# US 12,603,791 B2 · Systems and methods for providing priority for user equipment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,603,791 B2
- Document ID: US12603791B2
- Status: Granted
- Kind: B2
- Application number: 18/886,003
- Filed: 2024-09-16
- Published: 2026-03-19
- Granted: 2026-04-14
- Earliest claimed: 2024-09-16
- Assignees: Verizon Patent and Licensing Inc.
- Applicants: Verizon Patent and Licensing Inc.
- Inventors: Toby Varughese John; Bibi M. Hakimzadeh; Lixia Yan; Chien-Yuan Huang
- Web page: https://patentgrep.com/patent/US12603791B2

## CPC

- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04W 12/0471: Key exchange
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A network device may receive a first private certificate and a second private certificate, and may provision the network device with the first private certificate and the second private certificate. The network device may receive, from a first UE, an IKE SA INIT request with a first payload that includes a priority indicator, and may decrypt the encrypted first IKE SA INIT request with the first private certificate. The network device may receive, from a second UE, an encrypted second IKE SA INIT request with a second payload that does not include the priority indicator, and may decrypt the encrypted second IKE SA INIT request with the second private certificate. The network device may detect congestion, and may prioritize traffic from the first UE over traffic from the second UE based on the congestion and based on the priority indicator.

## Claims

### Claim 1

A method, comprising:
receiving, by a network device, a first private certificate associated with a first user equipment (UE) and a second private certificate associated with a second UE;
provisioning, by the network device, the network device with the first private certificate and the second private certificate;
receiving, by the network device and from the first UE, an encrypted first Internet key exchange (IKE) security association (SA) initialization (INIT) request with a first payload that includes a priority indicator;
decrypting, by the network device, the encrypted first IKE SA INIT request with the first private certificate;
receiving, by the network device and from the second UE, an encrypted second IKE SA INIT request with a second payload that does not include the priority indicator;
decrypting, by the network device, the encrypted second IKE SA INIT request with the second private certificate;
detecting, by the network device, congestion associated with the network device; and
prioritizing, by the network device, traffic from the first UE over traffic from the second UE based on the congestion and based on the priority indicator being in the first IKE SA INIT request and not in the second IKE SA INIT request.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
providing a first IKE SA INIT response with the priority indicator and first security options to the first UE; and
providing a second IKE SA INIT response with second security options to the second UE.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
receiving a first priority of the first UE and a second priority of the second UE; and
storing the first priority and the second priority in a data structure.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
receiving, from the first UE, an encrypted third IKE SA INIT request;
decrypting the encrypted third IKE SA INIT request with the first private certificate;
receiving, from the second UE, an encrypted fourth IKE SA INIT request;
decrypting the encrypted fourth IKE SA INIT request with the second private certificate; and
prioritizing the traffic from the first UE over the traffic from the second UE based on the congestion and based on the first priority being higher than the second priority.

### Claim 5 (depends on 4)

The method of claim 4, further comprising:
providing a first IKE SA INIT response with first security options to the first UE; and
providing a second IKE SA INIT response with second security options to the second UE.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
receiving, from the first UE, an encrypted third IKE SA INIT request with a first flag set to a first priority;
decrypting the encrypted third IKE SA INIT request with the first private certificate;
receiving, from the second UE, an encrypted fourth IKE SA INIT request with a second flag set to a second priority;
decrypting the encrypted fourth IKE SA INIT request with the second private certificate; and
prioritizing the traffic from the first UE over the traffic from the second UE based on the first priority being higher than the second priority.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
providing, to the first UE, a first IKE SA INIT response with first security options and the first flag set to the first priority; and
providing, to the second UE, a second IKE SA INIT response with second security options and the second flag set to the second priority.

### Claim 8

A network device, comprising: memory; and
one or more processors configured to:
receive a first private certificate associated with a first user equipment (UE) and a second private certificate associated with a second UE;
provision the network device with the first private certificate and the second private certificate;
receive, from the first UE, an encrypted first Internet key exchange (IKE) security association (SA) initialization (INIT) request with a first payload that includes a priority indicator;
decrypt the encrypted first IKE SA INIT request with the first private certificate;
receive, from the second UE, an encrypted second IKE SA INIT request with a second payload that does not include the priority indicator;
decrypt the encrypted second IKE SA INIT request with the second private certificate;
detect congestion associated with the network device;
prioritize traffic from the first UE over traffic from the second UE based on the congestion and based on the priority indicator being in the first IKE SA INIT request and not in the second IKE SA INIT request;
provide a first IKE SA INIT response with the priority indicator and first security options to the first UE; and
provide a second IKE SA INIT response with second security options to the second UE.

### Claim 9 (depends on 8)

The network device of claim 8, wherein the network device communicates with the first UE and the second UE via a non-Third-Generation-Partnership-Project access network.

### Claim 10 (depends on 8)

The network device of claim 8, wherein the network device is one of an evolved packet data gateway or a non-Third-Generation-Partnership-Project interworking function.

### Claim 11 (depends on 8)

The network device of claim 8, wherein the priority indicator is associated with a critical service provided to the first UE but not to the second UE.

### Claim 12 (depends on 11)

The network device of claim 11, wherein the critical service includes one of a mission critical service, a mission priority service, or an emergency service.

### Claim 13 (depends on 8)

The network device of claim 8, wherein the network device receives the first private certificate and the second private certificate from a provisioning system.

### Claim 14 (depends on 8)

The network device of claim 8, wherein the one or more processors are further configured to:
prioritize the traffic from the first UE over traffic from one or more other UEs based on the congestion and based on the priority indicator.

### Claim 15

A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a network device, cause the network device to:
receive, from a provisioning system, a first private certificate associated with a first user equipment (UE) and a second private certificate associated with a second UE;
provision the network device with the first private certificate and the second private certificate;
receive, from the first UE, an encrypted first Internet key exchange (IKE) security association (SA) initialization (INIT) request with a first payload that includes a priority indicator;
decrypt the encrypted first IKE SA INIT request with the first private certificate;
receive, from the second UE, an encrypted second IKE SA INIT request with a second payload that does not include the priority indicator;
decrypt the encrypted second IKE SA INIT request with the second private certificate;
detect congestion associated with the network device; and
prioritize traffic from the first UE over traffic from the second UE based on the congestion and based on the priority indicator being in the first IKE SA INIT request and not in the second IKE SA INIT request.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more instructions further cause the network device to:
provide a first IKE SA INIT response with the priority indicator and first security options to the first UE; and
provide a second IKE SA INIT response with second security options to the second UE.

### Claim 17 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more instructions further cause the network device to:
receive a first priority of the first UE and a second priority of the second UE; and
store the first priority and the second priority in a data structure.

### Claim 18 (depends on 17)

The non-transitory computer-readable medium of claim 17, wherein the one or more instructions further cause the network device to:
receive, from the first UE, an encrypted third IKE SA INIT request;
decrypt the encrypted third IKE SA INIT request with the first private certificate;
receive, from the second UE, an encrypted fourth IKE SA INIT request;
decrypt the encrypted fourth IKE SA INIT request with the second private certificate; and
prioritize the traffic from the first UE over the traffic from the second UE based on the congestion and based on the first priority being higher than the second priority.

### Claim 19 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more instructions further cause the network device to:
receive, from the first UE, an encrypted third IKE SA INIT request with a first flag set to a first priority;
decrypt the encrypted third IKE SA INIT request with the first private certificate;
receive, from the second UE, an encrypted fourth IKE SA INIT request with a second flag set to a second priority;
decrypt the encrypted fourth IKE SA INIT request with the second private certificate; and
prioritize the traffic from the first UE over the traffic from the second UE based on the first priority being higher than the second priority.

### Claim 20 (depends on 19)

The non-transitory computer-readable medium of claim 19, wherein the one or more instructions further cause the network device to:
provide, to the first UE, a first IKE SA INIT response with first security options and the first flag set to the first priority; and
provide, to the second UE, a second IKE SA INIT response with second security options and the second flag set to the second priority.