Telefonaktiebolaget Lm Ericsson (publ)

Stere Preda

Daniel Migault

Suresh Krishnan

Catherine Truchan

Fereydoun Farrahi Moghaddam

Peyman Talebi Fard

Amine Boukhtouta

Makan Pourzandi

Wubin Li

Elaheh Jalalpour

Enayatallah Ghaznavi

Thomas Ingemarsson

A method, system and apparatus are disclosed. According to one or more embodiments, a verifier is provided. The verifier includes processing circuitry configured to obtain a hash algorithm and a fully qualified domain name, FQDN, associated with a virtual network function, VNF, image, determine an identifier for the VNF image based at least on the hash algorithm and the FQDN, perform domain name system security extensions, DNSSEC, resolution of the determined identifier for the VNF image at least in part by requesting at least one attribute of the VNF image using the determined identifier for the VNF image and validating a response associated with the request, and perform validation of the VNF image in response to successful DNSSEC resolution.

Domain name system security extension (DNSSEC) for container signature management

A method for steering an original packet transmitted by a UE. The method includes receiving a first packet, wherein the first packet encapsulates the original packet. The method also includes extracting networking information (e.g., IP source, IP destination, tunnel identifier) from the first packet. The method also includes generating an SFC header (e.g., an NSH header), wherein the SFC header comprises: i) an SPI that identifies a service path and ii) metadata, wherein the metadata comprises the networking information extracted from the first packet. The method also includes generating a second packet comprising the SFC header and the original packet. The method also includes providing the second packet to an SFF that is configured to select a service path based on the SPI included in the SFC header of the second packet and forward the second packet based on the selected service path.

Radio access network (RAN) architecture

Systems and methods for maintaining privacy of security protocol parameters are provided. A node receives an encrypted packet and determines if the Security Parameters Index (SPI) value has been updated. The node can modify its stored SPI value(s) accordingly and process the encrypted packet.

IPsec privacy protection

A system, node and wireless device are provided. An intermediate node is provided that includes processing circuitry configured to: receive a packet where the packet includes metadata associated with first input data of a first node, first output data of the first node, a first PC signature and a public cryptographic key associated with the first node, verify that the first PC signature corresponds to a process that led from the first input data to the first output data using the public cryptographic key, verify a link between first node and the intermediate node by comparing the received packet and the first output data, and determine whether to perform at least one service function on the packet based at least in part on the verification of the first PC signature and the verification of the link between the first node and the intermediate node.

Verification and/or certification along a service chain

Apparatuses and methods are disclosed for enabling signalling storm mitigation in Internet Protocol (IP) Security (IPsec)-secured virtual Radio Access Network (vRAN). In one embodiment a method in a first network node includes receiving a trigger to establish an IPsec session with a second network node, the IPsec session being associated with a user equipment (UE); responsive to the trigger to establish the IPsec session associated with the UE, derive a unique identifier for the UE; generate a Security Parameter Index (SPI) value based at least in part on the unique identifier derived for the UE, the SPI value being unique to the IPsec session; and communicate an indication of the SPI value to the second network node.

Signalling storm mitigation in a secured radio access network

Methods and systems for automatic provisioning of security policies for content streaming control within a Content Delivery Network (CDN) are provided. According to one aspect, a method for automatic provisioning of security policies for content streaming control by a network node within a CDN that supports at least one streaming media protocol comprises: obtaining a manifest, the manifest being generated in response to a user requesting a streaming content from the CDN; determining a first security policy associated with the user and/or the requested streaming content in accordance with the manifest; updating a set of firewall rules for implementing security policies in accordance with the determined first security policy; and applying the updated set of firewall rules to validate requests from the user for the streaming content. The policies are dynamically configured and may be sparsely provisioned, e.g., downloaded only to the pertinent nodes and activated only when necessary.

Automatic provisioning of streaming policies for video streaming control in CDN

Methods and systems for group re-authentication of devices in a wireless telecommunication network are provided. According to one aspect, a method of operation of a base station in a wireless telecommunication network comprises receiving a group authentication request message from a mobility management entity, the group authentication request message comprising a group identifier; identifying at least one user equipment as belonging to a group identified by the group identifier; sending an individual authentication request message to each identified UE; receiving an authentication response from at least one of the identified UE; aggregating the received at least one authentication response to create a group authentication response message; and sending the group authentication response message to the mobility management entity.

Enhanced aggregated re-authentication for wireless devices

Systems and methods for virtualizing edge node functionality as a service for handling content delivery are described herein. An edge node receives a packet and determines if it associated with an established session and if it should be offloaded for processing. An offload status indicator and/or session context information can be added to the offloaded packet and it is transmitted to a subsequent edge node.

Virtual edge node as a service

Systems and methods are disclosed herein that relate to secure monitoring or interception of traffic in a wireless communications system. In some embodiments, a method of operation of a network node comprises receiving a list of one or more obfuscated target identifiers from a monitoring node, where each obfuscated target identifier is a user identifier of a target user that is encrypted using a first encryption key that is unknown to the network node. The method further comprises receiving an encrypted packet from another network node and determining whether an encrypted user identifier of the encrypted packet matches one of the obfuscated target identifiers. The method further comprises, if the encrypted user identifier matches one of the obfuscated target identifiers, further encrypting the encrypted packet using a second encryption key negotiated between the network node and the monitoring node and transmitting the further encrypted packet to the monitoring node.

Enhanced lawful interception

Systems and methods for processing inbound and outbound secure packet traffic are provided herein. A first lookup operation can be performed to identify a security association corresponding to a received packet. A second lookup operation can be performed to determine a security parameters index associated with the packet and the identified security association. The packet can be processed in accordance with the security association and the security parameters index.

Flow multiplexing in IPsec

Methods, systems, and computer program products for security context escrowing are provided herein. According to one aspect, a method of operation of a network node for a telecommunications network comprises storing security context information associated with a small data, fast path connection between a wireless device and a first gateway that is serving the wireless device, determining a change in the gateway that is serving the wireless device from the first gateway to a second gateway, and, in response to determining the change, providing the stored security context information to the second gateway for use with the wireless device.

Security context escrowing

Systems and methods relating to an efficient communication system to, e.g., support Massive Machine Type Communication (M-MTC) devices are disclosed. In some embodiments, a base station in a cellular communications network comprises, during initial attachment of a wireless device, establishing a Data Radio Bearer (DRB) between the base station and the wireless device, updating a context of the wireless device to include information regarding the DRB established between the base station and the wireless device to thereby provide a mapping between the DRB and a cellular network identifier of the wireless device. The method further comprises, during initial attachment of the wireless device, providing, to the wireless device, at least a portion of an Internet Protocol (IP) address assigned to the wireless device and updating the context of the wireless device to include the at least a portion of the IP address of the wireless device.

Simplified wireless connectivity for a cellular communications system

In one aspect of the teachings herein, a controlling gateway and an associated radio access point are configured for operation in a radio access network and use a radio protocol stack that is split on the network side between the gateway and the access point, for conveying radio bearer traffic going between the radio access network and a wireless device. According to methods and apparatuses disclosed, the radio protocol entities affected by the stack split communicate using Internet Protocol, IP, sessions. Advantageously, the radio bearer traffic conveyed over the split stack maps to different IP sessions in dependence on any one or more of network capabilities, various isolation or privacy requirements associated with the device and/or traffic, the types of data being conveyed, the types of radio bearers involved, and the involved Radio Link Control, RLC, operating modes.

Method and apparatus for a radio node and a controlling gateway

Systems and methods relating to scheduling Paging Occasions (POs) are disclosed. Embodiments of a method of operation of a network node are disclosed. In some embodiments, the method of operation of a network nodes comprises assigning POs to a plurality of User Equipments (UEs) in accordance with one or more anti-affinity groups such that, for a defined time interval, POs within the defined time interval are assigned to UEs in a same anti-affinity group. The method further comprises notifying the plurality of UEs of the POs assigned to the UEs. In this manner, the expected maximum number of pages within the defined time interval is substantially reduced.

Growing community of inventors

Longueuil, Canada

Stere Preda