Nokia Solutions and Networks Oy

Siemens Aktiengesellschaft

Nokia Technologies Oy

Nokia Siemens Networks Oy

Nokia Siemens Networks Gmbh & Co Kg

Nokia Solutions and Networks Gmbh & Co. Kg

Guenther Horn

John McFarland Harris

Devaki Chandramouli

Curt C Wong

Jorge Cuellar

Anja Jerichow

Peter Schneider

Marc Blommaert

Wolf-Dietrich Moeller

Woonhee Hwang

Suresh P Nair

Umamaheswar Achari Kakinada

Nagendra S Bykampadi

Thomas Belling

Dan Forsberg

Eric J Drury

Joachim Charzinski

Alexander Milinski

Róbert Ropolyi

Volker Kessler

Bart Vinck

Wolfgang Pieper

Bindhya Vashini Tiwari

Ulrike Meyer

Robert Ropolyi

Klaus Mueller

Wolfgang Buecker

Heribert Roeser

Hinrich Eilts

Paula Hannele Siren

Bernd Jaeger

Various communication systems may benefit from appropriate security measures. For example, mobile networks may benefit from the flexible selection of security features. A method can include receiving an attach request. The method can also include sending a response to the request. The response can include information configured to allow selection of a control plane integrity algorithm independently of a user plane integrity algorithm.

Flexible selection of security features in mobile networks

Systems, methods, apparatuses, and computer program products for securing user plane (e.g., MB2-U) interface between a group communication service application server (GCS AS) and Broadcast Multicast Service Center (BM-SC) are provided. One method may include transmitting a message via a control plane, to an application server, indicating whether to establish a security association on a user plane in an interface between the GCS AS and the BM-SC. The method may also include providing, to the GCS AS, a target internet protocol (IP) address and possible port as a target for the security association.

Group communication service enabler security

User equipment is registered with a visited public land mobile network, VPLMN, in a process including: producing at the user equipment a concealed identifier; producing at the user equipment a freshness code; and sending by the user equipment to the VPLMN the concealed identifier and the freshness code; receiving by the user equipment an identity request from the VPLMN indicating that the long-term identifier must be transmitted to the VPLMN in a non-concealed form; receiving by the user equipment from the VPLMN a permission authenticator; and verifying at the user equipment if the permission authenticator has been formed with a cryptographic authentication of the home public land mobile network, HPLMN, and the user equipment or a subscription module at the user equipment indicating permission to transmit the long-term identifier to the VPLMN in the non-concealed form and if yes, transmitting the long-term identifier to the VPLMN in the non-concealed form.

Registering user equipment with a visited public land mobile network

In accordance with the occurrence of a mobility event whereby user equipment moves from accessing a source network to accessing a target network in a communication system environment, the user equipment sends a control plane message to the target network comprising an integrity verification parameter associated with the source network and an integrity verification parameter associated with the target network. By providing integrity verification parameters for both the source network and the target network in an initial message sent by the user equipment to the mobility management element of the target network, the mobility management element of the target network can verify the user equipment on its own or seek the assistance of the source network.

Security in intersystem mobility

A method, apparatus, and computer program product, in which a password-based digest access authentication procedure is used for performing authentication between a client and a server, wherein the authentication procedure is secured by at least one of modifying a digest-response parameter with a user password and generating a bootstrapped key based on the user password and at least one fresh parameter not used in a previous protocol run between the client and the server.

Secure bootstrapping architecture method based on password-based digest authentication

Certain example embodiments may generally relate to multi-security levels/traffic management across multiple network function instantiations, including virtualized network function instantiations. A method may include configuring a first instantiation of a first network function to provide a first type of security. The method may also include configuring a second instantiation of the first network function to provide a second type of security that is different than the first type of security. The method may further include allocating at least some of the subscriber traffic to the first instantiation.

Multi-security levels/traffic management across multiple network function instantiations

It is provided an apparatus, comprising property checking means configured to check whether a claimant property information received from a claimant device corresponds to a predefined claimant attribute; obtaining means configured to obtain a result, which is positive only if the claimant property information corresponds to the predefined claimant attribute as checked by the property checking means; key generation means configured to generate a first claimant intermediate key from a predefined claimant permanent key stored in the apparatus; supplying means configured to supply, to the claimant device, the first claimant intermediate key using a secured protocol, wherein at least one of the key generation means and the supplying means is configured to generate and to supply, respectively, the first claimant intermediate key only if the result is positive.

Remote verification of attributes in a communication network

An apparatus comprises a memory unit, and a control unit connected to the memory unit. The apparatus can be configured to interface at least one access node; the control unit is configured to derive at least one local level security key within an established security context for a terminal, forward the derived local security key to at least one access node, and detect failures in a handover for a terminal being served by a first access node towards a second access node. The failures concern the interface between the apparatus and the second access node. In response to a verified trigger condition, the control unit can re-adjust local level security keys with keys maintained at the terminal within the established security context.

Methods, apparatuses and computer program products enabling to improve handover security in mobile communication networks

Systems, methods, apparatuses, and computer program products for providing security between WebRTC clients and IMS are provided. One method includes storing, by a network node, at least one parameter per internet protocol multimedia subsystem (IMS) subscription, where the at least one parameter comprises at least one identity of any web real time communication (WebRTC) web server function that is authorized to authenticate an IMS subscriber in WebRTC. The method may further include receiving a WebRTC web server function identity from a call state control function, comparing the received WebRTC web server function identity with the at least one parameter associated with the IMS subscription, and rejecting IMS communication when there is not a match between the received WebRTC web server function identity and the at least one parameter associated with the IMS subscription.

Security for access to the IP multimedia subsystem (IMS) with web real time communication (WebRTC)

The present invention is related to a method, apparatus, and computer program product, in which a password-based digest access authentication procedure is used for performing authentication between a client and a server, wherein the authentication procedure is secured by at least one of modifying a digest-response parameter with a user password and generating a bootstrapped key based on the user password and at least one fresh parameter not used in a previous protocol run between the client and the server.

Systems, methods, apparatuses, and computer program products for security handling in, for example, cells that support multiple frequency band indication are provided. One method includes receiving, for example by a source evolved node B (eNB) configured to communicate with a user equipment, a multiple frequency band indicator (MFBI) list, the multiple frequency band indicator (MFBI) list comprising at least one frequency band number listed in the same order of priority as broadcast by a target eNB. The method may further include selecting one of the at least one frequency band number for use by the source eNB, calculating a security key (KeNB*) using the DL EARFCN belonging to the selected frequency band number with the highest priority that is also supported by the user equipment, and signaling the calculated security key to the target eNB.

Security handling for multi frequency band

In a method for key handling in mobile communication systems, first and second numbers are exchanged between entities of the mobile communication system. The first and second numbers are respectively used only once with respect to the respective system parameters of the communication system and therefore allowing greater security in the communication system.

Key handling in communication systems

It is disclosed a method (and related apparatus) including selecting, at a first endpoint entity, at least one range of protection to be granted, the range of protection relating to one of a plurality of network elements in at least one access network and at least one core network and to a second endpoint entity, and transmitting, to a network element entity, a signaling message including first establishment information indicating the at least one range of protection to be granted; and a method (and related apparatus) including receiving, at the network element entity, the signaling message from the first endpoint entity, obtaining, from a second endpoint entity and based on the first establishment information, second establishment information indicating protection granted by the second endpoint entity, and signaling, from the network element entity to the first endpoint entity, third establishment information indicating the protection granted to the first endpoint entity.

Growing community of inventors

Munich, Germany

Guenther Horn