# US 2013/0157619 A1 · States for breakout appliance in a mobile data network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2013/0157619 A1
- Document ID: US20130157619A1
- Status: Published application
- Kind: A1
- Application number: 13/682,404
- Filed: 2012-11-20
- Published: 2013-06-20
- Earliest claimed: 2011-12-19
- Assignees: International Business Machines Corporation
- Inventors: Vincenzo V. Di Luoffo; Philip E. Grady; Scott A. Liebl; George W. Van Leeuwen
- Web page: https://patentgrep.com/patent/US20130157619A1

## CPC

- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
- H04W 24/00: Supervisory, monitoring or testing arrangements
- H04W 40/02: Communication route or path selection, e.g. power-based or shortest path routing
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04W 12/65: Environment-dependent, e.g. using captured environmental data
- H04W 24/02: Arrangements for optimising operational condition
- H04W 88/14: Backbone network devices
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Mobile network services are performed in a mobile data network in a way that is transparent to most of the existing equipment in the mobile data network. The mobile data network includes a radio access network and a core network. A breakout appliance in the radio access network breaks out data coming from a basestation, and performs one or more mobile network services at the edge of the mobile data network based on the broken out data. The breakout appliance includes multiple states that support manufacturing, testing, production, tamper detection and end of life, and the functions of the breakout appliance vary according to its state.

## Claims

### Claim 1

A method for processing data packets in a mobile data network that includes a radio access network coupled to a core network, the method comprising the steps of:
a plurality of antennas sending and receiving network messages between user equipment and a plurality of basestations in the radio access network, each basestation communicating with a corresponding one of the plurality of antennas;
a breakout appliance in the one of the plurality of basestations that performs the steps of:
defining an existing first data path in the radio access network for non-broken out data;
defining a second data path for broken out data;
identifying first data received from a corresponding basestation as data to be broken out;
sending the first data on the second data path;
forwarding other data that is not broken out on the first data path; and
performing a first service with respect to internet protocol (IP) data sent to the first user equipment in response to an IP data request in the first data from the first user equipment; and
defining a plurality of states, each state defining a different set of steps performed by the breakout appliance.

### Claim 2 (depends on 1)

The method of claim 1 wherein the plurality of states comprises a manufacturing state that initializes a security subsystem and writes a plurality of keys to the security subsystem.

### Claim 3 (depends on 1)

The method of claim 1 wherein the plurality of states comprises a tampered state that inhibits booting of at least one system in the breakout appliance.

### Claim 4 (depends on 1)

The method of claim 1 wherein the plurality of states comprises a production state that allows the breakout appliance to send the first data on the second data path during normal operation of the breakout appliance.

### Claim 5 (depends on 1)

The method of claim 1 wherein the plurality of states comprises a testing state that allows the breakout appliance to be tested after tampering or failure and when the breakout appliance passes a plurality of health tests, initializing a security subsystem and writing a plurality of keys to the security subsystem.

### Claim 6 (depends on 5)

The method of claim 5 wherein when the breakout appliance does not pass the plurality of health tests in the testing state, changing the state of the breakout appliance to an end of life state that erases keys in the breakout appliance and erasing at least one block of executable code in the breakout appliance.

### Claim 7 (depends on 1)

The method of claim 1 wherein the plurality of states comprises an end of life state that erases keys in the breakout appliance and erases at least one block of executable code in the breakout appliance.

### Claim 8

A method for processing data packets in a mobile data network that includes a radio access network coupled to a core network, the method comprising the steps of:
a plurality of antennas sending and receiving network messages between user equipment and a plurality of basestations in the radio access network, each basestation communicating with a corresponding one of the plurality of antennas;
providing a breakout appliance in one of the plurality of basestations, the breakout appliance comprising:
a system controller that controls function of the breakout appliance;
a service processor that monitors the breakout appliance and provides control functions for the breakout appliance;
a security subsystem that provides secure access to keys stored in a non-volatile memory; and
a telco breakout system that performs the steps of:
defining an existing first data path in the radio access network for non-broken out data;
defining a second data path for broken out data;
identifying first data received from a corresponding basestation as data to be broken out;
sending the first data on the second data path;
forwarding other data that is not broken out on the first data path; and
performing a plurality of services with respect to internet protocol (IP) data sent to the first user equipment in response to an IP data request in the first data from the first user equipment;
wherein the service processor defines a plurality of states for the breakout appliance, each state defining a different set of steps, wherein the plurality of states comprises:
a manufacturing state;
a tampered state;
a production state;
a testing state; and
an end of life state;
placing the breakout appliance in the manufacturing state, and in response thereto, performing the steps of:
initializing the security subsystem; and
writing the keys to the security subsystem;
placing the breakout appliance in the production state, and in response thereto, performing the steps of:
allowing the telco breakout system to send the first data on the second data path during normal operation of the breakout appliance.

### Claim 9 (depends on 8)

The method of claim 8 further comprising the steps of:
detecting tampering of the breakout appliance, and in response thereto, changing the state to the tampered state; and
in response to the tampered state, inhibiting booting of the system controller and the telco breakout system.

### Claim 10 (depends on 9)

The method of claim 9 further comprising the steps of:
changing the state to the testing state that allows the breakout appliance to be tested after tampering or failure, and when the breakout appliance passes a plurality of health tests, initializing the security subsystem, writing the keys to the security subsystem, and changing the state to the production state.

### Claim 11 (depends on 10)

The method of claim 10 wherein when the breakout appliance does not pass the plurality of health tests in the testing state, changing the state of the breakout appliance to the end of life state that erases keys in the breakout appliance and erases at least one block of executable code in the breakout appliance.