# US 10,321,503 B2 · Method and apparatus for attaching a remote unit to a mobile core network via a standalone untrusted non-3GPP access network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,321,503 B2 - Document ID: US10321503B2 - Status: Granted - Kind: B2 - Application number: 15/375,115 - Filed: 2016-12-11 - Published: 2018-06-14 - Granted: 2019-06-11 - Earliest claimed: 2016-12-11 - Assignees: Motorola Mobility LLC - Applicants: Motorola Mobility LLC - Inventors: Apostolis Salkintzis - Web page: https://patentgrep.com/patent/US10321503B2 ## CPC - H04W 12/08: Access security - H04W 8/22: Processing or transfer of terminal data, e.g. status or physical capabilities - H04W 40/22: using selective relaying for reaching a BTS [Base Transceiver Station] or an access point - H04W 76/11: Allocation or use of connection identifiers - H04W 76/14: Direct-mode setup - H04W 76/15: Setup of multiple wireless link connections - H04W 76/19: Connection re-establishment - H04W 76/10: Connection setup - H04W 88/085: {Access point devices with remote components} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method and apparatus attach a remote unit to a mobile core network via a standalone untrusted non-3GPP access network. A remote unit can be communicated with over a non-3GPP access network via a first network interface. A mobile core network can be communicated with via a second network interface and a third network interface. A secure connection request to establish a secure connection can be received via the first network interface. The secure connection with the remote unit can be established via the first network interface. Signaling data can be relayed between the secure connection and the second network interface when the secure connection request is associated with the first capability. A data connection can be established via the third network interface on behalf of the remote unit and user data can be relayed between the secure connection and the data connection when the secure connection request is associated with the second capability. ## Claims ### Claim 1 An apparatus comprising: a first network interface that communicates with a remote unit over a non-3GPP access network; a second network interface that communicates with a mobile core network; a third network interface that communicates with the mobile core network; a controller that: receives a secure connection request to establish a secure connection via the first network interface, determines whether the secure connection request is associated with a first capability or a second capability, establishes the secure connection with the remote unit via the first network interface, relays signaling data between the secure connection and the second network interface when the secure connection request is associated with the first capability, and establishes a data connection via the third network interface on behalf of the remote unit and relays user data between the secure connection and the data connection over the third network interface when the secure connection request is associated with the second capability, wherein the first capability supports non-access stratum communication and the second capability does not support non-access stratum communication. ### Claim 2 (depends on 1) The apparatus according to claim 1, wherein the controller establishes a data connection via the third network interface on behalf of the remote unit by requesting a protocol data unit session via the second network interface. ### Claim 3 (depends on 2) The apparatus according to claim 2, wherein the controller requests protocol data unit session by a sending a protocol data unit session setup request message via the second network interface, where the protocol data unit session setup request message includes an indication that indicates that default parameters should be used for the requested protocol data unit session. ### Claim 4 (depends on 2) The apparatus according to claim 2, wherein the controller receives a resource setup request via the second network interface in response to requesting the protocol data unit session, where the resource setup request triggers the controller to send a success message to the remote unit indicating that the secure connection is successfully established. ### Claim 5 (depends on 2) The apparatus according to claim 2, wherein the controller requests a protocol data unit session by sending a protocol data unit protocol data unit session request after the remote unit is successfully attached in the mobile core network. ### Claim 6 (depends on 1) The apparatus according to claim 1, wherein the controller receives an identity of the remote unit via the first network interface, where the identity of the remote unit has an identity format, and wherein the controller determines whether the secure connection request is associated with a first capability or a second capability based on the identity format. ### Claim 7 (depends on 6) The apparatus according to claim 6, wherein an identity format includes a suffix added to a username in the identity, where the suffix added to the username indicates the secure connection request is associated with the first capability. ### Claim 8 (depends on 7) The apparatus according to claim 7, wherein an omission of the suffix indicates the secure connection request is associated with the second capability. ### Claim 9 (depends on 1) The apparatus according to claim 1, wherein the controller receives a remote unit identity message via the first network interface, the remote unity identity message including an identity of the remote unit, and wherein the controller determines whether the secure connection request is associated with a first capability or a second capability based on the presence of a capability information element in the remote unit identity message. ### Claim 10 (depends on 1) The apparatus according to claim 1, wherein the non-3GPP access network is a wireless local area network containing at least one wireless local area network access point. ### Claim 11 (depends on 1) The apparatus according to claim 1, wherein second network interface exchanges control plane data with the mobile core network, and wherein the third network interface exchanges user plane data with the mobile core network. ### Claim 12 (depends on 1) The apparatus according to claim 1, wherein the secure connection is only used to transfer signaling data when the secure connection is associated with the first capability. ### Claim 13 (depends on 1) The apparatus according to claim 1, wherein the secure connection is only used to transfer user data when the secure connection is associated with the second capability. ### Claim 14 A method comprising: communicating with a remote unit over a non-3GPP access network via a first network interface; communicating with a mobile core network via a second network interface; communicating with the mobile core network via a third network interface; receiving a secure connection request to establish a secure connection via the first network interface; determining whether the secure connection request is associated with a first capability or a second capability; establishing the secure connection with the remote unit via the first network interface; relaying signaling data between the secure connection and the second network interface if the secure connection request is associated with the first capability; and establishing a data connection via the third network interface on behalf of the remote unit and relaying user data between the secure connection and the data connection if the secure connection request is associated with the second capability, wherein the first capability supports non-access stratum communication and the second capability does not support non-access stratum communication. ### Claim 15 (depends on 14) The method according to claim 14, wherein establishing a data connection comprises requesting a protocol data unit session via the second network interface. ### Claim 16 (depends on 15) The method according to claim 15, wherein establishing a data connection comprises receiving a resource setup request via the second network interface in response to requesting the protocol data unit session, where the resource setup request triggers the sending of send a success message to the remote unit indicating that the secure connection is successfully established. ### Claim 17 (depends on 15) The method according to claim 15, wherein the protocol data unit session is requested by sending a protocol data unit protocol data unit session request after the remote unit is successfully attached in the mobile core network. ### Claim 18 (depends on 14) The method according to claim 14, further comprising receiving an identity of the remote unit via the first network interface, where the identity of the remote unit has an identity format, wherein determining comprises determining whether the secure connection request is associated with a first capability or a second capability based on the identity format. ### Claim 19 (depends on 14) The method according to claim 14, further comprising receiving a remote unit identity message via the first network interface, the remote unity identity message including an identity of the remote unit, wherein determining comprises determining whether the secure connection request is associated with a first capability or a second capability based on the presence of a capability information element in the remote unit identity message.