# US 2013/0157618 A1 · Key storage and retrieval in a breakout component at the edge of a mobile data network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2013/0157618 A1
- Document ID: US20130157618A1
- Status: Published application
- Kind: A1
- Application number: 13/681,358
- Filed: 2012-11-19
- Published: 2013-06-20
- Earliest claimed: 2011-12-19
- Assignees: International Business Machines Corporation
- Inventors: Ronald L. Billau; Vincenzo V. Di Luoffo; Philip E. Grady; George W. Van Leeuwen
- Web page: https://patentgrep.com/patent/US20130157618A1

## CPC

- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
- H04W 40/02: Communication route or path selection, e.g. power-based or shortest path routing
- H04W 40/32: for defining a routing cluster membership
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04W 12/65: Environment-dependent, e.g. using captured environmental data
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Mobile network services are performed in a mobile data network in a way that is transparent to most of the existing equipment in the mobile data network. The mobile data network includes a radio access network and a core network. A breakout component in the radio access network breaks out data coming from a basestation, and performs one or more mobile network services at the edge of the mobile data network based on the broken out data. These services may require the use of keys. Keys are stored and retrieved from a non-volatile key storage in a way that assures subsystems that need the keys have access to the keys. The keys retrieved from the non-volatile key storage are stored in a shared memory in the requesting subsystem, which allows any applications that requires access to the keys to directly access the keys in the shared memory.

## Claims

### Claim 1

A method for processing data packets in a mobile data network that includes a radio access network coupled to a core network, the method comprising the steps of:
a plurality of antennas sending and receiving network messages between user equipment and a plurality of basestations in the radio access network, each basestation communicating with a corresponding one of the plurality of antennas;
a breakout component in the one of the plurality of basestations that performs the steps of:
defining an existing first data path in the radio access network for non-broken out data;
defining a second data path for broken out data;
identifying first data received from a corresponding basestation as data to be broken out;
sending the first data on the second data path;
forwarding other data that is not broken out on the first data path; and
performing a first service with respect to internet protocol (IP) data sent to the first user equipment in response to an IP data request in the first data from the first user equipment;
storing keys to a non-volatile key storage and retrieving keys from the non-volatile key storage; and
when an application running on a first subsystem system in the breakout component requires access to a key stored in the non-volatile key storage, the application requesting access to the key from the first subsystem, and in response to the request by the application to access the key, the first subsystem retrieving the key from the security subsystem and writing the key to a shared memory in the first subsystem.

### Claim 2 (depends on 1)

The method of claim 1 further comprising the steps of:
detecting tampering of the breakout component; and
in response to a detected tampering of the breakout component, erasing the keys in the non-volatile key storage.

### Claim 3 (depends on 1)

The method of claim 1 further comprising the step of writing the keys to the non-volatile key storage in the security subsystem during manufacture of the breakout component.

### Claim 4 (depends on 3)

The method of claim 3 where the step of writing the keys to the non-volatile key storage in the security subsystem comprises the step of writing each key with a corresponding key identifier.

### Claim 5 (depends on 4)

The method of claim 4 wherein the step of writing the keys to the non-volatile key storage in the security subsystem comprises the step of writing each key with a corresponding secret value.

### Claim 6 (depends on 1)

The method of claim 1 further comprising the step of the first subsystem requesting the key from the security subsystem using a key identifier corresponding to the key.

### Claim 7 (depends on 6)

The method of claim 6 wherein the step of the first subsystem requesting the key from the security subsystem further comprises the step of requesting the key from the security subsystem using a secret value corresponding to the key.

### Claim 8 (depends on 1)

The method of claim 1 further comprising the step of the application accessing the key in the shared memory.

### Claim 9

A method for processing data packets in a mobile data network that includes a radio access network coupled to a core network, the method comprising the steps of:
a plurality of antennas sending and receiving network messages between user equipment and a plurality of basestations in the radio access network, each basestation communicating with a corresponding one of the plurality of antennas;
providing a breakout component in one of the plurality of basestations, the breakout component comprising:
a system controller that controls function of the breakout component;
a service processor that monitors the breakout component and provides control functions for the breakout component;
a security subsystem that includes a key mechanism for storing keys to a non-volatile key storage and retrieving keys from the non-volatile key storage, wherein the keys are written to the non-volatile key storage in the security subsystem with a corresponding key identifier and a corresponding secret value during manufacture of the breakout component, the security subsystem comprising a tamper detection mechanism that detects tampering of the breakout component, and in response to a detected tampering of the breakout component, erases the keys in the non-volatile key storage;
a telco breakout system that performs the steps of:
defining an existing first data path in the radio access network for non-broken out data;
defining a second data path for broken out data;
identifying first data received from a corresponding basestation as data to be broken out;
sending the first data on the second data path;
forwarding other data that is not broken out on the first data path; and
performing a plurality of services with respect to internet protocol (IP) data sent to the first user equipment in response to an IP data request in the first data from the first user equipment;
writing the keys to the non-volatile key storage in the security subsystem during manufacture of the breakout component with each key having a corresponding key identifier and a corresponding secret value;
when an application running on a first subsystem system in the breakout component requires access to a key stored in the non-volatile key storage, the application requesting access to the key from the first subsystem using the key identifier and secret value corresponding to the key, and in response to the request by the application to access the key, the first subsystem retrieving the key from the security subsystem and writing the key to a shared memory in the first subsystem;
the application accessing the key in the shared memory;
detecting tampering of the breakout component; and
in response to a detected tampering of the breakout component, erasing the keys in the non-volatile key storage.