# US 11,444,980 B2 · On-demand wireless device centric security for a 5G wireless network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,980 B2 - Document ID: US11444980B2 - Status: Granted - Kind: B2 - Application number: 16/849,098 - Filed: 2020-04-15 - Published: 2021-10-21 - Granted: 2022-09-13 - Earliest claimed: 2020-04-15 - Assignees: T-Mobile USA, Inc. - Applicants: T-Mobile USA, Inc. - Inventors: Venson Shaw; Sunil Lingayat; Gaviphat Lekutai - Web page: https://patentgrep.com/patent/US11444980B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/102: {Entity profiles} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04W 4/02: Services making use of location information - H04W 4/44: for communication between vehicles and infrastructures, e.g. vehicle-to-cloud [V2C] or vehicle-to-home [V2H] - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 12/08: Access security - H04W 12/12: Detection or prevention of fraud - H04W 12/63: Location-dependent; Proximity-dependent - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The disclosed embodiments include a method performed by a wireless network to mitigate a security risk arising from an application-layer transaction and contextual scenario of a wireless device (WD). A security resource can be maintained inactive by default and configured for on-demand activation in response to a security risk associated with the WD. The method can include monitoring the WD for application-layer transactions and contextual scenarios, and detecting a security risk relative to a particular type of a application-layer transaction and a contextual scenario of the WD. In response to detecting the security risk, the security resource is activated to support the application-layer transaction while safeguarding the entire wireless network. In response to detecting a change to the application-layer transaction or the particular contextual scenario, the security resource for the WD can be deactivated. ## Claims ### Claim 1 A method performed by a wireless network to mitigate a security risk arising from an application-layer transaction and associated contextual scenario of a wireless device (WD) at an endpoint of the wireless network, the method comprising: maintaining a security resource of the wireless network and a profile of the WD, wherein the security resource is inactive by default and configured for on-demand activation in response to the security risk associated with the WD while on the wireless network; monitoring the WD for application-layer transactions and associated contextual scenarios while on the wireless network; detecting a security risk relative to a particular type of a particular application-layer transaction and a particular contextual scenario of the WD, wherein the particular contextual scenario is based on a location of the WD while the particular application-layer transaction is ongoing and the profile of the WD; in response to detecting the security risk, activating the security resource to support the particular application-layer transaction while safeguarding the wireless network; detecting a change to the particular application-layer transaction or the particular contextual scenario; and in response to detecting the change to the particular application-layer transaction or the particular contextual scenario, deactivating the security resource for the WD, and in response to detecting the change to the particular contextual scenario, activating a nominal resource to support the particular application-layer transaction. ### Claim 2 (depends on 1) The method of claim 1, wherein detecting the change to the particular application-layer transaction or the particular contextual scenario comprises: detecting the change to the particular contextual scenario as a change in the location of the WD while the particular application-layer transaction is ongoing; and activating the nominal resource to support the particular application-layer transaction on the wireless network. ### Claim 3 (depends on 1) The method of claim 1, wherein detecting the change to the particular application-layer transaction or the particular contextual scenario comprises: detecting completion of the particular application-layer transaction; and activating the nominal resource to support subsequent application-layer transactions. ### Claim 4 (depends on 1) The method of claim 1, wherein the particular contextual scenario includes a combination of a time associated with the particular application-layer transaction, the location of the WD, and a user indicated in the profile of the WD. ### Claim 5 (depends on 1) The method of claim 1, wherein the particular application-layer transaction is WD-originated to transmit data over the wireless network. ### Claim 6 (depends on 1) The method of claim 1, wherein the particular application-layer transaction is WD-terminated to receive data over the wireless network. ### Claim 7 (depends on 1) The method of claim 1, wherein detecting the security risk comprises: determining that the particular type of the particular application-layer transaction exposes sensitive user information. ### Claim 8 (depends on 1) The method of claim 1, wherein activating the security resource comprises: provisioning an application security policy for a network access node, wherein the network access node serves the WD for the particular application-layer transaction. ### Claim 9 (depends on 1) The method of claim 1, wherein the security resource comprises an encryption mechanism to secure transmission of data for the particular application-layer transaction. ### Claim 10 (depends on 1) The method of claim 1, wherein the profile includes an indication of an identity of a user of the WD, and the particular contextual scenario indicates, based on the identity of the user, that the particular application-layer transaction requires safeguarding. ### Claim 11 (depends on 1) The method of claim 1, wherein the WD comprises a wireless user equipment (UE) and the wireless network comprises a 5G wireless network. ### Claim 12 (depends on 1) The method of claim 1, wherein the wireless network comprises a public cloud network, a private cloud network, or a hybrid cloud network. ### Claim 13 (depends on 1) The method of claim 1, wherein the WD comprising any of: an Internet-of-Things (IOT) wireless device; a vehicle-to-everything (V2X) wireless device; a machine-to-machine (M2M) wireless device; or a machine-to-everything (M2X) wireless device. ### Claim 14 (depends on 1) The method of claim 1, wherein monitoring the WD comprises: periodically monitoring the WD on the wireless network while the WD is in a first contextual scenario and continuously monitoring the WD while the WD is in a second contextual scenario. ### Claim 15 (depends on 1) The method of claim 1, wherein detecting the security risk comprises: detecting the security risk relative to criteria including a pre-selected location, a pre-selected time range, and a classification of a user operating the WD. ### Claim 16 (depends on 1) The method of claim 1, wherein the particular contextual scenario is indicative of a location of a festival, a concert, or a sporting event including the WD. ### Claim 17 (depends on 1) The method of claim 1, wherein the security resource is deployable to any of multiple WDs on the wireless network when a security risk arises for any of the multiple WDs. ### Claim 18 A network access node of a 5G wireless network, the network access node comprising: a processor; and memory containing instructions that, when executed by the processor, cause the network access node to: maintain multiple security resources and multiple nominal resources for the 5G wireless network, wherein the multiple security resources and the multiple nominal resources are deployable on-demand based on contextual scenarios of wireless user equipment (UEs) on the 5G wireless network; monitor UE-originated and UE-terminated application-layer transactions of multiple wireless UEs on the 5G wireless network, wherein the UE-originated and the UE-terminated application-layer transactions are for different application-layer transaction types and are monitored for contextual scenarios associated with the multiple wireless UEs on the 5G wireless network; detect a relative security risk to the 5G wireless network based on a particular contextual scenario of a particular wireless UE, wherein the particular contextual scenario is based on a location of the particular wireless UE and is associated with a particular application-layer transaction on the 5G wireless network; upon detecting an increase in the relative security risk, trigger deployment of a security resource of the multiple security resources to support the particular application-layer transaction associated with the particular wireless UE while safeguarding the 5G wireless network; and upon detecting a decrease in the relative security risk, trigger deployment of a nominal resource of the multiple nominal resources to continue support of the particular application-layer transaction associated with the particular wireless UE. ### Claim 19 (depends on 18) The network node of claim 18, wherein the network access node is a next generation NodeB (gNB) that handles radio communications with the wireless UE by using a 5G new radio (NR) interface and connects to a core network of the 5G wireless network. ### Claim 20 A non-transitory computer-readable medium with instructions stored thereon that, when executed by a system, cause the system to perform operations comprising: monitoring application-layer communications and associated contextual scenarios of a wireless device (WD) on a wireless network; detecting a security risk based on a particular application-layer communication that occurs while the WD is in a particular contextual scenario, wherein the particular contextual scenario includes a location of the WD, a time when the particular application-layer communication occurs, and an identity of a user engaging in the particular application-layer communication; in response to detecting the security risk, activating a security resource to support the particular application-layer communication to safeguard the wireless network while the WD is in the particular contextual scenario; detecting a change in the particular contextual scenario as a change in the location of the WD while the application-layer communication is ongoing, wherein the change in the contextual scenario is associated with a reduction in the security risk; and in response to detecting the reduction in the security risk, activating a nominal resource to replace the security resource and support the particular application-layer communication on the wireless network.