Tune control for shared access system

Devices and methods are provided for implementing a shared radio frequency spectrum allocation system. Access points and end user devices in an Authorized Shared Access System are allowed to access a channel of the shared radio frequency spectrum managed by an Authorized Shared Access System controller. Access points provide a communication, or frequency, channel over which similarly configured end user devices obtain access to data networks for client devices. Secure access to the allocated channel of the shared radio frequency spectrum is provided, thereby preventing rogue devices from gaining uncontrolled, or unauthorized, access to a channel of the shared radio frequency spectrum that may result in interference with other users of the channel including higher priority users. A secure synthesizer and secure encrypted tuning control words uniquely and securely control local channel usage.

BACKGROUND

In recent years, radio frequency spectrum has become available for use by the general public that was typically reserved for exclusive use by government entities or large entities. Typically, when radio frequency spectrum is made available, the Government licenses segments or bands of spectrum in various areas of a country for particular users. This method of purchasing licenses to radio frequency is similar to purchasing specific seats at baseball game, the tickets of the seats behind home plate are specifically sold by the row and seat number. In the past, spectrum was offered to enterprises in sets of specific frequencies in the available spectrum, such as, for example, 20 MHz, −22 MHz, 22.001 MHz-24 MHz, and so on.

However, a present proposal would authorize a single channel (or set of channels) within an available range of frequency bands in a shared radio frequency spectrum model. In this shared radio frequency spectrum model, a single smaller channel (or set of channels) could be at any frequency within the recently made available larger frequency band. In other words, a license can be purchased for a 10 kHz channel in the frequency range of 20 MHz-22 MHz. Under the license, any device would be allowed to operate within the 20-22 MHz range, but only on an assigned 10 kHz channel within the range. This new licensing proposal is like a general seating arrangement in a baseball stadium, where an outfield general seating ticket is purchased and the ticket holder is seated anywhere the usher directs so long as it is in the outfield bleachers section of the baseball stadium, as opposed to a previously designated specific seat. In other words, the user does not choose a specific seat in a general seating arrangement.

A need exists, however, for a technique to protect the licensee's use of the band of frequency channels from interference or other adverse effects caused by others' unauthorized use of the various channels and to keep the authorized users on their assigned channels. The inventor has identified the need for an authorized shared access system that implements a secure method for reporting the access point identification (secure ID), for reporting a GPS derived location (secure location reporting), and for receiving a secure tuning control word (an encrypted synthesizer tuning command) to securely select a channel at the GAA AP or GAA EUD device.

DETAILED DESCRIPTION OF EXAMPLES

The Federal Government has proposed making radio frequency spectrum (e.g. 100 MHz within the 3.5 GHz range) that is currently reserved for government and military uses to commercial vendors available for use on a shared basis. For example, the radio frequency spectrum that is to be shared by other users as well as the government users is in the frequency ranges typically used for military or air-traffic radars (airborne and ship-borne), air-ground/ground-air communications, and other uses, which are often intermittent uses. None of the Federal Government uses are full time uses of radio frequencies within the radio frequency spectrum that is to be shared with commercial and unlicensed users. As a result, there are periods of time, which, depending upon location, may be of a long duration, in which a swath of radio frequency spectrum is unused. A purpose of the spectrum sharing is to allow non-Federal Government users to make use of this unused radio frequency spectrum until the Federal Government (i.e. higher priority) users need to use it. For example, users in a coastal region may use frequency spectrum typically reserved for US Navy radar systems until a US Navy ship enters the region and needs the to use the ship-borne radar in the reserved frequency spectrum.

Due to the different levels of use of radio frequency spectrum in different areas of the United States, instead of large geographical regions, such as entire states, there may likely be pockets of coverage areas in which the radio frequency spectrum may be used. For example, as shown inFIG. 1, the shared radio frequency spectrum may be shared in one or more coverage areas110A-I spread over a large geographical region under the control of an authorized shared access system and database (ASAS)105. The ASAS105would allow the sharing of the radio frequency spectrum on a priority basis between three tiers of users in the different coverage areas110A-I.

For example, the first tier (Tier 1) users, having the highest priority would the government and military incumbent operations. The next tier (Tier 2) would be Priority Access/Commercial Wireless Network Providers (e.g. Verizon®, AT&T® and the like), who would have mid-level priority. The third tier (Tier 3), with the lowest priority, would be for General Authorized Access (GAA) users. Tier 1 users are assumed to have full access whenever needed or desired. The ASAS105is the system that manages the allocation of the shared radio frequency spectrum to the various Tier 2 and Tier 3 users based on the use of the band by higher-priority Tier 1 users. The ASAS105may be a system of one or more controller(s)106and one or more database(s)115, all of which may receive data from various Tier 1-3 users. The database115may be populated with data regarding the expected use of the shared radio frequency spectrum. For example, a shared access spectrum regulating body, such as a Federal Government agency, a quasi-government agency, or a private regulator, may receive input, such as scheduled or expected spectrum usage and locations of the scheduled or expected usage from the various Tier 1 and 2 users. This input may be received months, days, or hours ahead of time to allow efficient management of the shared access spectrum. The one or more controllers106communicate with the database115to determine the availability of spectrum to be shared and the locations in which the spectrum may be shared. Based on this information, the ASAS105can make determinations of the channels used, coverage areas110A-I size and durations.

The coverage areas110A-I may be larger in more rural areas (e.g. measured in square miles) and smaller in urban settings (e.g. measured in square city block(s)). In addition, the coverage areas110A-I inFIG. 1are areas in which the radio frequency spectrum to be shared is used by the Tier 1 and Tier 2 users without interference. For example, the database may indicate that the Tier 1 and Tier 2 users in Dickinson County, Iowa, USA are not using frequencies in the shared radio frequency spectrum for several days. An ASAS controller106of the ASAS105upon receiving a request from a Tier 3 device in the vicinity of Dickinson County for access to an available frequency in the shared radio frequency spectrum may determine if any of the shared radio frequency spectrum is available to be shared. Using information obtained from a database115regarding the Tier 1 and Tier 2 users, the ASAS controller106identifies an available channel within the frequency band for use by Tier 3 users in a coverage area that includes the requesting device in the vicinity of Dickinson County, Iowa. The ASAS controller106of the ASAS105provides an encrypted, secure code word indication of the identified channel and an expiration time of the requesting Tier 3 devices granting access to the identified channel. An expiration time is included, for example, because the database may indicate, after some time, that a Tier 1/2 user may need access to the identified channel in Dickinson County, Iowa. In which case, the requesting Tier 3 device may be moved to another available channel, or completely disconnected, in favor of the Tier 1/2 user.

As shown inFIG. 2, the ASAS105may control, via one or more ASAS database(s)115and one or more ASA controller(s)106, the determination and management of the channels within the shared radio frequency spectrum and within the coverage areas210A-B. In this example, the radio frequency channel is allocated to the Tier 1 (Government/military user) and, under a license, to a Tier 2 (commercial) user for non-interfering use (i.e. Tier 1 and Tier 2 users use the radio frequency spectrum without interfering with one another). The ASAS105is coupled to an ASA database115that stores data related to the use of the shared radio frequency spectrum by the higher tiered users and also the locations of lower tier users, who will be discussed in more detail in the following paragraph.

The ASAS105is configured to implement spectrum sharing paradigms that may allow a Third Tier (Tier 3-GAA, General Authorized Access) set of users to share a frequency band by having timed access or managed access to allocated radio frequency channels along with Tier 1 (government and military incumbent operations) and Tier 2 (Priority Access/Commercial Wireless Network Providers) without interfering with the Tier 1 and Tier 2 users. The Tier 3 users may be unlicensed, which means that any Tier 3 user may use the available spectrum without guaranteed further protection from interference from other GAA users. Examples of GAA users may be a retail store, a local delivery truck service, hand-held radio service, a rural town or rural county non-essential governmental service entities (e.g. animal control, social services, and the like), small businesses, colleges, universities, individuals or others that need or want only intermittent connectivity to a data communication network. The types of data that can be transmitted over the data communication network include document data (e.g., document files, spreadsheets and the like), audio data, multimedia data, image data, sensor data (e.g., water levels, electricity usage, roadway conditions, and the like), video data, voice data and the like. In addition, control signaling data (e.g. data for establishing communication sessions, providing connected device status information and the like) may be exchanged between the ASAS system105and any of the GAA user devices using the shared spectrum.

Geographical areas within the radio frequency coverage regions allocated for use by the Tier 1 and Tier 2 users may have smaller coverage areas carved out for use by Tier 3 users, such that the Tier 3 users will not interfere with use of the spectrum by the Tier 1 and Tier 2 users in the remaining area of the coverage area. For example, as shown inFIG. 3, under control and management (described in more detail later) of the ASAS105, the shared radio frequency spectrum channels allocated to the Tier 1 or, under license, to Tier 2 users in certain coverage areas, such as210A and210B, may have smaller coverage areas, such as310A-C, within respective coverage areas210A and210B in which specific radio frequency channel(s) is (are) temporarily turned over to Tier 3 users for non-interfering use. For example, the ASAS database115maintains and stores updates of shared radio frequency spectrum channel allocations, Tier 1/2/3 device locations and activity as well as potential future activity. The methodology used by the ASAS105to determine the smaller coverage areas310A-C will be described in more detail below.

The ASAS system105may have stored in the ASAS database115information related to when the Tier 1 and Tier 2 users are scheduled to use frequency channels (which may be all available channels) of the shared radio frequency spectrum in a particular location. Based on this data in the ASAS database, the ASA controller106may assign respective areas, e.g. coverage areas210A and210B as shown inFIG. 2. Under control of the ASAS system105, the shared radio frequency spectrum may be shared in respective coverage areas in a more efficient, and non-interfering manner.

In the spectrum sharing paradigms that may be implemented, the unlicensed Tier 3 users may have the following impact. Firstly, the unlicensed Tier 3 access points (APs) and end user devices (EUDs) will likely operate at low power commensurate with FCC regulation part15related to unlicensed device power levels. Secondly, the Tier 3 APs and EUDs are not under the direct control of a wireless service provider network (WSPN). Examples of WSPN include cellular carriers that provide global system for mobile communication (GSM) systems, code division multiple access (CDMA) systems, universal mobile telecommunications systems (UMTS), or long term evolution (LTE) systems for data and voice communications. A WSPN wireless air interface (WAI) typically has a separate control layer that controls authentication of handsets, billing and identification information, air interface resource control (channel allocation), and management of the interface to the wireless network, and a separate data layer that handles the exchange of data between devices. However, unlike GSM, CDMA, UMTS, and LTE WSPN systems, the Tier 3 users would be under a different WAI that may not have a control layer and a data layer similar to the WSPN layers. Instead, a Tier 3 AP or EUD would be more similar to a Wi-Fi air interface, where there is neither a centralized wireless network control plane nor an organized wireless network.

For Tier 3 devices, this lack of a centralized WSPN control plan raises a number of issues in the context of sharing spectrum between Tier 1, 2 and 3 users. For example, sharing may require the use of an Authorized Shared Access System (ASAS) controller and database system105to properly allocate spectrum regions, in order to share the resources among different tiers of users, and also, more importantly, to avoid co-channel interference. The ASAS system105with reference to the ASAS database may allocate frequency channels of shared spectrum based upon the requests for allocation (time, amount of spectrum desired, and, most critically, the location). Location is important to assure that the channel allocation does not interfere with any higher priority users operating in the vicinity of the location. Based upon location, the ASAS system105may use a propagation model to determine how large any keep-out zones (see KO areas ofFIG. 3) would need to be around the co-channel Tier 1 and Tier 2 users to protect the higher priority users from Tier 3 interference. Outside this keep-out zone radius, the same channel allocation could be reused (frequency reuse) by other users in any of the Tiers 1-3.

The ASAS system105when determining keep-out (KO) zones could use either a database approach or a spectrum sensing approach. In the database approach, the ASAS system105database may include Tier 1, Tier 2 and Tier 3 device locations, respective device parameters, such as signal power levels, assigned channels, and the like, and apply signal propagation models based on known or expected power output levels of the respective devices in a proposed coverage area to determine whether a requesting Tier 3 device can be granted access to available spectrum and also the extent of the coverage area provided for the requesting Tier 3 device. Based on the results of the determination, the ASAS105controller may grant or deny access to the channels by the requesting Tier 3 device. In the spectrum sensing approach, the Tier 3 APs and/or Tier 3 EUDs could use scanning receivers to measure the channels of interest and report back to the ASAS105controller measurements that indicated whether or not interference from other co-channel users was detected at their present location. Also, a hybrid approach could be employed, where both the database (using a propagation model calculation) along with spectrum sensing reports from the Tier 3 AP/EUDs are used in combination to determine the keep-out zones for the respective coverage areas310A-C. For example, the KO zone for coverage areas310A may be different from the KO zone for coverage areas310B and310C. The size of the KO zone may be determined by the ASAS105based on the above-mentioned database propagation models, spectrum use measuring or the hybrid approach. Database and propagation calculation methods have the advantage of simpler methods and algorithms based purely on location information, but precise prediction of RF propagation is notoriously inaccurate. It can be quite complex to have all the data (local terrain data, building locations, locations of trees, dielectric and conductivity constants, etc,) in order to accurately calculate local propagation. On the other hand, spectrum sensing requires additional hardware capabilities at the various radio stations and also a set of standardized communications interfaces (across dissimilar air interfaces and hardwares) to allow the ASA system to request measurements, receive the measurement reports, and properly store and map the results. These measured results are more accurate in that they include all local effects, such as the presence of buildings, whether local foliage has leaves, etc, and therefore includes all the real world effects, regardless of whether they are included in a theoretical propagation model. Once the database propagation models or the spectrum sensing indicates unoccupied spectrum, that channel or set of channels could be allocated for serving the requesting Tier 3 GAA user.

An example of an access point and an end user device implementation that would provide shared radio frequency spectrum coverage for lower priority users in an authorized shared access system is shown inFIG. 4. Generally, the ASAS105has determined that a Tier 3 coverage area310A is available for non-interfering use of the shared radio frequency spectrum based on various parameters of the Tier 1, Tier 2 and requesting Tier 3 devices. The requesting access point (AP)410is allocated an available channel (a channel or channel set that is within the frequency band in which the AP410is to operate), and begins operating on the indicated channel. Also, the AP410is configured to forward the indicated channel as well as other parameters, such as maximum signal power levels and the like, to the AP's associated end user (EU) devices412, which can begin communicating with the access point410on the allocated channel. In addition, the ASAS105may determine a KO zone relative to the coverage areas310A where this specific, allocated channel will not be allocated for use by any other users. The operation of the access point410and end user devices412will be described in more detail below.

In order to protect Tier 1 and Tier 2 users in a shared spectrum system from rogue behavior on the part of Tier 3 GAA users and devices (APs410and EUDs412), three mechanisms are secured. First, the identity of the Tier 3 user making the request for a spectrum allocation is securely known. Therefore, the user identification protocols are encrypted, such that the ASAS cannot be spoofed by a Tier 3 device faking another identity. Second, the Tier 3 AP reports its valid location for interference determination (e.g., keep out radius). For example, the protocol should mitigate against a problem such as when the AP is actually in New Jersey, but provides a location in Alaska, so the ASA controller may give access to channel XYZ, which may be properly available for use in Alaska, but that is already in use in New Jersey. As a result, the spoofing New Jersey based AP is mistakenly allocated a channel that is clear for non-interfering use in Alaska, but heavily used in New Jersey. In which case, the rogue New Jersey device interferes with other users in Tier 1/2/3. That location report to the ASAS is based upon an internal GPS within the AP, so the AP can accurately determine and report its own location. That location report to the ASAS controller is secure, so the report is encrypted, again to avoid the possibility of spoofing the ASAS105as far as location reporting is concerned. In an example, encryption takes place within a secure ASIC implementation within the GPS reporting system, and not under the control of firmware or software executing on the local microprocessor within the AP device. And, thirdly, the Tier 3 AP and EUD devices are not able to autonomously tune their own RF synthesizers for channel tuning.

FIG. 5Ais a high-level functional block diagram of an example of a system including an access point implemented in a time division duplex (TDD) configuration for providing access to shared radio frequency spectrum for end user devices. The system500may include an AP device501A, a data network107, an authorized shared access (ASA) controller106and data servers103. The data servers103provide data and other services to devices (e.g. AP501and EUD) and systems that access the data network107. Also, connected to data network107is the ASA controller106, which is part of the ASAS105described above with respect toFIGS. 1-4. The ASA controller106has access to the database and other resources of the ASAS105(e.g. implemented on a database server(s)104in this example). The ASA controller106may determine the frequency band that will be allocated to the requesting AP501A from the available frequency bands in the shared radio frequency spectrum. In addition, the ASA controller106may determine the extent, if any, keep-out zones and the transmit power settings of the AP501A and any connected EUD. The ASA controller106is able to communicate with the AP501A through the data network107via a communication channel (e.g., Wi-Fi, fiber optic, coaxial cable and the like) that is different from the shared frequency spectrum.

The TDD AP501A includes a transmitter (XMITTER)510, a duplex switch520, a synthesizer530, a receiver (RCVR)540, a local controller550A, a GPS receiver/reporter560, and a band pass filter570. Under control of the local controller550A, the AP501A performs routing functions typical of, for example, a Wi-Fi router or other type of signal router, but only in the channel allocated by the ASA controller106. Similar functionality is also envisioned for access points or end user devices that are implemented in frequency division duplex (FDD) systems, which will be discussed in more detail with reference toFIG. 5B.

The AP501A is an access point for connecting EUD (not shown) to the data network107and the data servers103. The AP501A and any of its served EUDs (which communicate with the data network via to the AP501A within the Tier 3 coverage area) communicate in the channel (or channel set) allocated by the ASA controller106. The AP501A may connect to an external network, such as the data network107, via a connection through an interface that is wired or wireless. If on a wireless interface, the connection is via a frequency spectrum band separate from the frequency band or channel used by the wireless AP501A to connect to an end user device or the like. The data network107may be any form of data network, such as the Internet, an intranet, a campus-wide LAN, metropolitan LAN or other form of data network that allows an external managing controller, such as ASA controller105, to communicate with the AP501A. Data signals, shown by the heavier lines labeled “Data,” are delivered from the data network via data connections (not shown) to the AP501A. The data from the data servers103and may be provided through the data network107to the AP501A via a wired (e.g. coaxial cable, fiber optic cable or otherwise hard-wired connection) or wirelessly, via a cellular connection, Wi-Fi, Bluetooth or some other wireless format in a frequency range outside the shared radio frequency spectrum. The AP501A, in an example of time division duplex (TDD) communications, simply passes data, via the transmission path that includes the transmitter510, the switch520, and the band pass filter (BPF)570, and an airlink (not shown), to an EUD that has requested the data. The AP501A is also configured, in a TDD implementation, to receive data from EUD user devices on the same channel that the AP501A uses to transmit. The AP501A receive channel includes the airlink to the AP device antenna, which is coupled to the BPF570, the BPF570, the switch520(configured to a receive state), receiver540, and the AP data output connections to the data network and data servers103.

The local controller550A of AP501A also distributes control signals within the AP501A based on signals received from the ASA controller106. The ASA controller106is coupled to the data network107, and transmits and receives control signals to/from multiple APs, such as AP501A, connected to the data network107, or other networks (not shown) that connect to the data network107. The AP501A through connections to the data network107, such as, for example, via a control connection with the external network, such as data network107, is configured to receive control signals from the ASA controller106. The control signals from the ASA controller106are received by the local controller550A and are either processed, or, in the case of the encrypted, secure control word, simply passed through to the secure synthesizer530. Control signals that are processed by the local controller550A may be status signals related to the status of the transmitter510, switch520and the receiver540, or requests for retransmission of the AP501A secure ID, and the like.

The secure synthesizer530is implemented, in some examples, as a dedicated secure ASIC and includes a processor (not shown) and a memory (not shown). The synthesizer530has control signal connections to the local controller550A for receiving the encrypted secure control word, to the transmitter510for providing a tuning signal for transmitting data in the transmit frequency band indicated in the encrypted secure control word, and to the receiver540for providing a tuning signal for receiving data signals in the receive frequency band indicated in the encrypted secure control word. Because of the possibility of interfering with the Tier 1 and Tier 2 users within the shared radio frequency spectrum, the secure synthesizer530is be implemented in a secure configuration in which the ASIC hardware or microprocessor firmware (or software stored in memory) cannot be re-written (i.e. re-flashed) to alter the behavior of the secure synthesizer530processor. In an example, only one type of secure synthesizer530is used in all access point devices, including AP501A, and includes program instructions for a secure synthesizer530ASIC or processor to execute a tuning encryption/decryption method that is used so that the ASA controller106need only apply one set of coded (encryption/decryption) methods to all intended individual Tier 3 user APs. The interface between the secure synthesizer530and the local controller550A may be via an inter-integrated circuit (12C), a universal asynchronous receiver/transmitter (UART), and universal serial bus (USB), or the like.

In this example, the secure synthesizer530processor executes program instructions retrieved from a memory accessible only by the secure synthesizer530processor to decrypt the encrypted, secure control word provided by the local controller550. Using the decrypted secure control word, the secure synthesizer530itself tunes the transmitter510and the receiver540to a channel indicated by the decrypted secure control word, which was provided as an encrypted secure control word by the ASA controller106.

When the ASA controller106is determining the channel allocation, the transmission permission parameters and other parameters (e.g. transmit power levels) for each of the respective APs, such as AP501A, the ASA controller106consults the database of the ASAS105to determine the availability of channels and the locations of higher priority Tier 1 and Tier 2 users. For example, the ASA controller106uses AP location information to check for possible interference conditions to/from higher priority users (e.g. the Tier 1 or Tier 2 users) based upon the KO zone area (SeeFIGS. 3 and 4) determined using different techniques, (such as the signal propagation model, an interference model, spectrum monitoring data provided in some examples, or a hybrid technique that uses a combination of both) and information in the ASAS105database. As a result, the location of the AP501A in a respective coverage area, such as coverage area310A, is one parameter for appropriate allocation of the frequency channels in the shared radio frequency spectrum. Other parameters may include signal power levels of other Tier 1/2/3 devices in the vicinity of an AP requesting access to available shared radio frequency spectrum.

The location determining and reporting functions of the AP501A are performed by the GPS receiver/reporter560. Location information of the local EUD served by the AP are assumed to be ‘local’ to the serving station (either the serving Access Point or the serving Small Cell).

The GPS receiver/reporter560is a secure AP501A component that communicates with the ASA controller106in a dedicated GPS communication pathway separate and secure from the communication pathway(s) established between the local controller550A and ASA controller106. In other words, the GPS receiver/reporter560is a position (i.e. location) determination component of the AP501. The GPS receiver/reporter560automatically determines location (i.e. position) information for the AP501A, and reports (i.e. conveys) the location information to the ASA controller106via the separate and secure communication paths. For example, the GPS location information report related to the AP501A is generated within a secure application-specific integrated circuit (ASIC) (with encryption all the way to the ASA controller106). The GPS receiver/reporter560is configured with encryption circuitry as well as a GPS receiver and a transmitter (i.e. reporter).

In another example, the GPS reporter560is not implemented on a conventional controller microprocessor controlled by a firmware (or software) image, because firmware or software can be re-written (reflashed) to alter the behavior of the devices' controllers (i.e. to prevent ‘hacking’ or ‘cracking’ of the hardware device in the GPS receiver/reporter560). The determination of the AP501A location or the subsequent encryption of the location is not performed by a microprocessor controller (within the GPS receiver/reporter560) under software or firmware control to minimize the risk of re-flashing to crack control and allow false location reporting. A GPS chipset (not shown), which may include a processor, GPS antenna, and other circuits, within the GPS receiver/reporter560provides the functions of measuring satellite signals and location determination. Additional circuitry, such as digital logic circuits, is configured to provide encryption of the location determination by the GPS chipset, to generate an encrypted GPS report (secure encryption method), and transmit (i.e. convey) the encrypted GPS report to the ASA controller106. The encrypted GPS report remains encrypted until received by the ASA controller106. For example, only the ASA controller106has the capability (e.g. private decryption key) to decrypt the transmitted, encrypted GPS report. By transmitting the GPS report in an encrypted manner separate from the local controller's550formatting and control, and directly (i.e. without being decrypted by any intermediary device or process prior to delivery to the ASA controller106) to the ASA controller106, the local controller550A of the AP501A cannot alter the encrypted GPS report, or be used to spoof the determined location (report a false location) of the AP501A. This avoids circumventing the ASAS105channel allocation of the available channels from the shared radio frequency based upon the real location of the AP501A. As a result, in an example, the AP501A does not include an input for a GAA user to enter initial location information. Instead, the system relies on secure reports from the GPS receiver/reporter560. Also, the GPS receiver/reporter560may provide location reports to the ASA controller106at different times. For example, the GPS receiver/reporter560transmits location reports of the AP501A, after the occurrence of an event, such as a request to download content that will consume bandwidth, shutdown of the AP501A local controller550A, just prior to start up, or similar events; or upon specific request by the ASA controller106. In some examples, the GPS receiver/reporter560provides location report updates to the ASA controller106over time, which may or may not be periodically. In this manner, if the AP501A unit is moved, the ASA controller106will automatically know the new location via the secure GPS report from the GPS receiver/reporter560without user intervention.

Operation of the AP501A will now be discussed in more detail. Prior to the AP501A establishing or maintaining a communication session with a served EUD (not shown), in response to a request from an EUD for data services received via the receiver RCVR540, the AP501A local controller550generates an access request that includes a secure identification (ID) of the AP501A, and that is transmitted to the ASA controller106in a communication channel, different from the communication (i.e., frequency) channel used by the AP501A to communicate with a EUD, established through the data network107with the ASA controller106. The secure ID is an identifier that uniquely and securely identifies the AP501A to the ASA controller106. The ASA controller106may authenticate the AP501A by accessing a database (not shown) of the ASAS105(also not shown).

In an example, the ASA controller106is configured to, in response to the request from the AP501A, determine a free channel, make the channel allocation, and provide a secure tuning control word via a communication path through the data network107to the AP501A. The secure control word is used to ensure that the Tier 3 devices (e.g. GAA AP501A and any EUDs connected to the AP501A) are under the secure control of the ASA controller106and the ASAS105for both transmit permission and channel selection (i.e. synthesizer tuning). The secure control word, when locally (i.e. at the AP501A) decrypted, indicates a channel in a frequency band of the shared access radio frequency spectrum on which the AP501A is allocated to communicate, and provides an indication of when it is permissible for the AP501A to transmit to the EUD. The communication channel allocation, for example, expires after a limited amount to time to prevent unauthorized future use. The transmit permission may be a time period in which transmission by the AP501A or EUD will not interfere with other higher priority users or, simply to establish a communication protocol with the EUD and the ASA controller106. The encrypted secure control word may also include additional parameters such as a transmit power level of the AP501A and any EUD that connects to the AP501A.

At this point, a brief discussion of a format of a secure control word, or tuning token, may be appropriate. A secure control word may include a secure socket layer (SSL) or transport layer security (TLS) header and an encrypted token. The SSL/TLS header may include an IP header, SSL/TLS parameters and an optional hypertext transport protocol (HTTP) field. The SSL/TLS parameters provide for encryption of the data while in transmit from the ASA106controller to the AP501A and/or an EUD, and provide a satisfactory level of insurance of data integrity and confidentiality. Using the SSL/TLS parameters, the AP501A or EUD processor may perform mandatory server authentication using public key infrastructure (PKI) protocols and insure that the device delivering the secure control word has a properly built certificate chain, such as a X509v3 certificate, to validate. The key generation and exchange may be performed according to known methods that provide a suitable level of security and data integrity to prevent unauthorized decryption of the secure control word. Of course, non-PKI methods may be used.

Any application data protocol (e.g., JASON or Binary file) may be used when transmitting the secure control word, HTTP is often preferred due to the prevalence of the web services infrastructure. As for the encrypted token portion, the encryption used may be a symmetric encryption such as advanced encryption standard (AES) or triple data encryption standard (3DES). The encrypted token portion may include a number of data fields, such as a metadata field, a frequency field, a random number and signature field and a message authentication code (MAC) field. Each field may include encrypted data relevant to tuning the AP secure synthesizer530to a suitable frequency. For example, the metadata field may include information such as a secure control word expiration date, a time and date and the relevant client and server identifiers (e.g., session identifiers, geo-location data and the like). The frequency field may include the frequency to which the synthesizer (and accordingly the transmitter and receiver) are to be tuned. The random number and signature field may include a random number generated from a secret encryption key (introduce entropy) that may be signed with a private key for authentication. The MAC field may be used for confirming the secure control word payload by using, for example, a hash-based message authentication algorithm or other suitable algorithm.

In an example of the secure control word workflow at the AP501A, the local controller550provides the IP address of the ASA controller106to the secure synthesizer530processor, and an SSL/TLS tunnel is established between the secure synthesizer530processor and the ASA controller106via the local controller550. The local controller550may be configured to handle all network operations of the secure synthesizer530, so complexity of the secure synthesizer530processor may be reduced. The ASA controller106delivers a status message to the secure synthesizer530processor. In return, the secure synthesizer530processor requests a frequency channel allocation from the ASA controller106. The ASA controller106delivers the secure control word to the secure synthesizer530processor. The secure synthesizer530processor processes the secure control word by obtaining (e.g., parsing or otherwise extracting) the frequency information from the respective data fields (as described above) of the secure control word. The secure synthesizer530processor may or may not return an acknowledgement message to the ASA controller106. The ASA controller106either in response to the acknowledgement message or, after a certain time period, may signal to the local controller550that the session is terminated.

The encrypted secure control word is transmitted via a communication connection, such as a connection to the Internet that supports Internet Protocol based communications, from the ASA controller106to an input of the Tier 3 AP501A and to the AP secure synthesizer530. The AP secure synthesizer530is the only component in the AP501A that is capable of decrypting the secure control word. In other words, the encrypted secure control word is delivered to the secure synthesizer530in encrypted form, and at least in one embodiment has not been and cannot be unencrypted by any intermediary device between the secure synthesizer530of the AP501A and the ASA controller106. The secure synthesizer530tuning is kept under a purely hardware control mechanism, not under the control of local software or firmware resident in the local controller550microprocessor, to prevent, for example, the software or firmware from potentially being re-flashed, with the new, unauthorized software or firmware programming code that would allow the AP or EUD device to tune autonomously. This mitigates the threat of the AP device501A from being “hacked” and prevents the resulting potentially interfering use of the AP device501A or EUD device (not shown).

As an additional security measure, by allowing only the secure synthesizer530to decrypt the secure control word, the system500prevents other components, such as local controller550, of the AP501A (and subsequently the end user device (not shown)) from autonomously selecting their own transmit and receive channels and prevents the AP501A local controller550microprocessor software or firmware control from autonomously instructing the secure synthesizer530tune to transmit and receive channels outside those allocated by the ASA controller106.

In operation the system500, the ASA controller106is configured to respond to requests for access to a channel of the shared radio frequency spectrum received from APs, such as AP501A. The AP501A may have an address (e.g. uniform resource locator (URL) or the like), which may be secure, of the ASA controller106, or some other form of sending communication to the ASA controller through the data network107. Alternatively, the ASA controller106may contact the AP501A as well as other APs with a broadcast notification whenever candidate channels are available, or anticipated to be available. In which case, the local controller550of the AP501A may generate a request for a channel from the shared radio frequency spectrum for communicating with an EUD. The AP501A access request may include a secure ID that uniquely identifies the AP501A. The secure ID may be a unique code provided to the AP501A at the time of manufacture (e.g. coded into the local controller or secure synthesizer), provided by a user at time of registering the AP, if necessary, with the ASAS105, or at time of purchase of the AP501A.

In response to the request, the ASA controller106may access the ASAS database115to authenticate the AP501A as an authorized device. The ASA controller106may cross-reference the AP501A secure ID with a list of secure IDs stored in the ASAS database115. In addition, as mentioned above, location information associated with the secure ID must be obtained from the requesting AP501A device and the AP501A GPS receiver/reporter560, or from the ASAS database115(e.g. based on the last time a channel was allocated to the AP501). The AP501A secure ID may include a GPS receiver/reporter560secure ID or an address of the GPS reporter560. The ASA controller106, using GPS reporter560identifying information from the AP501A access request or obtained from the ASAS database115, may identify the GPS reporter560and obtain a reported location of the AP501A. Upon authentication of the AP501A as an authorized AP, the ASA controller106may access data indicating the availability of frequency channels (i.e. candidate channels) in the shared radio frequency spectrum for allocation to the AP501A. The ASA controller106based on an analysis of the data (e.g. the location of the AP501A, the scheduled use of frequency channels by higher priority users in the vicinity of the AP501A location, and/or other factors, such as other Tier 3 users in the vicinity) in the database may determine a frequency channel allocation and an expiration time for the AP501A access to the allocated channel. After the ASA controller106determines the frequency channel allocation and the expiration time, the ASA controller106generates an encrypted secure control word that is transmitted to AP501A via the connection to the AP501through the data network107.

The secure control word is received at the AP501A by the local controller550, but is passed uninspected to the secure synthesizer530. Upon receipt of the secure control word, the secure synthesizer530may decrypt the secure control word and tune itself to the appropriate allocated channel(s) for reception and transmission.

Note that discussion of theFIGS. 1-8Aprimarily refers to time division duplex (TDD) communications, but the example devices (e.g.501,601and701) may be configured for frequency division duplexing (FDD) instead of or, in addition to TDD operation. A difference, as illustrated inFIG. 5B, being that the encrypted secure control word and respective tuning signals sent to the transmitter510and receiver540in the TTD examples indicate the same frequency, while in FDD the transmit frequency and the receive frequency (channels) are different, so the encrypted secure control word may be different to indicate the respective channel allocations for respective transmit and receive functions. As a result, in FDD, the tuning signals to the transmitter510and the receiver540will be different. The switch520and band pass filter570would be replaced by a duplex filter for FDD operation.

FIG. SB is a high-level functional block diagram showing an example of an access point implemented in a frequency division duplex (FDD) for providing access to shared radio frequency spectrum as well as a network, controller and servers in communication with the access point. The system500B includes an FDD-configured AP501B that interacts with the same external system components as AP501A, which are the data servers103, ASA controller106and network107. As for the components of AP501B, the GPS receiver/reporter560, the transmitter510and the receiver540are configured the same in AP501B as the same components in the AP501A ofFIG. 5A. However, instead of synthesizer520, which provides a single tuning signal to both the transmitter510and receiver540as inFIG. 5A, the FDD-configured AP501B uses a pair of synthesizers530T and530R.

In FDD systems, the transmitter510and receiver540functions may operate simultaneously or substantially simultaneously, and the duplexer or diplexer switch (e.g.,520inFIG. 5A) is replaced by a duplexer filter516(also known as a diplexer filter). The duplexer filter516is connected to the antenna, and has two separate branches, one supported by a band pass filter (BPF) tuned to the transmitter band (i.e., TX BPF512), and the second branch supported by a BPF tuned to the receiver band (i.e., RX BPF519). The duplexer filter516is configured to allow the receiver to receive signals on the first communication (i.e., frequency) channel and to transmit signals on the second (paired) frequency channels. The secure control word in a FDD implementation may include at least a pair of secure controls words (e.g., one for transmitter tuning and another for receiver tuning) are provided by the ASA controller106. Each of the individual secure control words in the pair of secure control words is different from the other secure control word in the pair, and will not be decrypted to produce the same frequency channel for tuning of the transmitter510and receiver540.

While in an FDD implementation, different channels for transmitting and receiving will be allocated to the AP501B and the synthesizer of AP501A, such as synthesizer530, is replaced by a pair of synthesizers530T and530R (if the uplink and downlink are uncoordinated), or, more likely, a fixed relationship (duplex spacing) between the uplink and downlink channel frequencies is employed, such that one indication indicates a pair of channel frequencies: one for uplink and one for downlink, a fixed separation in frequency apart. In the case of an FDD implementation, the secure control word will include a tuning word that indicates a pair of communication channel frequencies (e.g. two frequencies or two channel) assignments that will be parsed by the secure synthesizer processor.

FIG. 6illustrates an example of the process600that the secure synthesizer530, in a TDD implementation, performs in response to receipt of a secure control word from an ASA controller106. A secure synthesizer, such as secure synthesizer530, receives encrypted secure control words via a local controller, such as local controller550in the AP501A (605). The secure synthesizer530processor executes encrypted instructions to decrypt the received, encrypted secure control word (610). As mentioned above, the encryption and decryption keys may be similar for all APs, so the processor may obtain decryption key(s) from a memory within the secure synthesizer circuitry. Alternatively, the secure synthesizer530may have decryption key(s) that are specific to the particular secure synthesizer530. For example, a secure synthesizer530in another AP may have decryption keys different from the decryption keys of secure synthesizer530in AP501A. The encryption technique, for example, used to encrypt the secure control word may be a public key encryption technique or other similar technique. In another example, the secure synthesizer530is implemented as an ASIC without firmware or software. In which case, the encryption/decryption logic is implemented in the circuitry of the ASIC.

In response to the decryption of the secure control word, the secure synthesizer530processor parses the decrypted secure control word to identify a timing word and a tuning word. In an example, the secure synthesizer may have a provision for any tuning word to expire, so that the secure synthesizer may not remain indefinitely locked onto one channel after original tuning. To facilitate the expiration of the tuning word, the timing word provides an indicator of a duration of a communication time interval. The communication time interval may be the time duration of the tuning word. For example, the timing word is a code word that indicates a specific expiration time and date (e,g. 130001012014—where the time is 1300 hours on Jan. 1, 2014), a time period from a predetermined date, where the predetermined date is the date on which the access point last received a secure control word, a set number of hours (e.g. 5), or some other indicator of an expiration time. The communication time interval may be provided by the ASA controller106based on the allocated communication channel to the AP501A and other allocated communication channels to other APs. The ASA controller106forwards the provided communication time interval to the respective APs with the respective secure control words.

In an example, the secure synthesizer530includes a provision for all tuning words to expire, so that the secure synthesizer530tuner may not remain indefinitely locked onto one channel after original tuning for an extended period of time. At the expiration of, or close to, a tuning word, a new tuning instruction is provided by the ASA controller106, or a new channel allocation request must be made by the secure synthesizer through the local controller550for a new secure control word. For example, the secure synthesizer530may be configured to not store old channel tunings or reuse previously provided secure control words. The decryption method is internal to the secure synthesizer530, therefore, the secure synthesizer530may need timing information (input from an external source such as the data network107or the ASA controller106or the GPS receiver/reporter560) to ensure expiration does occur and occurs at the correct time. Alternatively, the timing information may be maintained internal to the AP501A by either the local controller550or the secure synthesizer530using or the GPS receiver/reporter560, for example, an internal clock that may be calibrated using time information from an external source. The timing information (which may also supplied by the ASA controller106(i.e. external source) may also require encryption to prevent spoofing of the timing information, for example, to make old secure control words appear younger by altering the apparent date or time compared to the expiration date or time.

Returning toFIG. 6, at620, the decrypted secure control word is parsed to identify a timing word and a tuning word. In addition to the timing and tuning words, expiration data (e.g. expiration time, time information related to the ASA controller106, a clock setting parameter for setting a clock internal to the secure synthesizer530and the like) related to each of the timing and tuning words may be obtained from the secure control word. The tuning word parsed, at620, from the encrypted secure control word may indicate a specific channel or specific frequency in the shared radio frequency spectrum frequency bands that is allocated by the ASA controller106to the AP501A and any EUDs that will be communicating with the AP501A.

Once the decrypted secure control word has been decrypted, the secure synthesizer530sets the tuning word expiration according to the decrypted timing word (630). The decrypted timing word may be stored in a memory of the secure synthesizer530, while timing information previously stored in another portion of the secure synthesizer530memory.

At640, the tuning word is further parsed by the secure synthesizer530processor to identify a tuning channel code word and a tuning control code timestamp.

One technique for maintaining security of the channel allocations and the encryption methods for generating secure control words is to continuously change the encryption at various times (e.g. rolling secure codes), and use new secure control words to indicate the change in channel allocation. The newly provided secure control word is a new encryption (e.g. new encryption/decryption keys are exchanged between the AP501A and the ASA controller106) and a new channel allocation, where the new channel allocation may or may not be the same as the previous channel allocation. This is performed, for example, based on the timing word.

For example, a secure control word may be decrypted to provide a tuning word indicating channel4has been allocated for tuning of the transmitter510and the receiver540, and, according to the timing word, the channel allocation to channel4expires in 10 minutes from the expiration time of a previously-received secure control word. Within the 10 minute time window, the ASA controller106provides a next, or updated, secure control word that is passed to the secure synthesizer530. The updated secure control word indicates a change of a channel (e.g. from channel4to channel13). The updated secure control word is parsed to identify the respective tuning word and the timing word. The timing word may include an expiration time as well as a timestamp of when the updated secure control word was generated by the ASA controller106. The next channel is channel13and the expiration time is 3 minutes from the expiration time of the previous secure control word (i.e. after the end of the 10 minute time window). The time may be maintained as continuous time such as 123456 in seconds, minutes or other units with a date indicator. For example, the 10 minute expiration time may be indicated in the timing word as 123466 or, if in seconds as 600 seconds, in which case, the timing word will indicate the expiration time as 124056 (i.e. 123456+600) with a data indicator of Ser. No. 12/312,015 (i.e. Dec. 31, 2015).

As a result of the rolling codes, there is not a one-to-one match between frequency tunings and tuning words that can be observed or deciphered by observing or storing old instructions and their resultant channel tunings. Together, the rolling code and encryption minimizes the probability of deciphering the encryption methods. So the secure tuning word has a tuning control code timestamp that causes the tuning channel code to expire by the next timeslot, and every secure tuning word appears new and unique.

In response to identifying the tuning channel code word and the tuning control code timestamp, the secure synthesizer processor530compares, at650, the expiration time of the received tuning word to the tuning control code timestamp to determine if the received tuning code has expired. Based on the comparison, a determination is made, at660, whether the tuning control code has expired. In response to a determination that the tuning control code has not expired (i.e. “No) at660, the process600proceeds to670in which the secure synthesizer530processor tunes the transmitter and receiver to the frequency channel indicated by the tuning channel code word. In addition, the expiration time based on the next tuning word expiration time is set. Also, the process600proceeds to680in which the encrypted secure control word used for the channel tuning in step670is further transmitted to the end user device(s) so any end user device(s) connected to the access point may tune to the allocated channel.

In this example, the end user device configured to operate as a TDD end user device, which is explained in more detail with respect toFIG. 8A, is configured to scan all frequencies for communications containing AP access information, such as secure control codes, AP identifiers and the like. After forwarding the secure control word to the end user device, the AP process600returns to receiving another encrypted secure control word at605.

Alternatively, in response to a determination that the tuning control code has expired (i.e. “Yes”) at660, the AP must make a new channel allocation request and the process600returns to step605, to receive an encrypted secure control word.

As noted in a TDD implementation, a single frequency may be allocated to the AP501A for both transmitting and receiving, in which case the timing of the transmitting and receiving functions will alternate.

Of course, the encrypting method is maintained by the ASA controller106(decryption key) such that all other parties (chipset manufacturers, hardware device manufacturers, service providers, end users, and other interested parties) cannot circumvent nor compromise the security features. The secure synthesizer530in one embodiment may not have any back doors (i.e. coding that allows the bypass of the security features by, for example, an administrator or device manufacturer). The back doors may allow, for example, commands to stay on one frequency, to accept unencrypted instructions, or any other mechanisms that avoid the use of the secure tuning code word provided by the ASA controller106. Otherwise, a firmware or software reflash can potentially exploit the backdoor and allow circumvention of the secure synthesizer530.

In this manner, any wireless air interface that does not have secure centralized network control of channel usage may, for example, use the internet protocol (IP) to provide over-the-top implementation of secure synthesizer tuning for secure channel allocation. In other words, an application is able to execute securely using the IP without requiring specific programming at an AP or EUD to provide the security.

FIG. 7is a high-level functional block diagram of an example of an access point device including a spectrum monitoring receiver that can be instructed to monitor or ‘sniff’ the shared radio frequency spectrum described in the examples herein. The system700includes elements that are similar to those described with respect toFIG. 5above. For example, the data servers103and the data network107perform functions with respect to the access point701similar to those described with respect toFIG. 5, so no further explanation of those elements will be provided in the following discussion for sake of brevity. While the ASA controller706performs substantially the same functions as ASA controller106, the ASA controller706includes additional functionality with respect to the spectrum monitoring (i.e. ‘sniffing’) receiver included with the example of access point701. In addition, other elements, such as the receiver540, GPS reporter560, and the band pass filter570, that perform similar functions as those described with respect toFIG. 5are similarly numbered, and a separate discuss of those similar functions will not be provided with respect toFIG. 7also for the sake of brevity.

The AP701is configured differently that the AP501described with respect toFIG. 5. The access point701includes a transmitter (XMITTER)510, a switch720(which may be the same or different from520), a synthesizer730(which may be the same or different from530), a receiver (RCVR)540, a monitoring receiver790(which may be the same or different from540), a local controller750, GPS receiver/reporter560, and a band pass filter570. Additional or revised components of AP701are configured to provide the additional functionality. For example, the revised components in AP701include switch720, secure synthesizer730, local controller750, and monitoring receiver790, and are configured to provide added functionality enabling the AP701to provide a channel traffic report to the ASA controller706.

In an example, the AP701includes a local controller750that in addition to control connections to the synthesizer730, transmitter510and receiver540as inFIG. 5, but also includes another control connection to the monitoring receiver790.

Under control of a local controller750, the AP701performs routing functions, for example, typical of a Wi-Fi router, but only in the frequency channel allocated by the ASA controller706. However, in this example, of an access point, the AP701also provides the additional functionality of detecting data communication traffic on other channels of the shared radio frequency spectrum in the vicinity of the AP701, and reporting the detected data communication traffic to the ASA controller706.

For example, in order to better determine a KO zone, or determine the frequency channel that can be allocated to the AP701or an AP nearby to AP701, it would be helpful if the ASA controller706had an indication of data traffic in the channels available for allocation from the shared radio frequency spectrum. In order to provide this functionality, the ASA controller706forwards a secure control word to the AP701in response to an access request from the AP701. The ASA Controller706may then decide it wishes to process additional information from the requesting AP701, or even from other nearby APs, in order to determine the local RF environment based upon the channels already in use by other nearby AP stations. By sampling some possible channels at the AP701or other nearby APs, the ASA controller706may decide that the KO zone may be allowed to be smaller without jeopardizing and causing interference, or that the KO zone must be larger, and the candidate channel cannot be made available for AP701.

The ASA controller706may decide to sample (i.e. monitor or “sniff”) on a candidate channel to determine if AP701, or any nearby AP, can detect any usage (e.g. interference) from other nearby users on that channel. The secure control word transmitted by the ASA controller706is similar to the secure control word described with respect toFIG. 5except the secure control word transmitted by the AP701includes additional control words. The ASA controller706may include the additional function of obtaining spectrum monitoring data from an AP as mentioned above with respect toFIGS. 3 and 4and the different methods of determining KO zones. Spectrum monitoring data may include, for example, an indication of the channels in the shared radio frequency spectrum that the AP701detects via the monitoring (i.e. “sniffing”) receiver790in the vicinity of the AP701. In this case, the ASA controller706would provide receive-only tuning control words to indicate that the ASA controller706wished AP701to monitor (i.e. “sniff”) the indicated channel and report the results back to the ASAS manager to make a further determination of possible channel allocations for AP701or surrounding AP units.

The ASA controller706may request spectrum monitoring data for several reasons in which case, the AP701may have different modes of operation. For example, the ASA controller706may be instructed to collect the spectrum monitoring data from an AP, such as AP701, by a higher level controller in the ASAS105in order to update database115without providing the AP701access to that candidate channel of the shared radio frequency spectrum (i.e. a spectrum monitoring only mode, receive-only monitoring, where the candidate channel is not allocated to the ‘sniffing’ AP), in order to determine which channel from the channels available from the shared radio frequency spectrum should be allocated to the AP701(i.e. an allocation channel selection mode), and/or an arbitrary request to obtain spectrum monitoring data while the AP701has access to a channel of the shared radio frequency spectrum and is communicating with an EUD (i.e. update propagation data mode).

Depending upon the mode in which the AP701will be operating, the ASA controller706, after receiving at least a secure position identifier from the GPS receiver/reporter560, provides one or more control words to the AP701. The ASA controller706may indicate the mode setting to the local controller750and/or the secure synthesizer730in a string of bits (e.g. a pair of bits) included in a field with the secure control words.

For example, a Tier 1 or Tier 2 user may have an interest in the traffic on a particular channel (e.g., specific equipment is configured for optimal operation in the particular channel and is sensitive to interference) so the particular channel and surrounding channels may be investigated. To provide the data needed to satisfy the investigation, the ASA controller706may determine a spectrum monitoring mode of all APs registered with the ASAS105or only those APs, such as AP701, in a location relevant to the channel investigation are targeted. Location information, for example, received from GPS receiver/reporter560and maintained in the ASAS database115from previous AP access requests may be used to identify the location relevant APs. In this case, a spectrum monitoring-only mode may be selected by the ASA controller706for obtaining the needed channel usage data.

In the spectrum monitoring-only mode, the AP701may provide several spectrum monitoring secure control words that each correspond to one of a set of candidate channels in the shared radio frequency spectrum that the ASA controller706has selected for investigation based on an indication from ASAS105. For example, the spectrum monitoring secure control words may correspond to channels in which the ASAS105is interested for purposes of refining propagation models for determining keep out zones, determining usage statistics for a particular AP or the like. The provided spectrum monitoring secure control words are not allocated use by the AP701for providing data network107access to an EUD, only for providing monitoring data to the ASA controller706(i.e. for ‘sniffing’). The spectrum monitoring secure control words, similar to the other secure control words, expire after a pre-determined time period, but also include an indicator that identifies the monitoring receiver790as the receiver to be tuned using the spectrum monitoring secure control words.

Upon receipt of the several secure control words for each of the channels of interest, the local controller750forwards the several secure control words to the secure synthesizer730. The secure synthesizer750decrypts the secure control words, either iteratively or as a batch, and tunes the monitoring receiver790to each of the respective channels for detected signals in the respective channels. The secure code words for each of the respective channels may include a tuning word and a tuning control code timestamp. The tuning control code timestamp may indicate an expiration for the respective tuning word that expires more quickly or more slowly than the expiration of a secure control word that is provided for the allocated communication channel (i.e. frequency channel) assigned to the AP701. For example, the expiration time may be the same for each channel of interest or may vary, for example, based on a level of interest of the ASAS105in the traffic on a particular channel. As a result, the expiration time for each channel may be fixed or may vary depending upon instructions from the ASA controller706.

In an allocation channel selection mode, the ASA controller706may be configured to include an instruction to obtain spectrum monitoring data whenever receiving an access request from a suitably configured AP, such as AP701, in order to select a channel for allocation to the AP701for data communication use. The ASA controller706may provide a number of secure control words to the AP701that correspond to the candidate channels from the shared radio frequency spectrum. The provided secure code words include encrypted timing words and tuning words, as in the example described with respect toFIG. 5. The local controller750receives the secure control words as well as the bit values indicating the operating mode. The local controller750passes the secure control words, still encrypted, to the secure synthesizer730for decryption, and enters the configuration for providing detected signals or measured power levels for the respective channels of interest. The secure synthesizer730decrypts the secure control words, and tunes the monitoring receiver790to the respective channels until the signal detection expires according to the timing word, and the monitoring receiver is tuned to a next channel indicated by a next secure control word. The detected signals may be processed to determine or measure one or more signal parameters, such as a received signal strength, a power level, and/or a signal quality, to provide a report. For example, measured power levels (e.g., received signal strength indicator (RSSI)) may be formed into reports for individual delivery to the ASA controller706. Alternatively, the measured power levels may be buffered in a memory (not shown) by the local controller750, and provided as a batch to the ASA controller706.

In response to receiving from the AP701local controller750the spectrum monitoring data obtained by the monitoring receiver790, the ASA controller706may determine that no other candidate channels appear to be occupied as observed by the AP701, or are at low enough powers that AP701or some other AP device nearby may, in fact, use that channel without adverse effects.

Or, as a result of finding an available channel, the ASA controller706may select any one (or a set) of the candidate channels from the available channels, for example, without concern for keep out zones, and send a secure control word corresponding to the selected channel (allocating that channel for AP701or some other nearby AP).

Alternatively, the ASA controller706may send a set of secure control words corresponding to the list of candidate channels. The local controller750in one embodiment will not have knowledge of which specific channels (i.e. the unencrypted channel numbers) are included in the list, but will receive one or more secure control words from which the local controller750and forward the one or more secure control words to the secure synthesizer730for monitoring (i.e. “sniffing”). The secure synthesizer730may iteratively tune to the channels indicated by the secure control words in the list corresponding to each candidate channel, and processes the signals on each channel to provide different signal parameters, such as receives signal strength indicators (RSSI) or the like. The monitoring receiver790forwards the results of the monitoring to the local controller750, which forwards the monitoring results to the ASA controller706. Based on the received monitoring results, the ASA controller706can select one secure control word that will be forwarded to the secure synthesizer730for decryption and tuning of the transmitter510and receiver540.

In another example, a secondary synthesizer731may be used to monitor, or “sniff,” other channels on a rolling basis. The secondary synthesizer731is a secure synthesizer configured in the same manner as synthesizer730. The secondary synthesizer731, via a control connection with the local controller750, may receive a secure control word B. In an example, the secondary synthesizer731is configured as an application specific integrated circuit that provides for the secure decryption of the secure control word B codes. The secure code word B may include a set of encrypted rolling tuning codes in which each tuning code of the set includes an encrypted tuning word corresponding to a channel of the shared radio frequency spectrum, and an encrypted time stamp that indicates when the tuning word expires. The “rolling” indicates that the time stamp is as short as possible for collecting data useful for the needs of the ASA controller706. For example, the time stamp for the tuning word may be tens to hundreds of milliseconds for the ASA controller706to determine signal traffic in the respective channels indicated by the rolling tuning codes in secure control word (B).

If the spectrum sensing is to occur when the TDD or FDD system is not actively receiving traffic, the AP ofFIG. 5and synthesizer530can be used where the conventional traffic receiver is retuned temporarily to another frequency for spectrum sensing purposes. If the timing is such that the synthesizer530cannot retune fast enough to support both traffic reception and transmission, as well as the additional interleaved spectrum sensing tasks, then the architecture ofFIG. 7may be used. Similarly, if the spectrum sensing is intended to occur simultaneously, on another frequency channel, while the AP supports traffic reception and transmission, then the architecture ofFIG. 7is deployed. The secondary synthesizer731also facilitates non-alternating, simultaneous reception use in a frequency division duplex implementation in which the respective receivers540and790are able to be tuned to two different channels simultaneously.

In an alternative example, the AP701is configured to provide channel signal monitoring when not be equipped with the monitoring receiver790and the secondary synthesizer731. When configured without the monitoring receiver790and the secondary synthesizer731, the synthesizer730can be provided with secure control words that include tuning words for the channels of interest, and when the receiver540and transmitter510are not in use (i.e. exchanging data with an EUD) the synthesizer730can tune to the channels of interest, and the receiver540can collect the signal data for the respective channels of interest. In this case, the tuning words may have a time stamp that is of longer duration to account for the potential conflict with the AP701being actively engaged with an end user device (i.e. when the AP701is exchanging data with an EUD).

In an alternative example, the ASAS105may instruct the ASA controller706to obtain channel usage data to update propagation data. In response, the ASA controller706instructs the AP701to enter an update propagation data mode. The update propagation mode may occur while the transmitter510and receiver540of AP701are tuned to an authorized channel that is providing bidirectional communication to/from an EUD and thus access to the data network107. While the transmitter510and receiver540are tuned to the authorized channel used by the AP and the served EUD, the second secure ‘sniffing’ synthesizer731may be provided with a signal indicating which candidate channel(s) is (Are) to be monitored by monitoring RCVR790. The ASA controller706supplies an indicator signal for the change in mode, and secure control word(s) corresponding to the candidate channels in which the ASAS105is interested in measuring in order to update the propagation models. Upon receipt of the secure control words corresponding to the candidate channels of interest, the secure synthesizer731may be enabled, and tune the monitoring receiver790to the candidate channel(s) indicated by the secure control word(s).

Of course, the AP701may have a ‘regular’ mode of operation similar to the mode of operation of AP501in which the monitoring receiver790and its supporting synthesizer731are not used to monitor any candidate channel usage data, or is only tuned to the ‘regular’ authorized channel that the receiver540is also tuned to, perhaps for diversity reception of the regular authorized channel. The receiver790does not ‘receive’ the candidate signals, as it may not decode them (e.g. for privacy purposes), the receiver790only monitors the received candidate signal for RSSI power level.

In another example, the ‘regular’ receiver540inFIG. 5Amay be configured to provide the ‘sniffing’ monitoring functions by using a candidate channel tuning from synthesizer530to sample a candidate channel for the RSSI power level while the transmitter510and the ‘regular’ reception function on an authorized channel for Receiver540are idle. In these idle times, receiver540can be retuned to a candidate channel for monitoring.

In another example, the receiver540in either ofFIG. 5or7may be configured to provide an indication of the quality of the channel (a quality of service (QOS) report) (e.g. number of bits lost, or corrupted, number of requests for retransmission of data and the like) about the authorized reception channel to the ASA controller706or106. For example, the local controller750/550of AP701/501may indicate to the ASA controller706/106that the authorized channel3is degraded each time it is assigned to the AP701/501. As a result, the ASA controller706/106may, for example, determine that an adjacent channel is too close in distance to another user using the same channel (co-channel), or some other problem exists.

FIG. 8Ais a high-level functional block diagram of an example of an end user device (EUD) that utilizes the shared radio frequency spectrum system. The end user device801A is part of system800A that includes the end user device801A and a local client880. The end user device (EUD)801A is served by its local host access point, such as access point (AP)501A. The local client880may be a device, such as a tablet, a laptop, a dongle connectable to a data port (e.g. universal serial bus (USB) port, mini-USB port), desktop computer, gaming device, media player or the like. Note that the EUD801A does not include a GPS receiver/reporter as does the AP501A. The location of the EUD801A is presumed to be the location of the local serving AP, such as AP501A, because the EUD801A is a low power device small radius of adequate performance) and is known to be served by the local access point.

The TDD EUD801A device is configured similar to the AP501A, and includes a transmitter810, duplexer switch820, secure synthesizer830, and a local controller850. In addition, the EUD801A is further configured to receive its control signals from the serving AP, such as AP501A or701, to which the EUD801A is wirelessly connected. For example, the AP501A may generate a signal indicating the APs availability for connecting any EUD in the vicinity of the AP to the data network. The EUD801A may standby in a detection state to detect AP signals. By being in a detect only state (receive-only), the EUD801A cannot interfere with any communications of higher tiered users in channels of the shared radio frequency spectrum that may be allocated in the vicinity of EUD801A. In addition, the EUD801may not have a permanently assigned serial number or user identity that is separate or unique from the serving access point.

The tuning permission signal transmitted by the AP501A may include transmission of the secure control word used for tuning the AP transmitter510and receiver530, so the EUD801A can transmit and receive in the same channel allocated to the AP501A. The EUD801A secure synthesizer830is configured similar to the AP501A secure synthesizer, and functions to parse and obtain the tuning words and timing words needed for communicating with the appropriate AP. For example, signals received from the AP501A may include the secure control word, the secure ID for the AP501A, and, perhaps, an EUD device identifier to uniquely identify the EUD801A to the AP501A. The secure control words, the secure ID for the AP501A, and the EUD identifier are supplied via the AP501A as the EUD has no direct connectivity (wired or wireless) to the data network107(i.e. Internet), the ASA controller106or the ASAS105.

Upon receipt of the secure control word, the EUD801A secure synthesizer830may perform the same functions as described above with respect to the secure synthesizer530. For example, the process600ofFIG. 6may be executed by the EUD801A to communicate with the AP501A. Once tuned to the proper transmitter810and receiver840frequencies, the EUD801A may facilitate communication by the local client with the AP501A and, via AP501A back to/from the data network107(i.e. the Internet connection).

FIG. 8Bis a high-level functional block diagram of an example of an end user device implemented in a frequency division duplex (FDD) configuration for providing access to shared radio frequency spectrum. The system800B includes an FDD-configured EUD801B that interacts with the local client880. As for the components of EUD801B, the transmitter810and the receiver840are configured the same in EUD801B as the same components in the EUD801A ofFIG. 8A. However, instead of synthesizer820, which provides a single tuning signal to both the transmitter810and receiver840, which are configured to provide a TDD implementation of an EUD, as inFIG. 8A, the FDD-configured AP801B uses a pair of synthesizers530T (coupled to the transmitter810) and530R (coupled to the receiver840. In addition, the local controller850B is configured to operate according to an FDD implementation that does not require the operation of switch820of the AP801A.

In FDD systems, the transmitter810and receiver840functions may operate simultaneously or substantially simultaneously, and the duplexer or diplexer switch (e.g.,820inFIG. 8A) is replaced by a duplexer filter816(also known as a diplexer filter). The duplexer filter816is connected to the antenna, and has two separate branches, one supported by a band pass filter (BPF) tuned to the transmitter band (i.e., TX BPF812), and the second branch supported by a BPF tuned to the receiver band (i.e., RX BPF819). The duplexer filter816is configured to provide the duplexing functionality to allow the receiver to receive signals on the first frequency channel and to transmit signals on the second frequency channels. The secure control word in a FDD implementation may include at least a pair of secure controls words (e.g., one for transmitter tuning and another for receiver tuning) are provided by the ASA controller106. Each of the individual secure control words in the pair of secure control words is different from the other secure control word in the pair, and will not be decrypted to produce the same frequency channel for tuning of the transmitter810and receiver840.

For example, the local controller850B is configured to provide a receiver (RCVR) secure control word to receiver secure synthesizer830R and a transmitter (XMIT) secure control word to a transmitter secure synthesizer830T. The local controller850B is configured to identify the respective secure control words. For example, the secure control words provided by the AP may include a data field indicating whether the secure control word is intended for transmitter or receiver. In other embodiments, the order of the secure control word may always be the same. In other words, the secure control words delivered by the AP may always have the receiver secure control word first and the transmitter secure control word second, or vice versa. The respective secure synthesizer (830R and830T) generates a tuning signal that is, output to the receiver840and transmitter810, respectively. For example, the receiver secure synthesizer830R receives the receiver (RCVR) secure control word from the local controller850B, processes the secure control word to derive a receiver tuning signal. The derived receiver tuning signal may correspond to a first frequency channel. The receiver840uses the derived receiver tuning signal to tune to the first frequency channel. In a similar fashion, the transmitter secure synthesizer830T receives the transmitter (XMIT) secure control word from the local controller850B, processes the XMIT secure control word to derive a transmitter tuning signal. The derived transmitter tuning signal may correspond to a second frequency channel that is different from the first frequency channel. The transmitter810uses the derived transmitter tuning signal to tune to the second frequency channel.

The EUDs801A and801B are examples of devices that may be coupled to local client devices880to provide connectivity to access points implementing either TDD or FDD signal protocols, respectively.

The foregoing paragraphs described configurations and implementations of access points and end user devices for use in a shared access system. The described configuration and implementations protect the licensee's use of a band of frequency channels from interference and other adverse effects caused by others' unauthorized use of the band of frequency channels. The described configurations utilize a combination of secure information to insure that the locations and specific frequency channels used by the described access points and end user devices remain secure when transmitted and used by the respective devices. The described secure synthesizer may be utilized in access points as well as end user devices to allow the access points and end user devices to operate in the frequency channels allocated by the ASA controller.

FIG. 9provides functional block diagram illustrations of general purpose computer hardware platforms for implementing one or more of the examples of a local controller, secure synthesizer, or the ASA controller.

A general purpose computer configured to operate as a controller or synthesizer device within an access device or end user device, for example, includes a data communication interface for packet data communication. The device also includes a central processing unit (CPU), in the form of one or more processors, for executing program instructions. The device platform typically includes an internal communication bus, program storage and data storage for various data files to be processed and/or communicated by the device, although the device often receives programming and data via network communications. The hardware elements, operating systems and programming languages of such devices are conventional in nature. Of course, the device functions may be implemented in a distributed fashion on a number of similar platforms, to distribute the processing load.

Hence, aspects of the methods of shared radio frequency spectrum access outlined above may be embodied in programming. Program aspects of the technology may be thought of as “products” or “articles of manufacture” typically in the form of executable code and/or associated data that is carried on or embodied in a type of machine readable medium. “Storage” type media include any or all of the tangible memory of the computers, processors or the like, or associated modules thereof, such as various semiconductor memories, tape drives, disk drives and the like, which may provide non-transitory storage at any time for the software programming. All or portions of the software may at times be communicated through the Internet or various other telecommunication networks. Such communications, for example, may enable loading of the software from one computer or processor into another, for example, from a management server or host computer of the authorized shared access system105into the computer platform of the ASA controller, access point and end user device that will allow the end user device to access a data network through an access point controlled by the ASA controller. Thus, another type of media that may bear the software elements includes optical, electrical and electromagnetic waves, such as used across physical interfaces between local devices, through wired and optical landline networks and over various air-links. The physical elements that carry such waves, such as wired or wireless links, optical links or the like, also may be considered as media bearing the software. As used herein, unless restricted to non-transitory, tangible “storage” media, terms such as computer or machine “readable medium” refer to any medium that participates in providing instructions to a processor for execution.