Nokia Technologies Oy

Nokia Solutions and Networks Oy

Saurabh Khare

Chaitanya Aggarwal

Anja Jerichow

Bruno Landais

Georgios Gkellas

Gerald Kunzmann

Laurent Thiebaut

Devaki Chandramouli

Colin Leon Kahn

Yannick Lair

Shubhranshu Singh

Narasimha Rao Pulipati

Suresh P Nair

Nagendra S Bykampadi

Thomas Belling

Rainer Liebhart

Konstantinos Samdanis

Horst Thomas Belling

German Peinado Gomez

Cinzia Sartori

Ulrich Wiehe

Jani Ekman

Iris Adam

Ranganathan Mavureddi Dhanasekaran

Ioannis Mouroulis

Muhammad Majid Butt

Rajesh Babu Natarajan

Rakshesh Pravinchandra Bhatt

Topuri Brahmaiah

Alex Moukalled

Jonathan Little

Pallab Gupta

Sireesha Bommisetty

Mallikarjunudu Makham

Apostolos Papageorgiou

Bahare Masood Khorsandi

Cincia Sartori

Bo Holm Bjerrum

Jani Petteri Ekman

The disclosure relates to an apparatus comprising at least one processor and at least one memory including computer code for one or more programs, the at least one memory and the computer code configured, with the at least one processor, to cause the apparatus at least to: receive (), from a model provider function, a user equipment identifier and a model identifier; generate () an access key to allow a user equipment identified by the user equipment identifier to access a model identified by the model identifier; store () the user equipment identifier and the model identifier along the access key to allow a user equipment identified by the user equipment identifier to access a model identified by the model identifier; and send (), to the user equipment, the access key.

Apparatus, method, and computer program

There is provided a method, computer program, and an apparatus for a network function service consumer, that causes the apparatus to perform: retrieving, from a first repository function, protected sensitive data; retrieving, from a second network function, at least one encrypted key; decrypting the retrieved at least one encrypted key using a private key associated with the network function service consumer to obtain a respective at least one key; and performing at least one of: decryption of the protected sensitive data using the at least one key to obtain sensitive data or integrity protected sensitive data; or verification of the integrity of the protected sensitive data using the at least one key.

Apparatus, methods, and computer programs for protecting sensitive data

Embodiments of the present disclosure relate to network function validation. The first network device receives, from a second network device, a request including profile information of the second network device to be validated, obtain registered profile information of the second network device from a third network device maintaining a blockchain ledger storing the registered profile information, and validate the profile information of the second network device based on the registered profile information. The validation can be implemented via blockchain, and OAuth is not need, and for pure consumer can be authorized, in addition information for validation is sufficient.

Network function validation

Embodiments of the present disclosure relate to terminal device authorization for requesting analytics. A terminal device transmits a subscription for an analytics with an analytics identity to a Unified Data Management (UDM), receives a subscribed analytics identity from the UDM, according to the subscription for the analytics, transmits a request comprising the analytics identity to a Session Management Function (SMF) or an Application Function (AF), and receives analytics result data from the SMF or the AF, according to the the analytics identity after authorization of the request. The terminal device authorization for requesting analytics as provided in the present disclosure is more secure.

Terminal device authorization for requesting analytics

A technique comprising: based on at least (i) one or more indications that a user equipment registered to a mobile communication system is associated with a vehicle and (ii) absence of an indication that the vehicle is authorised by a traffic management entity, requesting subscription to a data analytics service for notifications about one or more events indicating travel of the user equipment.

Method and apparatus for communication system serving vehicles

Example embodiments of the present disclosure relate to access token revocation in security management. In an example method, in response to providing, to a second device, an access token for the second device to access a NF service from a third device, a first device stores a mapping indicating an association among the access token, the second device and the third device. In response to determining that the second device is abnormal, the first device sends, to at least one target device based on the mapping, an indication of revoking the access token. In this way, at least one target device associated with revoked access token can be informed and potential damage caused by the abnormal NF can be eliminated.

Access token revocation in security management

Methods, systems, apparatuses, and computer program products are provided for authorized machine learning model retrieval for a communications network. In this regard, an access token request for one or more machine learning models related to a communications network is received from a network function service consumer (NFc). The access token request includes information to identify the one or more machine learning models. The NFc is then authorized with respect to the one or more machine learning models based on the information included in the access token request. Additionally, enhanced an access token for retrieving the one or more machine learning models is provided to the NFc based on valid authorization of the NFc with respect to the one or more machine learning models.

Authorized machine learning model retrieval for a communications network

According to an example aspect of the present invention, there is provided an apparatus configured to function as a network function repository, and transmit to a network function consumer an access token authorizing access to a service provided by a network function producer, the access token comprising an at least one of: indication of a fully qualified domain name of the network function consumer, an indication of a domain from which access to the network function producer is allowed and an indication of a stand-alone non-public network from which access to the network function producer is allowed.

Network security

Systems, methods, apparatuses, and computer program products for dynamically unsubscribing from a public land mobile network (PLMN)/non-private network (NPN) service. In example embodiments, a method is provided. The method comprises transmitting, by a user equipment (UE), at least one first message () associated with registering with at least one network, wherein the at least one first message () includes first information that indicates whether the user equipment (UE) is capable of unsubscribing from one or more services associated with the at least one network; and receiving, by the user equipment (UE), at least one second message () associated with accepting registration of the user equipment (UE) with the at least one network, wherein the at least one second message () includes second information that indicates whether the user equipment (UE) is allowed to unsubscribe from the one or more services.

Dynamically unsubscribing from a PLMN/NPN service

There is provided a method, apparatus and computer program product for causing a network repository function to perform: receiving, from a network function service consumer, an access request for an access authorization token, the request comprising a first identification of the network function service consumer and a first identification of at least one network slice on which access is requested; generating an access token in response to the request, the access token comprising at least one network slice identifier for the at least one network slice identified by the first identification; and providing the generated access token to the network function in response to the request for an access authorization token.

Apparatus, methods, and computer programs

Techniques for detecting and isolating rogue network entities in a communication network are provided. For example, a method comprises receiving from at least one network entity in a communication network a message identifying one or more network entities suspected of malicious activity operating within the communication network, and initiating one or more remedial actions within the communication network to prevent the one or more network entities suspected of malicious activity operating within the communication network from accessing other network entities in the communication network.

Rogue network function detection and isolation in a communication network

There is provided a method, computer program, and an apparatus for a network function that causes the network function to: receive, from a service consumer, event subscription information comprising an intra-domain address and an inter-domain address for signalling event subscription notification information from a service producer to the service consumer; determine whether a first service producer is located in the same domain as the service consumer; select at least one of the inter-domain address and the intra-domain address to signal to the first service producer in dependence on said determining; and signal the selected at least one address to the first service producer.

The disclosure relates to a first apparatus comprising at least one processor and at least one memory including computer code for one or more programs, the at least one memory and the computer code configured, with the at least one processor, to cause the apparatus at least to: send (), to a second apparatus, a request comprising information indicating a list of public land mobile network identifiers identifying a first public land mobile network supported by the first apparatus, and information to derive a second public land mobile network supported by the second apparatus; and receive (), from the second apparatus, a response comprising information indicating a list of public land mobile network identifiers identifying the second public land mobile network supported by the second apparatus.

There is provided an apparatus comprising means for receiving, at an analytics function from a first network function, a request for one or more timer adjustments for at least one timer associated with one or more network functions; obtaining, by the analytics function from one or more further network functions, one or more input parameters relating to network behaviour; and sending, from the analytics function to the first network function, an output comprising one or more timer adjustments for the at least one timer, wherein the output is based on the obtained one or more input parameters.

Method, apparatus and computer program for configuring one or more parameters associated with a network function

According to an example aspect of the present invention, there is provided an apparatus configured to process a request for an access token authorizing access for a network function consumer to a service provided by a network function producer, the request being received in the apparatus from a service communication proxy, wherein the processing comprises one or more of the following verification: verification that a credential data element comprised in the request, cryptographically signed by the network function consumer, identifies the request, the service or a type of the service, and verification with reference to a further node, or to a profile of the network function consumer, that the service communication proxy is authorized to act on behalf of the network function consumer, and transmit, responsive to at least one of the verifications being successful, the requested access token, the access token comprising an indication of the service communication proxy.

Growing community of inventors

Bengaluru, India

Saurabh Khare