Abstract: A routing platform for routing 4G and 5G mobile data traffic in a mobile core networks implementing Option-3 of 5G Non-Standalone deployment. The routing platform captures S6a Diameter messages sent between a Mobility Management Entity (MME) and a Home Subscriber Server (HSS) and examines the captured messages to determine whether a user equipment (UE) is configured for a 5G data connection. The routing platform intercepts a GTP Create-Session-Request message sent from a Serving Gateway (SGW) and determines whether the GTP message is associated with the UE previously determined to be configured for a 5G data connection. If the GTP message is associated with the UE configured for a 5G data connection, the GTP message is either sent to a dedicated 5G Packet Network Data Gateway (PGW) or the GTP message is modified so that a single PGW handling both 4G and 5G traffic can establish a 5G session for the UE.

Abstract: A routing platform for routing 4G and 5G mobile data traffic in a mobile core networks implementing Option-3 of 5G Non-Standalone deployment. The routing platform captures S6a Diameter messages sent between a Mobility Management Entity (MME) and a Home Subscriber Server (HSS) and examines the captured messages to determine whether a user equipment (UE) is configured for a 5G data connection. The routing platform intercepts a GTP Create-Session-Request message sent from a Serving Gateway (SGW) and determines whether the GTP message is associated with the UE previously determined to be configured for a 5G data connection. If the GTP message is associated with the UE configured for a 5G data connection, the GTP message is either sent to a dedicated 5G Packet Network Data Gateway (PGW) or the GTP message is modified so that a single PGW handling both 4G and 5G traffic can establish a 5G session for the UE.

Abstract: A virtualized Policy, Charging, Negotiation and Enforcement Entity (PCNE) is disclosed for serving cellular traffic across multiple networks. The PCNE manages signaling and user payloads to apply policies compliant to concerned networks in real time. The PCNE provides policy control to a Home network even when its outbound subscriber traffic is locally offloaded at a Visited network or IP Packet Exchange (IPX) cloud. The PCNE protects the Visited network against capacity overuse by inbound subscriber traffic, thereby providing joint control to the Home and Visited network operators resulting in optimal use of bandwidth and resources along with consistent subscriber experience. The PCNE enables the Home network operator to implement domestic quota buckets and policies while its subscriber is roaming in the Visited network by applying differential policy and charging rules. Traffic can be offloaded to a preferred packet data gateway after enforcing the negotiated policies.

Abstract: The specialized networking and application system includes an enforcer configured to intercept the signaling messages and select an optimal SGW, PGW, SMF/UPF and application servers in real time. More specifically, the enforcer intercepts and generates GSM MAP, Diameter, GTP-C and HTTP2/JSON signaling messages. The enforcer executes a policy to force the user devices to re-establish the data connection, thus anchoring at different SGW, PGW, SMF/UPF and application server to keep end-to-end routing path optimal, when the impacting factor changes. The enforcer can further feed its performance data and decision matrix into the analyzer and database to further optimize the decision process. Analyzer and KPI metrics databases are installed at central data centers to collect the KPI data from different probes and enforcer, calculate in real-time the optimal routing path with different decision factors considered, and interact with enforcer to update the latest optimal path status based on the data collected.

Abstract: A Slicing Agent node is deployed between standard Home Subscriber Server (HSS) node and a Serving General Packet Radio Service Support Node (SGSN) node, a Mobility Management Entity (MME) node, or a 3rd Generation Partnership Project Authentication Authorization and Accounting (3GPP AAA) node on S6a/S6d/SWx interfaces of a Core Network. The Slicing Agent node selects the Packet Data Gateway (PGW) and communicates the identifying information of the selected PGW to SGSN/MME/3GPP AAA nodes. The PGW is selected to serve subscriber sessions based on the subscriber's profile, usage, and business needs. The Slicing Agent node can be positioned in any Core Network setup around the globe irrespective of whether it is a roaming or a non-roaming scenario for subscribers/devices having global or country-specific Subscriber Identity Modules (SIMs), without requiring any enhancements or upgrades in legacy or existing network nodes including SGSN, MME, 3GPP AAA and HSS.

Abstract: A Slicing Agent node is deployed between standard Home Subscriber Server (HSS) node and a Serving General Packet Radio Service Support Node (SGSN) node, a Mobility Management Entity (MME) node, or a 3rd Generation Partnership Project Authentication Authorization and Accounting (3GPP AAA) node on S6a/S6d/SWx interfaces of a Core Network. The Slicing Agent node selects the Packet Data Gateway (PGW) and communicates the identifying information of the selected PGW to SGSN/MME/3GPP AAA nodes. The PGW is selected to serve subscriber sessions based on the subscriber's profile, usage, and business needs. The Slicing Agent node can be positioned in any Core Network setup around the globe irrespective of whether it is a roaming or a non-roaming scenario for subscribers/devices having global or country-specific Subscriber Identity Modules (SIMs), without requiring any enhancements or upgrades in legacy or existing network nodes including SGSN, MME, 3GPP AAA and HSS.

Abstract: A specialized networking and application system which includes a consent and campaign blockchain network for advertising campaigns. Off-chain databases are used to store a user's personal data records that are not suitable to be stored in blockchain ledger system. A user receives an opt-in request link prompting the user to consent to receiving advertising campaign messages. The invention verifies user's consent using a single-use token and, if the verification is successful, the advertising campaign messages are transmitted to the user. The invention enables users to centrally manage their consents/preferences for various enterprises, various channels and/or campaigns, storing encrypted subscribers' consents/preferences data into trusted blockchain network, validating the preferences before delivering a campaign message to the user, and providing audit trials and historical campaign messages with analytic data to the users.

Abstract: A specialized networking and application system which includes a consent and campaign blockchain network for advertising campaigns. Off-chain databases are used to store a user's personal data records that are not suitable to be stored in blockchain ledger system. A user receives an opt-in request link prompting the user to consent to receiving advertising campaign messages. The invention verifies user's consent using a single-use token and, if the verification is successful, the advertising campaign messages are transmitted to the user. The invention enables users to centrally manage their consents/preferences for various enterprises, various channels and/or campaigns, storing encrypted subscribers' consents/preferences data into trusted blockchain network, validating the preferences before delivering a campaign message to the user, and providing audit trials and historical campaign messages with analytic data to the users.

Abstract: A packet interceptor monitors GTP traffic for control signaling and data plane traffic. The interceptor reroutes a packet by modifying its IP addresses and forwards the packet to a packet data network gateway server. The server receives the GTP-U packet, performs identification based on the synchronized GTP session information, decapsulates the GTP tunnel information from the GTP-U packet and sends to either a proxy server or the destination application server directly. The proxy server performs message filtering, stores packet contents into storage and forwards the packet out to the destination application server. The filtering function of the proxy server can be trained and enhanced with machine learning algorithms. Thus, the proxy server can automatically detect the traffic type and allow or block the packet based on the detection result.

Abstract: A system for supporting the deployment of an embedded subscriber identification module (eSIM) provisioning management system on the ES3 interface between Subscription Manager Data Preparation (SM-DP) of a target mobile network operator (MNO) and Subscription Manager Secure Routing (SM-SR) of a current MNO. A SM-Proxy implements a SM-SR functionality on a first interface towards the SM-DP, and implements a SM-DP functionality on a second interface towards the SM-SR. A hosted SM-DP implements a RESTful API to receive SIM profile information from a provisioning server in the target MNO's network. An Agreement Management system controls a set of eSIM provisioning rules. A Service Portal enables the MNOs to manage their eSIM provisioning rules across their MNO partners.

Abstract: A system for supporting the deployment of an embedded subscriber identification module (eSIM) provisioning management system on the ES3 interface between Subscription Manager Data Preparation (SM-DP) of a target mobile network operator (MNO) and Subscription Manager Secure Routing (SM-SR) of a current MNO. A SM-Proxy implements a SM-SR functionality on a first interface towards the SM-DP, and implements a SM-DP functionality on a second interface towards the SM-SR. A hosted SM-DP implements a RESTful API to receive SIM profile information from a provisioning server in the target MNO's network. An Agreement Management system controls a set of eSIM provisioning rules. A Service Portal enables the MNOs to manage their eSIM provisioning rules across their MNO partners.

Abstract: A networking and application system for handling the data communications protocols in the mobile packet core network. General Packet Radio Service (GPRS) Tunneling Protocol (GTP) has a control plane for control signaling (GTP-C) and a data plane for user data (GTP-U). A GTP Switch interfaces with Serving GPRS Support Node (SGSN) and/or serving gateway (S-GW). The GTP Switch provides Interment Protocol (IP) address manipulation to hide the topology of distributed control plane and data plane instances. The GTP Switch also implements dynamic node selection to route the control signaling and data plane traffic to different instances, hosted on separate servers, thus enabling higher flexibility in the network routing path optimization and scalable and elastic handling of the data traffic.

Abstract: This invention is a system and method for mobile authentication using HTTP redirect in GTP tunnels. The authentication procedure generates a one-time-token that returns to the Enterprise application that requests the authentication. The authentication platform injects a HTTP redirect response to the mobile device via the GTP-U tunnel that corresponds to the GTP session of the inputted-MSISDN. The HTTP redirect response carries a URL with the one-time-token as parameter. The Enterprise application authenticates the HTTP request by comparing the one-time-token in the HTTP request parameter against the value returned by the authentication platform during its authentication request API call.

Abstract: A packet interceptor monitors GTP traffic for control signaling and data plane traffic. The interceptor reroutes a packet by modifying its IP addresses and forwards the packet to a packet data network gateway server. The server receives the GTP-U packet, performs identification based on the synchronized GTP session information, decapsulates the GTP tunnel information from the GTP-U packet and sends to either a proxy server or the destination application server directly. The proxy server performs message filtering, stores packet contents into storage and forwards the packet out to the destination application server. The filtering function of the proxy server can be trained and enhanced with machine learning algorithms. Thus, the proxy server can automatically detect the traffic type and allow or block the packet based on the detection result.

Abstract: A traffic hub used in mobile communications for data offloading, diversion and security. The traffic hub includes an Evolved Packet Data Gateway (ePDG) module configured to transmit and receive data packets for a mobile device in Roaming Untrusted Wi-Fi network for secured access to an Evolved Packet Core (EPC) network, a Trusted WLAN Access Gateway (TWAG) module configured to transmit and receive the data packets for a mobile device in Roaming Trusted Wi-Fi network for secured access to the EPC network and a General Packet Radio Service (GPRS) Tunneling Protocol (GTP) Proxy (GProxy) module, the GProxy module being the core module of the traffic hub configured to enforce policy rules on the data packets prior to exchanging the data packets with logically selected Peer Gateway General Packet Radio Service (GPRS) Serving Node (GGSN)/Packet Data Network (PDN) Gateway (PGW) and ePDG/TWAG nodes. The GProxy also operates as a GTP-aware firewall to protect Home GGSN/PGW nodes from malicious traffic.

Abstract: A method of transmitting data to a virtual group consisting of multiple user devices. A plurality of network-connected user devices are grouped together into a virtual group using their International Mobile Subscriber Identification (IMSI) or Mobile Station International Subscriber Directory Number (MSISDN) contained within a SIM card residing within each user device. An application programming interface (API) and a single identification are established for the virtual group and are exposed to an application server. Data packets sent to the virtual group via a communications protocol from the application server are intercepted and directed to each user device within the virtual group. The plurality of user devices within the virtual group can simultaneously receive the data stream.

Abstract: A networking and application system for handling the data communications protocols in the mobile packet core network. General Packet Radio Service (GPRS) Tunneling Protocol (GTP) has a control plane for control signaling (GTP-C) and a data plane for user data (GTP-U). A GTP Switch interfaces with Serving GPRS Support Node (SGSN) and/or serving gateway (S-GW). The GTP Switch provides Interment Protocol (IP) address manipulation to hide the topology of distributed control plane and data plane instances. The GTP Switch also implements dynamic node selection to route the control signaling and data plane traffic to different instances, hosted on separate servers, thus enabling higher flexibility in the network routing path optimization and scalable and elastic handling of the data traffic.

Abstract: The invention is a method of detecting malicious behavior of a network participant. Specific usage values observable at a network connectivity layer are defined. These usage values can be size of data transferred, quantity of data bursts, a quantity of IP address destinations, a network protocol being used, and/or a length of an encryption key. The invention measures the usage values for the network participant across multiple networks over a predetermined period of time and creates a statistical digital dossier representative of patterns of the measured usage values for the network participant. The invention monitors the behavior of the network participant by measuring current usage values. The current usage values are compared against the statistical digital dossier and, if a deviation beyond a predefined tolerance is detected, an alert signal is issued.

Abstract: The present invention is directed to methods of and systems for converting data that is in a format unsupported by a recipient device into images that are supported and can thus be accurately rendered by the recipient device. Thus, recipient devices, such as mobile phones and text messengers, all of which are able to display images, are all able to render characters in languages not supported by the recipient device. A method of the present invention converts data for display on a receiving device configured to accurately render data in one or more supported formats. The method includes determining whether a first format of the data is a supported format, and automatically converting the data into a second format supported by the second device if the first format is not a supported format. Preferably, the first format is defined by a character set and the second format is a binary image format.

Abstract: A method and apparatus provide access to communication services using dynamically assigned user credentials. The method includes establishing a communication connection with a first communication network (such as GSM, UMTS, CDMA, or LTE networks) using a real user credential (e.g., a SIM, a USIM, or an R-UIM card or certificates) in a first communication module, utilizing the first communication connection to request the dynamically assigned user credential from a remote management system, and registering a second communication module into the second communication network. The second communication connection is then tethered to allow other devices to access the Internet or other network.