Nokia Corporation

Nokia Technologies Oy

Qualcomm Incorporated

Huawei Technologies Co., Limited

Nokia Mobile Phones Limited

Nokia Siemens Networks Oy

Nokia Networks Oy

Vringo Infrastructure Inc.

Withsecure Corporation

Valtteri Niemi

Jukka Vialen

Nadarajah Asokan

Philip Ginzboorg

Jukka Vialén

Sinikka Sarkkinen

Dan Forsberg

Jan Kall

Aki Niemi

Kaisa Nyberg

Antti-Pentti Vainio

Tao Haukka

Niina Karhuluoma

Hua Li

Gabor Bajko

Jaakko Rajaniemi

Kimmo Tapio Kettunen

Mikko Aleksi Uusitalo

Tuija Helena Hurtta

Harri Juhani Pekonen

Guillaume Sebire

Ahti Muhonen

Jukka Tapio Ranta

Henry Haverinen

Markus Isomäki

Pekka Laitinen

Markku Anttoni Oksanen

Kari Leppanen

Fabio Longoni

Kari Juhani Niemela

Timo Rantalainen

Sampo Juhani Sovio

Nikolai Nefedov

Jose Costa-Requena

Jukka Antero Alve

Paolo Palumbo

Miikka Poikselkä

Frank Mademann

Lauri Piikivi

Dajiang Zhang

Shkumbin Hamiti

Patrik Flykt

Antti Kiiveri

Miguel Angel Garcia-Martin

Marc Blommaert

Matti Kantola

Atte Länsisalmi

Juha Tomberg

Gábor Bajko

Changhong Li

Dan Lars Anders Forsberg

Shreekanth Lakshmeshwar

Pasi Kärkäs

Kalle J Kärkäs

Sander Van Valkenburg

Jukka Vialèn

Holger Hussman

Jan Mårtensson

Ola Lidholm

Rami Suominen

Mika P Hietala

Tommi Viitanen

Alexey Kirichenko

Sara Ramezanian

Tommi Meskanen

Atte Lansisalmi

Tero Kovanen

This application provides an extended authentication method and apparatus for a generic bootstrapping architecture and a storage medium. A first network element obtains a bootstrapping transaction identifier (B-TID) and a key lifetime; and the first network element sends the B-TID and the key lifetime to the terminal, so that the terminal performs extensible authentication protocol (EAP)-based generic bootstrapping architecture (GBA) authentication and key agreement (AKA) authentication with the first network element based on the B-TID and the key lifetime.

Extended authentication method and apparatus for generic bootstrapping architecture, and storage medium

There is provided a method comprising: generating and sharing an initial value of an integrity token between an endpoint node and a security backend computer, collecting data at the endpoint node, wherein dissimilar data types are aligned as input events, generating a new integrity token every time a new input event is written to a local repository of the endpoint node, wherein the new integrity token is generated based on the new input event and a prior integrity token that was generated prior to the new integrity token, removing the prior integrity token generated prior to the new integrity token from the endpoint node each time a new integrity token has been generated, and sending one or more input events with the new integrity token to the security backend computer for enabling the security backend computer checking integrity of the data received from the endpoint.

Method for integrity protection in a computer network

A network authentication system comprises user equipment (UE), a service network (SN) and a home network (HN). The HN generates an expected user response (XRES) based on an identifier of the UE and generate an indicator, and sends the part of XRES and the indicator to the SN. The SN receives the part of XRES and indicator, and receives a user response (RES) from the UE. The SN then compares the RES with the XRES base on the indicator, and sends a confirmation message to the HN when the comparison succeeds.

Network authentication method, device, and system

A method of communication between a first node and a second node for a system where a plurality of different channels is provided between said first and second node. The method comprises the step of calculating an integrity output. The integrity output is calculated from a plurality of values, some of said values being the same for said different channels. At least one of said values is arranged to comprise information relating to the identity of said channel, each channel having a different identity. After the integrity output has been calculated, Information relating to the integrity output is transmitted from one of said nodes to the other.

Integrity check in a communication system

A sender and a receiver includes first and second arrays of coupled oscillators, respectively, that are substantially identically constructed so as to exhibit substantially the same dynamical response to excitation. A chaotic waveform generated at the sender is transmitted to the receiver, which generates a second chaotic waveform, and compares the received waveform with the generated second waveform. If the first and second waveforms match the sender is an authorized sender. An integrated circuit includes an array of coupled oscillators that in combination generate a waveform in response to at least one excitation signal. The array of coupled oscillators represents, in response to application of the excitation signals, a multi-dimensional security key that is shared between the sender of the waveform and the receiver of the waveform.

Encryption/identification using array of resonators at transmitter and receiver

A method and apparatus for intersystem mobility security context handling between different radio access networks which can include a receiver configured to receive a tracking area update message from a user terminal. The message can include a first key identifier configured to identify a mapped security context and a second key identifier configured to identify a cached security context. A verifier can be configured to verify the tracking area update message with a key identified by the first or second key identifier.

Intersystem mobility security context handling between different radio access networks

A method includes receiving a command to change a medium access control (MAC) address associated with a wireless local area network (WLAN) apparatus; and changing the medium access control address, without restarting a wireless modem of the apparatus, only if a restriction on an allowed rate of medium access control address changes is not violated. An apparatus that operates in accordance with the method is also described.

Limiting rate of MAC address change in wireless modem

A set of associated keys for an authentication process to be performed in a second network is calculated based on a random value used in an authentication process of a first network.

Generating keys for protection in next generation mobile networks

The invention proposes a method for transmitting a message to a plurality of user entities in a network by using a multicast service, comprising the steps of encrypting a multicast message by using ciphering, and sending the encrypted multicast message to the plurality of user entities simultaneously. The invention also proposes a corresponding multicast service control device and a corresponding user entity.

Ciphering data for transmission in a network

An identifier containing at least one encrypted part is received at a first network entity. A second network entity may then be determined based on the identifier. A request for assistance in decryption of the identifier from the second network entity may be sent from the first entity to the second network entity. The second network entity may then assist the first networks entity in an appropriate manner.

Identifiers in a communication system

The user equipment (UE) and the Mobility Management Entity (MME) in an evolved 3GPP system generate authentication material that can be carried inside a packet switched network temporary mobile station identifier (P-TMSI) signature field of a Universal Mobile Telecommunications System (UMTS) signaling message from the UE to a UMTS/GPRS serving GPRS support node (SGSN) in a UMTS or GPRS Terrestrial Radio Access Network (UTRAN) or in a GSM/Edge Radio Access Network (GERAN), as well as from the SGSN to the MME of the evolved 3GPP system. The MME authenticates a context transfer request from the UTRAN/GERAN system based on the transferred authentication material and knowledge of how to create or to verify the authentication material. Additionally, the MME and the UE derive or verify authentication material, based on at least one user-specific key, for embedding in the P-TMSI signature field in legacy 3GPP signalling.

System and method for authenticating a context transfer

Ciphering as a part of the multicast concept

A method for protecting traffic in a radio access network connected to at least two core networks. The method comprises maintaining a corenetwork-specific authentication protocol and a radio-bearer-specific ciphering process, and generating, for each ciphering process, a count parameter comprising a cyclical sequence number and a hyperframe number (HFN) which is incremented each time the cyclical sequence number completes one cycle. For each core network or authentication protocol, a first radio bearer of a session is initialized with a HFN exceeding the highest HFN used during the previous session. When a new radio bearer is established, the mobile station selects the highest HFN used during the session for the core network in question, increments it and uses it for initializing the count parameter for the new radio bearer. At the end of a session, the mobile station stores at least part of the highest HFN used during the session.

Counter initialization, particularly for radio frames

Growing community of inventors

Helsinki, Finland

Valtteri Niemi