IP Library › Granted Patent US 10,893,025
Granted Patent B2
US 10,893,025 · App. 16/014,294 · Granted Jan 12, 2021

Security management in communication systems with network function assisted mechanism to secure information elements

Inventors: Nagendra S. Bykampadi (Bangalore, IN); Suresh P. Nair (Whippany, NJ); Anja Jerichow (Munich, DE)
Assignee: Nokia Technologies Oy
H04L63/04H04L63/12H04L63/20H04W12/00505H04W12/06H04W12/08H04W88/16H04L63/0471H04L67/02H04W12/001H04W12/10H04W84/042
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,893,025
App. No.
16/014,294
Granted
Jan 12, 2021
Kind
B2
Abstract

In a communication system comprising a first network operatively coupled to a second network, wherein the first network comprises a first security edge protection proxy element operatively coupled to a second security edge protection proxy element of the second network; the method comprises constructing a message at a network function in the first network destined for the second network, wherein the message comprises at least one information element and an indicator, wherein the indicator is set to specify at least one security operation to be applied to the at least one information element before sending the message to the second security edge protection proxy element of the second network.

Claims (37)

1. A method comprising:

in a communication system comprising a first network operatively coupled to a second network, wherein the first network comprises a first security edge protection proxy element operatively coupled to a second security edge protection proxy element of the second network, wherein the first network comprises a visited network in the communication system and the second network comprises a home network in the communication system;

constructing a message at a first network function in the first network destined for a second network function in the second network, wherein the message comprises at least one information element and at least one indicator, wherein the at least one indicator is set to specify at least one security operation to be applied to the at least one information element before sending the message to the second security edge protection proxy element of the second network.

2. The method of claim 1 , further comprising the first network function in the first network sending the constructed message to the first security edge protection proxy element such that the first security edge protection proxy element can apply the at least one security operation specified by the at least one indicator set by the first network function in the message.

3. The method of claim 1 , wherein the at least one security operation comprises one or more of encryption, integrity-protection, confidentiality-protection, and information element modification control.

4. The method of claim 1 , wherein the constructed message further comprises at least one additional information element and at least one additional indicator set to specify at least one additional security operation to be applied to the at least one additional information element before sending the message to the second security edge protection proxy element of the second network.

5. The method of claim 4 , wherein the at least one security operation specified by the at least one indicator for the at least one information element and the at least one additional security operation specified by the additional indicator for the at least one additional information element in the constructed message are different security operations.

6. The method of claim 1 , wherein the constructed message is a HyperText Transport Protocol (HTTP) request message.

7. The method of claim 6 , wherein a format of the HTTP request message utilizes a JavaScript Object Notation (JSON).

8. The method of claim 1 , wherein the communication system comprises a 5G system.

9. An article of manufacture comprising a non-transitory computer-readable storage medium having embodied therein executable program code that when executed by a processor causes the processor:

in a communication system comprising a first network operatively coupled to a second network, wherein the first network comprises a first security edge protection proxy element operatively coupled to a second security edge protection proxy element of the second network, wherein the first network comprises a visited network in the communication system and the second network comprises a home network in the communication system;

to construct a message at a first network function in the first network destined for a second network function in the second network, wherein the message comprises at least one information element and at least one indicator, wherein the at least one indicator is set to specify at least one security operation to be applied to the at least one information element before sending the message to the second security edge protection proxy element of the second network.

10. Apparatus comprising:

in a communication system comprising a first network operatively coupled to a second network, wherein the first network comprises a first security edge protection proxy element operatively coupled to a second security edge protection proxy element of the second network, wherein the first network comprises a visited network in the communication system and the second network comprises a home network in the communication system;

at least one processor coupled to a memory and configured to:

construct a message at a first network function in the first network destined for a second network function in the second network, wherein the message comprises at least one information element and at least one indicator, wherein the at least one indicator is set to specify at least one security operation to be applied to the at least one information element before sending the message to the second security edge protection proxy element of the second network.

11. A method comprising:

in a communication system comprising a first network operatively coupled to a second network, wherein the first network comprises a first security edge protection proxy element operatively coupled to a second security edge protection proxy element of the second network, wherein the first network comprises a visited network in the communication system and the second network comprises a home network in the communication system;

receiving, at the first security edge protection proxy element, a message constructed at a first network function in the first network destined for a second network function in the second network, wherein the message comprises at least one information element and at least one indicator, wherein the at least one indicator is set to specify at least one security operation to be applied to the at least one information element before sending the message to the second security edge protection proxy element of the second network; and

applying, at the first security edge protection proxy element, the at least one security operation specified by the at least one indicator to the at least one information element in the received message to form a secured message.

12. The method of claim 11 , wherein the first security edge protection proxy element parses the received message to obtain the at least one information element.

13. The method of claim 11 , further comprising the first security edge protection proxy element sending the secured message to the second security edge protection proxy element of the second network.

14. The method of claim 11 , wherein the received message further comprises at least one additional information element and at least one additional indicator set to specify at least one additional security operation to be applied to the at least one additional information element before sending the message to the second security edge protection proxy element of the second network.

15. The method of claim 14 , wherein the at least one security operation specified by the at least one indicator for the at least one information element and the at least one additional security operation specified by the additional indicator for the at least one additional information element in the constructed message are different security operations.

16. The method of claim 11 , wherein the received message is a HyperText Transport Protocol (HTTP) request message.

17. The method of claim 16 , wherein a format of the HTTP request message utilizes a JavaScript Object Notation (JSON).

18. An article of manufacture comprising a non-transitory computer-readable storage medium having embodied therein executable program code that when executed by a processor causes the processor:

in a communication system comprising a first network operatively coupled to a second network, wherein the first network comprises a first security edge protection proxy element operatively coupled to a second security edge protection proxy element of the second network, wherein the first network comprises a visited network in the communication system and the second network comprises a home network in the communication system;

to receive, at the first security edge protection proxy element, a message constructed at a first network function in the first network destined for a second network function in the second network, wherein the message comprises at least one information element and at least one indicator, wherein the at least one indicator is set to specify at least one security operation to be applied to the at least one information element before sending the message to the second security edge protection proxy element of the second network; and

to apply, at the first security edge protection proxy element, the at least one security operation specified by the at least one indicator to the at least one information element in the received message to form a secured message.

19. Apparatus comprising:

in a communication system comprising a first network operatively coupled to a second network, wherein the first network comprises a first security edge protection proxy element operatively coupled to a second security edge protection proxy element of the second network, wherein the first network comprises a visited network in the communication system and the second network comprises a home network in the communication system;

at least one processor coupled to a memory and configured:

to receive, at the first security edge protection proxy element, a message constructed at a first network function in the first network destined for a second network function in the second network, wherein the message comprises at least one information element and at least one indicator, wherein the at least one indicator is set to specify at least one security operation to be applied to the at least one information element before sending the message to the second security edge protection proxy element of the second network; and

to apply, at the first security edge protection proxy element, the at least one security operation specified by the at least one indicator to the at least one information element in the received message to form a secured message.

20. The method of claim 1 , wherein the constructed message comprises a hypertext transfer protocol (HTTP) request message comprising a request line, one or more headers, and a message body, the HTTP request message comprising a separate indicator value for each JavaScript Object Notation (JSON)-based information element in the message body.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 21, 2018
From: BYKAMPADI, NAGENDRA S.; NAIR, SURESH P.; JERICHOW, ANJA
To: NOKIA TECHNOLOGIES OY
Reel/Frame 046163/0486 →
Priority Claims (1)
IN 201841005885 · Feb 15, 2018 · national
Continuity (1)
Related Publication 20190253395A1 · Aug 15, 2019