Telefonaktiebolaget Lm Ericsson (publ)

Jari Arkko

Karl Norrman

Mats Näslund

Ari Keränen

Pekka Nikander

Bengt Sahlin

Vesa Lehtovirta

Rolf Blom

Stefan Rommer

Jouni Mäenpää

Joachim Sachs

Hans Bertil Rönneke

Patrik Salmela

Tuomas Tirronen

Vesa Torvinen

Mats Fredrik Sagfors

Anders E Eriksson

Tero Kauppinen

Jukka Ylitalo

Miljenko Opsenica

Anna Larmo

Göran Rune

Mikael Prytz

Mohit Sethi

Heikki Mahkonen

Göran Eriksson

Vlasios Tsiatsis

Jaime Jiménez

Magnus Westerlund

Per Magnusson

Oscar Novo Diaz

Abu Shohel Ahmed

Ryoji Kato

Petri Jokela

Zhang Fu

Jan Melén

Kristian Slavov

Elena Dubrova

Christian Gotare

Miika Komu

Teemu Rinta-Aho

Tomas Mecklin

Fredrik Garneij

Heidi-Maria Back

Le Wang

Jesus-Angel de-Gregorio-Rodriguez

Jakob Saros

Sébastien Pierrel

Ari Keranen

Krister Boman

Martti Kuparinen

Jimmy Kjällman

Esa Turtiainen

Harri Toivanen

Tommi Roth

Ari Huttunen

Ralf Brunberg

Simone Ferlin

Seppo Arponen

Mika Korpela

David Castellanos-Zamora

Näslund Mats

Johan LundsjÖ

András MÉHES

Göran Selander

Mats NÄSLUND

Fredrik Lindholm

Ari KERÄNEN

Jesus-Angel De Gregorio Rodriguez

Mats Naslund

Heidi-Maria Rissanen

Mats Sågfors

A method () for registering with a serving network (). The method is performed by a UE (). The method includes the UE transmitting (s) to the serving network () a message () indicating a UE capability that is relevant for a home network (), wherein the 5 serving network () is configured to send to the home network () a message () indicating the UE capability.

Providing UE capability information to an authentication server

A method of re-establishing a connection between a LWM2M client and an LWM2M server following a reconnection of the LWM2M client to the LWM2M server includes determining, at the LWM2M client, a state of the LWM2M client device prior to reconnection of the LWM2M client, transmitting, to the LWM2M server, an indication of the state of the LWM2M client prior to reconnection of the LWM2M client, and receiving a response from the LWM2M server indicating whether the indicated state of the LWM2M client is an expected state or an unexpected state of the LWM2M client.

LWM2M client state synchronization

Methods of operating a user equipment (UE) in a mobile communication network are disclosed. An authentication process start message may be transmitted from the UE to the mobile communication network, wherein the authentication process start message includes an identifier for the UE. After transmitting the authentication process start message from the UE, a request commit message may be received from the mobile communication network. Responsive to receiving the request commit message, a response commit message may be transmitted to the mobile communication network. After transmitting the response commit message, an authentication challenge message may be received corresponding to the authentication process start message. Related methods of operating network nodes are also discussed.

Methods providing authentication using a request commit message and related user equipment and network nodes

A method for a serving network to selectively employ perfect forward security (PFS) based on an indication from a home network is described. The method includes receiving, by the serving network, a PFS indicator from the home network; determining, by the serving network, whether the PFS indicator indicates that the home network has instructed the serving network to employ PFS for communications with a piece of user equipment; and performing, by the serving network, a PFS procedure with the piece of user equipment in response to determining that the PFS indicator indicates that the home network has instructed the serving network to employ PFS for communications with the piece of user equipment.

Serving-network based perfect forward security for authentication

A communication device of a communication network receives, via a network, a challenge, generates a first Diffie Hellman, DH, parameter, a first verification code for the first DH parameter, forwards the challenge or a derivative thereof to an identity module, receives at least one result parameter as response from the identity module, determines, based on the result parameter, whether the first DH parameter is authentic, and if the first DH parameter is authentic, generates and sends a second DH parameter to the network device for session key generation based on the first DH parameter and the second DH parameter.

Communication between a communication device and a network device

Methods may be provided to transmit encrypted data from a communication device to a remote storage system. A data value and information related to the data value may be provided, where the information related to the data value includes an identifier associated with the communication device and a time-value associated with the data value. A combination of the time-value and the identifier may be encrypted using a public key to provide a first encrypted value. The data value may be encrypted using the public key to provide a second encrypted value, and a hidden datum package may be generated including the time-value, the first encrypted value, and the second encrypted value. The hidden datum package including the time-value, the first encrypted value, and the second encrypted value may be transmitted to the remote storage system.

Methods providing transmission and/or searching of encrypted data and related devices

A method in a user equipment for attaching the user equipment to a mobile communications network comprises receiving a list of network slice identities, wherein a network slice identity identifies a portion of the mobile communications network that serves as a logical network to a set of user equipment (step). A network slice is selected based on one or more criteria (step). A network slice attachment request is sent to a network node (step), for requesting attachment of the user equipment to the selected network slice of the mobile communications network.

Apparatus and method for attaching user equipment to a mobile communications network

Systems and methods for increasing the value of trash. By increasing the value of trash, persons have an incentive to collect litter and deposit the collected litter at an appropriate trash collection site (e.g., garbage can, reverse vending machine, recycling center, etc.). In one aspect, a financial instrument (e.g., a Bitcoin, Bitcoin-like value, account identifier, or any other financial instrument) or a pointer to a financial instrument is attached to the object itself or placed inside of the object in a way that is not easily extracted before appropriate time.

Trash collection systems and methods

Disclosed is a method in an operator authentication server for authentication of a communication device associated with a communication device manager. The communication device manager being associated with a plurality of communication devices, wherein the operator authentication server has transmitted group subscriber identity module (SIM) information to the communication device manager, wherein the group SIM information is associated with an international mobile subscriber identity (IMSI) number and a shared secret K. The method comprises receiving from the communication device a request for authentication comprising a sub identifier associated with the communication device; determining whether the sub identifier is known. Wherein if it is determined that the sub identifier is known, the method comprises: deriving a secret Ki associated with the communication device based on the shared secret K, and the sub identifier; transmitting a challenge to the communication device, wherein the challenge is formed cryptographically based on the derived secret Ki; receiving from the communication device a response to the challenge, wherein the response is cryptographically formed based on the derived secret Ki; determining whether the received response is correct by confirming that it was cryptographically formed by using the derived secret Ki. When it is determined that the received response is correct, the method comprises: authenticating the communication device and derive a first session key based on the derived secret Ki.

Communication device authentication for multiple communication devices

Methods for provisioning a service in a first network and providing the service by an entity in a second network are disclosed. The methods comprising maintaining in a software repository in the first network, one or more software images (I, I, . . . Ii) of corresponding one or more services and where each service is identified by a service identifier (Si) and storing configuration information related to the one or more services in a database repository of the first network. The method of providing the service in the second network further comprises receiving and storing one or more software images (I, I, . . . ) for one or more services of the first network and where each service is identified by a service identifier (Si) and upon detecting a trigger indicating a request for a service of the one or more services, instantiating the software image of the service in the serving network.

Serverless core network architecture

Using an authentication server to program network elements, such as a network node, in accordance with software-defined networking techniques in order to establish a traffic flow rule for a communication device or user of the communication device. After successfully authenticating a communication device or user, the authentication server and/or network node may use an identifier received at the authentication server in connection with the authentication procedure in order to obtain a traffic flow rule for the communication device. The traffic flow rule may be established at the network node or forwarded to a second network node configured to receive network packets from the communication device. The first identifier may be any one of a user identifier identifying a user, an application identifier identifying an application, and a device identifier unique to the communication device.

Systems and methods for routing traffic originating from a communication device

Systems and methods that are particularly well-suited for service-based core network endpoint authentication are disclosed. In some embodiments, a method of operation of a network node implementing a second network function in a core network of a cellular communications system comprises receiving, at a main service of the second network function, a request from a first network function for a desired service via Hypertext Transfer Protocol/Representational State Transfer (HTTP/REST) signaling. The request comprises information that identifies one or more delegate endpoints of the first network function that expose one or more delegate services, respectively, of the first network function for providing the desired service using one or more different communication styles. The method further comprises initiating the desired service using a selected delegate endpoint from the one or more delegate endpoints identified by the information comprised in the request.

Service-based 5G core authentication endpoints

A critical application system includes a wireless device, an application and a network device. The network device is configured to: receive a command from the at least one wireless device through a first application protocol interface; monitor the connection to the at least one wireless device; determine whether a change in connectivity through the connection occurs, and if so, send information regarding the change in connectivity to the application device through a second application protocol interface. The application device controller is configured to: receive information regarding a change in connectivity to at least one of the at least one wireless device through the second application protocol interface, and determine an action to take; and send a command to at least one of the at least one wireless device through a third application protocol interface, where the controller is configured to: receive the command and execute the associated action.

Method and apparatus for handling a critical application

A communication device for communication with a network device during EAP-AKA'. The communication device is operative to receive a first Perfect Forward Secrecy, PFS, parameter value and at least one attribute value indicating a choice of a Diffie-Hellman group from the network device. The communication device is also operative to receive a cipher key, CK, and an integrity key, IK. Generate a modified cipher key, CK&#x2032;, and a modified integrity key, IK&#x2032; based on CK, IK and an access network identity. Operations include calculating a second PFS parameter value. Send the second PFS parameter value to the network device. Calculate a third PFS parameter value. Derive, using a Pseudo-random function, a key based on the third PFS parameter value, CK&#x2032;, IK&#x2032; and an identity associated with the communication device. A network device, methods, further communication devices, a server, computer programs and a computer program product are also disclosed.

Communication with server during network device during extensible authentication protocol&#x2014;authentication and key agreement prime procedure

Growing community of inventors

Kauniainen, Finland

Jari Arkko