Nokia Corporation

Nokia Siemens Networks Oy

Nokia Technologies Oy

Spyder Navigations LLC

Intellectual Ventures I LLC

Pasi Ismo Eronen

Henry Haverinen

Hannes Tschofenig

Gabor Bajko

Nadarajah Asokan

Teemu Ilmari Savolainen

Hannu Petri Hietalahti

Dajiang Zhang

Kaisa Nyberg

Da Jiang Zhang

Lars Rene Eggert

Changhong Li

Shreekanth Lakshmeshwar

A method, apparatus, and computer program product are provided for facilitating randomized port allocation. An apparatus may include a processor configured to receive a port allocation message from a network management entity. The port allocation message may comprise an encryption key, an initial input value, and a value indicating a number of ports allocated to the apparatus for communication on a network. The processor may be further configured to calculate at least one port allocated to the apparatus with an encryption function based at least in part upon the encryption key and initial input value. Corresponding methods and computer program products are also provided.

Methods, apparatuses, and computer program products for facilitating randomized port allocation

A network element, method and computer program product is enabled to perform interactive connectivity checks in a mobility environment. Specifically, a network element comprises a discovery unit configured to identify a candidate defined as a combination of an internet protocol address and a port which the network element can use to communicate with a particular other network element. The network further comprises a mobile internet protocol signaling unit configured to submit a candidate identified by the discovery unit and to receive a candidate related to the other network element, and a simple traversal underneath network address translators protocol enabled unit configured to perform a connectivity check for a pair constituted by the submitted candidate and the received candidate by using the simple traversal underneath network address translators protocol.

Performing interactive connectivity checks in a mobility environment

The invention relates to a method comprising initiating a session from a subscriber terminal, wherein the subscriber terminal does not comprise a specific user identification module, and authenticating the session based on a temporary identification of the subscriber terminal, by using a procedure performing a server authentication and avoiding a client authentication.

Support of UICC-less calls

A network element, method and computer program product enable to reduce the need to send keep-alive messages when elements have to be traversed. Specifically, a network element comprises a port allocation request unit configured to request from a server over the transmission control protocol the allocation of a user datagram protocol port having a destination determined to take care of traffic for the network element. The network element further comprises a registration unit configured to create a message for requesting internet protocol registration and to send the message over the transmission control protocol.

Reducing keep-alive messages in connection with element traversal by relay mechanism

A system and method for the implementation of a proxy smart card application in a mobile telephone. The mobile telephone receives a smart card related message from a remote terminal. If the smart card related message is related to a function implemented by electronic device software within the mobile telephone, the electronic device software processes the message. If the smart card related message is not related to a function implemented by the electronic device software, the message is transmitted to the smart card.

Proxy smart card applications

The invention relates to a method for delivering certificates in a communication system using Extensible Authentication Protocol (EAP). The identity of a mobile node is sent to a gateway from which the identity is sent to a network entity. In the network entity is selected at least one first certificate based on information relating to the mobile node. In the network entity is signed the at least one first certificate using a master key. The at least one first certificate is provided from the network entity to the mobile node.

Method for distributing certificates in a communication system

The invention proposes a method for handling authentication requests in a network, wherein the authentication requests may have different types, the method comprising the steps of determining (S, S, S) types of the authentication requests, and applying (S-S) a policy for handling the received authentication requests based on the determined types of authentication requests. The invention also proposes a corresponding network control element and a computer program product.

Protection against denial-of-service attacks

A method for use by a telecommunication terminal () in checking whether a candidate RAND in an EAP/SIM RAND challenge is likely a replay, based on using a Bloom filter including a vector data structure () for determining (admittedly sometimes erroneously) whether the candidate RAND is in a set of previously used RAND values. The components of the vector data structure () are set to one or left at zero depending on whether pointers corresponding to the previously used RAND values point to them. The pointers can be hash functions or can be constructed from the previously used RAND values. To provide for smooth filter performance at points in time when the Bloom filter is full and cannot hold information for any new previously used RAND values, the vector data structure () is partitioned into more than one part, and only one part is reset and re-initialized at a time.

Replay prevention mechanism for EAP/SIM authentication

A method for use by a WLAN terminal in determining which of at least some SSIDs on a preferred SSID list hosted by the WLAN terminal are available at one or another accessible WLAN access point, based on sending probe messages to accessible WLAN access points, each probe message indicating a respective SSID, but sending such a probe message for an SSID on the list only if a respective indicator included in the list indicates that the WLAN terminal is to probe for the SSID.

Method and apparatus for indicating service set identifiers to probe for

A system for ensuring that a first subscriber in a unlicensed mobile access system is prevented from unauthorized use of a second subscriber's identity when the first subscriber requests services from a mobile station to a core network. The system comprises authenticating means for authenticating a mobile station to an unlicensed mobile access network before higher-layer messages are sent from the mobile station, and thereafter, for authenticating the mobile station to a core network. The system also includes a mobile station with a subscriber identity module that includes an identifying means for identifying the mobile station. The system further includes a unlicensed mobile access network for connecting the mobile station to the core network and for relaying signals between the mobile station and the core network. The unlicensed mobile access network comprises checking means for ensuring that higher-layer messages passing through the unlicensed mobile access network to the core network are from the mobile station that authenticated with the unlicensed mobile access network. The system also includes the core network for implementing transaction control and user services. During authentication between the mobile station and the unlicensed mobile access network, the unlicensed mobile access network stores the identifying means that is associated with the mobile station and after authentication between the mobile station and the core network, the unlicensed mobile access network uses the checking means to examine higher-layer messages that are sent from the mobile station to the core network and to ensure that the identifying means associated with mobile station is stored in the higher-layer message.

Growing community of inventors

Helsinki, Finland

Pasi Ismo Eronen