British Telecommunications Public Limited Company

Claudia Cristina

Fadi El-Moussa

Simon A Beddus

Simon Beddus

Method of Operating a Telecommunications Network A computer-implemented method () of operating a telecommunications network (), the telecommunications network comprising a client device () and a server (), wherein the server and the client device are connected via an access point (), the method comprising the steps of: receiving a service request from the client device, said service request requesting a service from the server (); identifying client device characteristic information associated with the client device (); identifying service requirement information associated with the requested service (); comparing the identified client device characteristic information with the identified service requirement information so as to determine if the client device information complies with the service requirement information (); and in response to said comparison: permitting the server to provide the requested service in accordance with the service request if the client device information complies with the service requirement information (); and preventing the server from providing the requested service in accordance with the service request if the client device information does not comply with the service requirement information ().

Method of operating a telecommunications network

A computer-implemented method of analysing anomalous network traffic in a telecommunications network, said telecommunications network comprising a plurality of network entities () and a security analyser (-), wherein the method comprises the steps of: receiving at the security analyser a network communication from a first network entity; identifying the first network entity; by means of the security analyser: analysing the network communication and/or a performance of the first network entity thereby to identify the network communication as an anomalous communication (); in response to identifying the network communication as an anomalous communication, communicating an instruction to the identified first network entity to respond with origin information regarding the anomalous communication, wherein the origin information identifies a preceding network entity from which the anomalous communication was directly received by the first network entity (); and commencing with the preceding network entity, iteratively communicating an instruction to a preceding network entity to respond with origin information for identifying another preceding network entity from which the anomalous communication was directly received until a source network entity from which the anomalous communication originated is identified (; and applying a security policy to the identified source network entity ().

Method of analysing anomalous network traffic

A containerisation orchestrator () is controlled by an analysis system () which assesses an application and a device for compatibility to have a candidate application installed on the device using the orchestrator. The analysis includes an assessment of the vulnerability of the installed application to failure or malicious attack, and a risk assessment of the consequences of such an event. The candidate containerised configuration () for the application is also assessed for compatibilities and vulnerabilities.

Vulnerability assessment of containerised installation

Containerised computing processes are generated by an orchestration processor interpreting user commands and user profile data to build a deployment specification specifying functions to be run by a containerised process, using a shell script run on a host virtualisation container. External events such as security threats and computing resource overloads can be used to generate the virtualised process, allowing vulnerability detection, and apply countermeasures such as deployment or migration of containers during attacks to lesser prone infrastructure, and allows the orchestration of non-container tools to provide security and resilience.

Containerised programming

A web server operating in a container has resource and network limits applied to add an extra layer of security to the web server. If a monitor detects that the container's resource usage is approaching one or more of these limits, which may be indicative of a DDoS attack, (step) or identifies traffic sources exhibiting suspicious behaviour, such as frequently repeated requests from the same address, or from a related set of addresses, a restrictor function caps the resources allowed by the original Webserver container to allow it to recover from buffer overflow and protect servers running in other containers from overwhelming any shared resources. A duplicator function starts up replica containers with the same resource limits to take overflow traffic, and a load balancing function then directs incoming traffic to these overflow containers etc. Traffic from suspicious sources is directed by the load balancer to one or more specially-configured attack-assessment container(s) where a 'dummy' web server operates. The behaviour of these sources is analysed by a behaviour monitoring function over some time to determine if they are legitimate or malicious, which can control a firewall to block addresses identified as generating malicious traffic.

Denial of service mitigation

Actuators and sensors in an intelligent system are controlled by setting encryption types and key lengths to individual applications based on the type of device and application being run. A server system () running in a communications gateway, selects an encryption policy for one or more devices under its control. This selection is controlled by an analysis function () using data relating to the type of device (), and the applications to be run on the device (), to generate an appropriate encryption policy () which can be deployed to the device (). Controlling the analysis and deployment in a gateway device allows co-ordination between devices, and reduces processor time in the devices. An agent is sent to the device alongside the encryption policy data, to control the device according to the encryption policy. In response to events detected and analyzed by analysis function (), the server sends triggers () to the agent loaded on the device to modify its encryption type in accordance with the policy previously deployed. Revisions and updates to the deployed policies can also be initiated, in response to dynamic factors such as resource usage (CPU, bandwidth, battery etc.), data sensitivity, external events and notifications of vulnerabilities to device type and applications used, in order to allocate resources more efficiently. Different encryption systems can be applied to different applications or data streams running on the same device, and encryption can be applied actively as and when required, using dynamic analysis of both the device and the application to encrypt data&#x2014;for example to only encrypt if malware is detected.

Growing community of inventors

London, United Kingdom

Claudia Cristina