Telefonaktiebolaget Lm Ericsson (Publ)

St-Ericsson Sa

Yi Cheng

Karl Norrman

Mats Näslund

Rolf Blom

Fredrik Lindholm

Frank Hartung

Luis Barriga

John Mattsson

Vincent Huang

Daniel Catrein

Ulf Björkengren

Karl Dan Gustav Jerrestam

Åke Busin

Göran Selander

Tor Kvernvik

Bo Åström

Ulf Christian Bjorkengren

Simon Moritz

Michael Liljenstam

Mattias Johansson

Mattias Eld

Arne Norefors

Hans Carlsson

Ignacio Mas Ivars

András Méhes

Ignacio Más Ivars

Nilo Mitra

Lorens Almehag

Daniel Cantrein

Mats Nåslund

Lars Bj&ouml;rup

Martin Jakob Rinman

Mats NÄSLUND

András MÉHES

A method for a first network node may protect confidentiality of a first identifier associated by the first network node with a subscription used by a mobile entity. The communications network comprises a home network of the mobile entity and a serving network serving the mobile entity. The first network node, which is part of the home network may: receive, from a second network node which is part of the serving network, a first request for authentication information for the mobile entity, the first request comprising the first identifier; generate a first pseudonym associated with the first identifier; create a link between the first pseudonym and the first identifier; and send, to the second network node, the first pseudonym in response to the first request for authentication information for use as an identifier for the mobile entity in the serving network. A method for a second network node is also provided.

Methods, network nodes, mobile entity, computer programs and computer program products for protecting privacy of a mobile entity

A method and arrangement is disclosed for managing session keys for secure communication between a first and at least a second user device in a communications network. The method is characterized being independent of what type of credential each user device implements for security operations. A first user receives from a first key management server keying information and a voucher and generates a first session key. The voucher is forwarded to at least a responding user device that, with support from a second key management server communicating with the first key management server, resolves the voucher and determines a second session keys. First and second session keys are, thereafter, used for secure communication. In one embodiment the communication traverses an intermediary whereby first and second session keys protect communication with respective leg to intermediary.

Key management for secure communication

A first data handling node () is configured to verify data received in a data distribution network with multiple data handling nodes forming a distribution path of a network topology, by obtaining tag information from a hash server (). The first data handling node () receives data (D) and a hash tag (H) from a second data handling node (). The received data (D) and hash tag (H) have been generated by the second node based on a previous hash tag (H, H) generated by a preceding third data handling node (). The third node has delivered data (D, D) to the second node, and the received data (D) has been generated by the second node based on the data (D, D) delivered by the third data handling node. The first data handling node () verifies the received data (D) based on the tag information from the hash server, which indicates whether the received hash tag (H) corresponds to a 'valid hash tag' (Hx) which is calculated by applying a predefined hash algorithm on the previous hash tag (H, H). When the received tag corresponds to the valid tag, the data is verified as trustworthy and not faked or manipulated.

Methods and nodes for verification of data

Methods and nodes () for handling a usage policy (P.P) pertaining to source data (D,D) generated by a source node (). The usage policy dictates permission to access and use the source data. The source node calculates a signature (Sig) based on an identification (id_D) of the source data and the usage policy (P) of the source data, and provides the source data, its usage policy and the calculated signature to a data processing node (). The data processing node then generates new data (D) based on the source data, and calculates a new signature (Sig) based on an identification (ldj_)) of the new data and at least one of: a new usage policy (P) pertaining to the generated new data, and the usage policy (P, P) of the source data. The data processing node finally provides the new data, the usage policies (P, P, P) and the signatures (Sig, Sig, Sig) to a data receiving node () which is thereby enabled to verify and comply with the provided usage policies based on the respective associated signatures.

Methods and nodes for handling usage policy

Imposing one or more usage constraints on digital content involves communicating a digital content data item to a digital content receiver system. The digital content data item includes the digital content and a usage constraint data item different from a digital license data item, or a reference to the usage constraint data item, the use case item being indicative of the one or more usage constraints.

Method and device for imposing usage constraints of digital content

A method for establishing a secured communication channel, between a first processing component and a second processing component; the method comprising executing a digital rights management agent on a processing unit, the digital rights management agent being configured to enforce permissions associated with digital content based on a digital rights management protection mechanism; receiving, by the digital rights management agent at least a security data item, the security data item including a session key data item; verifying authenticity of the received session key data item by the digital rights management agent using said digital rights management protection mechanism; providing the verified session key data item by the digital rights management agent to at least the second processing component; establishing a secured communication channel between the first and second processing components using at least the provided session key data item.

Method and device for communicating digital content

A method and arrangement in a multimedia gateway connected to a multimedia service network, for providing access to multimedia services for communication devices connected to a private network. In the multimedia gateway, a communication unit receives a request from a device in the private network for a public identity associated with the multimedia gateway. An identity manager then selects and allocates an associated public identity from a pool of public identities associated with the multimedia gateway which have been predefined as valid in the multimedia service network. The communication unit then registers the device by activating the allocated associated public identity in the multimedia service network. Thereby, the multimedia gateway can establish a multimedia session on behalf of the device, using the allocated associated public identity.

Dias-dynamic IMPU assignment service

A method and apparatus for sending a first secured media stream having a payload via an intermediate node. The intermediate node receives from a sender the first secured media stream. An end-to-end context identifier and a hop-by-hop context identifier are determined for the first secured media stream, where the hop-by-hop context identifier relates to the intermediate node and the end-to-end identifier relates to the sender. A second secured media stream is generated, which includes at least the payload of the first secured media stream and the context identifiers to identify the first secured media stream. The second secured media stream is sent to a receiving node, and the context identifiers are also sent to the receiving node. The context identifiers are usable by the receiving node to recover the first secured media stream.

Sending secure media streams

Methods, systems and communication nodes for protecting Session Initiation Protocol (SIP) message payloads are described. Different protection techniques can be used to protect SIP payloads depending upon, for example, whether a recipient client application resides in a user equipment or an application server and/or whether a recipient client application resides in a same SIP/IP domain as the target SIP application server which is sending the SIP payloads.

Methods and systems for end-to-end secure SIP payloads

A system for generation of processed data for use in third party relationship monitoring is described. The system includes a communications system providing services to subscribing users. The communications system includes a rules database for storing rules, a data mining agent for mining and storing data relating to subscribing users, a content generator for generating protected user-related data from the mined data and communicating said user-related data over an interface, and a rights object generator for generating a usage rights object in response to the rules stored in the rules database and communicating said usage rights object over the interface. A tamper proof processing arrangement is connected to the interface. The tamper proof processing arrangement receives the user-related data and usage rights object from the communications system and processes the user-related data under control of the usage rights object. A signal output generator generates an output signal representative of processed data received from the processing arrangement.

Method for user privacy protection

An IMS system includes an IMS initiator user entity. The system includes an IMS responder user entity that is called by the initiator user entity. The system includes a calling side S-CSCF in communication with the caller entity which receives an INVITE having a first protection offer and parameters for key establishment from the caller entity, removes the first protection offer from the INVITE and forwards the INVITE without the first protection offer. The system includes a receiving end S-CSCF in communication with the responder user entity and the calling side S-CSCF which receives the INVITE without the first protection offer and checks that the responder user entity supports the protection, inserts a second protection offer into the INVITE and forwards the INVITE to the responder user entity, wherein the responder user entity accepts the INVITE including the second protection offer and answers with an acknowledgment having a first protection accept. A method for supporting a call by a telecommunications node.

Method and apparatuses for end-to-edge media protection in an IMS system

The embodiments of the present invention relate to apparatuses, in terms of a client device () and a server () and to methods in the client device () and in the server () respectively for enabling a user to consume content provided by a content provider. According to the method in the client device () the method comprises: assembling a request for rights for consuming a content and indicating in the request which content to consume; determining if an upgrade key, associated with the content, is present in the client device; including, in such a case, in the request, an identifier of the upgrade key that is associated with the content, sending the request to the content provider; receiving, a response comprising an encrypted rights object; decrypting the encrypted rights object and starting to use the rights object for consuming the content.

Apparatuses and methods for enabling a user to consume protected contents of a content provider

Methods and arrangements for enabling the use of a first device () for controlling transfer of media content from a content provider () to a second device (). The first device has a pre-established security association with the communications network. When the network detects a request made by the first device for delivery of media content to the second device, key information is established which enables determination of one or more media keys for encryption of the media content. The network sends key information to the content provider and to the first device. The content provider then delivers media content encrypted by the media key(s) to the second device. Further, the first device forward the media key(s) over a local communication link to the second device for decryption of media content encrypted by the media key(s) when delivered by the content provider.

Method and arrangement for enabling play-out of media

A method and apparatus for sending protected media data from a data source node to a client node via an intermediate node. The data source node establishes a first hop-by-hop key to be shared with the intermediate node and an end-to-end key to be shared with the client node. A single security protocol instance is configured and used to trans-protocol form data from a media stream into transformed data using the keys. The transformed data is then sent to the intermediate node. The intermediate node uses the first hop-by-hop key to apply a security processing to the transformed data, and establishes a second hop-by-hop key with the client node. A second transformation is performed on the transformed data using the second hop-by-hop key to produce further transformed media data, which is then sent to the client node. At the client node a single security protocol instance is configured with the second hop-by-hop key and the end-to-end key, which are used to apply further security processing to the transformed media data.

Growing community of inventors

Sundbyberg, Sweden

Yi Cheng