Telefonaktiebolaget Lm Ericsson (Publ)

Bernard Smeets

Alexander Maximov

Christian Gehrmann

Martin Hell

Karl Norrman

Mats Näslund

Tommy Arngren

Rolf Blom

Håkan Englund

Lina Pålsson

Harald Gustafsson

Elena Dubrova

Patrik Salmela

Tomas Thyni

Christine Jost

Göran Selander

Makan Pourzandi

Kimmo Juhani Hiltunen

Luis Barriga

Alexey Shapin

Per Persson

Per Ståhl

Joakim Persson

Christoffer Jerkeby

Patrik Ekdahl

John Fornehed

Daniel Bergström

Petri Mikael Johansson

Bernd Möller

Robert Baldemair

Gunnar Mildh

Paul Schliwa-Bertling

Yufei W Blankenship

Yi-Pin Eric Wang

John Walter Diachina

Sorour Falahati

Pradeepa Ramachandra

Miguel Lopez

Jacobus Cornelis Haartsen

Kumar Balachandran

Joachim Sachs

Andreas Höglund

Torsten Dudda

Osman Nuri Can Yilmaz

Jonas Fröberg Olsson

Jose Luis Pradas

Niklas Andgart

Mattias Andersson

Vesa Lehtovirta

Peter Ökvist

Sándor Rácz

János Farkas

Ying Sun

Dinand Roeland

György Miklós

Henrik Enbuske

Stefano Ruffini

Nianshan Shi

Zhenhua Zou

José Araújo

Harald Kallin

Sara Sandberg

Dennis Sundman

Anna Larmo

Ari Keränen

Balázs Varga

Magnus Sandgren

Kittipong Kittichokechai

Geza Szabo

Qiang Li

Abdulrahman Alabbasi

Norbert Reider

Kazi Wali Ullah

András Kern

Alexandros Palaios

Gabor Nemeth

Zsolt Kenesi

Ola Angelsmark

Michael Liljenstam

Majid Gerami

Harri Hakala

Mattias Johansson

Kun Wang

Mattias Eld

Bikramjit Singh

Johan Lundsjö

Björn Johansson

Sebastian Weber

Dhruvin Patel

Hubertus Andreas Munz

Yosr Jarraya

Björn Bjäre

Mårten Wahlström

Anders Nohlgren

Johan Kristofer Olsson

Per-Olof Nerbrant

Johannes Nygren

Fredrik Svensson

Muhammad Ikram Ashraf

A method for enabling attestation of a platform comprising a Trusted Execution Environment, TEE, and a Trusted Platform Module, TPM is disclosed. The method is performed by the TEE and comprises: receiving, from an Application of the platform, a request for generation of an attestation quote, the request comprising a nonce, information on which PCR(s) to be used and information about Attestation Keys; establishing a connection to the TPM and obtaining from it at least one PCR value; generating an attestation quote based on the received nonce and the at least one PCR value; signing the attestation, and rendering the attestation quote available for the Application.

Methods and means for attestation of a platform

A security management system including a first TEE and a common TEE is provided. The first TEE is a secured environment for data associated with a first entity. The common TEE is a secured environment for data associated with any one of a plurality of entities. First anonymization parameters are shared between the first TEE and the common TEE. The first anonymization parameters are based at least in part on at least one privacy requirement of the first entity and at least one utility requirement of the security management system. The security management system includes processing circuitry configured to: anonymize first data associated with the first entity based at least in part on the first anonymization parameters, analyze at least the anonymized first data for performing data investigation, and generate analysis results based at least in part on the analysis of at least the anonymized first data.

Multi-tenancy trusted data anonymization

There is provided mechanisms for obtaining a HWAC for a baseband node. A method is performed by a network planner node. The method comprises performing mutual authentication between a TEE of the network planner node and a TEE of the baseband node. The method comprises providing, towards the TEE of the baseband node, a request for HWAC calculation data based on a network resource need. The method comprises obtaining, from the TEE of the baseband node, the requested HWAC calculation data. The method comprises obtaining the HWAC by inputting the obtained HWAC calculation data and a quantification of the network resource need to a HWAC calculation function on the TEE of the network planner node, where the HWAC is given as output from the HWAC calculation function. The method comprises providing, towards the TEE of the baseband node, the HWAC.

Secure handling of hardware activation codes

Techniques for enhancing performance in Industrial Internet-of-Things (IIoT) scenarios, including techniques for time-sensitive networking (TSN) and 5G wireless network integration. An example method, performed by a wireless device, comprises receiving system information (SI) from a radio base station (RBS) of a radio access network (RAN), the SI being indicative of support for TSN through the RBS, and establishing at least one TSN stream with an external data network, through the RBS. The example method further includes receiving a first timing signal from the wireless communications network, via the RBS, receiving a second timing signal from the external TSN data network to which the wireless device is connected, comparing the first timing signal to the second timing signal to determine an offset, and transmitting the offset to the wireless communications network.

Industrial automation with 5G and beyond

There is provided mechanisms for attesting a first TEE residing on a first node. A method is performed by a second TEE also residing on the first node. The method comprises obtaining a request from the first TEE to be attested. The method comprises, in response thereto, obtaining a shared key from a third TEE residing on a second node. The method comprises performing local attestation of the first TEE, whereby the first TEE is provided with the shared key from the second TEE.

Attestation of trusted execution environments

There is provided mechanisms for provisioning of an application level identity from an ID backend server to a communication device. The provisioning of the application level identity is protected using TLS-, DTLS-, or OSCORE-based secure communication. The communication device comprises an identity module configured for interaction according to GSMA RSP based remote subscription profile download. The methods are performed by the communication device and the ID backend server.

Provision of application level identity

Embodiments described herein relate to methods and apparatuses for enabling remote management of a profile in an identity module in an NB-IoT device. A proxy server is configured with access to a database of one or more external identifiers associated with one or more respective NB-IoT devices, wherein the one or more external identifiers are used to address the respective one or more NB-IoT devices via an exposure function in a core network. A method in the proxy server comprises receiving a request to deliver a triggering message to the NB-IoT device, wherein the request comprises a device identifier; determining an external identifier based on the received device identifier; and delivering the triggering message to the NB-IoT device using the external identifier.

Methods and apparatus for enabling remote management of a profile in an identity module

There is provided mechanisms for profile handling of a batch of identity modules. Each identity module in the batch of identity modules has credentials for secure installation of profiles. A method is performed by an LPA of a proxy device. The LPA comprises credentials for profile download. The credentials comprise a certificate. The credentials enable the LPA to act as a virtual identity module. Another method is performed by a subscription management entity. Yet another method is performed by an identity module in the batch of identity modules.

Profile handling of a batch of identity modules

There is provided mechanisms for authenticating an OEM entity as manufacturer of a communication device comprising an identification module. A method is performed by a network entity. The method comprises providing, towards tire identification module, a challenge of a challenge-response authentication procedure. The method comprises obtaining, from the identification module, a first response of the challenge-response authentication procedure. The method comprises providing, towards the OEM entity and upon having obtained the response, the challenge. The method comprises obtaining, from the OEM entity, a second response of the challenge-response authentication procedure. The method comprises authenticating the OEM entity as the manufacturer of the communication device only when the second response matches the first response.

Authentication of an original equipment manufacturer entity

The application discloses methods and corresponding systems and network devices and/or nodes for enabling user equipment belonging to a home network to access data communication services in a visited network of a wireless communication system. By way of example, there is provided a method that comprises the step of obtaining at least one cryptographic token originating from a network node of the home network of the user equipment and cryptographically signed by a private key associated with the home network, wherein the at least one cryptographic token represents means for accessing data communication services via user data transport functions of the visited network. The method also comprises cryptographically signing the obtained and signed token by a private key associated with the user equipment to generate a double-signed token, and sending the double-signed token to a network node of the visited network, which validates the double-signed token for enabling the user equipment to access data communication services via the user data transport functions of the visited network.

Trusted solutions for enabling user equipment belonging to a home network to access data communication services in a visited network

It is provided a method for enabling a user device to verify data integrity. The method is performed in a network node and includes: obtaining measurement data indicating resource usage by the user device; obtaining a session identifier; generating a measurement indicator using a one-way function, based on the measurement data; generating an asymmetric cryptographic signature of the session identifier and the measurement indicator, the asymmetric cryptographic signature being based on a private key of a cryptographic key pair of the network node; and storing, in a distributed ledger database, a set of data comprising the asymmetric cryptographic signature, the session identifier and the measurement indicator.

Verifying data integrity

A method of verifying that a first device and a second device are physically interconnected is disclosed. The method is performed by a verifier and includes sending a challenge Rto the first device, for use as basis for input to a first physical unclonable function, PUF, &#x2014;part of the first device, receiving, a response, RES, from the second device, the response RESbeing based on an output of a second PUF part of the second device, and verifying that the first device and the second device are interconnected for the case that the received response, RES, and an expected response fulfills a matching criterion. A method in a first device and a method in a second device and corresponding devices, computer programs and computer program products are also disclosed.

Methods of verifying that a first device and a second device are physically interconnected

There is provided mechanisms for obtaining a VC certificate from a server. A method is performed by network equipment. The method comprises performing, by an enclave of the network equipment, measurements on at least one property of the network equipment. The method comprises providing, by the enclave, a request for the VC certificate from the server upon having attested the measurements. The method comprises receiving, from the server, the VC certificate in response to the request and storing the VC certificate in the network equipment.

Provisioning of vendor credentials

There is provided mechanisms for handling instances of a trusted execution environment on an execution platform. The trusted execution environment is associated with a secure cryptoprocessor. The secure cryptoprocessor holds a register. The trusted execution environment is configured to read from and write to the register at a given index i. A method is performed by the trusted execution environment. The method comprises checking, upon start of a new instance of the trusted execution environment, status of the register at the given index i, and wherein, when the register at the given index i has its status set to 'undefined', an internal status value is set to a first value, and else, when a value is read from the register at the given index i, the internal status value is set to a second value based on the read value. The method comprises writing the internal status value to the register at the given index i. The method comprises running the new instance. The method comprises, whilst running the new instance, reading a current value from the register at the given index i. The method comprises enabling the new instance to keep running only when the current value equals the internal status value.

Instance handling of a trusted execution environment

A method and a corresponding runtime environment for migrating an instance of an actor of an application are provided. An initiating runtime environment performs a method comprising selecting, based on obtained security attributes for a set of target runtime environments, a target runtime environment from the set of target runtime environments for migration of the instance of the actor. The method comprises migrating the instance of the actor to the selected target runtime environment once the target runtime environment has been selected.

Actor migration

Growing community of inventors

Dalby, Sweden

Bernard Smeets