# US 12,010,107 B2 · Network security architecture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,107 B2 - Document ID: US12010107B2 - Status: Granted - Kind: B2 - Application number: 17/736,044 - Filed: 2022-05-03 - Published: 2022-08-18 - Granted: 2024-06-11 - Earliest claimed: 2015-07-12 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: Soo Bum Lee; Gavin Bernard Horn; Anand Palanigounder - Web page: https://patentgrep.com/patent/US12010107B2 ## CPC - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/10: Integrity - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In an aspect, a network supporting client devices includes one or more network nodes implementing network functions. Such network functions enable a client device to apply a security context to communications with the network when the client device is not in a connected mode. The client device obtains a user plane key shared with a user plane network function implemented at a first network node and/or a control plane key shared with a control plane network function implemented at a second network node. The client device protects a data packet with the user plane key or a control packet with the control plane key. The data packet includes first destination information indicating the first network node and the control packet includes second destination information indicating the second network node. The client device transmits the data packet or control packet. ## Claims ### Claim 1 A method for a network access node, comprising: receiving a first packet and an encrypted client device context from a client device; determining a next hop network node based on the first packet, without storing a security context for the client device based on the encrypted client device context; and forwarding the first packet and the encrypted client device context to the next hop network node without verifying the first packet received from the client device when a network attach mode of the client device is a reduced data transfer mode. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving a second packet from a network node; and forwarding the second packet received from the network node to the client device without protecting the second packet when the network attach mode of the client device is the reduced data transfer mode. ### Claim 3 (depends on 2) The method of claim 2, further comprising: identifying the client device from a temporary identifier in the second packet, wherein the second packet is a data packet. ### Claim 4 (depends on 3) The method of claim 3, further comprising: removing the temporary identifier from the second packet prior to forwarding the second packet. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving, from the client device, a request to attach to a network with an indication of the network attach mode, wherein the network attach mode is the reduced data transfer mode. ### Claim 6 (depends on 1) The method of claim 1, wherein the determination of the next hop network node is based on preconfigured information at the network access node or based on destination information included in the first packet, wherein the network attach mode is the reduced data transfer mode. ### Claim 7 (depends on 6) The method of claim 6, wherein the destination information includes a network function identifier that enables identification of a network node implementing a network function. ### Claim 8 (depends on 7) The method of claim 7, wherein the network function identifier is associated with a user plane network function implemented at a second network node. ### Claim 9 (depends on 1) The method of claim 1, further comprising: adding, to the first packet, a temporary identifier associated with the client device, wherein the first packet is a data packet; and storing the temporary identifier. ### Claim 10 (depends on 9) The method of claim 9, wherein the temporary identifier is a cell radio network temporary identifier (C-RNTI), and wherein the temporary identifier is stored for a predetermined period of time. ### Claim 11 A network access node, comprising: a communication circuit configured to communicate with one or more network entities; and a processing circuit coupled to the communication circuit, the processing circuit configured to: receive a first packet and an encrypted client device context from a client device; determine a next hop network node based on the first packet, without storing a security context for the client device based on the encrypted client device context; and forward the first packet and the encrypted client device context to the next hop network node without verifying the first packet received from the client device when a network attach mode of the client device is a reduced data transfer mode. ### Claim 12 (depends on 11) The network access node of claim 11, wherein the processing circuit is further configured to: receive a second packet from a network node; and forward the second packet received from the network node to the client device without protecting the second packet when the network attach mode of the client device is the reduced data transfer mode. ### Claim 13 (depends on 12) The network access node of claim 12, wherein the processing circuit is further configured to: identify the client device from a temporary identifier in the second packet, wherein the second packet is a data packet. ### Claim 14 (depends on 11) The network access node of claim 11, wherein the processing circuit is further configured to: receive, from the client device, a request to attach to a network with an indication of the network attach mode, wherein the network attach mode is the reduced data transfer mode. ### Claim 15 (depends on 11) The network access node of claim 11, wherein the processing circuit is further configured to: add, to the first packet, a temporary identifier associated with the client device, wherein the first packet is a data packet; and store the temporary identifier. ### Claim 16 A non-transitory processor-readable storage medium having instructions stored thereon, which when executed by at least one processing circuit causes the at least one processing circuit to: receive a first packet and an encrypted client device context from a client device; determine a next hop network node based on the first packet, without storing a security context for the client device based on the encrypted client device context; and forward the first packet and the encrypted client device context to the next hop network node without verifying the first packet received from the client device when a network attach mode of the client device is a reduced data transfer mode. ### Claim 17 (depends on 16) The non-transitory processor-readable storage medium of claim 16, wherein the instructions further cause the at least one processing circuit to: receive a second packet from a network node; and forward the second packet received from the network node to the client device without protecting the second packet when the network attach mode of the client device is the reduced data transfer mode. ### Claim 18 (depends on 16) The non-transitory processor-readable storage medium of claim 16, wherein the instructions further cause the at least one processing circuit to: receive, from the client device, a request to attach to a network with an indication of the network attach mode, wherein the network attach mode is the reduced data transfer mode. ### Claim 19 (depends on 16) The non-transitory processor-readable storage medium of claim 16, wherein the instructions further cause the at least one processing circuit to: add, to the first packet, a temporary identifier associated with the client device, wherein the first packet is a data packet; and store the temporary identifier. ### Claim 20 (depends on 19) The non-transitory processor-readable storage medium of claim 19, wherein the instructions further cause the at least one processing circuit to: identify the client device from a temporary identifier in the second packet, wherein the second packet is a data packet.