro-code, etc.) that runs on a processor such as a digital signal processor, which may collectively be referred to as “circuitry,” “a module” or variants thereof.
It should also be noted that in some alternate implementations, the functions/acts noted in the blocks may occur out of the order noted in the flowcharts. For example, two blocks shown in succession may in fact be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality/acts involved. Moreover, the functionality of a given block of the flowcharts and/or block diagrams may be separated into multiple blocks and/or the functionality of two or more blocks of the flowcharts and/or block diagrams may be at least partially integrated. Finally, other blocks may be added/inserted between the blocks that are illustrated, and/or blocks/operations may be omitted without departing from the scope of inventive concepts. Moreover, although some of the diagrams include arrows on communication paths to show a primary direction of communication, it is to be understood that communication may occur in the opposite direction to the depicted arrows.
Many variations and modifications can be made to the embodiments without substantially departing from the principles of the present inventive concepts. All such variations and modifications are intended to be included herein within the scope of present inventive concepts. Accordingly, the above disclosed subject matter is to be considered illustrative, and not restrictive, and the examples of embodiments are intended to cover all such modifications, enhancements, and other embodiments, which fall within the spirit and scope of present inventive concepts. Thus, to the maximum extent allowed by law, the scope of present inventive concepts are to be determined by the broadest permissible interpretation of the present disclosure including the following claims and their equivalents, and shall not be restricted or limited by the foregoing detailed description.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/SE2016/050185 | 3/9/2016 | WO | 00 |
