Telefonaktiebolaget Lm Ericsson (publ)

Daniele Gaito

Giuseppe Celozzi

Luca Baldini

Gaetano Patria

Enrico De Luca

Elvira Villani

Gaetano Barba

Raffaele Costabile

Mariano Russo

Francesco Attanasio

Biagio Maione

Dario De Vito

Carmine Galotto

Antonio Vitiello

Chiara Santella

Lucia Savarese

Alfredo Somma

Dario Scudiero

Gennaro Falanga

Domenico Raffaele Cione

Antonio Giorgio Gaggia

Maria Pia Cancro

Antonio Villa

Vincenzo Starace

Lorenzo Giuseppe Elisio

Rosa Catapano

Alfonso Buonocore

Michele La Torre

Gianpaolo Di Mauro

Maurizio De Masi

A lawful interception provisioning function, LIPF () and a system information retrieval function, SIRF (), communicate with each other via the X1 and X2 protocols. The LIPF () obtains, from the SIRF (), information pertaining to a network function, NF(), which is an instance of a virtual network function, VNF, in a telecommunicationnetwork (), where said information is unrelated to any LI target and any task associated with a point of interception, POI (), in the NF ().

Obtaining information pertaining to a network function in lawful interception

A technique of authenticating an operator of a wireless terminal device is presented, wherein the first terminal device comprises a subscriber identity module (SIM) and wherein a subscription identifier is stored in the SIM. A method aspect of this technique comprises receiving the subscription identifier or a temporary identifier associated with the subscription identifier. The method aspect also comprises receiving a first set of biometric data of the operator, wherein the first set of biometric data has been entered by the operator at the terminal device, and sending a database request towards a subscriber database in a core network domain of a wireless communication system, the database request including the subscription identifier or the temporary identifier. The method further comprises receiving, in response to the database request, a second set of biometric data associated in the subscriber database with the subscription identifier or the temporary identifier, and authenticating the first set of biometric data on the basis of the second set of biometric data so as to obtain a first authentication result.

Technique for authenticating operators of wireless terminal devices

A request associated with a destination to which a point of interception, POI, () is to transmit intercepted data via an X2/X3 interface during lawful interception, LI, is received from an administrative function, ADMF (), via an X1 interface. The request comprises an identifier of the destination and version information that specifies at least one version of a transmission protocol to use by the POI for transmission of intercepted data to the identified destination. The POI determines whether or not the POI is able to transmit intercepted data via the X2/X3 interface using a version of the protocol that is equal to one of the versions in the received version information. The received version information is compared with version information available in the POI. A response is transmitted via the X1 interface that indicates if the POI is able to transmit intercepted data via the X2/X3 interface.

Transmitting or receiving version information of transmission protocol

A service interruption manager function, SIMF, receives information that indicates that lawful interception, LI, service interruption associated with an LI task has occurred. Based on the received information, a determination is made of a status regarding the LI service interruption associated with the LI task, for example a determination whether the LI service interruption associated with the LI task has a current status that is any of: terminated, ongoing or initiated. A message is then transmitted, to a delivery function, DF, via an HI2 interface, the message comprising at least the determined status regarding the LI service interruption.

Managing service interrupts in lawful interception

The present disclosure provide a node and method performed in the node for connecting at least two Lawful Interception (LI) sites () to the same Physical Networks Function (PNF) comprising a Point Of Interception (POI) or Virtual Networks Function (VNF) () comprising a virtualised Point Of Interception (vPOI) () controlled by a Triggering Control Function (TCF) (), for lawful interception of the data communication sessions of targets defined by warrants comprising information identifying the targets, wherein said node () is adapted to configure the POIs/vPOIs/TCFs according to LI sites requests and policy requirements for each LI site, the node comprises a multi LI Site Database, mLSDB, () enabling the POI or vPOI/TCF to serve more than one LI site at the same time.

Method, node and computer program of lawful interception systems and networks

The invention relates to methods, communication devices, computer programs and computer program products related to Lawful Interception, LI. An LI, Administration Function, ADMF, sends a request over an X1 interface to a Network Element, NE, that is configured to perform an action associated with an LI, to add information associated with a destination or modify information of an existing destination for a message to be sent from the NE to the LI ADMF over the X1 interface. The NE receives the request, adds information associated with a destination or modifies information of an existing destination, and sends a response to the LI ADMF over the X1 interface, wherein the response comprises a result associated with the request.

Methods, system and communication devices related to lawful interception

Network slice providers and resource providers in a communication network are configured to cause various records related to a smart contract for one or more resources to be stored in a permissioned blockchain. The records include an allocation, a deallocation and monitoring records related to the resource(s). When the resources are released, the blockchain records ease settling slice beneficiaries' financial obligations.

Methods and devices for resource sharing using smart contracts

A method () performed by a communication device hosting a network element, NE, the method comprising: —preparing () a Report Issue request message for reporting an Issue; —incrementing () an Issue count to obtain a current Issue count of Issues reported by the NE to a lawful interception, LI, administrative function, ADMF; —adding () the current Issue count to the Report Issue request message; —sending () the Report Issue request message () including the current Issue count to the LI ADMF; —receiving () a request message () from the LI ADMF requesting information about at least one Report Issue request message sent by the NE and not received by the LI ADMF; and —sending () a response message () including the requested information.

Methods, communication devices and system relating to performing lawful interception

Methods and network devices implement a lawful interception (LI) trigger control function as an LI target handler and a modified trigger control function. A generic LI triggering interface enables the modified trigger control function to query the LI target handler regarding whether entities using a network function instance are in a target list. The LI target handler has to meet the LI security requirements, but the modified trigger control function does not have to meet such requirements.

Methods and devices for triggering lawful interception

A method, performed by a first entity (), for providing a service in a communications network (). The first entity () obtains (), from a second entity (), a request. The request is for one or more links () to be allocated to a first network slice to provide a service via one or more paths (). The () connect one or more nodes (). The request indicates at least one of: a) one or more requirements to be met by the links (), and b) a first priority to be assigned to the first network slice. The first entity () determines () the links () to be allocated to the first network slice. The determining () is based on the one or more requirements, the first priority, and a set of available resources. The first entity () sends (), to another entity (), an indication based on the determined links ().

First entity, second entity, third entity, and methods performed thereby for providing a service in a communications network

A method for allocating a plurality of virtual machines (-) provided on at least one host (-) to a virtualized network function is provided, which provides a defined functional behavior in a network and requires a total application capacity for the functional behavior, the functional behavior being provided by needed virtual machines from the plurality of virtual machines, wherein each of the at least one host has an available processing capacity which can be assigned to the virtual machines provided on the corresponding host, and each virtual machine has at least one flavor which indicates a used processing capacity of the available processing capacity of the corresponding host and which corresponds to a partial application capacity of the total application capacity provided by the corresponding virtual machine, the method comprising: &#x2014;determining the total application capacity of the virtualized network function, &#x2014;determining, for each of the virtual machines, the at least one flavor taking into account the available processing capacity of the host on which the corresponding virtual machine is provided, and the corresponding at least one partial application capacity, &#x2014;determining the needed virtual machines from the plurality of virtual machines and needed flavors of the needed virtual machines that are required to provide the total application capacity, wherein determining the needed virtual machines and needed flavors comprises: performing an iterative process in which the needed virtual machines are dynamically determined from the plurality of virtual machines based on the total application capacity, and in which the needed flavor for each of the needed virtual machines is dynamically determined taking into account the total application capacity and the available processing capacity provided on the host on which the corresponding needed virtual machine is provided.

Dynamic flavor allocation

A Software Defined Network (SDN) comprises a plurality of resources including Network Elements (NEs) and network links connecting the NEs. A method comprises receiving a request to provision an SDN Datapath in the SDN. The request comprises performance metrics for the SDN Datapath and a geographic constraint to be applied to resources used in provisioning the SDN Datapath. The method further comprises assembling a candidate set of resources to provision the SDN Datapath and initiating provision of the SDN Datapath using resources selected from the candidate set. Assembling a candidate set of resources to provision the SDN Datapath comprises obtaining a geographic location attribute of resources in the SDN and populating the candidate set with those resources having a geographic location attribute satisfying the received geographic constraint.

Datapath provision in software defined networks

A method () of managing a communications network comprising a plurality of hosts by allocating instances of virtual network function components, VNFC, to hosts, the method comprising receiving () a request for allocation of an instance of a VNFC to a host, the instance belonging to an anti-affinity group, AAG, of instances and attempting allocation () of the instance to a host. If allocation of the instance fails () because for each host considered for allocation of the instance a first number of instances, WA, belonging to the AAG that are allocable to a single host would be exceeded by allocation of the instance to the host the method comprises assigning () to the instance a second number of instances, WA', belonging to the AAG that are allocable to a single host, wherein WA&#x2032; is greater than WA and reattempting allocation () of the instance. Following successful allocation, if sufficient capacity for the instance subsequently becomes available on another host and if the WA of the instance would not be exceeded by allocation of the instance to the other host, migrating () the instance to the other host; or following unsuccessful allocation, if there is sufficient capacity for the instance available on at least one host, increasing WA&#x2032; of the instance and recommencing by reattempting allocation ().

Allocating VNFC instances with anti affinity rule to hosts

A technique for resolving a link failure occurring on a link between a first virtualized network function, VNF, and a second VNF provided in a cloud computing environment is disclosed. A method implementation of the technique is performed by the first VNF and comprises receiving a link failure notification comprising link recovery status information indicating a current recovery status of the link, and triggering an action depending on the link recovery status information to resolve the link failure.

Technique for resolving a link failure

It is disclosed a method, an arrangement and a computer program for configuring a secure domain, SD, in a network functions virtualization infrastructure. The SD comprises virtual objects handling privileged information. NS instance information of a virtual object is obtained based on input from a party associated with the SD. The NS instance information is searched for a level of confidentiality and a geographic location information. When having identified the level of confidentiality and the geographic location information, the virtual object is allocated to the SD according to the geographic location information, based on the level of confidentiality and a specific role of the party. It is an advantage that access to a SD is allowed or granted based on the specific role of the party.

Growing community of inventors

Pagani, Italy

Daniele Gaito