Nokia Technologies Oy

Nokia Corporation

Nokia Solutions and Networks Oy

Nokia Technology Oy

Zheng Yan

Jukka Antero Alve

Juha Hietasarka

Peter K Chiu

Petteri Saarinen

Mia Lahteenmaki

Piotr Cofta

Mingjun Wang

Wenxiu Ding

Xuyang Jing

Rui Zhang

Sihui Zhao

Xixun Yu

Mia Lähteenmäki

Shanshan Bian

Wei Sun

Jukka Alve

Example embodiments of the present disclosure relate to verifiability for execution in a trusted execution environment (TEE). According to a method, a request for execution of a task is transmitted by a first apparatus and to a second apparatus, the task comprising a plurality of functions to be executed. A first validation key is generated from identification information of the plurality of functions based on an expected execution plan in at least one trusted execution environment of the second apparatus. An execution result for the task and a second validation key are received from the second apparatus. Correctness of the execution result is determined by comparing the first validation key with the second validation key. Through the solution, it is possible to provide the verifiability of the correctness of the execution result returned by the remote apparatus and achieves high performance on security, trust, and privacy.

Verifiability for execution in trusted execution environment

A method and apparatus for trust management in an integrated network, the integrated network comprising a plurality of different communication networks, each of a plurality of different communication networks comprising at least one miner node, at least one authentication node, and at least one network node. A blockchain system is constituted by miner nodes in the different communication networks. A block of a blockchain of the blockchain system comprises an identity of a previous block of the blockchain, a timestamp of generation of the block, a trust value list that contains a trust value of each of at least one network node in the plurality of different communication networks, and a hash code of trust related data that are used to evaluate trust values in the trust value list. The block can be shared within any of the different communication networks, for trust management on the at least one network node based on its trust value.

Method and apparatus for trust management in integrated networks based on blockchain

A voiceprint authentication apparatus is provided, comprising: a voice receiving module configured to receive a user's voices in different speaking modes; a feature extraction module configured to extract respective sets of voice features from the user's voices in different speaking modes; a synthesis module configured to generate a first voiceprint template by synthesizing the respective sets of voice features; and a first communication module configured to send the first voiceprint template to a server to authenticate the user, wherein the user's voices and the respective sets of voice features are not sent to the server. A corresponding voice authentication method, as well as a computer readable medium, are also provided.

Privacy-preserving voiceprint authentication apparatus and method

Various example embodiments relate generally to providing security for a communication network based on detection and mitigation of an attack in the communication network. Various example embodiments supporting attack detection and mitigation may be configured to support detection and mitigation of an attack in a communication network based on distributed collection of network traffic information at network elements and analysis of aggregated network traffic information at a network controller for determining whether a traffic anomaly indicative of an attack on the communication network is detected. Various example embodiments supporting attack detection and mitigation may be configured to support detection and mitigation of an attack in a communication network based on use of traffic records for supporting the collection, aggregation, and analysis of network traffic information.

Network security

A method, device, and system for network traffic analysis are provided. The method comprises obtaining traffic data of current time interval, recording the traffic data in a Chinese Remainder Theorem based Reversible Sketch (CRT-RS) based on a hash operation comprising Modulo operations, detecting abnormal buckets in the CRT-RS based on a change between the traffic data of current time interval and traffic data of previous time interval, and recovering abnormal source address associated information based on the abnormal buckets, wherein the modulus of the Modulo operations are selected from the modulus in Chinese Remainder Theorem (CRT) as pairwise coprime integers and the CRT-RS includes a plurality of buckets. The step of detecting uses a Modified Multi-chart Cumulative Sum.

Method, device, and system for network traffic analysis

Methods, apparatus, computer program product and computer readable medium are disclosed for authentication. A method comprises: sending an authentication request to a relying party, wherein the authentication request comprises a voice authentication command of a user; receiving from an identity provider at least one first challenge message with respective randomly generated verification code and respective first randomly generated challenge style; and sending at least one voice verification code to the identity provider, wherein the at least one voice verification code is pronounced by the user in the light of the respective randomly generated verification code and the respective first randomly generated challenge style.

Apparatus, method and computer program product for authentication

According to an example aspect of the present invention, there is provided an apparatus comprising at least one processing core, at least one memory including computer program code, the at least one memory and the computer program code configured to cause the apparatus to receive an identifier of a function, encrypted input data, an encrypted computation result, encrypted random data and an encrypted output of the function, when nm with the random data, obtain a homomorphic polynomial factorization of the function, comprising obtaining a decomposed representation of the function, the representation comprising a sum of polynomials, and verify that the computation result is correct by checking, whether a difference between the encrypted output and the encrypted computation result equals a value of the decomposed representation, wherein the encrypted random data and the encrypted input data are used as parameter values in the sum of polynomials.

Secured computing

Methods, apparatus, computer program product and computer readable medium are disclosed for trust management in software defined networking. A method comprises: collecting network performance results after a network policy issued by an application is applied; collecting a feedback for the network policy; and calculating a trust value of the application based at least partly on the network performance results and the feedback.

Apparatus, method and computer program product for trust management

A method for securing D2D communications may comprise: encrypting communication data based at least in part on a security policy associated with at least one of a general trust evaluation and a local trust evaluation; and sending the encrypted communication data from a first user equipment to one or more second user equipments, wherein the second user equipment of which at least one of a general trust evaluation result and a local trust evaluation result satisfies the security policy set by the first user equipment is eligible to access the encrypted communication data.

Flexible security channel establishment in D2D communications

According to an example aspect of the invention, there is provided an apparatus comprising at least one processing core and at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to receive, from a first user, a ciphertext, a first hash value and a first ciphered encryption key, receive, from a second user, a second hash value, responsive to a determination the first hash value is the same as the second hash value, obtain a re-encryption key, and apply the re-encryption key to the first ciphered encryption key to obtain a re-encrypted encryption key, the re-encrypted encryption key being decryptable with a secret key of the second user.

De-duplication of encrypted data

According to embodiments of the present invention, trust evaluation is performed on network entities including a host and a network node with privacy preservation to determine an unwanted traffic source. The trust evaluation is based on detection reports from the hosts and monitoring reports from the network nodes. The network nodes do not know contents of the detection reports, and an entity which executes the trust evaluation does not know real identifiers of the hosts and network nodes.

Control of unwanted network traffic

A method for authentication and key agreement in a communication network is disclosed. In the method, a network node generates a common public key and a master secret key, assigns to a first user equipment a first set of one or more pseudonym identifications corresponding to a real identity of the first user equipment, the common public key and a first private key specific to the first user equipment, and assigns to a second user equipment a second set of one or more pseudonym identifications corresponding to a real identity of the second user equipment, the common public key and a second private key specific to the second user equipment. In response to a request for establishing a communication session between the first user equipment with a first pseudonym identification and the second user equipment with a second pseudonym identification, the network node generates a first intermediate key for the first user equipment based on the common public key and a second secret key shared between the second user equipment and the network node, and a second intermediate key for the second user equipment based on the common public key and a first secret key shared between the first user equipment and the network node. Upon successfully authenticate each other based on the common public key, the first and second user equipments generate a session key to be used for securing the communication session based on the first and second intermediate keys respectively.

Authentication and key agreement in communication network

Method and apparatus are disclosed for homomorphic re-encryption schemes in a system comprising a cloud service provider (CSP), a third authorized party (TAP), a data requestor (DR) and a plurality of data providers (DPs). According to an embodiment, a method implemented at a CSP comprises: in response to a request from a TAP, obtaining from a plurality of DPs cipher texts of their respective data, based on the request, wherein each DP is able to homomorphically encrypt its data; analyzing the cipher texts; and sending the analyzing result to the TAP, wherein the TAP is able to re-encrypt the analyzing result, such that a DR can decrypt the re-encrypted analyzing result with the DR's secret key. According to another embodiment, a method implemented at a CSP comprises: collecting from a plurality of DPs cipher texts of their respective data, wherein each DP is able to homomorphically encrypt its data; analyzing the cipher texts; in response to a request from a TAP, encrypting the analyzing result; and sending the encrypted analyzing result to the TAP, wherein the TAP is able to re-encrypt the encrypted analyzing result, such that a DR can decrypt the re-encrypted analyzing result with the DR's secret key.

Schemes of homomorphic re-encryption

An approach is provided for managing data duplication in cloud computing. A method comprising, sending from a first device to a data center, data encrypted with a data encryption key for storing the encrypted data at the data center; encrypting the data encryption key according to an attribute-based encryption (ABE) scheme by using identity as an attribute in a deduplication policy for the data; issuing to a second device, a personalized secret attribute key which is derived from a public key of the second device according to the attribute-based encryption (ABE) scheme, wherein the personalized secret attribute key is to be used for decrypting the encrypted data encryption key at the second device, in combination with the policy.

Method and apparatus for duplicated data management in cloud computing

A method is disclosed, comprising obtaining, by a first apparatus, a first identifier associated with the first apparatus, wherein the first identifier is different from a second identifier associated with the first apparatus, providing, by the first apparatus, at least one message to at least one further apparatus of at least one further apparatus, wherein each of the at least one message comprises a key information of the first apparatus and is associated with the first identifier associated with the first apparatus, and determining, by the first apparatus, a session key of a communication session associated with the first apparatus and the at least one further apparatus, based on at least one message received, by the first apparatus, provided by at least one further apparatus of the at least one further apparatus, wherein each of the at least one message comprises a key information of the respective further apparatus and is associated with a first identifier associated with the respective further apparatus.

Growing community of inventors

Espoo, Finland

Zheng Yan