# US 11,310,664 B2 · Security protection to prevent unauthorized use of mobile network extenders > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,664 B2 - Document ID: US11310664B2 - Status: Granted - Kind: B2 - Application number: 16/884,604 - Filed: 2020-05-27 - Published: 2020-10-08 - Granted: 2022-04-19 - Earliest claimed: 2019-03-04 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Shivaji Pundlik Diwane; Hungjen Sean Yang; Sundara Paal Rani Thirumalaiappan; Keith Neil Mark Dsouza; Sendilvadivu Ganesan - Web page: https://patentgrep.com/patent/US11310664B2 ## CPC - H04W 12/08: Access security - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04W 12/069: using certificates or pre-shared keys - H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning - H04W 12/50: Secure pairing of devices - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In one illustrative example, a mobile network extender has a network interface configured to connect with a host router and a cellular modem configured to provide a wireless link for communications via a cellular mobile network. In a pairing process, the extender may establish a secure encrypted channel with the router via the network interface. In a locking process, the extender may receive information from the router and verify the information. Upon verification, the extender may be set in a locked state in which the extender is logically locked to the router. The extender may also receive and store a secret session key from the router, and permit the router to acquire the extender for communications. In the locked state, the extender may permit or deny subsequent router acquisition upon router reconnection based on verifying, using the secret session key, authentication data received via the network interface. ## Claims ### Claim 1 A method comprising: at a mobile network extender comprising a module which includes a network interface to connect with a host router of a private network and a cellular modem to provide a wireless link with a base station of a cellular mobile network to provide wide area network access for the private network via the host router, performing a verification procedure which includes receiving a security pass from the host router via the network interface, calculating a cross-reference security pass, and verifying the security pass with the cross-reference security pass; and based on a positive verification of the security pass with the cross-reference security pass, setting the mobile network extender in a locked state in which the mobile network extender is logically locked to the host router, and permitting the host router to acquire the mobile network extender to provide the wide area network access for the private network via the wireless link, wherein, in the locked state, permitting or denying subsequent router acquisition upon router reconnection with the mobile network extender is based on a result of again performing the verification procedure. ### Claim 2 (depends on 1) The method of claim 1 wherein, in the locked state, permitting or denying the subsequent router acquisition upon the router reconnection with the mobile network extender further comprises: permitting the subsequent router acquisition upon the router reconnection based on verifying a match between the security pass and the cross-reference security pass; and denying the subsequent router acquisition upon the router reconnection if the security pass fails to match the cross-reference security pass. ### Claim 3 (depends on 1) The method of claim 1, wherein the mobile network extender further comprises one or more subscriber identity module (SIM) interfaces, each SIM interface is configured to receive a SIM for use with the cellular modem, and the method further comprises: based on the positive verification of the security pass with the cross-reference security pass, locking the SIM attached to one of the one or more SIM interfaces. ### Claim 4 (depends on 3) The method of claim 3, wherein calculating the cross-reference security pass further comprises calculating the cross-reference security pass as a function of a device certificate of the host router, a security token associated with the mobile network extender, and a random number that is received from the host router. ### Claim 5 (depends on 4) The method of claim 4, further comprising: at the mobile network extender, sending to a cloud server one or more messages including extender information, the extender information including a device certificate of the mobile network extender and an International Mobile Equipment Identity (IMEI) of the mobile network extender; and receiving from the cloud server one or more messages indicating a response which includes the security token, the security token being calculated as a function of the device certificate of the mobile network extender and the IMEI of the mobile network extender. ### Claim 6 (depends on 4) The method of claim 4, further comprising: at the mobile network extender, receiving from a cloud server the device certificate of the host router which is registered with the cloud server. ### Claim 7 (depends on 6) The method of claim 6, further comprising: at the mobile network extender, receiving from the cloud server a Card Holder Verification 1 (CHV1) of the SIM for locking the SIM. ### Claim 8 (depends on 1) The method of claim 1, wherein the verification procedure further includes sending the cross-reference security pass to the host router via the network interface for verification at the host router. ### Claim 9 (depends on 1) The method of claim 1, further comprising: at the mobile network extender, in response to receiving, from the host router, one or more messages indicating a request for unlocking the mobile network extender from the host router, again performing the verification procedure which includes again receiving the security pass from the host router via the network interface, again calculating the cross-reference security pass, and again verifying the security pass with the cross-reference security pass; and based on another positive verification of the security pass with the cross-reference security pass, setting the mobile network extender from the locked state to an unlocked state in which the mobile network extender is logically unlocked from the host router. ### Claim 10 A mobile network extender comprising: a module including one or more processors, a network interface to connect with a host router of a private network, and a cellular modem with an antenna; the cellular modem with the antenna operative to provide a wireless link with a base station of a cellular mobile network to provide wide area network access for the private network via the host router; one or more Subscriber Identity Module (SIM) interfaces, each SIM interface being configured to receive a SIM for use with the cellular modem; the one or more processors being configured to: perform a verification procedure which includes receiving a security pass from the host router via the network interface, calculating a cross-reference security pass, and verifying the security pass with the cross-reference security pass; and based on a positive verification of the security pass with the cross-reference security pass, set the mobile network extender in a locked state in which the mobile network extender is logically locked to the host router, and permit the host router to acquire the mobile network extender to provide the wide area network access for the private network via the wireless link, wherein, in the locked state, permitting or denying subsequent router acquisition upon router reconnection with the mobile network extender is based on a result of again performing the verification procedure. ### Claim 11 (depends on 10) The mobile network extender of claim 10, wherein the one or more processors are further configured to: based on the positive verification of the security pass with the cross-reference security pass, lock the SIM attached to one of the one or more SIM interfaces. ### Claim 12 (depends on 11) The mobile network extender of claim 11, wherein the one or more processors are configured to calculate the cross-reference security pass by calculating the cross-reference security pass as a function of a device certificate of the host router, a security token associated with the mobile network extender, and a random number that is received from the host router. ### Claim 13 (depends on 12) The mobile network extender of claim 12, wherein the one or more processors are further configured to: send, to a cloud server via the cellular modem with the antenna, one or more messages including extender information, the extender information including a device certificate of the mobile network extender and an International Mobile Equipment Identity (IMEI) of the mobile network extender; and receive, from the cloud server via the cellular modem with the antenna, one or more messages indicating a response which includes the security token, the security token being calculated as a function of the device certificate of the mobile network extender and the IMEI of the mobile network extender. ### Claim 14 (depends on 13) The mobile network extender of claim 13, wherein the one or more processors are further configured to: receive, from the cloud server via the cellular modem with the antenna, the device certificate of the host router which is registered with the cloud server; and receive, from the cloud server via the cellular modem with the antenna, a Card Holder Verification 1 (CHV1) of the SIM for locking the SIM. ### Claim 15 A computer program product for a mobile network extender, comprising a module including one or more processors, a network interface to connect with a host router of a private network, and a cellular modem to provide a wireless link with a base station of a cellular mobile network to provide wide area network access for the private network via the host router, the computer program product comprising: a non-transitory computer readable medium; instructions stored in the non-transitory computer readable medium, the instructions being executable by the one or more processors of the mobile network extender for: performing a verification procedure which includes receiving a security pass from the host router via the network interface, calculating a cross-reference security pass, and verifying the security pass with the cross-reference security pass; and based on a positive verification of the security pass with the cross-reference security pass, setting the mobile network extender in a locked state in which the mobile network extender is logically locked to the host router, and permitting the host router to acquire the mobile network extender to provide the wide area network access for the private network via the wireless link, wherein, in the locked state, permitting or denying subsequent router acquisition upon router reconnection with the mobile network extender is based on a result of again performing the verification procedure. ### Claim 16 (depends on 15) The computer program product of claim 15 wherein the instructions are executable on the one or more processors of the mobile network extender for, in the locked state, permitting or denying the subsequent router acquisition upon the router reconnection with the mobile network extender by: permitting the subsequent router acquisition upon the router reconnection based on verifying a match between the security pass and the cross-reference security pass; and denying the subsequent router acquisition upon the router reconnection if the security pass fails to match the cross-reference security pass. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein the mobile network extender further comprises one or more subscriber identity module (SIM) interfaces, each SIM interface being configured to receive a SIM for use with the cellular modem, and wherein the instructions are executable on the one or more processors of the mobile network extender further for: based on the positive verification of the security pass with the cross-reference security pass, locking the SIM attached to one of the SIM interfaces. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein the instructions are executable on the one or more processors of the mobile network extender for calculating the cross-reference security pass by calculating the cross-reference security pass as a function of a device certificate of the host router, a security token associated with the mobile network extender, and a random number that is received from the host router. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein the instructions are executable on the one or more processors of the mobile network extender further for: sending to a cloud server one or more messages including extender information, the extender information including a device certificate of the mobile network extender and an International Mobile Equipment Identity (IMEI) of the mobile network extender; and receiving from the cloud server one or more messages indicating a response which includes the security token, the security token being calculated as a function of the device certificate of the mobile network extender and the IMEI of the mobile network extender. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the instructions are executable on the one or more processors of the mobile network extender further for: receiving from the cloud server the device certificate of the host router which is registered with the cloud server.