Nokia Technologies Oy

Nokia Corporation

Nokia Solutions and Networks Oy

Telefonaktiebolaget Lm Ericsson (publ)

Provenance Asset Group LLC

Nokia Technology Oy

Here Global B.v.

Silke Holtmanns

Pekka Laitinen

Rune Lindholm

Ian Justin Oliver

Nagendra S Bykampadi

Hannu Bergius

Marko Schuba

André Dolenc

Mikko Aleksi Uusitalo

Ilkka Antero Keskitalo

Zexian Li

Philip Ginzboorg

Sami Johannes Kekki

Martti Johannes Moisio

Frank Hartung

Dan Forsberg

Jani Ekman

Martin Gerdes

Raphael Quinet

Da Jiang Zhang

Martin Karl Peylo

Yoan Jean Claude Miche

Yang Liu

Bruno Landais

Anja Jerichow

Nadarajah Asokan

Marko Tapio Tuukkanen

Amaanat Ali

Jaakko Rajaniemi

Pekka Kuure

Zhongliang Hu

Jari Vainikka

Dajiang Zhang

Hannes Tschofenig

Axel Busboom

Gerald Goermer

Tao Haukka

Jan Ignatius

Hannu Tuominen

Kari Miettinen

Aapo Kalliola

Shreekanth Lakshmeshwar

Janne Uusilehto

Marc Richarme

Vladimir Bashkirov

Xiaoguang Zhao

Alireza Sohi

Chaitra Shanthappa

Thomas Kumpf

Tiina S Koskinen

Yoan Miche

Wei Zheng

Cheng Cai

Yulong Zhang

Gabor Ungvari

Rune Adolf Lindholm

Jan Erik Ignatius

Jani Petteri Ekman

Martin Peylo

Embodiments of the present disclosure relate to methods, apparatuses and computer readable storage media for hop-by-hop security. A proposed method comprises receiving, at a first apparatus and from a second apparatus associated with a first network function, a message directed from the first network function to a second network function, the message comprising a first signature and network function information, the network function information at least comprising identification information of the first network function; in accordance with a successful validation of the first signature, updating the message with a second signature specific to a service communication proxy implemented by the first apparatus; and transmitting the updated message to a third apparatus associated with the second network function, the updated message comprising at least the second signature and the network function information.

Enhanced hop by hop security

Methods and apparatus, including computer program products, are provided In one aspect there is provided a method. The method may include detecting, at a first node, an event; generating, at the first node, a message in response to the detected event; and sending, at the first node, the message to at least a second node to enable the second node to determine at least one of a reliability or an importance of the message. Related apparatus, systems, methods, and articles are also described.

Flexible security rating and decision mechanism for machine type communications

Methods and apparatus are disclosed for unified security configuration management. A method may comprise: determine a security configuration to be executed; determine at least one security application which is installed on at least one node and is associated with the security configuration; format for the security configuration, instructions corresponding to each of the at least one security application, respectively; and send the instructions to the at least one node for respective configuration for each of the at least one security application.

Method, system and apparatus for unified security configuration management

According to an example aspect of the present invention, there is provided an apparatus comprising a receiver configured to receive a message from a first security zone, distinct from the one where the apparatus is comprised in, and at least one processing core configured to determine whether to apply a recovery action to the message, the determination comprising a first verification, based on first criteria, to assess whether to apply the recovery action outright, and only in case the first verification does not result in the assessment to apply the recovery action outright, a second verification, based on second criteria, to generate a first weight and a third verification, based on third criteria, to generate a second weight, and to compare a sum of the first weight and the second weight to a predefined trigger to perform the determination.

Method for message filtering in an edge node based on data analytics

A service request is received at a first service communication proxy element, wherein the service request is received from a service consumer and is a request to access at least one service of a service producer. The first service communication proxy element determines at least one target service producer based on the service request. The first service communication proxy element sends an access token request to an authorization entity, wherein the access token request is generated based on the determining step. The first service communication proxy element receives an access token response from the authorization entity, wherein the access token response comprises an access token. The first service communication proxy element may then send a service request with the access token to a second service communication proxy element, wherein the second service communication proxy element is associated with the target service producer. The method may apply to roaming and non-roaming scenarios.

Service authorization for indirect communication in a communication system

A cellular terminal detects any capability reporting trigger and responsively to such determination produces a cellular network authentication capabilities message indicative of cellular network authentication capabilities available for the terminal; and transmits the cellular network authentication capabilities message to the cellular network. The cellular network receives the network authentication capabilities message from a cellular terminal, selects a cellular authentication algorithm based on capabilities indicated by the network authentication capabilities message; and performs cellular authentication with the cellular terminal using the selected cellular authentication algorithm.

Cellular network authentication control

Methods and apparatus, including computer program products, are provided in one aspect there is provided a method. The method may include detecting, at a first node, an event; generating, at the first node, a message in response to the detected event; and sending, at the first node, the message to at least a second node to enable the second node to determine at least one of a reliability or an importance of the message. Related apparatus, systems, methods, and articles are also described.

It is provided a method, comprising instructing a subscription device to indicate an applied privacy protection to a visited network; instructing the subscription device to provide a protected subscription identifier to the visited network, wherein the protected subscription identifier is based on a permanent subscription identifier protected according to the applied privacy protection.

Privacy protection capabilities

In accordance with the example embodiments of the Invention there is at least a method and apparatus to detect that at least one message received from another network device of a communication network is in response to a prior message using a spoofed source address; based on the detecting, mirror the at least one message; and send to the another network device the mirrored at least one message to cause the another network device to filter out the at least one message in response to the prior message using the spoofed address. Further, there is at least a method and apparatus to receive from a network node signaling associated with at least one message; based on the signaling, detect that the at least one message is in response to a prior message using a spoofed source address; and based on the detecting, filter out the at least one message in response to the prior message using the spoofed source address.

Diameter edge agent attack detection

In accordance with an example embodiment of the present invention, there is provided an apparatus, comprising a transceiver arranged to insertably interface with an integrated module, at least one processing core configured to enable the integrated module to be connected, via the apparatus, to a network, the transceiver being configured to receive from the integrated module information enabling the apparatus to become an endpoint of a connection to a network node, and the at least one processing core being configured to receive, using the connection, a computer program for operating the apparatus. In some embodiments, the integrated module comprises a universal integrated circuit card and a secure execution environment.

Method and apparatus for managing devices

A method, apparatus and computer program product are provided to selectively accept requests for communication that may be supported by different identification profiles with the selective acceptance being based upon a predefined criteria, such as the cost of the communications. In the context of a method, a request for communications is received from a network operator. The communications with the network operator are supported by a first of a plurality of identification profiles. The method also includes determining, relative to a predefined criteria, whether the communications should be supported by the first identification profile or by another identification profile configured to support communications with another network operator. In an instance in which the communications should be supported by another identification profile, the method causes the request for communications to be denied.

Method and apparatus for managing communications with multiple identification profiles

This document discloses a solution for detecting and mitigating anomalies such as signalling storms in a radio access network of a wireless communication system. According to an aspect, there is disclosed a method including receiving, in a first local traffic analysis module, configuration parameters from a second local traffic analysis module or from a central traffic analysis module connected to a plurality of local traffic analysis modules; monitoring, by a first traffic analysis module by using the received configuration parameters, traffic in a radio access network of a wireless communication system; detecting, in the monitored traffic on the basis of the configuration parameters, an anomaly causing a control plane signalling load; and in response to said detecting, taking an action to mitigate the anomaly and reporting information on the anomaly to the central traffic analysis module.

Detection and mitigation of signalling anomalies in wireless network

The present invention provides apparatuses, methods, computer programs, computer program products and computer-readable media regarding handling of certificates for embedded Universal Integrated Circuit Cards. The present invention comprises composing, by a management entity, such as a subscription manager, a deletion command message for deleting certificates from an embedded universal integrated circuit card, eUICC, on which a plurality of certificates is pre-installed, the deletion command message including information on certificates to be deleted and an authorization of the management entity, and transmitting the deletion command message to the eUICC.

Handling of certificates for embedded universal integrated circuit cards

Method, apparatus and computer program for receiving an identification of an application that has issued a connectivity request for cellular communications with a cellular network; determining an access point name to be used for providing the identified application with the cellular communications; and verifying whether the identified access point name use is allowable with the identified application and accordingly allowing or preventing said use.

Method and apparatus for cellular access point control

A method, apparatus and computer program in which a cellular terminal: transmits a request that requires authentication procedure triggering to a cellular network and responsively receiving from the cellular network an authentication request message with an indication of a selected cryptographic algorithm from a group of a plurality of cryptographic algorithms; decodes the authentication request message to a decoded authentication request according to the selected cryptographic algorithm and based on a shared secret known by the cellular terminal and a network operator of the cellular terminal; based on the decoded authentication request, the shared secret and the selected cryptographic algorithm, produces and encrypts an authentication response message; and transmits the authentication response message to the cellular network.

Cellular network authentication

Growing community of inventors

Klaukkala, Finland

Silke Holtmanns