Telefonaktiebolaget Lm Ericsson (publ)

Selander, Göran

Lindholm, Fredrik

Nyström, Magnus

Göran Selander

Mats Näslund

Gunnar Mildh

Rolf Blom

Fredrik Lindholm

Johan Rune

Jari Tapio Vikberg

Magnus Stattin

Elena Dubrova

Fredrik Lindqvist

Mattias Eld

Karl Norrman

Petter Arvidsson

Bernard Smeets

Harald Kallin

Magnus K Almgren

Michael Liljenstam

Konstantinos Dimou

Niklas Johansson

Per Skillermark

Tommy Arngren

Jari Arkko

Christian Gehrmann

Magnus Lindström

András Rácz

Mikael Prytz

Vlasios Tsiatsis

Anders E Eriksson

Per Magnusson

Frank Hartung

Luis Barriga

Yi Cheng

Magnus Nyström

John Mattsson

Johan Lundsjö

Börje Ohlman

Ulf Björkengren

Teemu Rinta-Aho

Jose Alonso-Rubio

Per-Olof Nerbrant

Micael Martell

Nicolae Paladi

Miguel Cardo Rodríguez

Freyr Saevarsson

Marco Tiloca

Joel Ståhl

Joachim Sachs

Mats NÄSLUND

Steinar Dahlin

András MÉHES

Johan LundsjÖ

Ritta Almgren

A method for enabling secure group communication in a communication network is performed in a sending node and includes providing signature verification related information to a plurality of listening nodes and sending a group message to the plurality of listening nodes, the group message including signature verification related information of the sending node. A method, nodes, computer programs, and a computer program product enabling secure group communication in a communication network are also presented.

Security for group communication

There is provided a method of operating a network controller for enabling secure communication between network endpoints in a distributed network, as well as a network controller and a network switch and a method of operating a network switch. The network controller has a secure channel with each of the network endpoints. The network controller is providing, in connection with establishment of a network flow for communication between the network endpoints, symmetric keying material associated with and valid only for that network flow. The network controller is further enabling provisioning of the symmetric keying material to the network endpoints for allowing cryptographically secure communication between the network endpoints on a per-flow basis.

Security for distributed networking

A method performed by an unmanned aerial vehicle, UAV (), or a remote control () for the UAV, for executing an operating session for the UAV in controlled airspace, comprises the steps of transmitting a request for permission to operate in the airspace to an airspace authority function () and receiving a reply to the request. If permission to operate is granted, the following steps are performed: receiving a message comprising information about a space-time region of airspace to operate in, monitoring a position of the UAV in space and time, and, if the position of the UAV is within the region and the UAV is either within a predetermined distance from a geographical border of the region, or predicted to reach the geographical border of the region within a predetermined time, activating assisted control of the UAV to keep the UAV within the region.

Unmanned aerial vehicle in controlled airspace

The disclosure relates to a method () for a serving device () of establishing a computational puzzle for use in communication between a client device () and the serving device (). The method () comprises establishing (), in the serving device (), the computational puzzle (p) based on a key shared by the client device () and the serving device () and on a solution (s', s&#x2033;) to the computational puzzle (p). Further method () in a serving device is provided, methods () for client devices (), serving devices (), client devices (), computer programs and computer program products.

Method and device for establishing a computational puzzle for use in communication between a client and a server

A method () of generating a cryptographic checksum for a message M(x) is provided. The method is performed by a communication device, such as a sender or a receiver, and comprises calculating () the cryptographic checksum as a first function g of a division of a second function of M(x), &#x192;(M(x)), modulo a generator polynomial p(x) of degree n, g(&#x192;(M(x))mod p(x)). The generator polynomial is calculated () as p(x)=(1&#x2212;x)&#xb7;P(x), and P1(x) is a primitive polynomial of degree n&#x2212;1. The primitive polynomial is selected (), based on a first cryptographic key, from the set of primitive polynomials of degree n&#x2212;1 over a Galois Field. By replacing a standard checksum with a cryptographic checksum, an efficient message authentication is provided. The proposed cryptographic checksum may be used for providing integrity assurance on the message, i.e., for detecting random and intentional message changes, with a known level of security. The proposed checksum is capable of detecting double-bit errors which may be introduced by a Turbo code decoder.

Generating cryptographic checksums

The disclosure relates to a method () for a network node () of a wireless network () of providing a device () access to the wireless network (). The method () comprises receiving (), from a device (), an access request comprising a preamble; establishing (), in response to the access request, a computational puzzle based on the received preamble; and sending () the computational puzzle to the device (). A corresponding method in a device is also disclosed, as are a network node (), device (), computer programs and computer program products.

Method in a network node for providing a device access to a network

A node () in an information centric network (ICN) receives a first identifier associated with an information object. The node () causes creation of a virtual node () in the ICN, for holding a mapping between a second identifier and the first identifier. The second identifier is assigned to a copy of the information object stored in the ICN. The node () causes creation of the virtual node () such that the mapping is arranged to cease after a predetermined event. The virtual node () is created with the sole purpose of providing copies of the information object to a small number of requestors (), and possibly to just one requestor (). Ceasing the mapping after delivery of the one copy, or the few copies, of the information object prevents unauthorized retrieval of the information object.

Access control in an information centric network

A method () of generating a cryptographic checksum for a message M(x) is provided. The method comprises pseudo-randomly selecting () at least two irreducible polynomials p(x). Each irreducible polynomial p(x) is selected based on a first cryptographic key from the set of irreducible polynomials of degree nover a Galois Field. The method further comprises calculating () a generator polynomial p(x) of degree n=formula (I) as a product of the N irreducible polynomials formula (II), and calculating () the cryptographic checksum as a first function g of a division of a second function of M(x), &#x192;(M(x)), modulo p(x), i.e., g(&#x192;(M(x)) mod p(x)). By replacing a standard checksum, such as a Cyclic Redundancy Check (CRC), with a cryptographic checksum, an efficient message authentication is provided. The proposed cryptographic checksum may be used for providing integrity assurance on the message, i.e., for detecting random and intentional message changes, with a known level of security. Further, a corresponding computer program, a corresponding computer program product, and a checksum generator for generating a cryptographic checksum, are provided. 

A method () of generating a cryptographic checksum for a message M(x) is provided. The method comprises pseudo-randomly selecting () a generator polynomial p(x) from the set of polynomials of degree n over a Galois Field and calculating () the cryptographic checksum as a first function g of a division of a second function of M(x), &#x192;(M(x)), modulo p(x), g(&#x192;(M(x))mod p(x)). The generator polynomial p(x) is pseudo-randomly selected based on a first cryptographic key. By replacing a standard checksum, such as a Cyclic Redundancy Check (CRC), with a cryptographic checksum, an efficient message authentication is provided. The proposed cryptographic checksum may be used for providing integrity assurance on the message, i.e., for detecting random and intentional message changes, with a known level of security. Further, a corresponding computer program, a corresponding computer program product, and a checksum generator for generating a cryptographic checksum, are provided.

It is presented a security server arranged to set up communication between a merchant device and a customer payment application. The security server comprises: a receiver arranged to receive a first message comprising a customer identifier, an application identifier and a security token; a determiner arranged to determine whether the merchant device is authorized; a transmitter arranged to send a second message to the merchant device, the second message indicating that the merchant device is authorized to effect payment; and a channel establisher arranged to set up a secure channel between the merchant device and the customer payment application in a secure element being adapted to be comprised in a mobile communication terminal, wherein all communication between the merchant device and the customer payment application is controlled by the security server. Corresponding methods, merchant device, computer programs and computer program products are also presented.

Methods, server, merchant device, computer programs and computer program products for setting up communication

It is disclosed a method and a constrained resource device () for establishing a secret first key between a client device () and the constrained resource device. The invention also relates to a method and an authorization server () for enabling establishing a secret first key between a client device () and the constrained resource device. Based on a secret second key shared () between the constrained RD and the AS, the secret first key shared between the constrained resource device and the client device can be established. Devices having constrained resources cannot use protocols with which additional messages are required to share a secure identity. Embodiments of the present invention have the advantage that a secret identity can be established within an authentication protocol and that no additional messages are required to establish the secret identity.

Key establishment for constrained resource devices

A method, computer program and a server node () in a communications network () for reduction of undesired energy consumption of the server node (), the method comprising: receiving a request message from a client (), the request message containing message fields comprising at least a message ID field and an integrity indication field containing a first integrity indication, determining a relation key by performing a calculation by usage of a master key commonly known by the server node () and an authorization engine () and at least data comprised in the message ID field, calculating a second integrity indication based on a subset of the message fields by usage of the relation key, wherein the subset excludes at least one message field that is predictable by a trusted client (), verifying the subset of the message fields by comparing the first and second integrity indications, and determining the message to be authorized when the comparison indicates equality, and wherein when the message is not authorized, suppressing reception of the message.

Methods, nodes and computer programs for reduction of undesired energy consumption of a server node

A method of authorizing a message received at a node in a wireless network is disclosed. The message from a sender device is formed by a plurality of symbols and includes a first message integrity indicator located at a predetermined distance from the start of the message such that further symbols of the message are included after the first message integrity indicator. The position of the first message integrity indicator in the message is determined, and a cryptographic operation is performed on at least some of the symbols of the message before the first message integrity indicator so as to generate a second message integrity indicator before the first message integrity indicator is received. The first and second message integrity indicators are compared, and an indication that the message is not authorized is provided if the second message integrity indicator does not match the first message integrity indicator.

Energy saving in wireless devices

A Feedback Shift-Register (FSR) enabling improved testing, e.g., Built-In Self-Tests (BIST), is provided. Each cell of the FSR may either be an observable cell, associated with a non-trivial feedback function implemented by a combinational logic circuit, or a controllable cell, having an associated state variable which belongs to the dependence set of exactly one of the non-trivial feedback functions. Each controllable cell is provided with a multiplexer for selecting either a predecessor cell of the controllable cell or a test value as input. Thus, the sequential circuit of the FSR in an embodiment is tested using tests for combinational logic. The disclosed test procedures utilize a minimal set of test vectors and allow detection of all single stuck-at faults in the FSR. The resulting dynamic power dissipation during test can be considerably less than known BIST designs.

Testing a feedback shift-register

Growing community of inventors

Bromma, Sweden

Göran Selander