In general, embodiments relates to a method for creating an on-demand tunnel (ODT) in a network between a first network device and a second network device, the method comprising: storing by the first network device, a a potentially suboptimal path to the second network device, determining that a trigger condition to create the ODT between the first network device and the second network device is satisfied, in response to the determination: transmitting, by the first network device, an ODT signaling packet to the second network device via the potentially suboptimal path, receiving, from the second network device and in response to transmitting the ODT signaling packet, an ODT keepalive by first network device via the ODT, and transmitting, after receiving the ODT keepalive, a second packet to the second network device via the ODT.

A communication device provides secure inter-device authentication that ensures certainty of processes. The communication device includes a control section configured to execute a process related to transmission or reception of a first authentication signal and a second authentication signal that are necessary for a first authentication process for authentication between the communication device and another communication device. The control section further controls a second authentication process for different authentication from the first authentication process, and starts a process related to transmission or reception of first information that is necessary for the second authentication process after transmission or reception of the second authentication signal.

A communication device provides secure inter-device authentication that ensures certainty of processes. The communication device includes a control section configured to execute a process related to transmission or reception of a first authentication signal and a second authentication signal that are necessary for a first authentication process for authentication between the communication device and another communication device. The control section further controls a second authentication process for different authentication from the first authentication process, and starts a process related to transmission or reception of first information that is necessary for the second authentication process after transmission or reception of the second authentication signal.

In certain embodiments, a (CBSD) base station for a (CBRS) radio system transmits new information elements in an existing capability exchange message to a spectrum access system (SAS) informing the SAS as to whether the SAS should transmit a channel-change message to the base station either (i) directly (and despite of domain proxy being present in the communication path) or (ii) via a domain proxy. If and when the SAS subsequently receives notification of incumbent activity from an Environmental Sensing Capability system, the SAS transmits either a new channel-change message or includes new information elements in an existing heartbeat message to the base station either (i) directly or (ii) via the domain proxy per the capability exchange message. The SAS can combine multiple channel-change messages for multiple base stations into a single message for transmission to a domain proxy that can communicate with those multiple base stations, thereby reducing communications to and from the SAS and decreasing the time that it takes to change channels without jeopardizing existing traffic.

In certain embodiments, a (CBSD) base station for a (CBRS) radio system transmits new information elements in an existing capability exchange message to a spectrum access system (SAS) informing the SAS as to whether the SAS should transmit a channel-change message to the base station either (i) directly (and despite of domain proxy being present in the communication path) or (ii) via a domain proxy. If and when the SAS subsequently receives notification of incumbent activity from an Environmental Sensing Capability system, the SAS transmits either a new channel-change message or includes new information elements in an existing heartbeat message to the base station either (i) directly or (ii) via the domain proxy per the capability exchange message. The SAS can combine multiple channel-change messages for multiple base stations into a single message for transmission to a domain proxy that can communicate with those multiple base stations, thereby reducing communications to and from the SAS and decreasing the time that it takes to change channels without jeopardizing existing traffic.

A device control method, includes: sending first device information to a proxy device; obtaining second device information; establishing a first connection with the cloud server, and sending the device information of the proxy device to the cloud server through the first connection, so as to establish a second connection between the proxy device and the cloud server based on the first device information and the second device information, the second connection being configured to transmit the keep-alive message; and in response to determining that notification information sent by the cloud server is received, controlling the Internet of Things device to enter a low power consumption mode, the notification information being configured to indicate that the second connection has been established between the proxy device and the cloud server.

A method for IP [=Internet Protocol] communication between a mobile terminal and its correspondent node in a mobile radio network. The method comprises establishing an IP connection between the mobile terminal and its correspondent node. After detecting a period of inactivity in the IP connection, keep-alive messages are sent via the IP connection at predetermined intervals, which are varied. The method comprises monitoring the lengths of several periods of inactivity at which the mobile radio network disconnects the IP connection.

A method for IP [=Internet Protocol] communication between a mobile terminal and its correspondent node in a mobile radio network. The method comprises establishing an IP connection between the mobile terminal and its correspondent node. After detecting a period of inactivity in the IP connection, keep-alive messages are sent via the IP connection at predetermined intervals, which are varied. The method comprises monitoring the lengths of several periods of inactivity at which the mobile radio network disconnects the IP connection.

Virtual private network (VPN) service provider infrastructure (SPI) receives a request to access a VPN from a client device. The VPN SPI selects an Internet Protocol (IP) address for access to the VPN by the client device from a pool of IP addresses. The VPN SPI provides access to the VPN for the client device via the IP address. The VPN SPI receives one or more handshake notifications from the client device. The VPN SPI determines that a threshold time period has passed since a latest-in-time handshake notification of the one or more handshake notifications. The VPN SPI disconnects the client device from the VPN in response to determining that the threshold time period has passed. The VPN SPI adds the IP address to the pool of IP addresses in response to disconnecting the client device from the VPN.

Virtual private network (VPN) service provider infrastructure (SPI) receives a request to access a VPN from a client device. The VPN SPI selects an Internet Protocol (IP) address for access to the VPN by the client device from a pool of IP addresses. The VPN SPI provides access to the VPN for the client device via the IP address. The VPN SPI receives one or more handshake notifications from the client device. The VPN SPI determines that a threshold time period has passed since a latest-in-time handshake notification of the one or more handshake notifications. The VPN SPI disconnects the client device from the VPN in response to determining that the threshold time period has passed. The VPN SPI adds the IP address to the pool of IP addresses in response to disconnecting the client device from the VPN.