Nokia Technologies Oy

Rakuten Symphony, Inc.

Nokia Solutions and Networks Oy

Nagendra S Bykampadi

Suresh P Nair

Anja Jerichow

Bruno Landais

Silke Holtmanns

Jani Ekman

Devaki Chandramouli

Laurent Thiebaut

Saurabh Khare

Uwe Rauschenbach

Krishna Pramod Adharapurapu

Dimitrios Schoinianakis

Thomas Belling

Guenther Horn

Ulrich Wiehe

Thomas Theimer

Tuomas Niemelä

Narasimha Rao Pulipati

Yoan Jean Claude Miche

Annett Seefeldt

Raghul Ravirajh

Satish Balagopalan

Pradyumna Ram Prasad

Paromita Chintan Shah

Suresh Nair

Provided are features for determining authentication status information of an Open Radio Access Network (O-RAN) Radio Unit (O-RU). According to embodiments, an O-RU controller may be configured to: obtain a Media Access Control (MAC) address of an O-RU; determine, based on the MAC address of the O-RU, an authentication status of the O-RU; based on determining that the O-RU has been authenticated, establish a channel binding with the O-RU; and based on determining that the O-RU has not been authenticated, isolate the O-RU from further communications with the O-RU controller.

Determining authentication status information of an O-RAN radio unit

Systems, methods, apparatuses, and computer program products for dynamically unsubscribing from a public land mobile network (PLMN)/non-private network (NPN) service. In example embodiments, a method is provided. The method comprises transmitting, by a user equipment (UE), at least one first message () associated with registering with at least one network, wherein the at least one first message () includes first information that indicates whether the user equipment (UE) is capable of unsubscribing from one or more services associated with the at least one network; and receiving, by the user equipment (UE), at least one second message () associated with accepting registration of the user equipment (UE) with the at least one network, wherein the at least one second message () includes second information that indicates whether the user equipment (UE) is allowed to unsubscribe from the one or more services.

Dynamically unsubscribing from a PLMN/NPN service

Embodiments of the present disclosure relate to methods, apparatuses and computer readable storage media for hop-by-hop security. A proposed method comprises receiving, at a first apparatus and from a second apparatus associated with a first network function, a message directed from the first network function to a second network function, the message comprising a first signature and network function information, the network function information at least comprising identification information of the first network function; in accordance with a successful validation of the first signature, updating the message with a second signature specific to a service communication proxy implemented by the first apparatus; and transmitting the updated message to a third apparatus associated with the second network function, the updated message comprising at least the second signature and the network function information.

Enhanced hop by hop security

In one example, a method initiates establishment of a secure tunnel by a security proxy element (e.g., SEPP) in a first communication network (e.g., VPLMN) with an internetwork exchange element (e.g., IPX node) which is operatively coupled between the first communication network and a second communication network (e.g., HPLMN). Upon establishment of the secure tunnel, the method sends a message from the security proxy element to the internetwork exchange element over the secure tunnel. The secure tunnel can be a VPN tunnel and can be established using TLS or IPsec. In one example, the internetwork exchange node functions as an HTTP proxy, and in another embodiment as an interception (e.g., MITM) proxy. In another example, HTTPS is used to establish a separate TLS connection for each HTTP message. In yet another example, the security proxy element is configured to select (and change as needed) the secure communication mechanism.

Security management between edge proxy and internetwork exchange node in a communication system

A user equipment in a communication system, a unified subscription identifier data structure is constructed. The unified subscription identifier data structure includes a plurality of fields that specify information for a selected one of two or more subscription identifier types and selectable parameters associated with the selected subscription identifier type, and wherein the information in the unified subscription identifier data structure is useable by the user equipment to access one or more networks associated with the communication system based on an authentication scenario corresponding to the selected subscription identifier type. For example, during different authentication scenarios, the user equipment utilizes the unified subscription identifier data structure to provide the appropriate subscription identifier (e.g., SUPI, SUCI or IMSI) and associated parameters for a given authentication scenario.

Unified subscription identifier management in communication systems

Techniques for detecting and isolating rogue network entities in a communication network are provided. For example, a method comprises receiving from at least one network entity in a communication network a message identifying one or more network entities suspected of malicious activity operating within the communication network, and initiating one or more remedial actions within the communication network to prevent the one or more network entities suspected of malicious activity operating within the communication network from accessing other network entities in the communication network.

Rogue network function detection and isolation in a communication network

A method of policy decision includes receiving, by a central policy server, a network policy, determining, by a cluster policy server that is separate from the central policy server, whether the network policy is relevant to a cluster corresponding to the cluster policy server, storing, by the cluster policy server, the network policy in a cluster policy database based on determining that the network policy is relevant to the cluster corresponding to the cluster policy server, obtaining, by a policy decision point (PDP) module that is separate from the cluster policy server, the network policy stored in the cluster policy database, and determining, by the PDP module, whether to implement the network policy based on a policy query received from a policy enforcement point (PEP) module.

Hierarchical policy-based decision framework for cloud-native telecommunication systems

There is provided an apparatus comprising means for: receiving, from a requesting service and/or from a network function, an indication of security credentials for a selected service agent; and transmitting the security credentials to the selected service agent as part of a service request from the requesting service.

Communication system

SEPP 1 forms a first TLS protected N32-c connection between with SEPP 2 so that SEPP 1 and SEPP 2 are respectively a TLS client and server. A TLS protected second N32-c connection between with SEPP 2 so that SEPP 1 and SEPP 2 are respectively a TLS server and client. On forming the first and second TLS protected N32-c connections, respective first and second shared secrets are formed. First and second master keys are obtained from the first and second shared secrets, respectively. N32-f context IDs are created by each SEPP on setup of the first and second N32-c connections. Based on the first master key and the first N32-f context ID, a first session key is produced for encryption of a first N32-f request to the second security edge proxy and correspondingly a second session key is produced for decryption of a second N32-f request from SEPP 2.

Method and apparatus for network function messaging

A request is received at an authorization entity for access to a service producer by a service consumer. The request comprises a public key of the service consumer. The authorization entity generates an access token with the public key of the service consumer bound thereto. The authorization entity sends the access token to the service consumer. The service consumer digitally signs the access token using a private key that corresponds to the public key bound to the access token to form a digital signature. The service consumer sends the access token with the public key bound thereto and the digital signature to the service producer. The service producer validates the access token, obtains the public key from the access token, and verifies the digital signature using the obtained public key of the service consumer. The service consumer is authorized when the access token is successfully validated and the digital signature is successfully verified.

Network function authentication based on public key binding in access token in a communication system

A method, performed by at least one processor, for protecting a front-haul link from a Man-in-the-Middle (MiTM) attack in a network communication system includes receiving, through a port of an authenticator, an authentication request for port authentication from a supplicant via an Ethernet Frame, obtaining, by the authenticator from the Ethernet frame, a hop count corresponding to a number of hops in a transmission path of the Ethernet frame between the supplicant and the authenticator, comparing the hop count to a predetermined threshold to determine whether the port should be disabled, and disabling the port based on the hop count being greater than the predetermined threshold.

Mechanism for protecting front-haul link from man-in-the-middle (MITM) attack

According to an example aspect of the present invention, there is provided a method, comprising: receiving a first message from a service-consuming second network entity in a second mobile network for a service-providing first network entity in a first mobile network, the first message comprising a first callback resource identifier, generating a second callback resource identifier on the basis of the first callback resource identifier, wherein the second callback resource identifier comprises a domain name of a security edge node in the first network, and transferring a callback message from the first network entity to the security edge node, the callback message comprising the second callback resource identifier.

Secure inter-mobile network communication

An apparatus relating to authorization of network functions includes at least one processor and at least one memory including computer program code. The at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to: send, from a first network function service consumer instance to an authorization server, a request for an access token for use in accessing a service provided by a network function service producer; receive, at the first network function service consumer instance from the authorization server, an access token for use in accessing the service provided by the network function service producer; and send, from the first network function service consumer instance to the network function service producer, a request to access the service provided by the network function service producer, the request to access the service including the access token.

Apparatuses and methods relating to authorization of network functions

Improved techniques for secure access control in communication systems are provided. In one example, in accordance with an authorization server function, a method comprises receiving a request from a service consumer in a communication system for access to a service type and one or more resources associated with the service type. The method determines whether the service consumer is authorized to access the service type and the one or more resources associated with the service type. The method generates an access token that identifies one or more service producers for the service type and the one or more resources associated with the service type that the service consumer is authorized to access, and sends the access token to the service consumer. The service consumer can then use the access token to access the one or more services and one or more resources. In addition to such resource level access authorization, target network function group access authorization can be performed.

Secure access control in communication system

According to an example aspect of the present invention, there is provided a method comprising receiving, by a network repository function, a request from a network function, wherein the request comprises a string associated with an instance identity of the network function, determining, by the network repository function, a type of the instance identity of the network function from a set of instance identity types, determining, by the network repository function, the instance identity of the network function based on the string associated with the instance identity of the network function and the type of the instance identity of the network function and transmitting, by the network repository function, a response to the network function, wherein the response depends on whether the instance identity of the network function was found in a list of network function instances registered at the network repository function.

Growing community of inventors

Bengaluru, India

Nagendra S Bykampadi