US 8,769,615 B2 · Key storage and retrieval in a breakout component at the edge of a mobile data network

Abstract

Mobile network services are performed in a mobile data network in a way that is transparent to most of the existing equipment in the mobile data network. The mobile data network includes a radio access network and a core network. A breakout component in the radio access network breaks out data coming from a basestation, and performs one or more mobile network services at the edge of the mobile data network based on the broken out data. These services may require the use of keys. Keys are stored and retrieved from a non-volatile key storage in a way that assures subsystems that need the keys have access to the keys. The keys retrieved from the non-volatile key storage are stored in a shared memory in the requesting subsystem, which allows any applications that requires access to the keys to directly access the keys in the shared memory.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims7

Dependent claims

A mobile data network comprising:

a plurality of basestations, each basestation communicating with a corresponding antenna that transmits and receives radio signals to and from user equipment, wherein the plurality of basestations are part of a radio access network that communicates with a core network in the mobile data network, each basestation comprising:
a breakout component that defines an existing first data path in the radio access network for non-broken out data, defines a second data path for broken out data, identifies first data corresponding to first user equipment received from a corresponding basestation as data to be broken out, sends the first data on the second data path, and forwards other data that is not broken out on the first data path, wherein the breakout component provides a first service with respect to internet protocol (IP) data sent to the first user equipment in response to an IP data request in the first data from the first user equipment, the breakout component comprising:
a security subsystem that includes a key mechanism for storing keys to a non-volatile key storage and retrieving keys from the non-volatile key storage, wherein the keys are written to the non-volatile key storage in the security subsystem during manufacture of the breakout component;
and
a first subsystem, and when an application running on the first subsystem system requires access to a key stored in the non-volatile key storage, the application requests access to the key from the first subsystem, and in response to the request by the application to access the key, the first subsystem retrieves the key from the security subsystem using a key identifier corresponding to the key and writes the key to a shared memory in the first subsystem, wherein the application accesses the key in the shared memory.

2 more elements

A mobile data network comprising:

a plurality of basestations, each basestation communicating with a corresponding antenna that transmits and receives radio signals to and from user equipment, wherein the plurality of basestations are part of a radio access network that communicates with a core network in the mobile data network, each basestation comprising:
a breakout component connected to the basestation and connected to an upstream computer system, the breakout component comprising:
a system controller that controls function of the breakout component;
a service processor that monitors the breakout component and provides control functions for the breakout component;
a security subsystem that includes a key mechanism for storing keys to a non-volatile key storage and retrieving keys from the non-volatile key storage, wherein the keys are written to the non-volatile key storage in the security subsystem with a corresponding key identifier and a corresponding secret value during manufacture of the breakout component, the security subsystem comprising a tamper detection mechanism that detects tampering of the breakout component, and in response to a detected tampering of the breakout component, erases the keys in the non-volatile key storage;
a telco breakout system that comprises:
a first service mechanism that defines an existing first data path in the radio access network for non-broken out data, defines a second data path for broken out data, identifies first data corresponding to first user equipment received from a corresponding basestation as data to be broken out, sends the first data on the second data path, and forwards other data that is not broken out on the first data path, wherein the first service mechanism provides a plurality of services with respect to internet protocol (IP) data sent to the first user equipment in response to an IP data request in the first data from the first user equipment;
when an application running on one of the system controller and the telco breakout system requires access to a key stored in the non-volatile key storage, the application requests access to the key from the one of the system controller and the telco breakout system by sending the key identifier and secret value corresponding to the key, and in response to the request by the application to access the key, the one of the system controller and the telco breakout system retrieves the key from the security subsystem and writes the key to a shared memory in the one of the system controller and the telco breakout system, wherein the application accesses the key in the shared memory.

5 more elements

A mobile data network comprising:

a plurality of basestations, each basestation communicating with a corresponding antenna that transmits and receives radio signals to and from user equipment, wherein the plurality of basestations are part of a radio access network that communicates with a core network in the mobile data network, each basestation comprising:
a breakout component that defines an existing first data path in the radio access network for non-broken out data, defines a second data path for broken out data, identifies first data corresponding to first user equipment received from a corresponding basestation as data to be broken out, sends the first data on the second data path, and forwards other data that is not broken out on the first data path, wherein the breakout component provides a first service with respect to internet protocol (IP) data sent to the first user equipment in response to an IP data request in the first data from the first user equipment, the breakout component comprising:
a security subsystem that includes a key mechanism for storing keys to a non-volatile key storage and retrieving keys from the non-volatile key storage, wherein the keys are written to the non-volatile key storage in the security subsystem during manufacture of the breakout component, wherein keys are written to the non-volatile key storage in the security subsystem with a corresponding key identifier and with a corresponding secret value;
a first subsystem, and when an application running on the first subsystem system requires access to a key stored in the non-volatile key storage, the application requests access to the key from the first subsystem, and in response to the request by the application to access the key, the first subsystem retrieves the key from the security subsystem and writes the key to a shared memory in the first subsystem, wherein the application accesses the key in the shared memory;
and
a tamper detection mechanism that detects tampering of the breakout component, and in response to a detected tampering of the breakout component, erases the keys in the non-volatile key storage.

3 more elements

Dependencies are inferred from the claim text.

Description14,245 words

Summary621 words

#1. Technical Field

#This disclosure generally relates to mobile data systems, and more specifically relates to key storage and retrieval in a breakout component at the edge of a mobile data network.

#2. Background Art

Brief description of the drawings31 figures

#The disclosure will be described in conjunction with the appended drawings, where like designations denote like elements, and:

#FIG. 1 is a block diagram of a prior art mobile data network;

#FIG. 2 is a block diagram of a mobile data network that includes first, second and third service mechanisms that all communicate via an overlay network;

Detailed description12,978 words

#The claims and disclosure herein provide mechanisms and methods for performing mobile network services in a mobile data network within the existing infrastructure of the mobile data network. These services may require access to keys, which are stored in a non-volatile key storage in a security subsystem. They keys may be read by a subsystem from the security subsystem, and are then written to a shared memory on the subsystem. Applications that require access to a key may then access the key in the shared memory on the subsystem.

#Referring to FIG. 1, a prior art mobile data network 100 is shown. Mobile data network 100 is representative of known 3G networks. The mobile data network 100 preferably includes a radio access network (RAN), a core network, and an external network, as shown in FIG. 1. The radio access network includes the tower 120, basestation 122 with its corresponding NodeB 130, and a radio interface on a radio network controller (RNC) 140. The core network includes a network interface on the radio network controller 140, the serving node 150, gateway node 160 and operator service network 170 (as part of the mobile data network). The external network includes any suitable network. One suitable example for an external network is the internet 180, as shown in the specific example in FIG. 1.

#In mobile data network 100, user equipment 110 communicates via radio waves to a tower 120. User equipment 110 may include any device capable of connecting to a mobile data network, including a mobile phone, a tablet computer, a mobile access card coupled to a laptop computer, etc. The tower 120 communicates via network connection to a basestation 122. Each basestation 122 includes a NodeB 130, which communicates with the tower 120 and the radio network controller 140. Note there is a fan-out that is not represented in FIG. 1. Typically there are tens of thousands of towers 120. Each tower 120 typically has a corresponding base station 122 with a NodeB 130 that communicates with the tower. However, network communications with the tens of thousands of base stations 130 are performed by hundreds of radio network controllers 140. Thus, each radio network controller 140 can service many NodeBs 130 in basestations 122. There may also be other items in the network between the basestation 130 and the radio network controller 140 that are not shown in FIG. 1, such as concentrators (points of concentration) or RAN aggregators that support communications with many basestations.

Facts

Application

13/329,517Filed 19 Dec 2011

Published

US 2013/0156020 A120 Jun 2013

Granted

1 Jul 2014

Term ends

15 Jun 2032

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment, including 179 days of adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification8 codes

H04W 12/04
Security arrangements; Authentication; Protecting privacy or anonymity: key management, e.g. using generic bootstrapping architecture [GBA]
H04W 12/126
Detection or prevention of fraud: anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
H04W 40/02
Communication routing or communication path finding: communication route or path selection, e.g. power-based or shortest path routing
H04W 40/32
Connectivity information management, e.g. connectivity discovery or connectivity update: for defining a routing cluster membership

Timeline

19 Dec 2011Application filedUS 13/329,517
20 Feb 2012Assigned to International Business Machines Corporationassignment of assignor's interest
20 Jun 2013PublishedUS 2013/0156020 A1
1 Jul 2014GrantedUS 8,769,615 B2
12 Oct 2026TodayWithin its term
15 Jun 2032Term endsEstimated, includes 179 days of adjustment

Key storage and retrieval in a breakout component at the edge of a mobile data network

Life of this patent

Key storage and retrieval in a breakout component at the edge of a mobile data network

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims7

Description14,245 words

Drawings

Classification8 codes

Life of this patent

Description14,245 words