US 2026/0304126 A1Published application

Adaptive security gateway tunnel internal address arbitration for telecommunications systems and applications

AssigneeT-Mobile Innovations LLC

InventorAmitav NAYAK

Life of this patent

Estimating the term…

Loading patent…

Abstract

Embodiments for adaptive security gateway tunnel internal address arbitration for telecommunications systems and applications are provided. A security gateway (SeGW) used by a network access node may include an adaptive internal tunnel address arbitrator for processing SeGW connection requests (e.g., Internet Key Exchange (IKE)-AUTH messages) from network access nodes. The arbitrator may be used to control the inner tunnel network address assignment process to minimize dropped IPSec tunnels when an IRAC authentication is successful, but a requested static inner IP address could not be allocated. Where an SeGW cannot provide the access node with a requested static address, as long as the access node's certificate is validated, the arbitrator may instead allocate an available dynamic inner IP address. The arbitrator advantageously facilitates maintaining a validly established IPSec tunnel by permitting the SeGW to assign an inner tunnel IP address from its pool of available dynamic IP addresses.

Claims20

Dependent claims

A system comprising:

one or more processors;
and
one or more computer-readable media storing computer-usable instructions that, when executed by the one or more processors, cause the one or more processors to:
obtain, at a security gateway, a connection request from a network node to initiate a connection between the network node and an operator core network of a telecommunication system, wherein the connection request includes an indication of a static inner tunnel address;
determine an availability of the static inner tunnel address for allocation to the network node;
when the static inner tunnel address is available for allocation to the network node, instantiate a secure encrypted tunnel connection between the security gateway and the network node and allocate an inner tunnel network address comprising the static inner tunnel address to the network node for communications with the operator core network through the secure encrypted tunnel;
and
when the static inner tunnel address is not available for allocation to the network node, instantiate the secure encrypted tunnel connection between the security gateway and the network node and allocate the inner tunnel network address comprising a dynamic inner tunnel address to the network node for communications with the operator core network through the secure encrypted tunnel connection.

5 more elements

A telecommunications network, the network comprising:

an operator core network;
and
a security gateway coupled to the operator core network, wherein the security gateway comprises an adaptive internal network address arbitrator, wherein the adaptive internal network address arbitrator executes operations to:
receive a connection request from a network node coupled to the security gateway through a backhaul network, the connection request comprising a request to initiate a connection between the network node and the operator core network using a static inner tunnel address;
determine an availability of the static inner tunnel address for allocation to the network node based at least on a static address pool;
when the static inner tunnel address is available for allocation to the network node, instantiate a secure encrypted tunnel connection between the security gateway and the network node via the backhaul network and allocate an inner tunnel network address comprising the static inner tunnel address to the network node;
and
when the static inner tunnel address is not available for allocation to the network node, instantiate the secure encrypted tunnel connection between the security gateway and the network node and allocate the inner tunnel network address comprising a dynamic inner tunnel address to the network node.

5 more elements

A method comprising:

obtaining, at a security gateway, a connection request from a network node to initiate a connection between the network node and an operator core network of a telecommunication system, wherein the connection request includes an indication of a static inner tunnel address;
determining an availability of the static inner tunnel address for allocation to the network node based at least on correlating the static inner tunnel address with a static address pool;
instantiating a secure encrypted tunnel connection between the security gateway and the network node;
allocating an inner tunnel network address comprising the static inner tunnel address to the network node for communications with the operator core network through the secure encrypted tunnel when the static inner tunnel address is determined as being available for allocation to the network node;
and
allocating the inner tunnel network address comprising a dynamic inner tunnel address to the network node for communications with the operator core network through the secure encrypted tunnel connection, when the static inner tunnel address is not available for allocation to the network node.

3 more elements

Dependencies are inferred from the claim text.