Abstract: A Blockchain Rules Engine is provided as a pluggable service that depicts a real-world implementation of a Rules Engine that stores rules, transactions, and results on a blockchain for use by blockchain and non-blockchain applications. The Blockchain Rules Engine manages rules implemented by a client application that interacts with a blockchain platform that manages the blockchain. The Blockchain Rules Engine includes a language specific software developer's kit (SDK) that provides an interface to the client application and that exposes rule execution functionality to the client application, a rules engine application programming interface (API) layer that provides a rules engine API to the language specific SDK and that receives and processes commands from the language specific SDK, and a blockchain platform specific service layer that interacts with the blockchain platform and accepts input from the rules engine API layer to execute business logic implemented in the rules.

Abstract: One feature pertains to a method for secure wireless communication at an apparatus of a network. The method includes receiving a user equipment identifier identifying a user equipment and a cryptographic key from a wireless wide area network node, and using the cryptographic key as a pairwise master key (PMK). A PMK identifier (PKMID) is generated based on the PMK and the two are stored at the network. A PMK security association is initialized by associating the PMK with at least the PMKID and an access point identifier identifying an access point of the apparatus. An association request is received that includes a PMKID from the user equipment, and it's determined that the PMKID received from the user equipment matches the PMKID stored. A key exchange is initiated with the user equipment based on the PMK to establish a wireless local area network security association with the user equipment.

Abstract: A system and method for providing assistance to a customer of a computing device. In one aspect, an incoming call is received from a device of a customer; a check for identification of the customer is done; an event history of the device is obtained; and a solution is provided to the customer using the event history. In another aspect, a method includes: receiving a code from a mobile computing device; and in response to receiving the code, calculating at least one set of data for use in guiding a request of a customer for service to a resource that can provide a suggested remedy. In another aspect, a method includes: identifying a user associated with a mobile computing device; determining an event history of the mobile computing device; and providing guidance to resolve an issue based on the event history.

Abstract: Authenticating a mobile user device with a mobile network operator in advance of an MNO authentication request from the mobile user device can be done by a satellite network sending an authentication request to the MNO system, obtaining a set of authentication vectors related to the mobile user device, storing them into a proxy home location register, receiving the MNO authentication request from the mobile user device, generating an authentication request response based on the authentication vectors, sending the authentication request response to the mobile user device, receiving an authentication response including a received signed response, comparing the received signed response with the stored signed response, and if the received signed response and stored signed response match, deem that to be a successful authentication, add an MNO location update message to a request queue and forward the MNO location update message to the MNO system over the channel when available.

Abstract: In order to provide a control apparatus that enhances security of a radio communication system run by a user, the control apparatus including an acquisition section and a registration section, the acquisition section being configured to acquire subscriber information in which at least authentication information is encrypted, and the registration section being configured to register the acquired subscriber information in a database included in a core network. The control apparatus may further include an authentication section configured to decrypt the encrypted authentication information, and use the decrypted authentication information and authentication information included in a connection request from a terminal apparatus to the core network to authenticate the terminal apparatus.

Abstract: A configuration to enable a base station to configure a UE with a sequence of predetermined configuration parameters for DRX operation based on predetermined state changes for the UE, wherein the DRX operation comprises a plurality of DRX cycles. The apparatus may transmit communication to the UE based on the sequence of predetermined configuration parameters for the DRX operation. The UE may receive the configuration from the base station and monitor for communication from the base station based on the sequence of predetermined configuration parameters for the DRX operation.

Abstract: A method of recommending workstations includes determining a location of a mobile device; determining a zone of interest for the mobile device in response to the location; determining a list of available workstations within the zone of interest; and displaying the list of available workstations within the zone of interests on the mobile device.

Abstract: Provided is a personal authentication device capable of simply securing security with little psychological and physical burden of a user to be authenticated.

Abstract: Method, systems and devices for wireless communication. The method includes protecting privacy of a transmitted network slice selection assistance information (NSSAI) between a user equipment and a base station. The method includes receiving a temporary NSSAI (T-NSSAI) from an access and mobility management function (AMF) to the base station, the T-NSSAI comprising at least one temporary single NSSAI (T-S-NSSAI) and storing the T-NSSAI in the base station. The method also includes receiving a radio resource control (RRC) signaling message from the user equipment to the base station, the RRC signaling message comprising a T-S-NSSAI corresponding to an allowed single NSSAI (S-NSSAI); and selecting the AMF based on the T-S-NSSAI.

Abstract: A method of operating a core network node in a communication system includes receiving, at a first network function, a registration message from a radio access network node to register a user equipment, UE, and, responsive to the registration message, transmitting a request for information on whether network slices associated with the UE are subject to Network Slice-Specific Authentication and Authorization, NSSAA. Responsive to the request, the method receives a response message including Single-Network Slice Selection Assistance Information, S-NSSAI, information associated with the UE, the S-NSSAI information including NSSAA status information relating to the S-NSSAI information, and determines whether to initiate an NSSAA procedure with the UE based on the S-NSSAI information. Related network nodes are disclosed.

Abstract: In a context of virtualized access points deployment, an access point of a first wireless network is split in a radio equipment deployed at the user premises and a radio equipment controller deployed in a data centre located a few kilometres from the user premises, the radio equipment and the radio equipment controller being interconnected via a wired network connection. In order to establish a secure wireless connection of a device to the virtualized access point in a user-friendly manner, a salient idea is to receive at the radio equipment controller in the data centre a first and a second information items respectively emulating a first action of a user on the first device and a second action of the user on the virtualized access point.

Abstract: Systems and methods provide packet data convergence protocol (PDCP) user plane (UP) integrity protection (IP) for a user equipments (UE) and radio access network (RAN) nodes operating in Evolved Universal Terrestrial Radio Access-New Radio dual connectivity (EN-DC). In an attach procedure, a UE may indicate a UE security capability for support of relay node (RN) PDCP UP IP used in LTE. Based on the LIE security capability, a master e Node B (MeNB) security capability, and a secondary g Node B (SgNB) security capability, the MeNB may determine whether to use UP IP between the UE and the MeNB, the UE and the SgNB, and/or in a split bearer between the MeNB and the SgNB.

Abstract: Methods, apparatuses, and computer program products are disclosed for generating and/or using a mobile legal identification data object. An example method includes receiving a request for a mobile legal identification data object and generating the mobile legal identification data object based at least in part on the request for the mobile legal identification data object. The method further includes associating the mobile legal identification data object with a user profile. The method further includes providing the mobile legal identification data object to a user device associated with the user profile.

Abstract: The present invention relates to a method and apparatus for efficiently controlling access for system load adjustment in mobile communication systems. A method for transmitting and receiving data by a terminal including a user equipment (UE) non access stratum (NAS) and a UE access stratum (AS) includes the steps of: receiving by the UE AE, information including emergency call-related information which includes barring information by type for the emergency call, from a base station; transmitting, by the UE NAS, a service request for the emergency call to the UE AS; and determining, by the UE AS, whether to bar the service request on the basis of emergency call-related information. During an emergency call transmission, network congestion can be easily controlled by enabling various types of emergency calls to be transmitted, and enabling access to be barred information according to the situation of a communication network and types of emergency calls.

Abstract: A communication system includes a central cloud server that decreases a gain of a currently active path, which corresponds to a primary communication path between a radio access network (RAN) node and one or more user equipment (UEs) via a first set of edge devices, until the currently active path becomes dormant. A gain of a dormant path, corresponding to a secondary communication path is increased until the dormant path becomes a new active path. Further, at least one edge device of the second set of edge devices is caused to transmit one or more beams of radio frequency (RF) signals in one or more specific directions towards one or more new neighboring nodes to establish the secondary communication path that is used as a backup communication path between the RAN node and the one or more UEs via a second set of edge devices different from the first set of edge devices.

Abstract: A first edge device includes a processor that communicates position information of the first edge device and a time-of-day. Based on the time-of-day and a specific initial access information, the processors sets: a first beam index for an uplink communication and a second beam index for a downlink communication, a specific physical cell identity indicating a first base station to which the first edge device is to be connected, a first wireless carrier network (WCN) from amongst a plurality of different WCNs at the edge device, and a beam configuration to service one or more user equipment in a surrounding area of the first edge device. The processor obtains control signals from the central cloud server and configures parameters of amplifier gains and phase responses associated with a first antenna array or a second antenna array of the first edge device, based on the obtained control signals.

Abstract: A communication directed to a recipient is stored in a message box of the recipient. A forwardee is identified based on an analysis of the communication. A request is received to transmit the communication to the forwardee. The communication is forwarded to a message box of the forwardee.

Abstract: Access category management objects may be configured for use in support of access category configurations of a user equipment (UE). Various methods for a UE configuration with access categories are disclosed. Signaling methods by a radio access network of access barring parameters such as a signaling method for a partial list of access barring parameters with explicit signaling of access category indexes and a signaling method for a full list of access barring parameters where access categories are signaled using a bitmap are disclosed. Access control parameters and an access control architecture in terms of access control function distribution within the UE protocol sublayers, solutions that address the impact of access control in a connected mode on a buffer status report, logical channel prioritization and flow control between the UE AS and UE NAS, and details regarding access barring checks are also disclosed.

Abstract: The disclosure provides a method and a device for wireless communication. The method includes: determining a target identifier, and receiving a first signal, the first signal carrying first information; wherein the first information comprises information of an access stratum, the first information is used for indicating a first identifier set, and the first identifier set comprises a positive integer number of identifiers; the first identifier set is associated to second information; a second signal carries the second information, and the second information comprises information of a non-access stratum; whether the first identifier set comprises the target identifier is used for determining whether the second information is valid. The disclosure determines the validity of the second information through reasonably determining the target identifier and the first identifier set, thus increasing the reliability of the system and saving system resources.

Abstract: The disclosure provides a device for generating a unique response to a challenge, the device comprising: a plurality of structures, each structure being able to change from a first distinct state, to a second distinct state, in response to an appropriate input challenge; the device being arranged to facilitate a challenge of the plurality of structures in combination, by changing an input to the plurality of structures in combination, to cause each structure of the plurality of structures to change from the first distinct state, to the second distinct state; as part of the challenge, the device being arranged to facilitate a measurement of an output of the plurality of structures in combination, in response to the input; wherein the unique response is at least indicative of a sequence in which the change in state takes place for each of the plurality of structures, in response to the input.

Abstract: A method of copying data from a first device to a second device, each device including a wireless communication interfaces having a maximum range, is disclosed. The first device and the second device are separated by a distance greater than the maximum range. The method includes: transmitting, by the first device, the data to a third device positioned within the maximum range of the first device; receiving the data at the third device and storing the data in a memory of the third device; moving the third device to a physical location within the maximum range of the second device; and transmitting, by the third device, the data to the second device.

Abstract: According to an example aspect of the present invention, there is provided an apparatus comprising means for receiving from a requesting network function, by a network repository function, an access token request, wherein the access token request is related to a network function consumer requesting access to a service provided by a network function producer and comprises an identity of a vendor of the network function consumer requesting access to the service, means for verifying by the network repository function, based at least on the identity of the vendor of the network function consumer, that the network function consumer is allowed to access the service and means for transmitting to the requesting network function, by the network repository function, an access token upon successful verification, wherein the access token generated and signed by the network repository function comprises the identity of the vendor of the network function consumer and an identity of the vendor of the network function produc

Abstract: Apparatuses, methods, and systems are disclosed for authenticating with a mobile communication network. One apparatus includes a memory comprising instructions executable by a processor to cause the apparatus to receive, from a remote unit, a first request to start authentication via a non-3GPP access network and to send, to the remote unit, an EAP-Start packet to initiate an EAP-5G session between the apparatus and the remote unit for exchanging NAS messages between the remote unit and an AMF via the apparatus. Here, the EAP-5G session utilizes EAP-5G packets having an expanded EAP type and a 3GPP vendor ID, the NAS messages being encapsulated within the EAP-5G packets. The apparatus further receives, from the remote unit, an EAP-5G response packet including a NAS request message and a first set of AN-Params including a PLMN ID of the mobile communication network and NSSAI.

Abstract: This Application describes mechanisms for enterprise remote management of cellular services provided via access credentials, e.g., subscriber identity modules (SIMs) and/or electronic SIMs (eSIMs), for wireless devices. To minimize requirements for user interaction, installation and management of business-supplied cellular service profiles on the wireless device can intercept alert notifications to reduce interruptions and allow for background management of the business-supplied cellular service profiles. Additionally, a business enterprise can use multiple, distinct services to initiate installation of an eSIM to a wireless device. When two different services attempt to install eSIMs on the wireless device in parallel, management software on the wireless device can control an order of installation and disallow duplicate installations of an identical eSIM to the wireless device.

Abstract: Methods for authenticating a user utilizing a smart speaker system are presented, the methods including: requesting a user authentication by issuing a voice command to a smart speaker; playing a sonic one-time password (OTP) on the smart speaker received from an authentication server in response to the requesting a user authentication; receiving the sonic OTP by a mobile device of the user; transmitting an OTP decoded from the sonic OTP to the authentication server; and authorizing the user by the authentication server to execute a secure transaction using the smart speaker system.

Abstract: A method for maintaining, commissioning and checking systems in warehouses, where a service technician has sight of the system in question and, by way of a mobile computer, makes wireless contact with the controller of the system in order to take control thereof, where taking control by the mobile computer is permitted by a central controller only if the service technician can have sight contact with the corresponding system, for which purpose localization services of a local radio network are used for the determination of the position and/or of the orientation of the mobile computer of the service technician.

Abstract: An application server may access a wireless communications device via an exposure function of a wireless communications network. The wireless communications network may generate suitable information to identify, access, and/or utilize the exposure function to manage the wireless communications device. The information may include a device identifier that identifies the wireless communications device, a node identifier that identifies a network node associated with the exposure function, and/or security information utilized to authenticate access to the exposure function. The wireless communications device may provide some or all of the information to an application server. The application server, in turn, may utilize the information received from the wireless community cations device to access the exposure function and manage the wireless communications device.

Abstract: This application provides communication methods, devices, and systems for improving communication efficiency. One communication method includes: receiving, by a target access network device and from a source access network device, a handover request message sent by a source access network device, wherein the handover request message is used to for requesting to hand over a terminal device from the source access network device to the target access network device; and obtaining, by the target access network device, network slice selection assistance information supported by the terminal device, wherein the network slice selection assistance information supported by the terminal device is used to indicates a network slice supported by the terminal device.

Abstract: A reader device is configured to connect a physical token to a host device. The reader device may be updated by a local or central administration device forwarding configuration commands in accordance with a standard that is used to communicate with the physical token. This is achieved by emulating a virtual token when no physical token is present, and addressing the memory of the reader device storing the configuration settings in the same manner as a memory of the physical token.

Abstract: Provided are a subscription data update method and apparatus, a node, and a storage medium, where the method includes: in a case where a first network function node determines that authentication and key management for applications (AKMA) subscription data of a user is updated, determining, by the first network function node, a second network function node storing an AKMA context of the user; sending, by the first network function node, a subscription data management notification message to the second network function node; and receiving, by the first network function node, a subscription data management notification response message sent by the second network function node; where the subscription data management notification response message is sent after the second network function node deletes the AKMA context of the user according to the subscription data management notification message.

Abstract: A system comprises an interface and a processor. The interface is configured to provide a request to join a publish group from a client or a point to point communication link of a lattice mesh; and receive a group key or a host public key. The processor is configured to determine whether a message has been received; in response to the message having been received, determine whether the message is to be sent on; in response to the message being determined not to be sent on, decode the message using the group key or the host public key; determine whether to store the message in a backfill database; in response to determining to store the message in the backfill database, store the message in the backfill database.

Abstract: Systems and methods for provisioning and validating a network are disclosed. One method can comprise providing a first communication tunnel between a network access point and a first tunnel endpoint. Availability of the first tunnel endpoint can be determined. If the first tunnel endpoint is determined to be available, network traffic can be routed to the first tunnel endpoint. If the first tunnel endpoint is determined to be unavailable, a second communication tunnel between the network access point and a second tunnel endpoint can be provided.

Abstract: A vehicle control system includes a terminal including a storage unit to store additional function information generated by software configured to add a new function to functionality of at least one electronic device mounted on a vehicle and a first communication unit to output the additional function information, and a vehicle control device including a second communication unit to communicate with the terminal through the first communication unit and configured to add a new function to the at least one electronic device based on the additional function information obtained from the terminal through the second communication unit.

Abstract: A device detection system is configured to determine whether a device is located within a venue. The device detection system provides user identifiers associated with a device to an anonymization server. The anonymization server provides anonymous identifiers to the device detection system corresponding to the user identifiers. A content distribution system provides content items for a campaign associated with the venue to users. The content distribution system provides user identifiers to the anonymization server and receives anonymous identifiers from the anonymization server. The content distribution system provides the anonymous identifiers to the device detection system. The device detection system compares the sets of anonymous identifiers to identify users that received a content item and subsequently visited the venue.

Abstract: A method for slice attachment and configuration, the method comprises: receiving a service request from a user equipment; selecting a second network node to process the service request; receiving a configuration for a network slice to enable the service requested by the user equipment; identifying a first point of presence to receive user plane information corresponding to the network slice; identifying a second point of presence to receive control plane information corresponding to the network slice; forwarding traffic corresponding to the network slice to a third point of presence; transmitting to the user equipment a handle identifying the user equipment context and the network slice configuration; and transmitting to the user equipment a user equipment configuration corresponding to the network slice.

Abstract: A communication system includes a central cloud server that decreases a gain of a currently active path, which corresponds to a primary communication path between a radio access network (RAN) node and one or more user equipment (UEs) via a first set of edge devices, until the currently active path becomes dormant. A gain of a dormant path, corresponding to a secondary communication path is increased until the dormant path becomes a new active path. Further, at least one edge device of the second set of edge devices is caused to transmit one or more beams of radio frequency (RF) signals in one or more specific directions towards one or more new neighboring nodes to establish the secondary communication path that is used as a backup communication path between the RAN node and the one or more UEs via a second set of edge devices different from the first set of edge devices.

Abstract: In one embodiment, a method of commissioning a third-party electronic device of a user for use with a tracking service includes detecting, by an application executing on the computing device of the user, the third-party electronic device within a communicative range of the computing device of the user. The third-party electronic device is not associated with the tracking service and is not communicatively coupled with the tracking service. The method includes initiating a commissioning exchange with the third-party electronic device. The method includes providing an output of the commissioning exchange to a tracking system server associated with the tracking service. The method includes receiving an acknowledgement that the third-party electronic device has been commissioned for use with the tracking service. The method includes providing, in response to the acknowledgement, a location associated with the third-party electronic device to the tracking system server.

Abstract: The present invention relates to an electronic device and a method of controlling the same, and more specifically, to a network configuration technology for electronic devices to be registered in a home network system. An electronic device according to one embodiment includes a communicator configured to perform data communication with a new electronic device which is not registered in an access point (AP), a storage which stores authentication information for accessing the AP, and a controller configured to, when the controller receives device identification information of the new electronic device through the communicator, control the communicator to transmit the authentication information, which allows the new electronic device to access the AP, to the new electronic device based on the received identification information.

Abstract: A method for providing content associated with a digital watermark on a mobile telecommunication device. The method includes coupling the mobile telecommunication device with a radio module integrated into an accessory mountable to the mobile telecommunication device and associated with the digital watermark. The digital watermark is a cryptographically unique and indivisible digital watermark. The method includes reading the digital watermark from the accessory and providing content associated with the digital watermark on the mobile telecommunication device. Further provided is an accessory for a mobile telecommunication device, which accessory includes a radio module associated with a digital watermark.

Abstract: A communication authentication method and a related device, the method including sending, by a user terminal, a generic bootstrapping architecture (GBA) authentication request carrying a user terminal identifier, receiving, by the user terminal, an authentication request carrying an authentication token (AUTN) and a random number (RAND), and deriving, by the user terminal, a first authentication vector based on the AUTN and the RAND, where the first authentication vector is different from a second authentication vector of the user terminal, the first authentication vector is a 5th generation (5G) GBA authentication vector, and the second authentication vector includes at least one of a 3rd generation/4th generation (3G/4G) GBA authentication vector or a 5G authentication vector.

Abstract: This application describes a phased approach to provision eSIM profiles to a wireless device. Credentials are preloaded to an eUICC during manufacture of the eUICC and used subsequently to load eSIM profiles to the eUICC without requiring an active, real-time connection to an MNO provisioning server. Multiple bound profile packages (BPPs) can be pre-generated and encrypted by MNO provisioning servers for an eUICC and transferred to a BPP aggregator server before assembly of the eUICC in a respective wireless device. A local provisioning server in a manufacturing facility mutually authenticates and connects to the BPP aggregator server to download and store one or more of the encrypted BPPs for later installation on the eUICC. The local provisioning server subsequently mutually authenticates and connects to the eUICC to load at least one of the one or more pre-generated, encrypted BPPs to the eUICC during assembly and/or testing of the wireless device.

Abstract: A method for applying or overriding a preferred-locality attribute during network function (NF) discovery includes, at a service communications proxy (SCP) or security edge protection proxy (SEPP) including at least one processor, receiving, from an NF, an NF discovery request including a preferred-locality attribute or lacking a preferred-locality attribute. The method further includes selecting, by the SCP or SEPP, a value for the preferred-locality attribute for the NF discovery request. The method further includes inserting, by the SCP or SEPP, the value for the preferred-locality attribute into the NF discovery request. The method further includes transmitting, by the SCP or SEPP, the NF discovery request to a network function repository function (NRF).

Abstract: Disclosed are methods, systems and paradigms for opt-in compliance with regulations. A region in physical space is defined. A condition for the region is defined, the condition being a capability of a communicator such as video recording, still image recording, audio recording, audio output, text messaging, audio communication, or remote connection. The presence and location of a communicator with the capability is detected in the region, and a message is sent to the communicator with a request for a response accepting or rejecting remote deactivation of the capability of the communicator. If an acceptance response is received, the communicator capability is deactivated. If an acceptance response is not received, a notification is generated that includes the lack of acceptance response and the location of the communicator.

Abstract: A device detection system integrates location data with online tracking data describing content viewed by a user. The device detection system is configured to determine whether a device is located within a venue. The device detection system provides user identifiers to an identity matching server. An entity associated with the venue may provide online tracking data obtained via a tracking pixel to the identity matching server. The identity matching server provides the tracking data and anonymous identifiers to the device detection system which correspond to the device user identifiers. The device detection system generates a customer journey timeline that describes the location data and online tracking data for a user. The device detection system or the entity may use the information in the customer journey timeline to modify or select digital content to provide to users.

Abstract: Representative embodiments enable a software application to access wireless services provided by a mobile network operator (MNO). According to some embodiments, a method can be implemented at a mobile device, and include (1) receiving, from a software application management entity, an installation package that includes: (i) first information for installing a software application, and (ii) second information for an electronic Subscriber Identity Module (eSIM) to be utilized by the software application to access the wireless services provided by the MNO, (2) utilizing the first information to install the software application on the mobile device, and (3) in response to receiving a request to launch the software application, causing the software application to execute on the mobile device, where: (i) the software application utilizes the eSIM to access wireless services provided by the MNO, and (ii) the wireless services are restricted in accordance with parameters associated with the eSIM.

Abstract: A system to identify a non-approved mobile device includes a scanner for mobile devices. The scanner may be deployed in a vehicle or in a building to detect the location of non-approved mobile devices therein. The scanner may receive RF transmissions from mobile devices located within the range of the scanner. Such mobile devices may be located within, outside, or proximal to the vehicle or building. Based on unique identifying signals, the scanner may classify the devices as approved, non-approved, or transient. The scanner may be in data communication with data storage capacities located within the scanner or accessible through wireless communication. Approved mobile devices may scan for transmissions within their environment and relay information to the scanner.

Abstract: Methods and systems are described herein for an improved mechanism for authenticating users. In particular, the methods and systems facilitate variable authentication of users on mobile devices based on current and historical physical movement of the mobile devices at geographic locations and during predetermined time intervals while maintaining user privacy. Specifically, methods and systems authenticate users by comparing current motion data to historical motion data to determine if a user must be re-authenticated. For example, current motion data may be inconsistent with historical motion data and may cause re-authentication of a user. As another example, current motion data may be consistent with historical motion data and may not require re-authentication of a user. Moreover, the methods and systems alleviate privacy concerns by not transmitting sensitive data over one or more wired or wireless networks.

Abstract: System, device, and method of Augmented Reality based mapping of a venue and navigation within a venue. A method includes: performing a crowd-sourced mapping process, that maps a retail store and maps particular products sold within that retail store, based on computer-vision analysis of a plurality of images captured by a plurality of end-user devices of customers within that retail store; and generating a representation of a store map reflecting actual real-time location of particular products within that retail store. Turn-by-turn walking directions are provided, to guide the user from his current in-store location towards a destination product within that retail store. Augmented Reality promotions, advertisements and marketing content elements, route guidance, and other content are generated and displayed on the end-user device.

Abstract: A mobile network operator (MNO) base station, e.g., an eNB, instructs a mobile virtual network operator (MVNO) user equipment (UE) to monitor to detect signals from base stations in its MVNO network and to report back the results. If the UE reports to the MNO base station, that it has detected signals from base stations, e.g. CBSDs, in its MVNO, the MNO base station applies one or more rules included in a stored Service Profile Identifier, corresponding to the UE, the applying of the one or more rules causes the MNO base station to disconnect or deny service to the UE. Alternatively, when it is determined that the UE did not detect a signal from a base station, e.g. a CBSD, in its MVNO, then the MNO base station provides communications service to the UE.

Abstract: An embodiment of the invention is a User Equipment UE, configured to: get ePDG selection information configured by the UE's HPLMN, said ePDG selection information including a list of PLMNs with an indication of whether the selection of an ePDG in a PLMN is preferred or mandatory or non-preferred, perform selection of an ePDG operated by a PLMN of a country the UE is located in, referred to as local PLMN, which has roaming agreement with the UE's HPLMN for untrusted WLAN access to EPC, based on said list of PLMNs configured in said ePDG selection information, and on a list of MCCs of said country and/or a list of local PLMNs.