Telefonaktiebolaget Lm Ericsson (publ)

St-ericsson Sa

Ericsson Modems Sa

Oct Circuit Technologies International Limited

Per Ståhl

Bernard Smeets

Petri Mikael Johansson

Vesa Lehtovirta

Patrik Salmela

Ari Keränen

Andreas Kristensson

Hervé Sibert

Kristian Slavov

Qiang Li

Abu Shohel Ahmed

Stefan Runeson

Ulf Björkengren

Håkan Englund

Patrik Ekdahl

John Fornehed

Anders Nohlgren

Martin Hovang

Mia Meinander

There is provided mechanisms for authenticating a first radio communication device with a network. A method is performed by the first radio communication device. The method comprises obtaining credentials for a network subscription to the network. The method comprises obtaining an upper part of a radio protocol stack, according to which radio protocol stack the first radio communication device is configured to communicate with the network. The method comprises authenticating with the network. The method comprises providing, to a second radio communication device, at least one key, as derived from the credentials during the authenticating, for use by the second radio communication device when executing the remaining part of the radio protocol stack for communication between the second radio communication device and the network.

Authentication of a radio communication device to a network

There is provided mechanisms for provisioning of an application level identity from an ID backend server to a communication device. The provisioning of the application level identity is protected using TLS-, DTLS-, or OSCORE-based secure communication. The communication device comprises an identity module configured for interaction according to GSMA RSP based remote subscription profile download. The methods are performed by the communication device and the ID backend server.

Provision of application level identity

Embodiments described herein relate to methods and apparatuses for enabling remote management of a profile in an identity module in an NB-IoT device. A proxy server is configured with access to a database of one or more external identifiers associated with one or more respective NB-IoT devices, wherein the one or more external identifiers are used to address the respective one or more NB-IoT devices via an exposure function in a core network. A method in the proxy server comprises receiving a request to deliver a triggering message to the NB-IoT device, wherein the request comprises a device identifier; determining an external identifier based on the received device identifier; and delivering the triggering message to the NB-IoT device using the external identifier.

Methods and apparatus for enabling remote management of a profile in an identity module

There is provided mechanisms for profile handling of a batch of identity modules. Each identity module in the batch of identity modules has credentials for secure installation of profiles. A method is performed by an LPA of a proxy device. The LPA comprises credentials for profile download. The credentials comprise a certificate. The credentials enable the LPA to act as a virtual identity module. Another method is performed by a subscription management entity. Yet another method is performed by an identity module in the batch of identity modules.

Profile handling of a batch of identity modules

There is provided mechanisms for initial network authentication between a communications device and a network. A method is performed by the communications device. The communications device comprises an identity module supporting remote subscription profile download. The identity module comprises credentials for remote subscription profile download. The method comprises performing a first message exchange with an authentication server. The first message exchange comprises an identity module challenge obtained from the identity module being transmitted to the authentication server from the communications device. The method comprises receiving a second message from the authentication server. The second message comprises an ephemeral public key of the authentication server, an authentication server challenge and an authentication server signature. The authentication server signature is based on the ephemeral public key of the authentication server, the authentication server challenge, and the identity module challenge and follows a format used for handling remote subscription profile download to the identity module. The method comprises transmitting a third message towards the authentication server. The third message comprises an ephemeral public key of the communications device and an identity module signature. The identity module signature is based on the identity module credentials used for remote subscription profile download and is based on the ephemeral public key of the communications device and the authentication server challenge and follows the format used for remote subscription profile download to the identity module. The method comprises generating a master session key (MSK) from a shared secret established using the ephemeral public key of the authentication server and a private key corresponding to the ephemeral public key of the communications device. The MSK is for use when establishing secure communication between the communications device and the network.

Initial network authorization for a communications device

There is presented mechanisms for profile handling of a communications device (). A method is performed by a local profile assistant () of a proxy device (). The method comprises obtaining an indication of handling a profile of the communications device (). The method comprises establishing a first secure communications link with a local profile assistant of the communications device. The method comprises establishing a second secure communications link with a subscription management entity () of the communications device. The method comprises receiving information pertaining to handling of the profile by the local profile assistant of the communications device, the information being received from the subscription management entity over the second secure communications link. The method comprises providing the information to the local profile assistant of the communications device over the first secure communications link.

Profile handling of a communications device

There is provided mechanisms for handling subscription profiles for a set of wireless devices. A method is performed by an MNO entity. The method includes obtaining a single request for handling subscription profiles for the set of wireless devices. The method includes performing, with a profile provisioning server, a preparation procedure for the set of wireless devices wherein a common batch profile handling parameter for the set of wireless devices is created, and whereby the set of wireless devices are associated with at least one matching identifier for tracking actions relating to the handling of the subscription profiles at the MNO entity and the profile provisioning server.

Handling of subscription profiles for a set of wireless devices

There is provided mechanisms for handling registration of data packet traffic for a wireless device in a communications network. A method is performed by a core network node. The method comprises registering an amount of data packet traffic in the communications network for the wireless device, wherein each data packet comprises an address of the wireless device, wherein the address is mapped to an identity of the wireless device, wherein the address comprises a first part defining an identity of a local network gateway of the wireless device and a second part defining the identity of the wireless device, and wherein selection of the second part is independent from the first part and the identity of the local network gateway. The method comprises mapping the amount of data packet traffic to the identity of the wireless device. The method comprises reporting the amount of data packet traffic and information identifying at least an identity of a group of wireless devices to which the wireless device belongs to a metering entity in the communications network.

Registration of data packet traffic for a wireless device

There is provided mechanisms for enabling secure communication between a first communications device and a second communications device. A method is performed by the first communications device. The method comprises performing a network attachment procedure with an authentication server. The method comprises establishing, during the network attachment procedure, a shared secret between the first communications device and the authentication server. The shared secret is established by running an authentication and key agreement protocol as part of the network attachment procedure with a network access identity of the first communications device as input. The method comprises deriving an application level shared key for the first communications device from the shared secret. The shared key is to be used for secure communication between the first communications device and the second communications device.

Secure communications using network access identity

This disclosure provides a method, performed in a wireless device, for obtaining initial access to a network in order to establish a connection to a server connected to the network. The wireless device stores a device public key and a device private key. The server stores the device public key. The method comprises transmitting an initial access request to a network node of the network and receiving an authentication request from the network node, the authentication request comprising a challenge. The method comprises generating a device authenticator based on the challenge and the device public key, and transmitting an authentication response to the network node. The authentication response comprises the device authenticator. The method comprises receiving an initial access response from the network node, the initial access response comprising an indicator of whether the initial access is granted or denied.

Method for obtaining initial access to a network, and related wireless devices and network nodes

Methods for communication for a device and a transport node are disclosed, the transport node facilitating communication between the device and a server. The method () for the device comprises assembling a message for sending to the server via the transport node (), the message comprising a message payload, an application layer header, and a signature, wherein at least one of the message payload or a part of the application layer header is encrypted. The method further comprises retrieving a compression context identifier corresponding to the application layer header (), replacing the application layer header in the message with the retrieved compression context identifier () and forwarding the message to the transport node (). The method () for the transport node comprises retrieving an application layer header corresponding to the compression context identifier (), and replacing the compression context identifier in the message with the retrieved application layer header ().

Methods and apparatus for communication

This disclosure provides a method, performed in a wireless device, for enabling a secure provisioning of a credential from a server. The wireless devicestores a device public key and a device private key. The serverstores the device public key. The method comprises receiving San authentication request from the server; generating Sa device authentication and integrity, DAI, indicator; and transmitting San authentication response to the server. The authentication response comprises the DAI indicator. The method comprises receiving Sa credential message from the server, the credential message comprising a server authentication and integrity, SAI, indicator. The SAI indicator provides a proof of the server's possession of the device public key. The method comprises verifying Sthe received credential message using the device public key.

Method for enabling a secure provisioning of a credential, and related wireless devices and servers

An exemplary method of maintaining secure time in a computing device is disclosed in which one or more processors implements a Rich Execution Environment (REE), and a separate Trusted Execution Environment (TEE). The TEE maintains a real-time clock (RTC) that provides a RTC time to the REE. A RTC offset is stored in non-volatile memory, with the RTC offset indicating a difference between the RTC time and a protected reference (PR) time. Responsive to a request from the REE to read the RTC time, a current RTC time is returned to the REE. Responsive to a request from the REE to adjust the RTC time, the RTC time and the corresponding RTC offset are adjusted by a same amount, such that the PR time is not altered by the RTC adjustment. An exemplary computing device operable to implement the method is also disclosed.

Method and apparatus for maintaining secure time

Systems and methods are provided for authenticating Internet Protocol (IP) Multimedia Subsystem (IMS) applications in a User Equipment (UE). A method includes: receiving a first Session Initiation Protocol (SIP) REGISTER message from an IMS application operating on the UE; transmitting a response message to the IMS application based on the received first SIP REGISTER message; receiving a second SIP REGISTER message from the IMS application operating on the UE; determining authentication for the IMS application based on the received second SIP REGISTER message from the IMS application operating on the UE; and based on the step of determining authentication for the IMS application, if the IMS application is authorized, then transmitting information associated with the first and second SIP REGISTER messages toward a SIP node or if the IMS application is unauthorized, then discarding data associated with the first and second SIP REGISTER messages.

Growing community of inventors

Klagshamn, Sweden

Per Ståhl