# US 11,909,724 B2 · Application and network slice security profile mapping for secure tunneling > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,724 B2 - Document ID: US11909724B2 - Status: Granted - Kind: B2 - Application number: 17/736,359 - Filed: 2022-05-04 - Published: 2022-08-18 - Granted: 2024-02-20 - Earliest claimed: 2020-06-04 - Assignees: Verizon Patent and Licensing Inc. - Applicants: Verizon Patent and Licensing Inc. - Inventors: Amir Saghir; Said Hanbaly; Mun Wei Low; Nimalan Kanagasabai - Web page: https://patentgrep.com/patent/US11909724B2 ## CPC - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys} - H04L 9/302: {involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04W 12/033: of the user plane, e.g. user's traffic - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04W 12/069: using certificates or pre-shared keys - H04W 12/71: Hardware identity - H04W 76/12: Setup of transport tunnels - H04L 2209/80: Wireless - H04W 88/16: Gateway arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A network node residing in a mobile network identifies a first network slice of the mobile network for use by a first session between a first user equipment device (UE) and a first application hosted by a first hosting device. The network node obtains a first security profile based on an identity of the first application and based on the identified first network slice, and establishes, using the obtained first security profile, a first secure tunnel between the network node and the first hosting device for transporting first data units associated with the first session between the network node and the first hosting device. ## Claims ### Claim 1 A method, comprising: identifying, by a network node residing in a mobile network, a first network slice of the mobile network for use by a first session between a first user equipment device (UE) and a first application hosted by a first hosting device; obtaining, by the network node, a first security profile based on an identity of the first application and based on the identified first network slice; and establishing, by the network node using the obtained first security profile, a first secure tunnel between the network node and the first hosting device for transporting first data units associated with the first session between the network node and the first hosting device. ### Claim 2 (depends on 1) The method of claim 1, further comprising: identifying, by the network node, a second network slice of the mobile network for use by a second session between a second UE and a second application hosted by a second hosting device; obtaining, by the network node, a second security profile based on an identity of the second application and based on the identified second network slice; and establishing, by the network node using the obtained second security profile, a second secure tunnel between the network node and the second hosting device for transporting second data units associated with the second session between the network node and the second hosting device. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving from the first UE, by the network node, a first session request for the first session between the first UE and the first application hosted by the first hosting device, wherein the first session request includes a first application identifier (ID) that indicates the identity of the first application. ### Claim 4 (depends on 1) The method of claim 1, further comprising: transporting, by the network node, the first data units associated with the first session between the network node and the first hosting device via the first secure tunnel. ### Claim 5 (depends on 1) The method of claim 1, wherein the first security profile includes at least one key and wherein establishing the first secure tunnel between the network node and the first hosting device further comprises: encrypting a first portion of the first data units associated with the first session and received from the first UE, using the at least one key, for forwarding the encrypted first portion of the first data units via the first secure tunnel to the first hosting device; and decrypting a second portion of the first data units associated with the requested first session and received from the first hosting device via the first secure tunnel, using the at least one key, for forwarding to the first UE. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving, by the network node from a configuration device, the first security profile, wherein the first security profile is configured by a network operator associated with the mobile network; an owner, operator, or administrator associated with the first hosting device; or an owner, operator, or administrator associated with the first UE; and storing, by the mobile network node, the first security profile in memory. ### Claim 7 (depends on 1) The method of claim 1, wherein the security profile includes a digital certificate or at least one key, a user selected security level, an application identifier (ID) that indicates the identity of the first application, and an ID associated with the first UE. ### Claim 8 (depends on 7) The method of claim 7, wherein the user selected security level indicates a level of security to be applied to the first secure tunnel. ### Claim 9 (depends on 7) The method of claim 7, wherein the user selected security level indicates one of a low, a medium, or a high level of security to be applied to the first secure tunnel. ### Claim 10 (depends on 9) The method of claim 9, wherein the low level of security comprises using one of Advanced Encryption Standard (AES) 126 or Message Digest algorithm 5 (MD5) to establish the first secure tunnel, wherein the medium level of security comprises using one of Rivest-Shamir-Adleman (RSA)-1024, Advanced Encryption Standard (AES) 512, or Secure Hash Algorithm (SHA)-1 to establish the first secure tunnel, and wherein the high level of security comprises using Elliptic-Curve Cryptography (ECC)-P256, Rivest-Shamir-Adleman (RSA)-2048, or Secure Hash Algorithm (SHA)-256 to establish the first secure tunnel. ### Claim 11 A network device residing in a mobile network, comprising: a memory configured to store a plurality of security profiles; and one or more processors, or logic, configured to: identify a first network slice of the mobile network for use by a first session between a first user equipment device (UE) and a first application hosted by a first hosting device, obtain a first security profile, from the plurality of security profiles stored in the memory, based on an identity of the first application and based on the identified first network slice, and establish, using the obtained first security profile, a first secure tunnel between the network device and the first hosting device for transporting first data units associated with the first session between the network device and the first hosting device. ### Claim 12 (depends on 11) The network device of claim 11, wherein the one or more processors, or logic, is further configured to: identify a second network slice of the mobile network for use by a second session between a second UE and a second application hosted by a second hosting device, obtain, from the plurality of security profiles stored in the memory, a second security profile based on an identity of the second application and based on the identified second network slice; and establish, using the obtained second security profile, a second secure tunnel between the network device and the second hosting device for transporting second data units associated with the second session between the network device and the second hosting device. ### Claim 13 (depends on 11) The network device of claim 11, further comprising: a communication interface configured to receive from the first UE a first session request for the first session between the first UE and the first application hosted by the first hosting device, wherein the first session request includes a first application identifier (ID) that indicates the identity of the first application. ### Claim 14 (depends on 11) The network device of claim 11, wherein the one or more processors, or logic, is further configured to: transport the first data units associated with the requested first session between the network device and the first hosting device via the first secure tunnel. ### Claim 15 (depends on 11) The network device of claim 11, wherein the first security profile includes at least one key and wherein, when establishing the first secure tunnel between the network device and the first hosting device, the one or more processors, or logic, is further configured to: encrypt a first portion of the first data units associated with the first session and received from the first UE, using the at least one key, for forwarding the encrypted first portion of the first data units via the first secure tunnel to the first hosting device; and decrypt a second portion of the first data units associated with the requested first session and received from the first hosting device via the first secure tunnel, using the at least one key, for forwarding to the first UE. ### Claim 16 (depends on 11) The network device of claim 11, wherein the security profile includes a digital certificate or at least one key, a user selected security level, an application identifier (ID) that indicates the identity of the first application, and an ID associated with the first UE. ### Claim 17 (depends on 16) The network device of claim 16, wherein the user selected security level indicates one of a low, a medium, or a high level of security to be applied to the secure tunnel. ### Claim 18 (depends on 17) The network device of claim 17, wherein the low level of security comprises using one of Advanced Encryption Standard (AES) 126 or Message Digest algorithm 5 (MD5) to establish the first secure tunnel, wherein the medium level of security comprises using one of Rivest-Shamir-Adleman (RSA)-1024, Advanced Encryption Standard (AES) 512, or Secure Hash Algorithm (SHA)-1 to establish the first secure tunnel, and wherein the high level of security comprises using Elliptic-Curve Cryptography (ECC)-P256, Rivest-Shamir-Adleman (RSA)-2048, or Secure Hash Algorithm (SHA)-256 to establish the first secure tunnel. ### Claim 19 A non-transitory storage medium storing instructions executable by a network device, residing in a mobile network, with one or more processors, wherein execution of the instructions causes the network device to: identify a first network slice of the mobile network for use by a first session between a first user equipment device (UE) and a first application hosted by a first hosting device; obtain a first security profile based on an identity of the first application and based on the identified first network slice; and establish, using the obtained first security profile, a first secure tunnel between the network device and the first hosting device for transporting first data units associated with the first session between the network device and the first hosting device. ### Claim 20 (depends on 19) The non-transitory storage medium of claim 19, wherein the security profile includes a digital certificate or at least one key, a user selected security level, an application identifier (ID) that indicates the identity of the first application, and an ID associated with the first UE, and wherein the user selected security level indicates one of multiple levels of security to be applied to the first secure tunnel.