Nokia Technologies Oy

Nokia Solutions and Networks Oy

Nokia of America Corporation

Nokia Corporation

Nokia Siemens Networks Oy

Anja Jerichow

Suresh P Nair

Nagendra S Bykampadi

Saurabh Khare

Chaitanya Aggarwal

Bruno Landais

Laurent Thiebaut

Georgios Gkellas

Yannick Lair

Thomas Belling

Peter Schneider

Annett Seefeldt

Konstantinos Samdanis

Guenther Horn

Jing Ping

Jani Ekman

Iris Adam

Ranganathan Mavureddi Dhanasekaran

Gerald Kunzmann

German Peinado Gomez

Dimitrios Schoinianakis

Ling Yu

Tero Henttonen

Silke Holtmanns

Philippe Godin

Colin Leon Kahn

Peter Rost

Cinzia Sartori

Christian Mannweiler

Ömer Bulakci

Subramanya Chandrashekar

Lianghai Ji

Hannu Flinck

Ulrich Wiehe

Martin Jansky

Horst Thomas Belling

Günther Horn

Jens Gebert

Bo Bjerrum

Shubhranshu Singh

Matti Puputti

Hans Thomas Höhne

Maximilian Riegel

Wolfgang Scheidl

Joachim Lüken

Kyösti Koivisto

Christian Guenther

Topuri Brahmaiah

Minisha Das

Mallikarjunudu Makham

Sireesha Bommisetty

Rekha Bharathi Somashekar

Sreejesh Sreekumar

Diwakar Jois

Genevieve Mange

Joachim Lueken

Daniel Fraunholz

Cincia Sartori

Bo Holm Bjerrum

Holger Nösekabel

According to an example aspect of the present invention, there is provided an apparatus configured to function as a network function repository, and transmit to a network function consumer an access token authorizing access to a service provided by a network function producer, the access token comprising an at least one of: indication of a fully qualified domain name of the network function consumer, an indication of a domain from which access to the network function producer is allowed and an indication of a stand-alone non-public network from which access to the network function producer is allowed.

Network security

It is provided a method comprising at least one of a) and b): a) monitoring whether a service request to produce a producer service is received and producing the producer service if the service request is received, wherein the producer service is a service produced by the access network; and b) consuming a producer service from a core network or an access network, wherein the producer service is consumed by an access network.

Access network with service-based interfaces

In one example, a method initiates establishment of a secure tunnel by a security proxy element (e.g., SEPP) in a first communication network (e.g., VPLMN) with an internetwork exchange element (e.g., IPX node) which is operatively coupled between the first communication network and a second communication network (e.g., HPLMN). Upon establishment of the secure tunnel, the method sends a message from the security proxy element to the internetwork exchange element over the secure tunnel. The secure tunnel can be a VPN tunnel and can be established using TLS or IPsec. In one example, the internetwork exchange node functions as an HTTP proxy, and in another embodiment as an interception (e.g., MITM) proxy. In another example, HTTPS is used to establish a separate TLS connection for each HTTP message. In yet another example, the security proxy element is configured to select (and change as needed) the secure communication mechanism.

Security management between edge proxy and internetwork exchange node in a communication system

There is provided a method, apparatus and computer program product for causing a network repository function to perform: receiving, from a network function service consumer, an access request for an access authorization token, the request comprising a first identification of the network function service consumer and a first identification of at least one network slice on which access is requested; generating an access token in response to the request, the access token comprising at least one network slice identifier for the at least one network slice identified by the first identification; and providing the generated access token to the network function in response to the request for an access authorization token.

Apparatus, methods, and computer programs

A user equipment in a communication system, a unified subscription identifier data structure is constructed. The unified subscription identifier data structure includes a plurality of fields that specify information for a selected one of two or more subscription identifier types and selectable parameters associated with the selected subscription identifier type, and wherein the information in the unified subscription identifier data structure is useable by the user equipment to access one or more networks associated with the communication system based on an authentication scenario corresponding to the selected subscription identifier type. For example, during different authentication scenarios, the user equipment utilizes the unified subscription identifier data structure to provide the appropriate subscription identifier (e.g., SUPI, SUCI or IMSI) and associated parameters for a given authentication scenario.

Unified subscription identifier management in communication systems

Example embodiments of the present disclosure relate to dynamic authorization. According to embodiments of the present disclosure, a solution for dynamic access control to data is proposed. On receiving data registration from a data source, a first device checks the data types to be produced by the data source and adds policies for the data or updates existing policies for the data according to its property. It also serves as access control decision point to determine consumers' access rights based on centrally managed policies. Authorization for data access is granted/denied according to local attributes/policies. In this way, it achieves a dynamic, context-aware and risk-intelligent access control to different kind of data from various data sources (i.e., service producers).

Mechanism for dynamic authorization

The disclosure relates to a first apparatus comprising at least one processor and at least one memory including computer code for one or more programs, the at least one memory and the computer code configured, with the at least one processor, to cause the apparatus at least to: send (), to a second apparatus, a request comprising information indicating a list of public land mobile network identifiers identifying a first public land mobile network supported by the first apparatus, and information to derive a second public land mobile network supported by the second apparatus; and receive (), from the second apparatus, a response comprising information indicating a list of public land mobile network identifiers identifying the second public land mobile network supported by the second apparatus.

Apparatus, method, and computer program

According to an example aspect of the present invention, there is provided an apparatus configured to process a request for an access token authorizing access for a network function consumer to a service provided by a network function producer, the request being received in the apparatus from a service communication proxy, wherein the processing comprises one or more of the following verification: verification that a credential data element comprised in the request, cryptographically signed by the network function consumer, identifies the request, the service or a type of the service, and verification with reference to a further node, or to a profile of the network function consumer, that the service communication proxy is authorized to act on behalf of the network function consumer, and transmit, responsive to at least one of the verifications being successful, the requested access token, the access token comprising an indication of the service communication proxy.

An apparatus comprises means for: causing information indicating a first security protocol profile of a first security protocol from a first security node of a first network to be sent from a first security node of a first network to a second security node of a second network, wherein the first security profile has one or more of: a modification policy; a data type policy; and a cipher suite; and causing the first security node to communicate with the second security node in accordance with the first security profile.

Apparatus, method, and computer program of protecting communications between networks using predefined security profiles

According to an example aspect of the present invention, there is provided an apparatus configured at least to: receive, from a service communication proxy, a request for an access token which authorizes access to a service at a network function provider, transmit an authorization token to the service communication proxy, the authorization token being specific to the request, and provide the access token to the service communication proxy responsive to determining that a cryptographic signature of a network function consumer on a signed version of the authorization token, received in the apparatus from the service communication proxy, is correct. The apparatus may work in a network serving user equipments, for example.

Authorization of network request

A request is received at an authorization entity for access to a service producer by a service consumer. The request comprises a public key of the service consumer. The authorization entity generates an access token with the public key of the service consumer bound thereto. The authorization entity sends the access token to the service consumer. The service consumer digitally signs the access token using a private key that corresponds to the public key bound to the access token to form a digital signature. The service consumer sends the access token with the public key bound thereto and the digital signature to the service producer. The service producer validates the access token, obtains the public key from the access token, and verifies the digital signature using the obtained public key of the service consumer. The service consumer is authorized when the access token is successfully validated and the digital signature is successfully verified.

Network function authentication based on public key binding in access token in a communication system

According to an example aspect of the present invention, there is provided an apparatus comprising means for receiving from a requesting network function, by a network repository function, an access token request, wherein the access token request is related to a network function consumer requesting access to a service provided by a network function producer and comprises an identity of a vendor of the network function consumer requesting access to the service, means for verifying by the network repository function, based at least on the identity of the vendor of the network function consumer, that the network function consumer is allowed to access the service and means for transmitting to the requesting network function, by the network repository function, an access token upon successful verification, wherein the access token generated and signed by the network repository function comprises the identity of the vendor of the network function consumer and an identity of the vendor of the network function producer.

Enhanced authorization in cellular communication networks

Techniques for dynamic security management in a communications network are disclosed. For example, a method comprises obtaining, at a network entity in a communication network, security information from one or more other network entities in the communication network. In response to at least a portion of the obtained security information, the method enables, by the network entity, dynamic enforcement within a user plane of the communication network of one or more security policies in accordance with one or more quality-of-service policies to manage one or more behaviors of user equipment.

Security enforcement and assurance utilizing policy control framework and security enhancement of analytics function in communication network

There is provided an apparatus configured to protect security of communication in roaming scenarios between a first network and a second network, the apparatus being a first apparatus residing in the first network and comprising means for

Termination of connections over a forwarding interface between networks

According to an example aspect of the present invention, there is provided an apparatus configured at least to determine whether a cryptographic signature of a token received in the apparatus from a network function consumer is valid, obtain a cryptographic signature of the apparatus of the token responsive to the cryptographic signature of the token being valid, and provide the token to a peer entity of the apparatus, wherein the cryptographic signature of the apparatus is either included into the token or provided in a header external to the token, wherein the peer entity is comprised in a second network, different from a first network where the apparatus is comprised in. The request may serve a user equipment, directly or indirectly.

Security procedure for cryptographic signature verification based on a trust relationship between edge nodes connecting home and visited networks

Growing community of inventors

Grafing, Germany

Anja Jerichow