CONTROLLING ACCESS TO AN OPERATOR NETWORK BY NON-CONFORMING DEVICES

• US 20160014154A1
• Filed: 07/08/2014
• Published: 01/14/2016
• Est. Priority Date: 07/08/2014
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: HUANG, Ye, CHAN, Yee Sin, VO, Loc Ba
• Granted Patent: US 9,450,983 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

A device is configured to receive an alarm message from a particular device that received a radio resource control request from a client device. The alarm message may indicate that a threshold access limit to an operator network is satisfied by the client device or that a particular protocol is being used by the client device. The device may determine a policy associated with the client device. The policy may indicate a policy rule associated with a policy action to be taken if the policy rule is violated. The device may determine the policy rule is violated based on the alarm message received from the particular device. The device may instruct the particular device to perform the policy action, by accepting or rejecting the radio resource control request, based on the policy rule being violated.

Claims

1. A device, comprising:

one or more processors to;

receive an alarm message from a particular device that received a radio resource control request from a client device,

the alarm message indicating that at least one of a threshold access limit to an operator network is satisfied by the client device or a particular protocol is being used by the client device;

determine a policy associated with the client device,

the policy indicating a policy rule associated with a policy action to be taken if the policy rule is violated;

determine the policy rule is violated based on the alarm message received from the particular device; and

instruct the particular device to perform the policy action, by accepting or rejecting the radio resource control request, based on the policy rule being violated.

2. The device of claim 1, where the one or more processors are further to:

send update information to the particular device that indicates the policy for the client device to permit the particular device to process a future radio resource control request from the client device.

3. The device of claim 1, where the particular device is a first base station included in the operator network, and where the one or more processors are further to:

send update information, which indicates the policy action for the client device, to a second base station included in the operator network based on the alarm message from the first base station.

4. The device of claim 1, where the particular device is a base station included in the operator network, and where the one or more processors are further to:

send update information, to a gateway device included in the operator network, that indicates the policy action for the client device,

the update information permitting the gateway device to update a cached policy data structure.

5. The device of claim 1, where the one or more processors are further to:

determine the client device is included in a device class defined by the operator network; and

where the one or more processors, when determining the policy rule is violated, are further to;

determine the policy rule is violated based on the client device being included in the device class.

6. The device of claim 5, where the device class is a machine-to-machine device class, and where the one or more processors, when determining the client device is included in the machine-to-machine device class, are further to:

send a request to a server,

the request including a client device identifier that identifies the client device;

receive a response from the server based on the request,

the response indicating the client device is the machine-to-machine device; and

determine the client device is included in the machine-to-machine device class based on the response.

7. The device of claim 1, where the one or more processors, when determining the policy associated with the client device, are further to:

send a request to a server;

the request including a client device identifier that identifies the client device;

receive a response from the server based on the request,

the response indicating the policy; and

determine the policy associated with the client device based on the response.

8. The device of claim 1, where the policy action limits how often the client device may be assigned a radio resource in the operator network.

9. The device of claim 1, where the one or more processors, when determining the policy rule is violated, are further to:

determine the policy rule is violated based on the alarm message received from the particular device and a message from another device that indicates the client device accessed the operator network via the other device.

10. The device of claim 1, where the alarm message is a first alarm message, and the one or more processors are further to:

receive a second alarm message from a gateway device, included in the operator network, that received a message from a server to be sent to the client device via the operator network,

the second alarm message indicating that at least one of the threshold access limit to the operator network is satisfied by the client device or the particular protocol is being used by the message being sent to the client device;

determine the policy rule is violated based on the second alarm message received from the gateway device; and

instruct the gateway device to perform the policy action, by preventing the message from being sent to the client device, based on the policy rule being violated.

11. The device of claim 10, where the one or more processors are further to:

send update information to a base station included in the operator network based on the second alarm message,

the update information permitting the base station to update a cached policy data structure.

12. The device of claim 1, where the one or more processors are further to:

send a notification to an application server that manages the client device,

the notification indicating that the client device violated the policy rule.

13. A computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by one or more processors, cause the one or more processors to;

store a policy data structure indicating a policy associated with a client device,

the policy indicating a policy rule associated with a policy action to be taken if the policy rule is violated by the client device,

the policy rule indicating at least one of a threshold access limit to an operator network or that a particular protocol is restricted;

receive a radio resource control request from the client device that requests a radio resource be assigned to the client device;

determine whether the client device violates the policy rule indicated by the policy data structure;

execute the policy action when the client device violates the policy rule; and

selectively assign the radio resource to the client device based on executing the policy action.

14. The computer-readable medium of claim 13, where the policy action includes at least one of limiting how often the client device may be assigned the radio resource or releasing a communication session with the client device.

15. The computer-readable medium of claim 13, where the one or more instructions further cause the one or more processors to:

store alarm information indicating an alarm condition,

the alarm condition being satisfied when at least one of an alarm access limit to an operator network is satisfied or an alarm protocol is used by the client device;

determine the alarm condition is satisfied;

send an alarm message to a server based on the alarm condition being satisfied;

receive an instruction from the server based on the alarm message;

the instruction indicating whether to assign the radio resource to the client device; and

selectively assign the radio resource to the client device based on the instruction.

16. The computer-readable medium of claim 15, where the one or more instructions further cause the one or more processors to:

receive update information from the server based on the alarm message,

the update information indicating an update to the policy associated with the client device; and

update the policy data structure based on the update information.

17. A method, comprising:

storing, by a gateway device in an operator network, a policy data structure that indicates a policy associated with a client device,

the policy indicating a policy rule associated with a policy action to be taken if the policy rule is violated,

the policy rule indicating at least one of a threshold access limit to an operator network or that a particular protocol is restricted;

receiving, by the gateway device, a message from an application server to be sent to the client device;

determining, by the gateway device, whether the message causes the client device to violate the policy rule indicated by the policy data structure;

executing, by the gateway device, the policy action when the message causes the client device to violate the policy rule; and

selectively causing, by the gateway device, the message to be sent to the client device, via the operator network, based on executing the policy action.

18. The method of claim 17, where the policy action includes at least one of limiting how often the client device may access the operator network or releasing a communication session with the client device.

19. The method of claim 17, further comprising:

storing alarm information indicating an alarm condition,

the alarm condition being satisfied when at least one of an alarm access limit to the operator network is satisfied or an alarm protocol is used by the message;

determining the alarm condition is satisfied;

sending an alarm message to a server based on the alarm condition being satisfied;

receiving an instruction from the server based on the alarm message;

the instruction indicating whether to cause the message to be sent to the client device; and

selectively causing the message to be sent to the client device based on the instruction.

20. The method of claim 19, further comprising:

receiving update information from the server based on the alarm message,

the update information indicating an update to the policy associated with the client device; and

updating the policy data structure based on the update information.