Nokia Corporation

Nokia Technologies Oy

Tao Haukka

Valtteri Niemi

Gabor Bajko

Aki Niemi

Gábor Bajko

Silke Holtmanns

Henry Haverinen

Hannu Petri Hietalahti

Markus Isomäki

Pekka Laitinen

Miikka Juhana Poikselka

Pekka Kuure

Jose Costa-Requena

Georg Mayer

Miikka Poikselkä

Miguel Angel Garcia-Martin

Atte Länsisalmi

Tommi Viitanen

Miikka PoikselkÄ

It is disclosed a method comprising monitoring validity of limited-validity key information, acquiring, from a network entity upon invalidity of the limited-validity key information, limited-validity transaction identification information based on unlimited-validity identification information identifying a terminal, generating new limited-validity key information based on the acquired limited-validity transaction identification information, and transmitting the acquired limited-validity transaction identification information to a network element.

Methods, apparatuses, system and computer programs for key update

A method for handling service failures for in a communications network comprising a user equipment, a first network element and a serving network element, the method comprising the following steps. Receiving at the first network element a first message from the user equipment. Transmitting the first message from the first network element to the serving network element. Detecting at the first network element that the serving network element is out of service. Determining at the first network element the type of the first message, and in dependence on the type of the first message sending from the first network element to the user equipment an error message including an indication that the serving network element is out of service.

Method for handling service failures

A method, program product and system of preventing or limiting the number of simultaneous sessions in a wireless local area network (WLAN). The method includes: determining whether subscriber terminal information has been changed between an old session and a new session, maintaining a connection with the old session if the subscriber terminal information has not changed, and establishing and authenticating the new session and disconnecting the old session if the subscriber terminal information has changed. A medium access control (MAC) address and a WLAN radio network identification can be compared between the old session and the new session to determine whether subscriber terminal information has been changed.

Method of preventing or limiting the number of simultaneous sessions in wireless local area network (WLAN)

A method for handling user identity and privacy, wherein a first Session Initiation Protocol (SIP) proxy is about to forward a SIP request to a next SIP proxy includes the step of determining whether Transport Layer Security (TLS) is supported in a hop to a next SIP proxy. When TLS is supported, the method includes establishing a TLS connection to the hop to the next SIP proxy, requesting a certificate from the next SIP proxy, receiving the certificate, verifying the certificate and trustworthiness of a network of the next SIP proxy and retaining identity information when the certificate and the trustworthiness of the network is verified. When TLS is not supported, or when the certificate is not verified, or when the trustworthiness of the network is not verified, the identity information is removed. Thereafter, the SIP request is forwarded over the TLS connection.

Handling of identities in a trust domain of an IP network

Disclosed is a method and system to discourage a MITM attacker in a data communications system that includes client and a server. The method includes, in a Digest Authentication and Key Agreement (AKA) challenge sent to the client from the server, setting an 'algorithm' field to 'algorithm='AKAv1-HMAC-MD5'' for directing the client to use the HMAC-MD5 keyed hash function when producing Digest credentials; and using at least one of an AKA Integrity Key (IK) or an AKA Cipher Key (CK) in the keyed hash function.

Method of protecting digest authentication and key agreement (AKA) against man-in-the-middle (MITM) attack

An apparatus and method for selecting a security association timer between user equipment and a control entity in a communication system are disclosed. The apparatus includes a transmitter configured to transmit a registration request message to a control entity in a communication system, whereby the registration request message is configured to request registration with the control entity. The apparatus further includes a receiver configured to receive an authentication challenge including a temporary timer, whereby the temporary timer is configured to set a time duration for the apparatus to respond to the authentication challenge. The receiver is further configured to receive an acknowledgement message including a security association timeout value in response to the transmitted registration message, whereby the security association timeout value includes a set time length of a security association equal to a registration time length set for registration of the apparatus. The transmitter is further configured to transmit a registration authentication message to the control entity before expiration of the temporary timer.

Method and communication system for controlling security association lifetime

A method for selecting a time length of a security association (SA) between user equipment (UE) which transmits and receives communications and a control entity in a communication system in accordance with the invention, includes transmitting a registration message (SM) from the user equipment to the control entity (P-CSCF) requesting registration of the user equipment with the control entity; after transmission of the registration message, setting the time length of the security association between the user equipment and the control entity to be equal to a registration time length set between the user equipment and the control entity during which registration of the user equipment with the control entity is valid; and transmitting the set time length of the security association to the user equipment as part of an acknowledgment message (SMor SM) to the registration message to cause the security association to have a time equal to the registration timer length.

The present invention is a system and method which provides authentication for data services for at least one UE () using common authentication information based upon information stored in a HSS () of a home network () of the at least one UE for multiple protocols. At least one proxy server () stores authentication information for each of the protocols which may be used to provide data services to the at least one UE. Authentication of the protocols available to the least one UE uses the authentication information stored at the at least one proxy server obtained from the protocol used in the home network of the at least one UE.

Growing community of inventors

Oulu, Finland

Tao Haukka