Nokia Technologies Oy

Nokia Solutions and Networks Oy

Jing Ping

Iris Adam

Anatoly Andrianov

Zhiyuan Hu

Stephane Mahieu

Zhigang Luo

Olaf Pollakowski

Suresh P Nair

Anja Jerichow

Konstantinos Samdanis

Chaitanya Aggarwal

Martin Kollar

Yueming Yin

Wei Lu

Janne Tapio Ali-Tolppa

Yannick Lair

Wieslawa Wajda

Jürgen Goerge

Wen Wei

Duan Chen

Manfred Schaefer

Xiaoguang Zhao

Xiaoming She

Shuqiang Sun

Stéphane Mahieu

Manfred SCHÄFER

Embodiments of the present disclosure relate to security communication in ProSe U2N relay. According to one aspect of the present disclosure, remote UE and relay UE receive a configuration comprising at least a set of indicators of a CP based security procedure or a UP based security procedure for a set of relay services. Based on an indicator for a relay service in the set of indicators, the remote UE and relay UE performs one of the CP based security procedure or the UP based security procedure for a communication between the remote UE and the relay UE for the relay service. In this way, remote UE and remote UE may correctly trigger a security procedure for U2N relay communication.

Security communication in prose U2N relay

Security communication in ProSe U2N relay

There is disclosed an apparatus. The apparatus comprises means for performing: in response to determining a lack of resource or an impending lack of resource in a communication network, determining whether an agreed level of service for one or more service requirements of one or more services will be affected; and when it is determined that the agreed level of service for one or more service requirements of one or more services will be affected, determining whether one or more customers can tolerate non-compliance with the agreed level of service.

Resource balancing

Provided herein are systems and methods for preventing network attacks in a network slice. In particular, security requirements of a network slice instance are retrieved and specific security policies to be applied to each of multiple constituent network slice subnet instances within the network slice instance are identified based on the security requirements. A deployment of one or more security function instances for each subnet instance configured according to a corresponding security policy is then facilitated.

Method and apparatus for preventing network attacks in a network slice

Example embodiments of the present disclosure relate to dynamic authorization. According to embodiments of the present disclosure, a solution for dynamic access control to data is proposed. On receiving data registration from a data source, a first device checks the data types to be produced by the data source and adds policies for the data or updates existing policies for the data according to its property. It also serves as access control decision point to determine consumers' access rights based on centrally managed policies. Authorization for data access is granted/denied according to local attributes/policies. In this way, it achieves a dynamic, context-aware and risk-intelligent access control to different kind of data from various data sources (i.e., service producers).

Mechanism for dynamic authorization

An entity that creates an adaptive trust model, by a trust model adaptor of the apparatus, configured to establish a trust relationship with an other apparatus according to a composition of trust of the other apparatus derived from a trust evaluator of the other apparatus and a composition of trust of the apparatus derived from a trust evaluator of the apparatus. The entity authenticates the other apparatus based on the adaptive trust model and policies defined in the adaptive trust model; defines access control rules for the other apparatus based on the adaptive trust model and the policies defined in the adaptive trust model; builds a secure channel with the other apparatus based on the adaptive trust model and policies defined in the adaptive trust model; and records behaviors of the other apparatus on the apparatus.

Adaptive mutual trust model for dynamic and diversity multi-domain network

A method and an apparatus for controlling over performance measurements. The method includes associating a measurement list with a containing MOI; associating number of MCIs with said containing MOI according to said measurement list; collecting measurement records according to attributes of at least one of said MCIs after said at least one MCI is activated; processing the measurement records and making them available to number of consumers. The solution is aligned with Services Based Management Architecture management paradigm that 3GPP SA5 introduced for 5G management in 3GPP Rel-15, which increases flexibility of both Management and Managed Entity, and enables reusability of the measurement data and tasks.

Method and apparatus for controlling over performance measurements

An example method may include receiving slice isolation policy for a network slice subnet (NSS) in a transport network (TN) domain, mapping the slice isolation policy to network resource isolation policy and traffic isolation policy, and mapping the network resource isolation policy and the traffic isolation policy to network resource allocation policy and data traffic forward policy, respectively. The network resource allocation policy and the data traffic forward policy may be applied in creation of the TN NSS.

Method and apparatus for isolation support in network slicing

Systems, methods, apparatuses, and computer program products for the management of heartbeat notifications, for instance, in a service based management architecture are provided. One method may include receiving, from a first entity, information comprising one or more attributes relating to management of an emission of heartbeat notifications at a second entity. The method may also include associating, by the second entity, the attributes with a subscription, associating the attributes with a communication channel between the second entity and a third entity relating to the subscription, and starting the emission of the heartbeat notifications according to the information received by the second entity from the first entity.

Managing notifications for communication surveillance

A method for network isolation management is described. The method includes assigning or creating one or more isolation groups for at least one service, wherein resources of services assigned in an isolation group are shared with or without isolation; wherein an isolation group is defined for at least one resource in each layer and each domain to gather the at least one resource of the at least one service; linking an isolation profile for each of the one or more isolation groups, wherein the isolation profile comprises at least one policy to protect the at least one resource of the one or more isolation groups, and wherein the isolation profile comprises at least an isolation level to define a type of isolation; and allocating or reallocating the at least one resource to the at least one service based on the isolation profile linked to the one or more isolation groups.

Method for network slice isolation management

Embodiments of the present disclosure provide a method and apparatus for security assurance of a network function or service. The method comprises: generating security requirements for a network function based on a security profile and a deployment and runtime environment of the network function; generating a security policy and a security test specification for the network function based on the security requirements; deploying the network function based on the security policy; validating security compliance of the network function with the security test specification; and activating the network function or service, in response to the network function being in compliance with the security policy.

Method and apparatus for security assurance of a network or management function

A credential manager imports credentials for a network slice in response to deployment of the network slice. The credentials are not known to other network slices. A repository is configured to store the credentials and protect the credentials based on credential protection policies that are defined by a service profile of the network slice. The repository is implemented in the credential manager, an authentication, authorization, and accounting (AAA) server, or other location. Properties of the credentials are modified in response to a modification trigger and the credentials are withdrawn in response to a withdrawal trigger.

Dynamic allocation of network slice-specific credentials

An apparatus comprising: at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to: determine () that at least one state of a network slice is to be adjusted in a limited geographical area of at least one network resource; and adjust () the at least one state of the network slice in the limited geographical area of the at least one network resource.

Apparatus, method, and computer program

Example embodiments of the present disclosure relate to methods, devices, apparatuses and computer readable storage media for network performance monitoring. In example embodiments, durations of normally released calls and durations of abnormally released calls are monitored during a measurement period. Based on the monitored durations of normally released calls and the monitored durations of abnormally released calls, an average value of the monitored durations of normally released call and an average value of the monitored durations of abnormally released calls are further determined. Then, the average value of the monitored durations of normally released call and the average value of the monitored durations of abnormally released calls are transmitted.

Network performance monitoring

Example embodiments of the present disclosure relate to devices, methods and computer readable storage media for service provisioning to facilitate analysis of a service from a network function (NF). In example embodiments, one or more logs are received from at least one of a first NF, a network repository function (NRF) and a service communication proxy (SCP). The one or more logs are associated with a service from a second NF. Further, analysis of provision of the service from the second NF is facilitated based on the one or more logs.

Growing community of inventors

Chengdu, China

Jing Ping