Telefonaktiebolaget Lm Ericsson (Publ)

Qualcomm Incorporated

Wassim Michel Haddad

Joel Halpern

Mats Näslund

Suresh Krishnan

Ravi Manghirmalani

Heikki Mahkonen

Vincent Douglas Park

Meral Shirazipour

Karl Norrman

Rolf Blom

Georgios Tsirtsis

George Tsirtsis

Samy Touati

Evgeny Tantsura

Samita Chakrabarti

Racha Ben Ali

Michaela Catalina Vanderveen

M Scott Corson

Mathew Scott Corson

Ramesh Subrahmaniam

Conny Larsson

András Méhes

A network device implements a method to protect a vehicle from insertion of malicious operations. The method includes establishing a communication session with a requestor as a proxy for the vehicle, receiving status information from the vehicle, querying a deep learning platform with the status information and message from the requestor, and dropping the message from the requestor in response to the deep learning platform indicating the message is malicious.

System for detecting short duration attacks on connected vehicles

A method and system support communication between a service executed by an edge server and a mobile application. The method includes receiving a transmission control protocol (TCP) handshake with an Internet Protocol (IP) anycast address from the mobile application; replying to the TCP handshake with an IP unicast address for the service to be utilized for a transport layer security (TLS) session; and establishing the TLS session between the service and the mobile application using the IP unicast address.

Mechanism to enable third party services and applications discovery in distributed edge computing environment

A method and system to improve datacenter security by configuring a security layer as a set of nano-services that are executed to service a single tenant of the datacenter such that the nano-service protects the single tenant from other entities in the datacenter and the nano-service being compromised does not compromise the security of other tenants of the datacenter. The method includes receiving a request to instantiate a virtual resource for a tenant, generating a nano-service to implement at least one security layer function for the virtual resource, and connecting the nano-service to the virtual resource and a virtual bridge in the datacenter to enable communication between the virtual resource (vR) and a network of the datacenter with the security layer function processing traffic between the virtual resource and the virtual bridge. The nano-service can be immutable once it begins execution. The security layer function can be an L2 or L3 function.

Using nano-services to secure multi-tenant networking in datacenters

A method is executed by a computing device to receive a request for a server via a known network access type, from a known application type, by a known user, or a known policy, instantiate a new unikernel with a differentiated communication protocol stack instance, in response to determining the request is not being serviced by a previously instantiated unikernel, and service the request by a previously instantiated unikernel, in response to determining the previously instantiated unikernel is available, where the new unikernel and the previously instantiated unikernel are separate from an operating system of the computing device.

Communication stack optimized per application without virtual machine overhead

A method is implemented by a network device communicatively coupled to a datacenter to detect a presence of unauthorized software and hardware in the datacenter. The method includes initiating deployment of a virtual agent on a node in the datacenter, where the virtual agent is to perform a security scan of the node and store results of the security scan in a memory allocated to the virtual agent at the node, and where the results of the security scan are to be encrypted using a data encryption key. The method further includes initiating migration of the virtual agent to a preconfigured location, where the results of the security scan are to be extracted from the virtual agent and decrypted at the preconfigured location.

Method and apparatus to secure and protect data-centers and generalized utility-based cloud computing environments from uninvited guests in the form of both hardware and software

A method and a computing device are provided for improving datacenter operation. The datacenter operation is improved by establishing differentiated communication protocol stack support as a set of nano-services. The nano-services are executed to service connections on a per application or server basis for the datacenter to reduce overhead caused by virtual machines or containers utilizing separate communication protocol stacks. The method includes receiving a request to for a server via a known network access type, from a known application type, by a known user, or a known policy, determining whether the request can be serviced by an existing nano-service for the server, and establishing a new nano-service with a differentiated communication protocol stack instance for the server, in response to the request not being serviced by the existing nano-service.

A network device implements a method for providing a service chain in a network by instantiating services on demand using a lightning module. The lightning module provides the services as applications executed by a unikernel where the unikernel is supported by a hypervisor. The method further includes receiving authentication, administration and accounting (AAA) service authentication of a user by the lightning module, instantiating a special unikernel to monitor a session for packets from the user, and instantiating service chain unikernels identified in at least one unikernel configuration file, in response to receiving a packet from the user.

Architecture for enabling fine granular service chaining

A system and method for chaining one or more services in a service provider network. A service chaining policy and associated Service Path Identifier (SPID) are determined at an ingress node with respect to a particular data packet flow. If the service chaining policy involves one or more service nodes to be traversed by the data packet flow, each service node's EIDs and RLOCs are determined. A sequential data exchange process with the service nodes is effectuated using encapsulation of data packets based on the EIDs and RLOCs for obtaining services in accordance with the order of services set forth in the chaining policy.

System and method for enabling services chaining in a provider network

Embodiments of the present disclosure include methods and apparatuses for enabling data path selection. In an EPG, ILNP mobility signaling is received. The ILNP signaling may include a destination locator for a BNG. A signaling message is sent to the BNG in response to the received ILNP signaling. An acknowledgement is received from the BNG. Traffic is tunneled between a mobile device and a RGW over a LTE interface. In a BNG, a signaling message is received. A message is sent to a SDN controller. A notification is received from the SDN controller that configuration of a RGW to tunnel traffic over a LTE interface is complete. An acknowledgement is sent to an EPG. In a RGW, a message is received from a SDN controller. Traffic is tunneled between a NAS and an EPG over a LTE interface based on the message received from the SDN controller.

Method and apparatus for enabling data path selection in a virtual home gateway

A scheme for virtualizing a remote physical device, e.g., customer premises equipment (CPE), at a cloud-based data center connected to a network. In one embodiment, a virtual switch operating at the CPE is operative to monitor device events at the CPE. When a device is connected to a CPE port, a virtual device port is created that is operative with a Software Defined Network (SDN) architecture. Responsive to an indication that a new SDN-compliant virtual device port is created, an SDN controller is operative to facilitate creation of a data tunnel between the CPE's virtual switch and a virtual switch of the data center.

System and method for virtualizing a remote device

A method, arrangement, and first access router in a packet-switched communication network for determining that a first endpoint originating a communication session with a second endpoint is not initiating a malicious man-in-the-middle attack. The first access router provides access for the first endpoint to the network and a second access router provides access for the second endpoint. The first and second access routers facilitate conducting a secure key exchange between the first and second endpoints, wherein a shared secret key is generated. The first access router utilizes a Prefix Reachability Detection (PRD) protocol to determine the first endpoint is topologically legitimate due to being topologically located behind the first access router, and then sends a Prefix Request Test Initialization (PRTI) message to the second access router indicating the first endpoint is topologically legitimate.

Method for prefix reachability in a communication system

A network, a method and devices (i.e., mobile node, access router, home agent, destination home agent) are described herein for enabling an efficient hybrid route optimization between two mobile endpoints so they can re-direct their data traffic to an optimal path without exchanging any mobility signaling messages.

System, method and devices for enabling efficient hybrid route optimization between two mobile endpoints

A method and apparatus to establish trust between two nodes in a communications network. A first node receives from a network node authentication data unique to the first node, which can be used to derive a compact representation of verification data for the first node. The first node also receives a certified compact representation of verification data of all nodes in the network. The first node derives trust information from the authentication data for the node, and sends to a second node a message that includes the trust information and part of the authentication data. The second node has its own copy of the certified compact representation of verification data of all nodes in the network, and verifies the authenticity of the message from the first node using the compact representation of verification data of all nodes in the network and the received trust information and authentication data.

Trust discovery in a communications network

Systems are provided including at least one identifier locator network protocol (ILNP) enabled mobile node running Internet protocol version 6 (IPv6). The mobile node is attached to an IPv6 network in an IPv6 domain. The system includes a virtual root server configured to receive a binding identifiers create (BIC) message from a domain name system 64 (DNS64) server associated with the IPv6 network. The BIC message includes an ILNP address of the mobile node running IPv6, a fake ILNP address of a destination device running IPv4 assigned by the DNS64 server and an ILNP address of the DNS64 server. The fake ILNP address includes a full real address of the destination device. The virtual root server is further configures to create a binding between the ILNP address of the mobile node and the fake ILNP address of the destination device; store the binding; and send a binding identifier acknowledgement (BIA) message to the DNS64 server.

Growing community of inventors

West New York, NJ, United States of America

Wassim Michel Haddad