Protection of traffic between network functions
AssigneeTelefonaktiebolaget LM Ericsson (publ)
InventorPasi Saarinen
Life of this patent
Estimating the term…
Abstract
Methods and network equipment in a core network for intercepting protected communication between core network (CN) network functions (NFs). A method performed by network equipment in a core network may include establishing a first connection with a first NF for which the network equipment serves as a proxy and establishing, on behalf of the first NF, a second connection that is towards a second NF and that is secure. The method may also include selectively forwarding communication between the first and second NFs over the first and second connections, including transmitting and/or receiving the communication on behalf of the first NF over the second connection. The method may further include intercepting the communication that the network equipment selectively forwards between the first and second NFs.
Claims16
A method performed by network equipment in a core network for intercepting protected communication between core network (CN) network functions (NFs), the method comprising:
- establishing a first connection with a first NF for which the network equipment serves as a proxy;
- establishing, on behalf of the first NF, a second connection that is towards a second NF and that is secure;
- selectively forwarding communication between the first and second NFs over the first and second connections, including transmitting and/or receiving the communication on behalf of the first NF over the second connection;
- and
- intercepting the communication that the network equipment selectively forwards between the first and second NFs;
- wherein the first connection is established responsive to the network equipment receiving a first connection request that requests a connection with the network equipment or the second connection is established responsive to the network equipment receiving a second connection request that requests a connection with the network equipment;
- wherein the first NF is an NF service consumer and the second NF is an NF service provider, or wherein the first NF is an NF service provider and the second NF is an NF service consumer;
- wherein the method further comprises receiving the first connection request from the NF service consumer or a proxy of the NF service consumer and identifying from the first connection request the NF service provider with which the NF service consumer requests to communicate.
Network equipment configured for use in a core network for intercepting protected communication between core network (CN) network functions (NFs), the network equipment comprising:
- processing circuitry and memory, the memory containing instructions executable by the processing circuitry wherein the network equipment is configured to:
- establish a first connection with a first NF for which the network equipment serves as a proxy;
- establish, on behalf of the first NF, a second connection that is towards a second NF and that is secure;
- selectively forward communication between the first and second NFs over the first and second connections, including transmitting and/or receiving the communication on behalf of the first NF over the second connection;
- and
- intercept the communication that the network equipment selectively forwards between the first and second NFs
- wherein the network equipment is configured to establish the first connection responsive to receiving a first connection request that requests a connection with the network equipment or establish the second connection responsive to receiving a second connection request that requests a connection with the network equipment;
- wherein the first NF is an NF service consumer and the second NF is an NF service provider, or wherein the first NF is an NF service provider and the second NF is an NF service consumer;
- wherein the memory contains instructions executable by the processing circuitry wherein the network equipment is further configured to:
- receive the first connection request from the NF service consumer or a proxy of the NF service consumer and identify from the first connection request the NF service provider with which the NF service consumer requests to communicate;
- or
- receive, over the first or second connection, an application layer request from the NF service consumer or a proxy of the NF service consumer and identify from the application layer request the NF service provider with which the NF service consumer requests to communicate;
- or
- receive from a network repository function (NRF) information identifying the NF service provider as the NF with which the NF service consumer requests to communicate.
Dependencies are inferred from the claim text.