PROVISIONING CREDENTIALS IN WIRELESS COMMUNICATIONS

• US 20150281966A1
• Filed: 03/26/2015
• Published: 10/01/2015
• Est. Priority Date: 03/28/2014
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: GRIOT, Miguel, HORN, Gavin Bernard, FACCIN, Stefano
• Granted Patent: US 9,942,762 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Aspects described herein relate to obtaining provisioned credentials for wireless network services. It can be determined that credentials have not been configured for accessing a network. In this case, a provisioning server supported by the network for obtaining credentials is selected, and a request to establish a connection with the network is transmitted. The transmitted request can indicate the provisioning server.

Claims

1. A method for obtaining provisioned credentials for wireless network services, comprising:

determining that credentials have not been configured for accessing a network;

selecting a provisioning server supported by the network for obtaining credentials; and

transmitting a request to establish a connection with the network, wherein the request indicates the provisioning server.

2. The method of claim 1, wherein transmitting the request is based at least in part on determining that the network allows for online provisioning of credentials.

3. The method of claim 1, wherein selecting the provisioning server is based at least in part on determining an indication of the provisioning server stored in a configuration or receiving the indication of the provisioning server from the network.

4. The method of claim 1, wherein determining that credentials have not been configured is based at least in part on determining information regarding one or more provisioning servers for the network.

5. The method of claim 1, further comprising:

establishing the connection with the provisioning server based at least in part on the request to establish the connection with the network; and

receiving credentials from the provisioning server over one or more data bearers established over the connection with the network.

6. The method of claim 5, further comprising establishing an authenticated connection with the network based at least in part on the credentials.

7. The method of claim 1, wherein transmitting the request comprises transmitting a non-access stratum (NAS) message including at least one of an attach request or a NAS message indicating provisioning.

8. The method of claim 7, wherein the NAS message indicates provisioning based at least in part on at least one of an access point name specified in the NAS message, an information element included in the NAS message, a provisioning server index or identifier specified in the NAS message, a provisioning server type specified in the NAS message, or a default provisioning server specified in the NAS message.

9. The method of claim 8, wherein the access point name is based at least in part on a service provider name of one or more service providers associated with the network.

10. The method of claim 7, wherein the NAS message indicates provisioning based at least in part on specifying a user equipment identifier or identifier type in the NAS message.

11. The method of claim 1, wherein the request to establish the connection includes an International Mobile Station Equipment Identity of a user equipment.

12. An apparatus for obtaining provisioned credentials for wireless network services, comprising:

a service querying component configured to determine that credentials have not been configured for accessing a network;

a credential requesting component configured to select a provisioning server supported by the network for obtaining credentials; and

a connection establishing component configured to transmit a request to establish a connection with the network, wherein the request indicates the provisioning server.

13. The apparatus of claim 12, wherein the connection establishing component is configured to transmit the request based at least in part on determining that the network allows for online provisioning of credentials.

14. The apparatus of claim 12, wherein the credential requesting component is configured to select the provisioning server is based at least in part on determining an indication of the provisioning server stored in a configuration or receiving the indication of the provisioning server from the network.

15. The apparatus of claim 12, wherein the service querying component is configured to determine that credentials have not been configured based at least in part on determining information regarding one or more provisioning servers for the network.

16. The apparatus of claim 12, wherein the connection establishing component is further configured to establish the connection with the provisioning server based at least in part on the request to establish the connection with the network, and wherein the credential requesting component is further configured to receive credentials from the provisioning server over one or more data bearers established over the connection with the network.

17. The apparatus of claim 16, wherein the connection establishing component is further configured to establish an authenticated connection with the network based at least in part on the credentials.

18. The apparatus of claim 12, wherein the connection establishing component is configured to transmit the request as a non-access stratum (NAS) message including at least one of an attach request or a NAS message indicating provisioning.

19. The apparatus of claim 18, wherein the NAS message indicates provisioning based at least in part on at least one of an access point name specified in the NAS message, an information element included in the NAS message, a provisioning server index or identifier specified in the NAS message, a provisioning server type specified in the NAS message, or a default provisioning server specified in the NAS message.

20. The apparatus of claim 19, wherein the access point name is based at least in part on a service provider name of one or more service providers associated with the network.

21. The apparatus of claim 18, wherein the NAS message indicates provisioning based at least in part on specifying a user equipment identifier or identifier type in the NAS message.

22. The apparatus of claim 12, wherein the request to establish the connection includes an International Mobile Station Equipment Identity of a user equipment.

23. An apparatus for obtaining provisioned credentials for wireless network services, comprising:

means for determining that credentials have not been configured for accessing a network;

means for selecting a provisioning server supported by the network for obtaining credentials; and

means for transmitting a request to establish a connection with the network, wherein the request indicates the provisioning server.

24. The apparatus of claim 23, wherein the means for transmitting transmits the request based at least in part on determining that the network allows for online provisioning of credentials.

25. The apparatus of claim 23, wherein the means for selecting selects the provisioning server is based at least in part on determining an indication of the provisioning server stored in a configuration or receiving the indication of the provisioning server from the network.

26. The apparatus of claim 23, wherein the means for determining determines that credentials have not been configured based at least in part on determining information regarding one or more provisioning servers for the network.

27. The apparatus of claim 23, wherein the means for transmitting further establishes the connection with the provisioning server based at least in part on the request to establish the connection with the network, and wherein the means for selecting further receives credentials from the provisioning server over one or more data bearers established over the connection with the network.

28. The apparatus of claim 27, wherein the means for transmitting further establishes an authenticated connection with the network based at least in part on the credentials.

29. The apparatus of claim 23, wherein the means for transmitting transmits the request as a non-access stratum (NAS) message including at least one of an attach request or a NAS message indicating provisioning.

30. The apparatus of claim 29, wherein the NAS message indicates provisioning based at least in part on at least one of an access point name specified in the NAS message, an information element included in the NAS message, a provisioning server index or identifier specified in the NAS message, a provisioning server type specified in the NAS message, or a default provisioning server specified in the NAS message.

31. The apparatus of claim 30, wherein the access point name is based at least in part on a service provider name of one or more service providers associated with the network.

32. The apparatus of claim 29, wherein the NAS message indicates provisioning based at least in part on specifying a user equipment identifier or identifier type in the NAS message.

33. The apparatus of claim 23, wherein the request to establish the connection includes an International Mobile Station Equipment Identity of a user equipment.

34. A computer-readable medium for obtaining provisioned credentials for wireless network services, comprising:

code for determining that credentials have not been configured for accessing a network;

code for selecting a provisioning server supported by the network for obtaining credentials; and

code for transmitting a request to establish a connection with the network, wherein the request indicates the provisioning server.

35. The computer-readable medium of claim 34, wherein the code for transmitting transmits the request based at least in part on determining that the network allows for online provisioning of credentials.

36. The computer-readable medium of claim 34, wherein the code for selecting selects the provisioning server is based at least in part on determining an indication of the provisioning server stored in a configuration or receiving the indication of the provisioning server from the network.

37. The computer-readable medium of claim 34, wherein the code for determining determines that credentials have not been configured based at least in part on determining information regarding one or more provisioning servers for the network.

38. The computer-readable medium of claim 34, wherein the code for transmitting further establishes the connection with the provisioning server based at least in part on the request to establish the connection with the network, and wherein the code for selecting further receives credentials from the provisioning server over one or more data bearers established over the connection with the network.

39. The computer-readable medium of claim 38, wherein the code for transmitting further establishes an authenticated connection with the network based at least in part on the credentials.

40. The computer-readable medium of claim 34, wherein the code for transmitting transmits the request as a non-access stratum (NAS) message including at least one of an attach request or a NAS message indicating provisioning.

41. The computer-readable medium of claim 40, wherein the NAS message indicates provisioning based at least in part on at least one of an access point name specified in the NAS message, an information element included in the NAS message, a provisioning server index or identifier specified in the NAS message, a provisioning server type specified in the NAS message, or a default provisioning server specified in the NAS message.

42. The computer-readable medium of claim 41, wherein the access point name is based at least in part on a service provider name of one or more service providers associated with the network.

43. The computer-readable medium of claim 40, wherein the NAS message indicates provisioning based at least in part on specifying a user equipment identifier or identifier type in the NAS message.

44. The computer-readable medium of claim 34, wherein the request to establish the connection includes an International Mobile Station Equipment Identity of a user equipment.

45. A method for obtaining provisioned credentials for wireless network services, comprising:

receiving a request to establish a connection from a user equipment (UE), the request indicating a provisioning server;

selecting a gateway for establishing a packet data context for the UE based at least in part on the request; and

sending a session request message to the gateway to establish the packet data context for the UE.

46. The method of claim 45, wherein the request from the UE comprises a non-access stratum (NAS) message including an attach request or a NAS message indicating provisioning.

47. The method of claim 46, further comprising determining the request to establish the connection is for provisioning credentials based at least in part on the NAS message, wherein selecting the gateway and sending the session request message are based at least in part on determining that the connection is for provisioning credentials.

48. The method of claim 47, wherein determining the request to establish the connection is for provisioning is based at least in part on an access point name specified in the request for establishing the connection.

49. The method of claim 45, wherein the request indicating of the provisioning server indicates that the connection is specific to provisioning.

50. The method of claim 45, wherein the session request message indicates that the packet data context for the UE is limited to provisioning credentials.

51. The method of claim 50, wherein the session request message indicates that the packet data context is limited to provisioning credentials based at least in part on identifying the provisioning server in the session request message.

52. The method of claim 45, wherein the session request message comprises a create session request message to establish the packet data context as a packet data network connection.

53. The method of claim 45, further comprising deactivating access to one or more other gateways based at least in part on receiving the request to establish the connection.

54. The method of claim 45, wherein the session request message indicates the UE is being provisioned such to facilitate controlling traffic at the gateway.

55. The method of claim 54, wherein the session request message indicates the UE is being provisioned based at least in part on specifying the provisioning server.

56. The method of claim 45, further comprising:

activating one or more data bearers for the UE based at least in part on the request; and

associating the packet data context with the one or more data bearers for sending credentials received from the gateway to the UE to establish an unauthenticated connection with the UE.

57. The method of claim 56, further comprising releasing the one or more data bearers or the packet data context after a period of time.

58. An apparatus for obtaining provisioned credentials for wireless network services, comprising:

a connection establishing component configured to receive a request to establish a connection from a user equipment (UE), the request indicating a provisioning server; and

a gateway communicating component configured to select a gateway for establishing a packet data context for the UE based at least in part on the request and send a session request message to the gateway to establish the packet data context for the UE.

59. The apparatus of claim 58, wherein the request from the UE comprises a non-access stratum (NAS) message including an attach request or a NAS message indicating provisioning.

60. The apparatus of claim 59, wherein the connection establishing component is further configured to determine the request to establish the connection is for provisioning credentials based at least in part on the NAS message, wherein the gateway communicating component is configured to select the gateway and send the session request message based at least in part on the connection establishing component determining that the connection is for provisioning credentials.

61. The apparatus of claim 60, wherein the connection establishing component is configured to determine the request to establish the connection is for provisioning based at least in part on an access point name specified in the request for establishing the connection.

62. The apparatus of claim 58, wherein the request indicating of the provisioning server indicates that the connection is specific to provisioning.

63. The apparatus of claim 58, wherein the session request message indicates that the packet data context for the UE is limited to provisioning credentials.

64. The apparatus of claim 63, wherein the session request message indicates that the packet data context is limited to provisioning credentials based at least in part on identifying the provisioning server in the session request message.

65. The apparatus of claim 58, wherein the session request message comprises a create session request message to establish the packet data context as a packet data network connection.

66. The apparatus of claim 58, wherein the gateway communicating component is further configured to deactivate access to one or more other gateways based at least in part on the connection establishing component receiving the request to establish the connection.

67. The apparatus of claim 58, wherein the session request message indicates the UE is being provisioned such to facilitate controlling traffic at the gateway.

68. The apparatus of claim 67, wherein the session request message indicates the UE is being provisioned based at least in part on specifying the provisioning server.

69. The apparatus of claim 58, further comprising a bearer activating component configured to activate one or more data bearers for the UE based at least in part on the request, and associate the packet data context with the one or more data bearers for sending credentials received from the gateway to the UE to establish an unauthenticated connection with the UE.

70. The apparatus of claim 69, wherein the bearer activating component is further configured to release the one or more data bearers or the packet data context after a period of time.

71. An apparatus for obtaining provisioned credentials for wireless network services, comprising:

means for receiving a request to establish a connection from a user equipment (UE), the request indicating a provisioning server; and

means for selecting a gateway for establishing a packet data context for the UE based at least in part on the request and sending a session request message to the gateway to establish the packet data context for the UE.

72. The apparatus of claim 71, wherein the request from the UE comprises a non-access stratum (NAS) message including an attach request or a NAS message indicating provisioning.

73. The apparatus of claim 72, wherein the means for receiving further determines the request to establish the connection is for provisioning credentials based at least in part on the NAS message, wherein the means for selecting selects the gateway and sends the session request message based at least in part on the means for receiving determining that the connection is for provisioning credentials.

74. The apparatus of claim 73, wherein the means for receiving further determines the request to establish the connection is for provisioning based at least in part on an access point name specified in the request for establishing the connection.

75. The apparatus of claim 71, wherein the request indicating of the provisioning server indicates that the connection is specific to provisioning.

76. The apparatus of claim 71, wherein the session request message indicates that the packet data context for the UE is limited to provisioning credentials.

77. The apparatus of claim 76, wherein the session request message indicates that the packet data context is limited to provisioning credentials based at least in part on identifying the provisioning server in the session request message.

78. The apparatus of claim 71, wherein the session request message comprises a create session request message to establish the packet data context as a packet data network connection.

79. The apparatus of claim 71, wherein the means for selecting further deactivates access to one or more other gateways based at least in part on the means for receiving the request to establish the connection.

80. The apparatus of claim 71, wherein the session request message indicates the UE is being provisioned such to facilitate controlling traffic at the gateway.

81. The apparatus of claim 80, wherein the session request message indicates the UE is being provisioned based at least in part on specifying the provisioning server.

82. The apparatus of claim 71, further comprising means for activating one or more data bearers for the UE based at least in part on the request, and associating the packet data context with the one or more data bearers for sending credentials received from the gateway to the UE to establish an unauthenticated connection with the UE.

83. The apparatus of claim 82, wherein the means for activating further releases the one or more data bearers or the packet data context after a period of time.

84. A computer-readable medium for obtaining provisioned credentials for wireless network services, comprising:

code for receiving a request to establish a connection from a user equipment (UE), the request indicating a provisioning server;

code for selecting a gateway for establishing a packet data context for the UE based at least in part on the request; and

code for sending a session request message to the gateway to establish the packet data context for the UE.

85. The computer-readable medium of claim 84, wherein the request from the UE comprises a non-access stratum (NAS) message including an attach request or a NAS message indicating provisioning.

86. The computer-readable medium of claim 85, wherein the code for receiving further determines the request to establish the connection is for provisioning credentials based at least in part on the NAS message, wherein the code for selecting selects the gateway and sends the session request message based at least in part on the code for receiving determining that the connection is for provisioning credentials.

87. The computer-readable medium of claim 86, wherein the code for receiving further determines the request to establish the connection is for provisioning based at least in part on an access point name specified in the request for establishing the connection.

88. The computer-readable medium of claim 84, wherein the request indicating of the provisioning server indicates that the connection is specific to provisioning.

89. The computer-readable medium of claim 84, wherein the session request message indicates that the packet data context for the UE is limited to provisioning credentials.

90. The computer-readable medium of claim 89, wherein the session request message indicates that the packet data context is limited to provisioning credentials based at least in part on identifying the provisioning server in the session request message.

91. The computer-readable medium of claim 84, wherein the session request message comprises a create session request message to establish the packet data context as a packet data network connection.

92. The computer-readable medium of claim 84, wherein the code for selecting further deactivates access to one or more other gateways based at least in part on the code for receiving the request to establish the connection.

93. The computer-readable medium of claim 84, wherein the session request message indicates the UE is being provisioned such to facilitate controlling traffic at the gateway.

94. The computer-readable medium of claim 93, wherein the session request message indicates the UE is being provisioned based at least in part on specifying the provisioning server.

95. The computer-readable medium of claim 84, further comprising code for activating one or more data bearers for the UE based at least in part on the request, and associating the packet data context with the one or more data bearers for sending credentials received from the gateway to the UE to establish an unauthenticated connection with the UE.

96. The computer-readable medium of claim 95, wherein the code for activating further releases the one or more data bearers or the packet data context after a period of time.

97. A method for obtaining provisioned credentials for wireless network services, comprising:

establishing a session for a user equipment (UE) for provisioning credentials to access a network;

determining specific information regarding a provisioning server based at least in part on the request; and

limiting external access for the UE to the provisioning server.

98. The method of claim 97, further comprising obtaining credentials from the provisioning server for the UE to access the network.

99. The method of claim 98, wherein the request includes information regarding a subscription provider of the network, and the obtaining credentials is based at least in part on the information.

100. The method of claim 98, further comprising communicating the credentials from the provisioning server to the UE over one or more data bearers established for the UE.

101. The method of claim 98, further comprising communicating the credentials for the UE to one or more network components for subsequent authentication of the UE.

102. An apparatus for obtaining provisioned credentials for wireless network services, comprising:

a network communicating component configured to establish a session for a user equipment (UE) for provisioning credentials to access a network; and

a communication managing component configured to determine specific information regarding a provisioning server based at least in part on the request and limit external access for the UE to the provisioning server.

103. The apparatus of claim 102, wherein the network communicating component is further configured to obtain credentials from the provisioning server for the UE to access the network.

104. The apparatus of claim 103, wherein the request includes information regarding a subscription provider of the network, and the network communicating component is configured to obtain the credentials based at least in part on the information.

105. The apparatus of claim 103, wherein the network communicating component is further configured to communicate the credentials from the provisioning server to the UE over one or more data bearers established for the UE.

106. The apparatus of claim 103, wherein the network communicating component is further configured to communicate the credentials for the UE to one or more network components for subsequent authentication of the UE.

107. An apparatus for obtaining provisioned credentials for wireless network services, comprising:

means for establishing a session for a user equipment (UE) for provisioning credentials to access a network; and

means for determining specific information regarding a provisioning server based at least in part on the request and limiting external access for the UE to the provisioning server.

108. The apparatus of claim 107, wherein the means for establishing further obtains credentials from the provisioning server for the UE to access the network.

109. The apparatus of claim 108, wherein the request includes information regarding a subscription provider of the network, and the means for establishing obtains the credentials based at least in part on the information.

110. The apparatus of claim 108, wherein the means for establishing further communicates the credentials from the provisioning server to the UE over one or more data bearers established for the UE.

111. The apparatus of claim 108, wherein the means for establishing further communicates the credentials for the UE to one or more network components for subsequent authentication of the UE.

112. A computer-readable medium for obtaining provisioned credentials for wireless network services, comprising:

code for establishing a session for a user equipment (UE) for provisioning credentials to access a network;

code for determining specific information regarding a provisioning server based at least in part on the request; and

code for limiting external access for the UE to the provisioning server.

113. The computer-readable medium of claim 112, wherein the code for establishing further obtains credentials from the provisioning server for the UE to access the network.

114. The computer-readable medium of claim 113, wherein the request includes information regarding a subscription provider of the network, and the code for establishing obtains the credentials based at least in part on the information.

115. The computer-readable medium of claim 113, wherein the code for establishing further communicates the credentials from the provisioning server to the UE over one or more data bearers established for the UE.

116. The computer-readable medium of claim 113, wherein the code for establishing further communicates the credentials for the UE to one or more network components for subsequent authentication of the UE.