Telefonaktiebolaget Lm Ericsson (publ)

Jari Arkko

Mats Näslund

Ari Keränen

Karl Norrman

Pekka Nikander

Vesa Lehtovirta

Rolf Blom

Stefan Rommer

Jouni Mäenpää

Jan Melén

Joachim Sachs

Hans Bertil Rönneke

Patrik Salmela

Tuomas Tirronen

Vesa Torvinen

Mats Fredrik Sagfors

Anders E Eriksson

Mohit Sethi

Tero Kauppinen

Anna Larmo

Göran Rune

Mikael Prytz

Heikki Mahkonen

Göran Eriksson

Vlasios Tsiatsis

Jaime Jiménez

Magnus Westerlund

Göran Selander

Per Magnusson

Oscar Novo Diaz

Jukka Ylitalo

Abu Shohel Ahmed

Zhang Fu

Ryoji Kato

Petri Jokela

Kristian Slavov

Elena Dubrova

Bengt Sahlin

Tomas Mecklin

Fredrik Garneij

Heidi-Maria Back

Le Wang

Miljenko Opsenica

Jesus-Angel de-Gregorio-Rodriguez

Christian Gotare

Teemu Rinta-Aho

Miika Komu

Jakob Saros

Sébastien Pierrel

Ari Keranen

Jimmy Kjällman

Martti Kuparinen

Krister Boman

Esa Turtiainen

Harri Toivanen

Tommi Roth

Ari Huttunen

David Castellanos-Zamora

Näslund Mats

Mika Korpela

Ralf Brunberg

Seppo Arponen

Simone Ferlin

Johan LundsjÖ

András MÉHES

Mats NÄSLUND

Fredrik Lindholm

Ari KERÄNEN

Jesus-Angel De Gregorio Rodriguez

Mats Naslund

Heidi-Maria Rissanen

Mats Sågfors

A computing device is disclosed. The computing device comprises processing circuitry that is configured to expose () a resource that is hosted at the computing device, wherein the resource comprises a digital interface for a physical entity to which the resource corresponds, and expose () information about a relation between a state of the resource and a state of the physical entity to which the resource corresponds. Also disclosed is a network node, the network node comprising processing circuitry that is configured to discover a resource that is hosted at the computing device, and to discover information about a relation between a state of the resource and a state of the physical entity to which the resource corresponds. The processing circuitry is further configured to prepare an action relating to the physical entity corresponding to the resource on the basis of a current state of the resource and the information, and to initiate execution of the prepared action.

Computing device, network node, and methods thereof

A technique for generating an internet protocol, IP, address according to IPv6, for access to one of a plurality of wireless devices connected or connectable to a wireless network from an application node in a communications network is provided. As to a method aspect of the technique, an IPv6 address for access from the application node in the communications network to a respective one of the wireless devices is generated based on a subnet identifier of the wireless network and a device identifier of the respective one of the wireless devices. The generated IPv6 address is provided for the access from the application node in the communications network.

Generating or providing IPV6 addresses

A method () for registering with a serving network (). The method is performed by a UE (). The method includes the UE transmitting (s) to the serving network () a message () indicating a UE capability that is relevant for a home network (), wherein the 5 serving network () is configured to send to the home network () a message () indicating the UE capability.

Providing UE capability information to an authentication server

A method of re-establishing a connection between a LWM2M client and an LWM2M server following a reconnection of the LWM2M client to the LWM2M server includes determining, at the LWM2M client, a state of the LWM2M client device prior to reconnection of the LWM2M client, transmitting, to the LWM2M server, an indication of the state of the LWM2M client prior to reconnection of the LWM2M client, and receiving a response from the LWM2M server indicating whether the indicated state of the LWM2M client is an expected state or an unexpected state of the LWM2M client.

LWM2M client state synchronization

Methods of operating a user equipment (UE) in a mobile communication network are disclosed. An authentication process start message may be transmitted from the UE to the mobile communication network, wherein the authentication process start message includes an identifier for the UE. After transmitting the authentication process start message from the UE, a request commit message may be received from the mobile communication network. Responsive to receiving the request commit message, a response commit message may be transmitted to the mobile communication network. After transmitting the response commit message, an authentication challenge message may be received corresponding to the authentication process start message. Related methods of operating network nodes are also discussed.

Methods providing authentication using a request commit message and related user equipment and network nodes

A method for a serving network to selectively employ perfect forward security (PFS) based on an indication from a home network is described. The method includes receiving, by the serving network, a PFS indicator from the home network; determining, by the serving network, whether the PFS indicator indicates that the home network has instructed the serving network to employ PFS for communications with a piece of user equipment; and performing, by the serving network, a PFS procedure with the piece of user equipment in response to determining that the PFS indicator indicates that the home network has instructed the serving network to employ PFS for communications with the piece of user equipment.

Serving-network based perfect forward security for authentication

A communication device of a communication network receives, via a network, a challenge, generates a first Diffie Hellman, DH, parameter, a first verification code for the first DH parameter, forwards the challenge or a derivative thereof to an identity module, receives at least one result parameter as response from the identity module, determines, based on the result parameter, whether the first DH parameter is authentic, and if the first DH parameter is authentic, generates and sends a second DH parameter to the network device for session key generation based on the first DH parameter and the second DH parameter.

Communication between a communication device and a network device

Methods may be provided to transmit encrypted data from a communication device to a remote storage system. A data value and information related to the data value may be provided, where the information related to the data value includes an identifier associated with the communication device and a time-value associated with the data value. A combination of the time-value and the identifier may be encrypted using a public key to provide a first encrypted value. The data value may be encrypted using the public key to provide a second encrypted value, and a hidden datum package may be generated including the time-value, the first encrypted value, and the second encrypted value. The hidden datum package including the time-value, the first encrypted value, and the second encrypted value may be transmitted to the remote storage system.

Methods providing transmission and/or searching of encrypted data and related devices

A method in a user equipment for attaching the user equipment to a mobile communications network comprises receiving a list of network slice identities, wherein a network slice identity identifies a portion of the mobile communications network that serves as a logical network to a set of user equipment (step). A network slice is selected based on one or more criteria (step). A network slice attachment request is sent to a network node (step), for requesting attachment of the user equipment to the selected network slice of the mobile communications network.

Apparatus and method for attaching user equipment to a mobile communications network

Systems and methods for increasing the value of trash. By increasing the value of trash, persons have an incentive to collect litter and deposit the collected litter at an appropriate trash collection site (e.g., garbage can, reverse vending machine, recycling center, etc.). In one aspect, a financial instrument (e.g., a Bitcoin, Bitcoin-like value, account identifier, or any other financial instrument) or a pointer to a financial instrument is attached to the object itself or placed inside of the object in a way that is not easily extracted before appropriate time.

Trash collection systems and methods

Disclosed is a method in an operator authentication server for authentication of a communication device associated with a communication device manager. The communication device manager being associated with a plurality of communication devices, wherein the operator authentication server has transmitted group subscriber identity module (SIM) information to the communication device manager, wherein the group SIM information is associated with an international mobile subscriber identity (IMSI) number and a shared secret K. The method comprises receiving from the communication device a request for authentication comprising a sub identifier associated with the communication device; determining whether the sub identifier is known. Wherein if it is determined that the sub identifier is known, the method comprises: deriving a secret Ki associated with the communication device based on the shared secret K, and the sub identifier; transmitting a challenge to the communication device, wherein the challenge is formed cryptographically based on the derived secret Ki; receiving from the communication device a response to the challenge, wherein the response is cryptographically formed based on the derived secret Ki; determining whether the received response is correct by confirming that it was cryptographically formed by using the derived secret Ki. When it is determined that the received response is correct, the method comprises: authenticating the communication device and derive a first session key based on the derived secret Ki.

Communication device authentication for multiple communication devices

Methods for provisioning a service in a first network and providing the service by an entity in a second network are disclosed. The methods comprising maintaining in a software repository in the first network, one or more software images (I, I, . . . Ii) of corresponding one or more services and where each service is identified by a service identifier (Si) and storing configuration information related to the one or more services in a database repository of the first network. The method of providing the service in the second network further comprises receiving and storing one or more software images (I, I, . . . ) for one or more services of the first network and where each service is identified by a service identifier (Si) and upon detecting a trigger indicating a request for a service of the one or more services, instantiating the software image of the service in the serving network.

Serverless core network architecture

Using an authentication server to program network elements, such as a network node, in accordance with software-defined networking techniques in order to establish a traffic flow rule for a communication device or user of the communication device. After successfully authenticating a communication device or user, the authentication server and/or network node may use an identifier received at the authentication server in connection with the authentication procedure in order to obtain a traffic flow rule for the communication device. The traffic flow rule may be established at the network node or forwarded to a second network node configured to receive network packets from the communication device. The first identifier may be any one of a user identifier identifying a user, an application identifier identifying an application, and a device identifier unique to the communication device.

Systems and methods for routing traffic originating from a communication device

Systems and methods that are particularly well-suited for service-based core network endpoint authentication are disclosed. In some embodiments, a method of operation of a network node implementing a second network function in a core network of a cellular communications system comprises receiving, at a main service of the second network function, a request from a first network function for a desired service via Hypertext Transfer Protocol/Representational State Transfer (HTTP/REST) signaling. The request comprises information that identifies one or more delegate endpoints of the first network function that expose one or more delegate services, respectively, of the first network function for providing the desired service using one or more different communication styles. The method further comprises initiating the desired service using a selected delegate endpoint from the one or more delegate endpoints identified by the information comprised in the request.

Service-based 5G core authentication endpoints

A critical application system includes a wireless device, an application and a network device. The network device is configured to: receive a command from the at least one wireless device through a first application protocol interface; monitor the connection to the at least one wireless device; determine whether a change in connectivity through the connection occurs, and if so, send information regarding the change in connectivity to the application device through a second application protocol interface. The application device controller is configured to: receive information regarding a change in connectivity to at least one of the at least one wireless device through the second application protocol interface, and determine an action to take; and send a command to at least one of the at least one wireless device through a third application protocol interface, where the controller is configured to: receive the command and execute the associated action.

Method and apparatus for handling a critical application

Growing community of inventors

Kauniainen, Finland

Jari Arkko