Telefonaktiebolaget Lm Ericsson (publ)

Daniel Migault

Stere Preda

Makan Pourzandi

Fereydoun Farrahi Moghaddam

Amine Boukhtouta

Suresh Krishnan

Yves Lemieux

Catherine Truchan

Yosr Jarraya

Reza Farrahi Moghaddam

Tereza Cristina Carvalho

Mohamed Cheriet

Wubin Li

Thomas Ingemarsson

Daiying Liu

Alireza Shameli-Sendi

Thiago Rodrigues Meira De Almeida

Bruno Medeiros De Barros

Enayatallah Ghaznavi

Elaheh Jalalpour

A method, system and apparatus are disclosed. According to one or more embodiments, a verifier is provided. The verifier includes processing circuitry configured to obtain a hash algorithm and a fully qualified domain name, FQDN, associated with a virtual network function, VNF, image, determine an identifier for the VNF image based at least on the hash algorithm and the FQDN, perform domain name system security extensions, DNSSEC, resolution of the determined identifier for the VNF image at least in part by requesting at least one attribute of the VNF image using the determined identifier for the VNF image and validating a response associated with the request, and perform validation of the VNF image in response to successful DNSSEC resolution.

Domain name system security extension (DNSSEC) for container signature management

A method for steering an original packet transmitted by a UE. The method includes receiving a first packet, wherein the first packet encapsulates the original packet. The method also includes extracting networking information (e.g., IP source, IP destination, tunnel identifier) from the first packet. The method also includes generating an SFC header (e.g., an NSH header), wherein the SFC header comprises: i) an SPI that identifies a service path and ii) metadata, wherein the metadata comprises the networking information extracted from the first packet. The method also includes generating a second packet comprising the SFC header and the original packet. The method also includes providing the second packet to an SFF that is configured to select a service path based on the SPI included in the SFC header of the second packet and forward the second packet based on the selected service path.

Radio access network (RAN) architecture

Systems and methods for maintaining privacy of security protocol parameters are provided. A node receives an encrypted packet and determines if the Security Parameters Index (SPI) value has been updated. The node can modify its stored SPI value(s) accordingly and process the encrypted packet.

IPsec privacy protection

A system, node and wireless device are provided. An intermediate node is provided that includes processing circuitry configured to: receive a packet where the packet includes metadata associated with first input data of a first node, first output data of the first node, a first PC signature and a public cryptographic key associated with the first node, verify that the first PC signature corresponds to a process that led from the first input data to the first output data using the public cryptographic key, verify a link between first node and the intermediate node by comparing the received packet and the first output data, and determine whether to perform at least one service function on the packet based at least in part on the verification of the first PC signature and the verification of the link between the first node and the intermediate node.

Verification and/or certification along a service chain

Apparatuses and methods are disclosed for enabling signalling storm mitigation in Internet Protocol (IP) Security (IPsec)-secured virtual Radio Access Network (vRAN). In one embodiment a method in a first network node includes receiving a trigger to establish an IPsec session with a second network node, the IPsec session being associated with a user equipment (UE); responsive to the trigger to establish the IPsec session associated with the UE, derive a unique identifier for the UE; generate a Security Parameter Index (SPI) value based at least in part on the unique identifier derived for the UE, the SPI value being unique to the IPsec session; and communicate an indication of the SPI value to the second network node.

Signalling storm mitigation in a secured radio access network

Methods, terminal and a data center gateway are provided for allowing efficient debugging and troubleshooting of data session encrypted with Perfect Forward Secrecy (PFS) encryption techniques such as for example the Transport Layer Security (TLS) protocol version 1.3. Embodiments of the invention allow the user terminal to authorize a data center gateway to persistently store one or more encryption keys associated with the data session for use to access the recorded data session and troubleshooting it after the session ended, when faults are detected. When a fault is detected, the user terminal provides authorization to the gateway to persistently store the data session along with one or more encryption key(s). With this, the gateway allows for the data session to be later decrypted and faults to be investigated despite the data session being encrypted with PFS techniques.

Access to content of encrypted data session

Methods and systems for automatic provisioning of security policies for content streaming control within a Content Delivery Network (CDN) are provided. According to one aspect, a method for automatic provisioning of security policies for content streaming control by a network node within a CDN that supports at least one streaming media protocol comprises: obtaining a manifest, the manifest being generated in response to a user requesting a streaming content from the CDN; determining a first security policy associated with the user and/or the requested streaming content in accordance with the manifest; updating a set of firewall rules for implementing security policies in accordance with the determined first security policy; and applying the updated set of firewall rules to validate requests from the user for the streaming content. The policies are dynamically configured and may be sparsely provisioned, e.g., downloaded only to the pertinent nodes and activated only when necessary.

Automatic provisioning of streaming policies for video streaming control in CDN

Systems and methods for virtualizing edge node functionality as a service for handling content delivery are described herein. An edge node receives a packet and determines if it associated with an established session and if it should be offloaded for processing. An offload status indicator and/or session context information can be added to the offloaded packet and it is transmitted to a subsequent edge node.

Virtual edge node as a service

Systems and methods are disclosed herein that relate to secure monitoring or interception of traffic in a wireless communications system. In some embodiments, a method of operation of a network node comprises receiving a list of one or more obfuscated target identifiers from a monitoring node, where each obfuscated target identifier is a user identifier of a target user that is encrypted using a first encryption key that is unknown to the network node. The method further comprises receiving an encrypted packet from another network node and determining whether an encrypted user identifier of the encrypted packet matches one of the obfuscated target identifiers. The method further comprises, if the encrypted user identifier matches one of the obfuscated target identifiers, further encrypting the encrypted packet using a second encryption key negotiated between the network node and the monitoring node and transmitting the further encrypted packet to the monitoring node.

Enhanced lawful interception

Systems and methods for processing inbound and outbound secure packet traffic are provided herein. A first lookup operation can be performed to identify a security association corresponding to a received packet. A second lookup operation can be performed to determine a security parameters index associated with the packet and the identified security association. The packet can be processed in accordance with the security association and the security parameters index.

Flow multiplexing in IPsec

Systems and methods are provided for mitigating security attacks by enabling collaboration between security service functions. A Service Function Chaining (SFC) node receives a packet and determines whether to apply a service function to the packet. Responsive to determining that the packet has been treated by the service function, the packet can be reclassified and switched to a different SFC path.

System and method for security service collaboration

Systems and methods are provided for packet handling and steering in a service function chaining network such that the full metadata associated with a packet need not be appended to the packet itself.

Network service context

A method, node and identifier authorizing entity for generating a unique identifier at a node in a hierarchal tree having a plurality of nodes, the hierarchical tree arranged in a plurality of levels. The method includes obtaining a first limit condition from a higher level node of the plurality of nodes in the hierarchal tree, generating the identifier, applying a function to the generated identifier, verifying that an output of the function satisfies the limit condition, determining a second limit condition for at least one lower level node of the plurality of nodes in the hierarchal tree, and sending the second limit condition to the at least one lower level node of the plurality of nodes in the hierarchal tree.

Growing community of inventors

Montreal, Canada

Daniel Migault