# US 10,320,755 B2 · Method and apparatus for data connectivity sharing

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,755 B2
- Document ID: US10320755B2
- Status: Granted
- Kind: B2
- Application number: 15/102,047
- Filed: 2013-12-09
- Published: 2016-10-20
- Granted: 2019-06-11
- Earliest claimed: 2013-12-09
- Assignees: Telefonaktiebolaget LM Ericsson (publ)
- Applicants: Telefonaktiebolaget LM Ericsson (publ)
- Inventors: Joel Cassel
- Web page: https://patentgrep.com/patent/US10320755B2

## CPC

- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 30/00: Commerce
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 12/1457: {using an account}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/04: specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
- H04L 67/125: involving control of end-device applications over a network
- H04L 67/562: Brokering proxy services
- H04W 4/24: Accounting or billing
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 12/08: Access security
- H04W 40/248: {Connectivity information update}
- H04W 76/11: Allocation or use of connection identifiers
- H04W 76/12: Setup of transport tunnels
- H04L 2209/64: Self-signed certificates
- H04W 12/43: using shared identity modules, e.g. SIM sharing
- H04W 12/72: Subscriber identity
- H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks
- H04W 88/06: adapted for operation in multiple networks {or having at least two operational modes}, e.g. multi-mode terminals
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A node enables sharing data connectivity between a consumer device and a broker device, and receives from a first packet routing node a request for a consumer authorization certificate. The request includes a subscriber identity. Based on the subscriber identity authorizing the subscriber for sharing data connectivity; a consumer authorization certificate is generated using a private encryption key associated with the node. The consumer authorization certificate includes the subscriber identity of the subscriber. The consumer authorization certificate is returned to the first packet routing node. A request for a data connectivity service for the subscriber is received from a second packet routing node. The request includes a consumer agreement certificate and a broker identity. The consumer agreement certificate is signed using a private key associated with the subscriber and includes the subscriber identity. The consumer agreement certificate is valued. A confirmation message is sent to the second packet routing node.

## Claims

### Claim 1

A method performed by a node, for enabling sharing data connectivity between a consumer device and a broker device, the method comprising the node performing the steps of:
receiving from a first packet routing node a request transmitted from the consumer device for a consumer authorization certificate, the request including a subscriber identity of a subscriber associated with the consumer device;
authorizing, based on the subscriber identity, the subscriber for sharing data connectivity with the broker device providing a data connectivity service for connecting the consumer device to an access network through the broker device by:
determining if the subscriber has funds to cover a cost of the data connectivity service; and
responsive to the subscriber having funds to cover the cost of the data connectivity service, authorizing the subscriber for the data connectivity service;
responsive to authorizing the subscriber, generating a consumer authorization certificate using a private encryption key associated with the node, said consumer authorization certificate including the subscriber identity of the subscriber;
returning the consumer authorization certificate towards the consumer device using the first packet routing node;
receiving a request for a data connectivity service for the subscriber from a second packet routing node, the request comprising a consumer agreement certificate and a broker identity for the data connectivity service provided by the broker device, said consumer agreement certificate signed using a private key associated with the subscriber and including the subscriber identity;
validating the consumer agreement certificate; and
responsive to validating the consumer agreement, sending a confirmation message towards the broker device using the second packet routing node.

### Claim 2 (depends on 1)

The method according to claim 1 further comprising charging an account associated with the subscriber identity and crediting an account associated with the broker identity for the data connectivity service.

### Claim 3 (depends on 1)

The method according to claim 1 wherein first packet routing node is a GPRS Support Node and second packet routing node is an EPC gateway.

### Claim 4 (depends on 1)

The method according to claim 1 wherein the step of authorizing further comprises determining a policy restriction.

### Claim 5

A node, for enabling sharing data connectivity between a consumer device and a broker device, comprising a processor and a memory, said memory containing instructions executable by said processor whereby said node is operative to:
receive from a first packet routing node a request transmitted from the consumer device for a consumer authorization certificate, the request including a subscriber identity of a subscriber associated with the consumer device;
authorize, based on the subscriber identity, the subscriber for sharing data connectivity with the broker device providing a data connectivity service for connecting the consumer device to an access network through the broker device by:
determining if the subscriber has funds to cover a cost of the data connectivity service; and
responsive to the subscriber having funds to cover the cost of the data connectivity service, authorizing the subscriber for the data connectivity service;
responsive to authorizing the subscriber, generate a consumer authorization certificate using a private encryption key associated with the node, said consumer authorization certificate including the subscriber identity of the subscriber;
return the consumer authorization certificate towards the consumer device using the first packet routing node;
receive a request for a data connectivity service for the subscriber from a second packet routing node, the request comprising a consumer agreement certificate and a broker identity for the data connectivity service provided by a broker associated with the broker device, said consumer agreement certificate signed using a private key associated with the subscriber and including the subscriber identity;
validate the consumer agreement certificate; and
responsive to validating the consumer agreement certificate, send a confirmation message towards the broker device using the second packet routing node.

### Claim 6 (depends on 5)

The node according to claim 5 further comprising charging an account associated with the subscriber identity and crediting an account associated with the broker identity for the data connectivity service.

### Claim 7 (depends on 5)

The node according to claim 5 wherein first packet routing node is GPRS Support Node and second packet routing node is and EPC gateway.

### Claim 8 (depends on 6)

The node according to claim 6 wherein the node is further adapted to determine a policy restriction.