Abstract: This invention is a system and method for mobile authentication using HTTP redirect in GTP tunnels. The authentication procedure generates a one-time-token that returns to the Enterprise application that requests the authentication. The authentication platform injects a HTTP redirect response to the mobile device via the GTP-U tunnel that corresponds to the GTP session of the inputted-MSISDN. The HTTP redirect response carries a URL with the one-time-token as parameter. The Enterprise application authenticates the HTTP request by comparing the one-time-token in the HTTP request parameter against the value returned by the authentication platform during its authentication request API call.

Abstract: A method of enhancing end-to-end security of the Diameter protocol. A client transmits a Request message to the server. The request message has a signature, which is generated by encrypting a hash result calculated by the client using predefined AVPs of the Request message. The server validates the signature by independently calculating the hash result and determining whether the hash result within the signature matches the calculated result. Upon successful validation of the signature, the server transmits an Answer message to the client. The Answer message contains a nonce value and a request for Authenticator message from the client. The client transmits an Authenticator message having a second signature based on the hash result calculated using the nonce. The server compares the received hash result with the calculated hash result. If there is a match, the server updates the information requested in the Request message.

Abstract: A method of transmitting data to a virtual group consisting of multiple user devices. A plurality of network-connected user devices are grouped together into a virtual group using their International Mobile Subscriber Identification (IMSI) or Mobile Station International Subscriber Directory Number (MSISDN) contained within a SIM card residing within each user device. An application programming interface (API) and a single identification are established for the virtual group and are exposed to an application server. Data packets sent to the virtual group via a communications protocol from the application server are intercepted and directed to each user device within the virtual group. The plurality of user devices within the virtual group can simultaneously receive the data stream.

Abstract: A Virtual Global Title Translation (V-GTT) Service implemented in a Signaling Connection Control Part (SCCP) Gateway using a single American National Standards Institute (ANSI) SS7 Point Code and a single International Telecommunications Union (ITU) SS7 Point Code for access to destination hubs on ITU and ANSI SS7 side of the SS7 network. The V-GTT enables ANSI SS7 and ITU SS7 operators to send their destination SS7 hub-specific traffic to a single hub-specific protocol for either the ANSI or ITU SS7 Point Code of V-GTT. The V-GTT Service application manages the traffic between ANSI/ITU SS7 operator and destination SS7 hub operators and performs ANSI SS7 to ITU SS7 (or ITU SS7 to ANSI SS7) protocol conversion if the destination hub is on a different SS7 protocol, thereby enabling an originating operator to send traffic to a single V-GTT Service hub-specific point code using the protocol that the originating operator currently employs.

Abstract: A method of enabling a home network to identify a location of its subscriber roaming within a visited network. An Intelligent Data Routing (IDR) application functions as a proxy between a Serving GPRS Support Node (SGSN) of the visited network and a Gateway GPRS Support Node (GGSN) of the home network. The IDR receives a Create PDP Context Request message or an Update PDP Context Request message that is sent from the SGSN to GGSN. The IDR determines whether the Routing Area Identity (RAI) and User Location Information (ULI) Information Elements (IEs) of the Request message have been populated by the SGSN. If the IDR application determines that at least one of these IEs is absent, the IDR application populates them with appropriate values obtained from the SGSN. The routing application sends the modified Request message having the populated RAI and ULI IEs to the GGSN.

Abstract: The invention is a method of detecting malicious behavior of a network participant. Specific usage values observable at a network connectivity layer are defined. These usage values can be size of data transferred, quantity of data bursts, a quantity of IP address destinations, a network protocol being used, and/or a length of an encryption key. The invention measures the usage values for the network participant across multiple networks over a predetermined period of time and creates a statistical digital dossier representative of patterns of the measured usage values for the network participant. The invention monitors the behavior of the network participant by measuring current usage values. The current usage values are compared against the statistical digital dossier and, if a deviation beyond a predefined tolerance is detected, an alert signal is issued.

Abstract: A method of assessing the security of a user's connection to a Sequenced Packet Exchange (SPX) network and the user's consumption of services via the SPX network. The invention includes digitally accessing a plurality of network nodes and obtaining data transmissions through said plurality of network nodes. Each transmission corresponds to a security implementation of a current state of the user's connection or consumption of SPX services. A coefficient is determined for each security implementation, wherein the coefficient corresponds to a weight given to each security implementation in determining a level of security of the user's connection or consumption. A security score representative of the level of security of the user's connection is calculated as a function of the security implementation and their corresponding coefficients. The security score is output to the user.

Abstract: A contextual SS7 firewall filter is inserted between a network operator and its roaming partners intra network and inter network SS7 traffic. SS7 firewall filter validates GSM MAP and GSM CAP messages based on specific criteria as provisioned for those message types and either allows them or blocks them from reaching their intended destination based on the validation results. The validation step involves verification of MSU correctness, verification of correctness of SS7 MTP fields for each MSU, and verification of correctness of SS7 SCCP fields for each MSU. SS7 firewall filter blocks GSM messages that fail at least one of the verification steps.

Abstract: GTP firewall service to block or allow GTP-C v1 messages from specific SGSN/GGSN and GTP-C v2 messages from specific SGW/PGW to prevent fraudulent activity occurring from any specific serving node or home node. GTP Traffic from specific SGSN (3G) or SGW (4G) can be blocked going to specific home operator, including 3G GSM to 4G LTE and 4G LTE to 3G GSM protocol interoperability provided by GTP Firewall. Individual Information Elements within GTP-C v1 and GTP-C v2 messages will be monitored based on home and serve operator configuration as well as GTP messages and Information Elements mapped from GTP-C v1 to GTP-C v2 for 3G GSM to 4G LTE interoperability and GTP-C v2 to GTP-C v1 for 4G LTE to 3G GSM interoperability.

Abstract: A method and system of providing a roaming data service to a User Equipment (UE) that requires a dual attachment to a Packet Switched (PS) network for the data service and a Circuit Switched (CS) network for a voice service, but the visited network is a data-only PS network. When the UE sends a dual attach request, the visited network communicates with the home network via a Diameter Agent to obtain the UE's PS profile needed to complete attachment of the UE in the visited network for data services. To enable CS attach of the UE with the visited network, a custom function, titled a SGs-Agent, is deployed. The SGs-Agent provides a predefined CS profile to the visited network, thereby enabling the UE to complete the CS attach with the visited network. The visited network provides data services to the UE, but the voice services are denied.

Abstract: An apparatus for facilitating toll free data access includes a processor and memory storing executable computer code causing the apparatus to at least perform operations including sending a request to a device requesting identification of one or more content providers that provide data to users in which the content providers pay for data, accessed from the content providers, on behalf of users. The accessed data is not considered data usage accrued by the users during a billing cycle or against a prepaid data plan. The computer program code may further cause the apparatus to receive an indication from the device of a content provider(s) that pays for the provision of the data on behalf of users. The computer program code may further cause the apparatus to determine whether a selected content provider pays for the provision of the data to users. Corresponding methods and computer program products are also provided.

Abstract: A method of providing voice call, data, and SMS services to a user equipment roaming in a 2G/3G visited network and subscribed to an LTE home network. An Interworking Function communicates with both the visited network and the home network. The Interworking Function translates between Mobile Application Part (MAP) protocol used by the 2G/3G visited network and Session Initiation Protocol (SIP) used by the LTE home network. The Interworking Function establishes both a MAP Registration with the 2G/3G visited network and also a SIP Registration with the LTE home network, thereby enabling provision of voice call, data, and SMS services to the roaming UE.

Abstract: A method of establishing connectivity between a mobile network operator (MNO) and a machine type communications (MTC) service provider. A machine type communications interworking function (MTC-IWF) Proxy is hosted on an IPX network service. MTC-IWF Proxy is connected to a MTC-IWF of the MNO and is also connected to a Service Capacities Center (SCS) of the MTC service provider. MTC-IWF Proxy connects to the MNO and the MTC service providers via trigger-service provider (Tsp) interface. Identity mapping services are provided between a first set of subscriber identifiers used by the MNO and a second set of subscriber identities used by the MTC service provider. The MTC-IWF Proxy hides the internal topology and relays signaling protocols used over a Tsp interface, thus enabling the MTC service providers and MNOs communicate without modifying their internal signaling protocols.

Abstract: A roaming method that enables the home network (HPMN) to use S8 Home Routed (S8HR) model for out-bound roaming while the visited network (VPMN) uses Local Breakout (LBO) model for in-bound roaming. An IMS Roaming Gateway (IR-GW) establishes an IMS bearer between the IR-GW and the home network's Packet Data Network Gateway (P-GW). The IR-GW replaces the source IP address on the SIP-Register message with the client IP address assigned to the UE by the HPMN P-GW. Upon receiving a SIP-Response message responsive to successful authentication of the UE with the HPMN, the IR-GW inserts its own IP address into the SIP-Response message and forwards it to the UE. IR-GW performs network address translation (NAT) between the source IP assigned to the UE by the VPMN and the client IP assigned to the UE by the HPMN.

Abstract: A Payment Gateway interfaces, in one embodiment, with a merchant's website or a payment aggregator used by the merchant's website, for facilitating purchases made at the website by a wireless user. In one embodiment, purchases at the website are paid for by charging the wireless user's prepaid account maintained in the mobile operator. The Payment Gateway accepts messages in an HTTP based message from the website or payment aggregator and provides a gateway function to the wireless user's service provider, which is accessible only using SS7 based MAP protocols. The mobile gateway ascertains the proper message syntax to use in a MAP based USSD message based on the wireless carrier. The mobile gateway also receives messages from the mobile operator, typically using a GSM MAP based protocol and initiates HTTP based messages back to the merchant's website.

Abstract: A traffic hub system comprising a roaming data module to send and receive data for a roaming wireless network for a mobile device, the mobile device comprising a service utilizing a high-speed data network, a home data module to send and receive data for a home wireless network for the mobile device, the home wireless network being a different network than the roaming wireless network, the home wireless network comprising a packet data network gateway.

Abstract: A method of determining inbound roaming market share of a host network is disclosed. The network subscribers are identified by their subscriber identity (IMSI). Each IMSI is categorized based on its roaming status. The roaming categories are as follows: successfully roaming, roaming but steered to another network, not roaming due to errors related to steering, not roaming due to errors not related to steering, roaming below a threshold, roaming below a threshold duration, and roaming on rival networks. SRI-for-SM results of SMS activity are used to determine the count of IMSIs roaming on rival networks. Market share is determined by calculating a quotient of the count of IMSI's categorized as successfully roaming on the host network and the difference between the total count of the IMSIs and the count of IMSIs categorized as not roaming due to errors not related to steering.

Abstract: An apparatus for securing communications includes a processor and memory storing executable computer code causing the apparatus to at least perform operations including receiving a request to activate a service transferring communications of a cellular network to a wireless local network. The computer program code may further cause the apparatus to provide an activation key to a device responsive to an indication that the device is authorized to utilize the service based on determining an identifier(s) of the request is valid. The computer program code may further cause the apparatus to provide a private key to the device, to enable the device to utilize the private key to subsequently register to transfer communications of the cellular network to a wireless local network(s), responsive to receiving a message for the private key from the device and a message from the cellular network. Corresponding methods and computer program products are also provided.

Abstract: A wireless data-oriented service provides toll free data access to wireless users, such as GSM or CDMA-based users, when accessing specified content. The content provider pays for (“sponsors”) access to specific content for wireless users, often in conjunction with advertisement campaigns. In one embodiment a separate access point name is used when making the request to distinguish between sponsored data and conventional data access requests. In another embodiment, a portal proxy is used and sponsored data is distinguished from conventional data by the address of the destination web site. Wireless users accessing the sponsored content are not billed for usage, but rather the content provider is billed for usage. A data session management platform generates appropriate call data records indicating the session usage and transmits the records to reconcile accounts between the mobile network operator and the content provider.

Abstract: A method or apparatus to provide a video ecosystem is described. The video ecosystem, in one embodiment, permits live video streaming between users on different platforms, carriers, and/or devices.