# US 2018/0324188 A1 · Tiered developer unlock of network hub with software defined radio protection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324188 A1 - Document ID: US20180324188A1 - Status: Published application - Kind: A1 - Application number: 15/660,815 - Filed: 2017-07-26 - Published: 2018-11-08 - Earliest claimed: 2017-05-08 - Assignees: T-Mobile USA, Inc. - Applicants: T-Mobile USA, Inc. - Inventors: Andrew Lee Watts - Web page: https://patentgrep.com/patent/US20180324188A1 ## CPC - H04W 12/088: using filters or firewalls - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06F 9/4416: {Network booting; Remote initial program loading [RIPL]} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 41/0813: characterised by the conditions triggering a change of settings - H04L 41/0823: characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability (for optimising operational conditions of wireless networks H04W24/02) - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0263: {Rule management} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/105: {Multiple levels of security} - H04L 65/1016: IP multimedia subsystem [IMS] - H04W 4/02: Services making use of location information - H04W 12/069: using certificates or pre-shared keys - H04W 16/10: Dynamic resource partitioning - H04W 72/0453: Resources in frequency domain, e.g. a carrier in FDMA - G06F 2221/033: Test or assess software - G06F 2221/2113: Multi-level security, e.g. mandatory access control - H04W 72/541: using the level of interference - H04W 72/542: using measured or perceived quality - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network hub may be unlockable into a development environment at various levels of access to implement tiered unlocking. A network hub may send a request to a server computer for a device-specific certificate that is usable to unlock the network hub, the request including (i) a requested level of access, and (ii) a device identifier (ID) associated with the network hub. The network hub may receive the certificate from the server computer, reboot, determine whether the certificate is associated with a trusted entity, and, if so, unlock the network hub at the requested level of access as an unlocked network hub. The unlocked network hub allows for particular development activities (e.g., flashing custom software), but depending on the requested level of access, may or may not allow a user to change settings of a configurable software defined radio (SDR) of the network hub and/or flash custom firmware. ## Claims ### Claim 1 A network hub comprising: a configurable software defined radio (SDR); one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the network hub to: send, over a computer network to a server computer, a request for a certificate that is usable to unlock the network hub into a development environment, the request including (i) a requested level of access, and (ii) a device identifier (ID) associated with the network hub; receive, from the server computer over the computer network, the certificate; reboot the network hub; determine whether the requested level of access associated with the certificate is a first level of access, or a second level of access; determine whether the certificate is associated with a trusted entity; and in response to determining that the certificate is associated with the trusted entity, unlock the network hub into the development environment at the requested level of access as an unlocked network hub, wherein the unlocked network hub: allows a user to change settings of the configurable SDR when the requested level of access is the first level of access, or allows the user to load custom software on the network hub, yet prevents the user from changing the settings of the configurable SDR when the requested level of access is the second level of access. ### Claim 2 (depends on 1) The network hub of claim 1, wherein: the instructions, when executed by the one or more processors, further cause the network hub to store the certificate in non-volatile memory of the network hub prior to rebooting the network hub; and determining whether the certificate is associated with the trusted entity comprises determining whether the certificate is signed with a key issued by the trusted entity. ### Claim 3 (depends on 1) The network hub of claim 1, further comprising a bootloader, wherein unlocking the network hub into the development environment comprises unlocking the bootloader of the network hub. ### Claim 4 (depends on 1) The network hub of claim 1, further comprising a manufacturing key persisted in non-volatile memory of the network hub, wherein: the requested level of access is determined to be the first level access; the instructions, when executed by the one or more processors, further cause the network hub to, after rebooting the network hub: retrieve the manufacturing key from the non-volatile memory, and validate the manufacturing key; and unlocking the network hub is further conditioned on validating the manufacturing key. ### Claim 5 (depends on 1) The network hub of claim 1, wherein the device ID comprises an International Mobile Equipment Identity (IMEI) associated with the network hub. ### Claim 6 (depends on 1) The network hub of claim 1, wherein the settings of the configurable SDR are changeable to provide the network hub with different cellular-based radio technologies. ### Claim 7 (depends on 1) The network hub of claim 1, wherein the trusted entity is a carrier that provides Internet Protocol Multimedia Subsystem (IMS)-based services to subscribing users via associated devices. ### Claim 8 A computer-implemented method implemented by a network hub, the method comprising: sending, over a computer network to a server computer, a request for a certificate that is usable to unlock the network hub into a development environment, the request including (i) a requested level of access, and (ii) a device identifier (ID) associated with the network hub; receiving the certificate from the server computer over the computer network; rebooting the network hub; determining whether the certificate is associated with a trusted entity; and in response to determining that the certificate is associated with the trusted entity, unlocking the network hub into the development environment at the requested level of access as an unlocked network hub, wherein the unlocked network hub: allows a user to change settings of a configurable software defined radio (SDR) of the network hub when the requested level of access is a first level of access, or allows the user to load custom software on the network hub, yet prevents the user from changing the settings of the configurable SDR when the requested level of access is a second level of access. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, further comprising, prior to rebooting the network hub, storing the certificate in non-volatile memory of the network hub, wherein the determining whether the certificate is associated with the trusted entity comprises determining whether the certificate is signed with a key issued by the trusted entity. ### Claim 10 (depends on 8) The computer-implemented method of claim 8, wherein the certificate is usable to unlock the network hub into the development environment at the requested level of access, and wherein the certificate is not usable to unlock any other device besides the network hub. ### Claim 11 (depends on 8) The computer-implemented method of claim 8, wherein the requested level of access is determined to be the first level of access, the method further comprising, after the rebooting of the network hub: retrieving a manufacturing key from non-volatile memory of the network hub; and validating the manufacturing key, wherein the unlocking of the network hub into the development environment is further conditioned on validating the manufacturing key. ### Claim 12 (depends on 8) The computer-implemented method of claim 8, wherein the device ID comprises an International Mobile Equipment Identity (IMEI) associated with the network hub. ### Claim 13 (depends on 8) The computer-implemented method of claim 8, wherein the unlocking of the network hub into the development environment comprises unlocking a bootloader of the network hub. ### Claim 14 One or more non-transitory computer-readable media storing computer-executable instructions that, when executed, cause one or more processors of a network hub to perform acts comprising: sending, over a computer network to a server computer, a request for a certificate that is usable to unlock the network hub into a development environment, the request including (i) a requested level of access, and (ii) a device identifier (ID) associated with the network hub; receiving the certificate from the server computer over the computer network; rebooting the network hub; determining whether the requested level of access associated with the certificate is a first level of access, or a second level of access; determining whether the certificate is associated with a trusted entity; and in response to determining that the certificate is associated with the trusted entity, unlocking the network hub into the development environment at the requested level of access as an unlocked network hub, wherein the unlocked network hub: allows a user to change settings of a configurable software defined radio (SDR) of the network hub when the requested level of access is the first level of access, or allows the user to load custom software on the network hub, yet prevents the user from changing the settings of the configurable SDR when the requested level of access is the second level of access. ### Claim 15 (depends on 14) The one or more non-transitory computer-readable media of claim 14, the acts further comprising, prior to the rebooting of the network hub, storing the certificate in non-volatile memory of the network hub, wherein the determining whether the certificate is associated with the trusted entity comprises determining whether the certificate is signed with a key issued by the trusted entity. ### Claim 16 (depends on 14) The one or more non-transitory computer-readable media of claim 14, wherein the certificate is usable to unlock the network hub into the development environment at the requested level of access, and wherein the certificate is not usable to unlock any other device besides the network hub. ### Claim 17 (depends on 14) The one or more non-transitory computer-readable media of claim 14, wherein the requested level of access is determined to be the first level of access, the acts further comprising, after the rebooting of the network hub: retrieving a manufacturing key from non-volatile memory of the network hub; and validating the manufacturing key, wherein the unlocking the network hub into the development environment is further conditioned on validating the manufacturing key. ### Claim 18 (depends on 14) The one or more non-transitory computer-readable media of claim 14, wherein the device ID comprises an International Mobile Equipment Identity (IMEI) associated with the network hub. ### Claim 19 (depends on 14) The one or more non-transitory computer-readable media of claim 14, wherein the settings of the configurable SDR are changeable to provide the network hub with different cellular-based radio technologies. ### Claim 20 (depends on 14) The one or more non-transitory computer-readable media of claim 14, wherein: the requested level of access is determined to be the second level of access; and the unlocked network hub prevents the user from changing the settings of the configurable SDR by virtue of a container executing in user space of the network hub in which the custom software can be loaded.