Profiles in deployable wireless communications systems

A deployable wireless communications system includes memory, an antenna, and a processor connected to the memory and the antenna. The processor is configured to execute instructions to control the antenna to provide a deployable wireless network to wireless communications devices and to provide access for the wireless communications devices to the deployable wireless network according to profiles of each of the plurality of wireless communications devices stored in the memory. The system further includes an import service executable by the processor to import into the memory a profile carried by a wireless communications device. The profile is to provide access for the wireless communications device to the deployable wireless network.

BACKGROUND

Deployable systems are often used to facilitate communications in emergencies or other incidents, during which normal communications infrastructure may not be functioning correctly. A typical deployable system may be transported to the scene of an emergency or other incident and may be used by first responders or other individuals at the scene. Deployable systems are useful in incident management and may reduce the impact of an incident when used effectively.

DETAILED DESCRIPTION

FIG. 1shows a communications system100according to an embodiment. The system100includes a wireless wide-area network (WWAN)102, a backend system104, and a deployable wireless communications system106. The system100further includes a plurality of wireless communications devices108. The wireless communications devices108may connect to the WWAN102to mutually communicate, with devices and networks outside the WWAN102, and to access services, including services provided by the backend system104.

It may be that a wireless communications device108becomes unable to communicate with the WWAN102or the backend system104. This may be a result of a natural disaster or incident affecting the infrastructure of the WWAN102or the backend system104, a human-caused disaster or incident, a technical fault of the WWAN102or backend system104, a range limitation of the WWAN102, or similar incident. In such cases, the deployable wireless communications system106may be deployed and the wireless communications device108may connect to the deployable wireless communications system106for communications and access to services. The deployable system106may be configured to replace lost services of the WWAN102and/or backend system104. The deployable wireless communications system106may be compact and transportable, so that it may be quickly and readily deployed to any affected location. For example, the deployable system106may fit within an emergency services or law enforcement vehicle or trailer. Any number of deployable wireless communications system106may be used for any given incident.

The WWAN102may include a cellular or mobile network, such as the kind provided by a commercial wireless carrier. The WWAN102may include radio/microwave transceivers to wirelessly communicate with the wireless communications devices108, a core network, switches, gateways, and other network infrastructure. The WWAN102may provide access to other networks, such as the backend system104, other WWANs, local-area networks, the internet, and similar. Examples of WWANs102include networks using technologies such as Long-Term Evolution (LTE), Worldwide Interoperability for Microwave Access (WiMAX), Evolved High Speed Packet Access (HSPA+), Universal Mobile Telecommunications System (UMTS), second-generation/third-generation (2G/3G) General Packet Radio Service (GPRS), and similar.

The backend system104may be configured to provide services to the wireless communications devices108via the WWAN102. Examples of services include messaging, email, data storage and retrieval, mapping, image/video storage and retrieval, voicemail, push-to-talk, calendaring, database access, and similar. The backend system104may be operated by an emergency services or law enforcement organization, for example.

The wireless communications devices108may be mobile phones, smartphones, tablet computers, notebook computers, portable radios, or similar devices. Each wireless communications device108stores a WWAN profile110to access the WWAN102. The WWAN profile110may be specific to the network102and may be stored in a Subscriber Identity Module (SIM), Universal Subscriber Identity Module (USIM), Universal Integrated Circuit Card (UICC), or similar, which may be implemented physically as a removable memory card (e.g., a SIM/USIM/UICC card) or as data in non-removable memory of the device108. A WWAN profile110is provisioned to a device108when that device108is to be used on the WWAN102. In normal operation, the device108uses the WWAN profile110for communications and access to services. If the WWAN profile110needs to be updated or modified, this may be readily done by the operator of the network102.

The deployable wireless communications system106includes a cellular or mobile network radio/microwave transceiver to wirelessly communicate with the wireless communications devices108and may implement other infrastructure to provide wireless communications and other services to the device108. The deployable system106may be configurable to provide access to other networks, such as the backend system104, other WWANs, local-area networks, the internet, and similar, depending on whether connections to these networks are available and whether these networks are operable. The deployable system106may operate as a standalone or “island” system that is not connected to another system, which may be the case during an emergency incident. The deployable system106may be implemented with technologies such as LTE, WiMAX, HSPA+, UMTS, 2G/3G GPRS, and similar.

The deployable wireless communications system106may be configured to provide services to wireless communications devices108including messaging, email, data storage and retrieval, mapping, image/video storage and retrieval, voicemail, push-to-talk, calendaring, database access, and similar. Such services may be independent of any services provided by the backend system104.

Each wireless communications device108may be provided with a deployable profile112to grant and control access to the deployable system106. The deployable profile112may be specific to the deployable system106and may be stored in a SIM/USIM/UICC or similar, which may be implemented as a removable memory card or as data in non-removable memory of the device108. The deployable profile112may be stored in the same memory as the WWAN profile110. Alternatively, two physical SIM/USIM/UICC or similar cards may be provided to the device108, one for each profile110,112. The deployable profile112is distinct from a WWAN profile110, in that the WWAN profile110does not provide access to the deployable system106and the deployable profile112does not provide access to the WWAN102.

Each wireless communications device108may further store a transportable deployable profile114. The transportable deployable profile114may contain data similar or identical to data contained in the deployable profile112. The transportable deployable profile114may be considered a transportable version of the deployable profile112, in that the device108uses the deployable profile112to communicate with the deployable system106and transports its deployable profile114to the deployable system106to facilitate such communication. A device108cannot typically extract data stored in a SIM/USIM/UICC, such as data in the deployable profile112, to provide such data to the deployable system106. Hence, the transportable deployable profile114is exported to the device108for import by the deployable system106, so that the deployable system106obtains data that corresponds to the deployable profile112of the device108to effect communications between the deployable system106and the device108.

A transportable deployable profile114may include a device profile, a user profile, or both. A device profile may define an identity for the wireless communications device108on the deployable system106. Example device identity information includes an International Mobile Subscriber Identity (IMSI), a Mobile Equipment Identifier (MEID), a Mobile Station International Subscriber Directory Number (MSISDN), an International Mobile Equipment Identity (IMEI), a telephone number, and similar unique identifier. A device profile may further define network access credentials, such as a device's cryptographic key, an authentication key (e.g., Ki), and similar. The corresponding deployable profile112of the device108, for example as stored in a SIM/USIM/UICC, contains similar or identical data.

A transportable deployable profile114may be encrypted and digitally signed by the backend system104to provide security and establish trust when a device108presents a transportable deployable profile114to a deployable system106. A transportable deployable profile114may be assigned a validity period. For example, start and end times may be associated with a transportable deployable profile114and the start and end times may be checked against a current time prior to using the transportable deployable profile114. A validity period may enhance security, in that compromised transportable deployable profiles114would only pose a risk for a limited time. Further, a validity period may also be used to enforce a scheduled scheme to export current transportable deployable profiles114to devices108.

A user profile included in a transportable deployable profile114may define application access information for a user of the wireless communications device108. Example user profile information includes a username, a password, a hash, a user's cryptographic key, biometric information, user roles, access permissions, preferences, personal information (e.g., name, telephone number, email address), and similar. In this embodiment, the deployable profile112of the device108, for example as stored in a SIM/USIM/UICC, does not contain these types of user profile data.

During the normal course of events, it is expected that the deployable profile112is used only when the deployable system106has been deployed, such as during an emergency incident. As such, use of the deployable profile112generally occurs less often than use of the WWAN profile110. If profiles are provided to the deployable system106in advance, so that the deployable system106may authenticate and authorize access to wireless communications devices108, there is a risk that any number of the profiles may be outdated, invalid, or missing for devices108that are relatively new to the system100. For example, profiles pre-loaded in the deployable system106may be associated with expired cryptographic keys or certificates, may be associated with devices108no longer is use, may be associated with users who no longer use devices108, or may be absent for devices108that have come into use since the profiles pre-loaded. In addition, various users carrying various devices may or may not attend the scene of an incident causing even well-planned profile preloading to fail.

To mitigate the above problem, each wireless communications device108transports its transportable deployable profile114to the deployable system106. The wireless communications device108obtains its transportable deployable profile114from the backend system104during normal operations, while the WWAN102is functioning normally. The transportable deployable profile114is stored on the device108in a non-useable form and the corresponding deployable profile112is not used. The transportable deployable profile114may be updated from time to time via the WWAN102, particularly to capture changes in data of a user profile. Then, at the time of an incident, the wireless communications device108moves to the geographic region where the deployable system106has been deployed and brings with it a relatively current transportable deployable profile114. The wireless communications device108sends the transportable deployable profile114to the deployable system106, which then provisions the wireless communications device108and its user on the deployable system106. The wireless communications device108and the deployable system106may then communicate on the basis of the transportable deployable profile114carried to the deployable system106and the deployable profile112already present at the wireless communications device108. The wireless communications device108serves as the delivery mechanism for its profile on the deployable system106. The deployable system106need not be pre-loaded with profiles that will potentially become stale. Moreover, any compatible wireless communications device108to be used with the deployable system106can bring its own transportable deployable profile114, so that the absence of a corresponding pre-loaded profile is no longer a problem.

In this embodiment, the backend system104includes a device export service120and a user export service122. The services120,122may be Representational State Transfer (RESTful) services operating via Hyper Text Transfer Protocol Secure (HTTPS). The device export service120is coupled to a database of device profiles124. The user export service122is coupled to a database of user profiles126. The databases124,126may store data representative of a set of devices and a set of users that could potentially be provisioned to the deployable system106. Each wireless communications device108thus may obtain from the respective service120,122its device profile and user profile, as one or more transportable deployable profiles114, for future use by the deployable system106. Transportable deployable profiles114are communicated to devices108through the WWAN102. Hence, at any suitable time that a device108has connectivity to the backend system104through the WWAN102, the device108may obtain a transportable deployable profile114in preparation for any future use of the deployable system106.

Further, in this embodiment, the deployable system106includes a device import service130and a user import service132. The services130,132may be services accessible to wireless communications devices108via a local connection interface. Example local connection interfaces include a wired connection, such as a serial bus, a local wireless connection, such an Institute of Electrical and Electronics Engineers (IEEE 802.11) Wi-Fi network, deployable wireless networks that are configured to provide limited access to devices prior to importation of transportable deployable profiles, and deployable wireless networks in general for transmission of transportable deployable profiles114that contain user profile data and not device profile data, which is needed to connect to a deployable wireless network. The device import service130is coupled to a database of device profiles134. The user import service132is coupled to a database of user profiles136. The databases134,136store data that are representative of devices and users that have been or will be provisioned on the deployable system106. This data may represent a subset of devices and users stored in the databases124,126at the backend system104. When a wireless communications device108is to use the deployable system106, the device108may provide to the respective service130,132its device profile and user profile, as one or more transportable deployable profiles114. Transportable deployable profiles114may be communicated to the deployable system106through the local connection interface, so that the transportable deployable profile114may then be used by the deployable system106to provision the device108to grant and control access of the device108to the wireless network provided by the deployable system106.

To facilitate import and export of profiles, a profile stored in a database124,126,134,136may be uniquely associated with a wireless communications device108through a unique identifier of the device108, such as any of the aforementioned unique identifiers. Additionally or alternatively, a profile stored in a database124,126,134,136may be uniquely associated with a user via user identity information, such as that discussed above.

In operation, a given wireless communications device108connects to the WWAN102, and authenticates using its WWAN profile110, so that it can communicate with other devices108and utilize services, including any services provided by the backend system104. During such time, in accordance with any number of methodologies discussed herein, the wireless communications device108obtains a device profile, a user profile, or both (generally described as a transportable deployable profile114) from an export service120,122for potential future use with the deployable system106. Should there be more than one different deployable system106, the device108may obtain a corresponding transportable deployable profile114for each such deployable system106. When the deployable system106is put into operation, such as during an emergency incident, and the wireless communications device108is to be used with the deployable system106, then the device108transmits the transportable deployable profile114to the deployable system106through a locally connected import service130,132. The deployable system106may then use the transportable deployable profile114to provision the device108on the wireless network provided by the deployable system106and communications may be made on the basis of the deployable profile112at the device and the transportable deployable profile114provided to the deployable system106. The device108may then be used wirelessly in conjunction with the incident.

FIG. 2shows an embodiment of a deployable wireless communications system106. The deployable system106includes a processor200, memory202, a wide-area wireless interface204, an antenna206, a local connection interface208, and an input/output (I/O) interface210. The I/O interface210may include a bus or similar subsystem to provide for communications among the components of the deployable system106.

The processor200is connected to the memory202and the I/O interface210. The processor200may include a central processing unit (CPU), a microcontroller, a microprocessor, a processing core, a field-programmable gate array (FPGA), or similar device capable of executing instructions. The processor200may cooperate with the memory202to execute instructions contained in the memory202.

The memory202may include a non-transitory machine-readable storage medium that may be any electronic, magnetic, optical, or other physical storage device that stores executable instructions. The machine-readable storage medium may include, for example, random access memory (RAM), read-only memory (ROM), electrically-erasable programmable read-only memory (EEPROM), flash memory, a storage drive, an optical disc, and the like. The machine-readable storage medium may be encoded with executable instructions. The memory202may include volatile memory, non-volatile memory, or both.

The wide-area wireless interface204and antenna206may be connected to the I/O interface210to communicate with the other components of the deployable system106. The wireless interface204and antenna206may implement a deployable wide-area wireless communications network, such as an LTE network, a WiMAX network, a HSPA+ network, a UMTS network, a GPRS network, or similar. Because the system106is deployable, its wide-area wireless communications network may include only one access point, namely, the wireless interface204. However, it is contemplated that multiple deployable systems106may be linked to form a deployable wide-area wireless communications network having multiple access points provided by the multiple wireless interfaces204.

The local connection interface208is distinct from the wide-area wireless interface204and antenna206and may include a Universal Serial Bus (USB) interface, a Wi-Fi interface, or similar wired or wireless local connection. The connection interface208may be considered a side channel through which data can be communicated with the deployable system without access to the wireless interface204. This side channel may be secured by requiring physical access to the deployable system106or by a security scheme provided to the connection interface208(e.g., local username and password). The connection interface208and/or connection interface204is configured to communicate with a wireless communications device108to import its transportable deployable profile114as a condition for the wireless communications device108and/or its user to be provisioned on the deployable wide-area wireless network provided by the wireless interface204and antenna206.

In other embodiments, import of transportable deployable profiles114may be facilitated via an open-service wide-area wireless network provided by the wide-area wireless interface204and antenna206. An example of such is an open-service LTE network. Other kinds of deployable wireless networks that are configured to provide limited access to unknown devices may also be used. Further, the wide-area wireless interface204and antenna206may be used to communicate a transportable deployable profile114that contains user profile data and not device profile data that would be required to allow communications with the wide-area wireless interface204and antenna206. In such embodiments, the connection interface208may be omitted.

The processor200is configured to execute instructions to control the antenna206and wireless interface204to provide a deployable wireless network and to control access to the deployable wireless network according to profiles134,136stored in the memory202.

The processor200is further configured to execute instructions to provide the device import service130and user import service132stored in the memory202. The service130,132is configured to import into the memory202device and/or user profiles carried by wireless communications devices108.

The processor200is further configured to execute instructions to provide a provisioning service220that accesses the profile databases134,136and provisions wireless communications devices108with the device and/or user profile brought by the device108, so as to grant and control access of the device108to the deployable wireless network implemented by the wireless interface204and the antenna206.

The processor200may further be configured to execute instructions to provide a cryptographic service222that may be configured to decrypt imported profiles for the import services130,132, to authenticate imported profiles by checking digital signatures of the profiles, or both. Authentication of an imported profile may be a condition to granting access to the respective device108to the wide-area deployable wireless network. In public-private cryptographic examples, the cryptographic service222may store or be configured to obtain a public key corresponding to a private key held by a backend system104.

The processor200may further be configured to execute instructions to provide any number of services224operable via the deployable wireless network provided by the deployable system106. Such service224may be linked to deployed user profiles136. Examples of such services are discussed elsewhere herein and include email, database access, and the like. For example, a deployed user profile containing email account information may be required to provide an email service to a particular user of a device108.

FIG. 3shows an embodiment of a backend system104. The backend system104includes a processor300, memory302, a network interface308, and an I/O interface310. The I/O interface310may include a bus or similar subsystem to provide for communications among the components of the backend system104.

The processor300is connected to the memory302and the I/O interface310. The processor300may include any of the kinds of processors discussed elsewhere herein to cooperate with the memory302to execute instructions contained in the memory302. The memory302may include a non-transitory machine-readable storage medium, such as a volatile memory, non-volatile memory, or both, of any of the kinds discussed elsewhere herein.

The network interface308may include any wired or wireless interface to connect the backend system104to a network, such as the WWAN102, a network connected to the WWAN102, the internet, or similar.

The processor200is configured to execute instructions to provide an export service, such as a device profile export service120and a user profile export service122, to export from the memory302a transportable deployable profile114to a wireless communications device108. The transportable deployable profile114may be one or more of a device profile and a user profile stored in respective databases124,126to grant and control access of the device108to a deployable wireless network, such as that provided by a deployable system106. The export service may be configured to export transportable deployable profiles114to devices108via network interface308and the WWAN102(FIG. 1).

In various embodiments, the export service120,122may be configured to export transportable deployable profiles114automatically without user interaction. This may include a scheduled export process, an opportunistic export process, or similar. In an example scheduled export process, a transportable deployable profile is exported and transmitted to the respective device108according to a configurable schedule, such as once per week, once per day, the first of every month, or similar. In another example scheduled export process, a transportable deployable profile has an expiry time, and a replacement transportable deployable profile is exported and transmitted to the respective device108when the expiry time is reached. In an example opportunistic export process, a transportable deployable profile is exported and transmitted to the respective device108as triggered by the device meeting a specific criterion, such as connecting to the backend system104, accessing a specific service provided by the backend system104, and similar.

In various embodiments, the export service120,122may be configured to export a transportable deployable profile in response to a user-initiated request received from the respective wireless communications device108. That is, the devices108may be provided with an application or access to a website, through which users may obtain transportable deployable profiles.

The processor200is configured to execute instructions to provide a cryptographic service322that may be configured to encrypt transportable deployable profiles to be exported by the export services120,122, to digitally sign transportable deployable profiles for export, or both. Encryption of a transportable deployable profile may use a key that is not accessible to the device108by which the transportable deployable profile is to be ultimately used. As such, the transportable deployable profile may be rendered unintelligible to the device108that carries it. Such an encrypted transportable deployable profile is then decrypted by the deployable system106at time of provisioning. This may help increase security for the deployable system106, should attempts be made to access a transportable deployable profile while it is being carried by a device108. In a public-private key encryption scheme, the backend system104may use a public key to encrypt transportable deployable profiles and the deployable system106may be provided with a corresponding private key to decrypt profiles. Regarding digital signing of transportable deployable profiles, the backend system104may sign profiles for export using a private key and the deployable system106may authenticate imported profiles using the corresponding public key.

The processor200may further be configured to execute instructions to provide backend services324to wireless communications devices108. Examples of such services are discussed elsewhere herein and include email, database access, and the like. Backend services324may be accessible to devices via WWAN profiles, deployable profiles, or both.

The backend services324and the services224provided by the deployable system106may be identical, may correspond, or may overlap. User profiles may provide user data to these services324,224, such as identity data, preferences, user contacts, talkgroup membership information, usernames, passwords, and the like. As such, it is advantageous for a transportable deployable profile114to be used to transport such data from the backend system104to the deployable system106. Each user carries his or her own user profile data for use with the deployable system106, should the need arise. In some implementations, users may experience a seamless or nearly seamless transition of services when activating their devices108on the deployable system106.

FIG. 4shows an embodiment of a wireless communications device108. The device108includes a processor400, memory402, a wide-area wireless interface404, an antenna406, a local connection interface408, an I/O interface410, a user interface device412, and a secure module414, such as a SIM/USIM/UICC. The I/O interface410may include a bus or similar subsystem to provide for communications among the components of the device108.

The processor400is connected to the memory402and the I/O interface410. The processor400may include any of the kinds of processors discussed elsewhere herein to cooperate with the memory402to execute instructions contained in the memory402. The memory402may include a non-transitory machine-readable storage medium, such as a volatile memory, non-volatile memory, or both, of any of the kinds discussed elsewhere herein.

The wide-area wireless interface404and antenna406may be connected to the I/O interface410to communicate with the other components of the device108. The wireless interface404and antenna406may be operable according to a technology such as LTE, WiMAX, HSPA+, UMTS, GPRS, or similar to connect with the WWAN102and the deployable wireless communications system106.

The local connection interface408is connected to the I/O interface410and is distinct from the wide-area wireless interface404and antenna406. The connection interface408may include a USB interface, a Wi-Fi interface, or similar wired or wireless local connection. The connection interface408is connectable to the connection interface208of the deployable system106, so that a transportable deployable profile carried by the device108may be sent to the deployable system106.

The user interface device412may be connected to the I/O interface410and may include a screen, a touchscreen, a button, a keyboard, a microphone, a speaker, and similar devices to provide for user interaction with the device108.

The processor400is configured to execute instructions to control the antenna406and wireless interface404to access a wide-area network using a profile stored in the secure module414. Such a profile is a WWAN device profile420when the device108is connected to the WWAN102and is a deployable device profile424when the device108is connected to a deployable system106.

In this embodiment, the secure module414is a memory card separate from the memory402. Such a card may be a SIM, USIM, UICC, or the like. The secure module414may be protected by an authentication protocol to prevent unauthorized access and its content, such as a profile stored therein, may be encrypted. In other embodiments, the secure module414is a portion of the memory402that may be encrypted and may have access controlled by an authentication protocol.

The secure module414may store a WWAN device profile420for use with the WWAN102. The secure module414may further store a deployable device profile424for use with the deployable system106. Further, any number of transportable deployable profiles may be stored in the memory402for transport to the deployable system106. In this example, the memory402stores a transportable deployable device profile422and a transportable deployable user profile426. Alternatively, the memory402may store a single transportable deployable profile that contains both the device and user profiles.

The processor400may further be configured to execute instructions to implement a profile utility430. The profile utility430may be configured to receive a transportable deployable profile422,426from a backend export service120,122of the backend system104, store the transportable deployable profile422,426in the memory402, and output the transportable deployable profile422,426to the deployable system106when the device108is to be provisioned at the deployable system106. When encryption is used, the profile utility430may be operable to receive, store, and output the transportable deployable profile422,426as an encrypted block of data that is unintelligible to the device108.

The processor400may further be configured to execute instructions to implement a graphical user interface (GUI)432to trigger a request for the transportable deployable profile422,426from the backend export service120,122of the backend system104in response to a user input at the user interface device412. That is, when the backend system104is configured to allow user self-service of transportable deployable profile422,426, the user interface device412may render a self-service user interface and handle related user input.

The profile GUI432may additionally or alternatively allow for user initiation or confirmation of output of the transportable deployable profile422,426to the deployable system106. That is, prior to a transportable deployable profile422,426being transmitted to the deployable system106by the side channel facilitated by the local connection interface408, the GUI432and user interface device412may be used to initiate or confirm such transmission.

As mentioned elsewhere herein, the transportable deployable device profile422may be exported to the deployable system106, so that the deployable system106and the device108may communicate on the basis of the profiles422,424. Further, the transportable deployable user profile424may be exported to the deployable system106, so that the deployable system106may be provided with user preferences, credentials, and other user data for services to be used on the deployable system106.

FIG. 5shows a method for exporting a transportable deployable profile to a wireless communications device. The method may be used with any of the devices and systems described herein or with other devices and systems. The method may be implemented by processor-executable instructions. The method begins at block500.

At block502, a wireless communications device108connects to a WWAN102using a WWAN profile110. The device108may be used normally to communicate with other devices108and to access services provided by the WWAN102.

At block504, the wireless communications device108connects to a backend system104via the WWAN102. The device108may access services provided by the backend system104.

At block506, when the device108is connected to the backend system104, a condition for exporting a transportable deployable profile114to the device108is checked. Example conditions include a device identity check, user identity check, schedule condition, an opportunistic condition, a user condition, and similar. A device identity check may include validating that the profile being exported is being sent to the device to which the profile belongs, for example, the device profile being exported is associated with a WWAN profile110already in the device108. A user identity check may include validating that the profile being exported belongs to the user of the device receiving the profile. A schedule condition may include the backend system104comparing an export time against an actual time. The schedule condition is met when the actual time meets or exceeds the export time. The export time may be a day of the week, a day of the month, a frequency, an expiry time of a previously exported transportable deployable profile114, or similar. An opportunistic condition may include the backend system104triggering export when the device108accesses a particular service, where such service may or may not be directly related to transportable deployable profile export. A user condition may include the backend system104receiving a user-initiated request from the device108to obtain a transportable deployable profile.

If the export condition is met, at block508, the transportable deployable profile114for the device108is exported to the device108and the method ends at block510. If the export condition is not met, then the method repeats. Prior to export, the transportable deployable profile114may be assigned a validity period, encrypted, and digitally signed. The method may be repeated continuously for any number of wireless communications devices108to continuously export updated transportable deployable profiles114to the devices108.

Further concerning encryption, when multiple deployable systems106are to be used by an entity, such as an emergency services agency, each deployable system106may be given a unique private key. At block508, encryption of transportable deployable profiles114would be performed using the corresponding public keys. Further, encryption of transportable deployable profiles114may also include using a symmetric key to obtain encrypted data that is then further encrypted using the corresponding public keys.

Alternatively, transportable deployable profiles114may be encrypted in transit. Export at block508may include use of an HTTPS link. Transportable deployable profiles114may be in the clear or encrypted by a key shared by the entity's deployable systems106.

FIG. 6shows a method of importing a transportable deployable profile into a deployable wireless communications system. The method may be used with any of the devices and systems described herein or with other devices and systems. The method may be implemented by processor-executable instructions. The method begins at block600.

At block602, a wireless communications device108carrying a transportable deployable profile114connects to a deployable wireless communications system106that has been deployed, for example, in response to an incident that affects a WWAN102that the device108would normally use. As the device108has not yet been provisioned on the wide-area wireless network operated by the deployable system106, the connection of the device108to the deployable system106may be via a side channel provide by a local connection interface, such as a USB or Wi-Fi interface, or another connection, such as an open-service LTE network connection.

At block604, initiation, confirmation, or both initiation and confirmation of transfer of the transportable deployable profile114from the device108to the deployable system106may be performed by either or both of the device108and the deployable system106. For example, a user of the device108may initiate transfer of the transportable deployable profile114. In such case, the operator of the deployable system106may provide confirmation of acceptance of the transfer via a user interface attached to the deployable system106. In another example, an operator of the deployable system106may initiate transfer of the transportable deployable profile114. In such case, the user of the device108may provide confirmation that the transportable deployable profile114is to be transferred via a user interface of the device108.

At block606, in response to the initiation, confirmation, or both, transportable deployable profile114is imported to the deployable system106. The transportable deployable profile114may be decrypted and authenticated. Further, any validity period for the profile may be checked. The transportable deployable profile114may be discarded if authentication fails or if it is outside the validity period.

The decryption performed at block606corresponds to the encryption performed at block508(FIG. 5), and the description above may be referenced.

At block608, the transportable deployable profile114is provisioned, such that the device108is granted access to the deployable system106as established by the profile112. The method may be repeated for any number of wireless communications devices108to import transportable deployable profiles114of the devices108into the deployable system106, as needed.

It should be apparent from the above that numerous other embodiments fall within the scope of this disclosure. In various embodiments, rather than separate device and user profiles, one transportable deployable profile is used for a wireless communications device to connect to a deployable system, where such a transportable deployable profile has some of all of the characteristics of the device and user profiles discussed herein. In various embodiments, a wireless communications device may carry profiles for one or more other devices. That is, an export service exports multiple different transportable deployable profiles to one device so that the device may output such profiles to a deployable system. This may allow for one device carry profiles for and facilitate provisioning of numerous other devices and users.

Systems and devices implemented according to this disclosure may provide various advantages. For example, a deployable system may not need to be pre-loaded with profiles for devices which may or may not ever use the deployable system. Each device may obtain and carry its own relatively current transportable deployable profile, so that if use of the deployable system is required, the device can provide its own transportable deployable profile. Further, the deployable system may be better able to handle unexpected devices and users, even devices and users who would not normally be expected to use the deployable system, provided they bear a valid transportable deployable profile.