Telefonaktiebolaget Lm Ericsson (publ)

Mohit Sethi

Patrik Salmela

Kristian Slavov

Vesa Lehtovirta

Nicklas Beijar

Parth Amin

Tero Kauppinen

Le Wang

Heidi-Maria Back

Jari Arkko

Ari Keränen

Jaime Jiménez

Miika Komu

Tomas Mecklin

Jimmy Kjällman

Dinand Roeland

György Miklós

Anna Larmo

Göran Rune

Oscar Novo Diaz

Luis Felipe Del Carpio Vega

Petri Jokela

Jan Melén

Miljenko Opsenica

Mert Ocak

Petri Laari

Roberto Morabito

Maria Ines Robles

Maziar Mehrabi

Joona Kannisto

Maria Innes Robles

Jimmy KJÄLLMAN

A Bluetooth device () is disclosed, the Bluetooth device being provisioned with a security credential () that is shared with an authentication server (). The Bluetooth device comprises processing circuitry configured to use a Bluetooth pairing mechanism to establish a pairing with a Bluetooth gateway (-) by establishing a shared secret key with the Bluetooth gateway and to perform an Extensible Authentication Protocol (EAP) authentication method towards the authentication server using the security credential, wherein performing the EAP authentication method comprises using the paired Bluetooth gateway to forward messages to and from the authentication server. The processing circuitry is further configured to bind the pairing established with the paired Bluetooth gateway to the performed EAP authentication method. Also disclosed are a Bluetooth gateway and methods performed by a Bluetooth device and a Bluetooth gateway.

Bluetooth device and Bluetooth gateway

Secure, authenticated communication is enabled between an initiator () (e.g., a user equipment) and a responder () (e.g., an authentication server function, AUSF, or a subscription de-concealing function, SIDF). The initiator () transmits a message () to the responder () over a secure communication channel (). The message () may include information indicating a third party () whose signing of data (e.g., bound to the secure communication channel ()) will authenticate the responder () to the initiator (). The responder () correspondingly retrieves from the third party () data that is signed by the third party () and transmits a response () to the initiator () that includes the retrieved data. The initiator () receives this response () and determines whether or not the responder () is authenticated by determining whether or not the response () includes data that is signed by the third party ().

Secured authenticated communication between an initiator and a responder

A method, performed by an EAP authenticator in a communication network, is disclosed. An identification of at least one EAP method supported by an EAP authentication server providing an EAP authentication service to the EAP authenticator is obtained, wherein the identification is obtained from a network entity of the communication network or from inspection of traffic through the EAP authenticator. The identification of at least one EAP method is provided to a device operable to request communication network access from the EAP authenticator. Also disclosed is a method, performed in an EAP authentication server in a communication network. A request for identification of EAP methods supported by the EAP authentication server is received, and a response to the request is sent identifying at least one EAP method supported by the EAP authentication server. An EAP authenticator, EAP authentication server and computer program are also disclosed.

Method and apparatus for extensible authentication protocol

Systems and methods for increasing the value of trash. By increasing the value of trash, persons have an incentive to collect litter and deposit the collected litter at an appropriate trash collection site (e.g., garbage can, reverse vending machine, recycling center, etc.). In one aspect, a financial instrument (e.g., a Bitcoin, Bitcoin-like value, account identifier, or any other financial instrument) or a pointer to a financial instrument is attached to the object itself or placed inside of the object in a way that is not easily extracted before appropriate time.

Trash collection systems and methods

Using an authentication server to program network elements, such as a network node, in accordance with software-defined networking techniques in order to establish a traffic flow rule for a communication device or user of the communication device. After successfully authenticating a communication device or user, the authentication server and/or network node may use an identifier received at the authentication server in connection with the authentication procedure in order to obtain a traffic flow rule for the communication device. The traffic flow rule may be established at the network node or forwarded to a second network node configured to receive network packets from the communication device. The first identifier may be any one of a user identifier identifying a user, an application identifier identifying an application, and a device identifier unique to the communication device.

Systems and methods for routing traffic originating from a communication device

A method is provided for registration of a device as a Network Application Function, NAF, in a Generic Bootstrapping Architecture, GBA. The device performs a GBA bootstrap operation with a Bootstrapping Server Function, BSF, and sends to a NAF registration function a request to register as a NAF. The device receives NAF registration information from the NAF registration function, and performs a NAF registration with the BSF. The NAF registration function receives from the device a request to register as a NAF, confirms that that the device is authorised to act as a NAF, and transmits the NAF registration information to the device.

Network application function registration

In response to a transition from a previous operational state to a current operational state of a given network partition of a plurality of network partitions of a core of a cellular network, a respective entry of a registry of the plurality of network partitions is updated. Network partition selection for a terminal is effected by participating in a communication of at least one selection control message corresponding to at least one entry of the registry.

Network partitions

It is presented a method, executed in a gateway, the gateway being arranged to facilitate communication between a client device and an application server. The method comprises the steps of: sending a request for an electronically transferable subscriber identity module, the request comprising an identifier based on an identity of the client device; receiving a response indicating that an electronically transferable subscriber identity module, generated based on the identifier, is available; downloading the electronically transferable subscriber identity; and storing the electronically transferable subscriber identity module with an association to the client device, along with any previously stored electronically transferable subscriber identity modules. A corresponding gateway, computer program and computer program product are also presented.

Gateway, client device and methods for facilitating communication between a client device and an application server

A method () for generating operating entropy is provided. The method () is performed by a cloud computing entity () run on shared underlying resources (). The method () comprises: sending () a respective entropy request to one or more servers (), inserting in each entropy request a respective timestamp, receiving () a response from each of the one or more servers (), each response payload comprising random bytes of unknown amount of entropy, verifying () validity of each response by comparing the respective timestamp in each response to a corresponding stored timestamp, and generating () the operating entropy based on at least one of the received responses. A cloud computing entity (), a computer program and a computer program product are also provided.

Method for generating operating entropy

It is provided a method performed in a gateway and comprises the steps of: receiving a first client request from the client device, the first client request comprising a first fully qualified domain name, FQDN; transmitting a gateway request to the application server; receiving an application server response from the application server, the application server response indicating a need to provide authentication; generating a second FQDN, based on the first FQDN and an identifier of the client device; generating a client specific shared key based on the second FQDN and a shared key; generating a redirect message comprising the second FQDN, an authentication request, a context identifier and the client specific shared key; transmitting the redirect message to the client device; receiving a second client request from the client device; and generating an authentication response in case the second client request fails to comprise an authentication response.

Gateway, client device and methods for facilitating secure communication between a client device and an application server using redirect

There is provided mechanisms for handling acknowledgements from nodes in a wireless radio ad-hoc network. A method is performed by a gateway of the wireless radio ad-hoc network. The method comprises transmitting radio signalling to nodes in the wireless radio ad-hoc network. The transmitted radio signalling is addressed to, and requiring acknowledgement from, at least one node in the wireless radio ad-hoc network. The method comprises receiving radio signalling from a node in the wireless radio ad-hoc network. The received radio signalling comprises one in-packet Bloom Filter comprising acknowledgement of the transmitted radio signalling from at least one of the nodes.

Handling of acknowledgement in wireless radio ad-hoc networks

A method performed by a machine-to-machine, M2M, server for managing communication with a M2M device is disclosed. The method comprising configuring the M2M device with a finite number of predetermined states and predetermined transitions for moving the M2M device into one of its predetermined states, and sending a message to the M2M device for executing at least one of the predetermined transitions.

Management of communication between M2M device and M2M server with finite state transitions created by the M2M device

The present disclosure relates to methods and arrangements for protecting the integrity of subscribers to personal area networks. This object is obtained by a method, performed in a service subscribing node of a personal area network, for discovering a service providing node. The method comprises obtaining a service identity resolving key. A discovery signal is received from a service publishing node, and a service identifier of the service providing node is determined from a service identity comprised in the received discovery signal using the service identity resolving key.

User profiling prevention in personal area network communication

It is disclosed a method of establishing a secure connection between a device and a network-based entity, NAF, via an access gateway, where the device and a network-based bootstrapping server, BSF, have a pre-established trust relationship. The method comprises the access gateway acting as a proxy between the device and the BSF. A reference to a NAF received from the BSF is used to securely authenticate the device to the NAF. An identity of the access gateway is sent to the NAF and the identity is used to authorise the device to use the access gateway. The access gateway identity is authenticated at the BSF and/or the NAF. The access gateway may relay messages to the device over a non-HTTP link.

Methods and devices for bootstrapping of resource constrained devices

A method performed by a communications system, for authenticating a station, STA, to access a network is provided. The STA is capable of communicating with a light source. The method includes sending, by a management server to a controller of the light source, network access information, sending, by the light source to the STA, the received network access information, which network access information is sent to the STA via a Visual Light Communication (VLC) channel. The VLC channel is emitted from the light source and received by a light detector in the STA. The STA is authenticated to the network by sending the received network access information to an Access Point (AP) operating in the network in which the STA communicates with the AP via a communication channel.

Growing community of inventors

Espoo, Finland

Mohit Sethi