STATES FOR BREAKOUT APPLIANCE IN A MOBILE DATA NETWORK

• US 20130157619A1
• Filed: 11/20/2012
• Published: 06/20/2013
• Est. Priority Date: 12/19/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Di Luoffo, Vincenzo V., Grady, Philip E., Van Leeuwen, George W., Liebl, Scott A.
• Granted Patent: US 8,607,074 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/02 Arrangements for optimising operational condition
• CPC Class Codes: H04W 40/02 Communication route or path selection, e.g. power-based or shortest path routing
• CPC Class Codes: H04W 88/14 Backbone network devices

Abstract

Mobile network services are performed in a mobile data network in a way that is transparent to most of the existing equipment in the mobile data network. The mobile data network includes a radio access network and a core network. A breakout appliance in the radio access network breaks out data coming from a basestation, and performs one or more mobile network services at the edge of the mobile data network based on the broken out data. The breakout appliance includes multiple states that support manufacturing, testing, production, tamper detection and end of life, and the functions of the breakout appliance vary according to its state.

Claims

1. A method for processing data packets in a mobile data network that includes a radio access network coupled to a core network, the method comprising the steps of:

a plurality of antennas sending and receiving network messages between user equipment and a plurality of basestations in the radio access network, each basestation communicating with a corresponding one of the plurality of antennas;

a breakout appliance in the one of the plurality of basestations that performs the steps of;

defining an existing first data path in the radio access network for non-broken out data;

defining a second data path for broken out data;

identifying first data received from a corresponding basestation as data to be broken out;

sending the first data on the second data path;

forwarding other data that is not broken out on the first data path; and

performing a first service with respect to internet protocol (IP) data sent to the first user equipment in response to an IP data request in the first data from the first user equipment; and

defining a plurality of states, each state defining a different set of steps performed by the breakout appliance.

2. The method of claim 1 wherein the plurality of states comprises a manufacturing state that initializes a security subsystem and writes a plurality of keys to the security subsystem.

3. The method of claim 1 wherein the plurality of states comprises a tampered state that inhibits booting of at least one system in the breakout appliance.

4. The method of claim 1 wherein the plurality of states comprises a production state that allows the breakout appliance to send the first data on the second data path during normal operation of the breakout appliance.

5. The method of claim 1 wherein the plurality of states comprises a testing state that allows the breakout appliance to be tested after tampering or failure and when the breakout appliance passes a plurality of health tests, initializing a security subsystem and writing a plurality of keys to the security subsystem.

6. The method of claim 5 wherein when the breakout appliance does not pass the plurality of health tests in the testing state, changing the state of the breakout appliance to an end of life state that erases keys in the breakout appliance and erasing at least one block of executable code in the breakout appliance.

7. The method of claim 1 wherein the plurality of states comprises an end of life state that erases keys in the breakout appliance and erases at least one block of executable code in the breakout appliance.

8. A method for processing data packets in a mobile data network that includes a radio access network coupled to a core network, the method comprising the steps of:

a plurality of antennas sending and receiving network messages between user equipment and a plurality of basestations in the radio access network, each basestation communicating with a corresponding one of the plurality of antennas;

providing a breakout appliance in one of the plurality of basestations, the breakout appliance comprising;

a system controller that controls function of the breakout appliance;

a service processor that monitors the breakout appliance and provides control functions for the breakout appliance;

a security subsystem that provides secure access to keys stored in a non-volatile memory; and

a telco breakout system that performs the steps of;

defining an existing first data path in the radio access network for non-broken out data;

defining a second data path for broken out data;

identifying first data received from a corresponding basestation as data to be broken out;

sending the first data on the second data path;

forwarding other data that is not broken out on the first data path; and

performing a plurality of services with respect to internet protocol (IP) data sent to the first user equipment in response to an IP data request in the first data from the first user equipment;

wherein the service processor defines a plurality of states for the breakout appliance, each state defining a different set of steps, wherein the plurality of states comprises;

a manufacturing state;

a tampered state;

a production state;

a testing state; and

an end of life state;

placing the breakout appliance in the manufacturing state, and in response thereto, performing the steps of;

initializing the security subsystem; and

writing the keys to the security subsystem;

placing the breakout appliance in the production state, and in response thereto, performing the steps of;

allowing the telco breakout system to send the first data on the second data path during normal operation of the breakout appliance.

9. The method of claim 8 further comprising the steps of:

detecting tampering of the breakout appliance, and in response thereto, changing the state to the tampered state; and

in response to the tampered state, inhibiting booting of the system controller and the telco breakout system.

10. The method of claim 9 further comprising the steps of:

changing the state to the testing state that allows the breakout appliance to be tested after tampering or failure, and when the breakout appliance passes a plurality of health tests, initializing the security subsystem, writing the keys to the security subsystem, and changing the state to the production state.

11. The method of claim 10 wherein when the breakout appliance does not pass the plurality of health tests in the testing state, changing the state of the breakout appliance to the end of life state that erases keys in the breakout appliance and erases at least one block of executable code in the breakout appliance.