# US 12,010,146 B2 · Method, system and apparatus for unified security configuration management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,146 B2 - Document ID: US12010146B2 - Status: Granted - Kind: B2 - Application number: 17/419,180 - Filed: 2019-01-02 - Published: 2022-03-31 - Granted: 2024-06-11 - Earliest claimed: 2019-01-02 - Assignees: Nokia Solutions and Networks Oy - Applicants: Nokia Solutions and Networks Oy - Inventors: Wei Zheng; Cheng Cai; Yulong Zhang; Xiaoguang Zhao; Silke Holtmanns; Ian Justin Oliver - Web page: https://patentgrep.com/patent/US12010146B2 ## CPC - H04L 9/3247: {involving digital signatures} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 9/44505: {Configuring for program initiating, e.g. using registry, configuration files} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms} - H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 41/5054: Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components - H04L 63/0272: {Virtual private networks} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 2009/45587: {Isolation or security of virtual machine instances} - H04L 41/342: between virtual entities, e.g. orchestrators, SDN or NFV entities - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and apparatus are disclosed for unified security configuration management. A method may comprise: determine a security configuration to be executed; determine at least one security application which is installed on at least one node and is associated with the security configuration; format for the security configuration, instructions corresponding to each of the at least one security application, respectively; and send the instructions to the at least one node for respective configuration for each of the at least one security application. ## Claims ### Claim 1 A method, comprising: determining in a server a security configuration to be executed; determining at least two different security applications which are installed on at least one node and are associated with the security configuration, wherein the at least two different security applications use different security protocols; according to a security protocol used by each of the at least two different security applications, formatting for the security configuration, instructions corresponding to each of the at least two different security application, respectively; and sending the instructions to the at least one node for respective configuration for each of the at least two different security applications, wherein determining at least two different security applications comprises obtaining address information of the at least one node on which the at least two different security applications are installed, and wherein the address information is obtained from a virtual network function management entity. ### Claim 2 (depends on 1) The method according to claim 1, wherein the determining of the security configuration is triggered by the server. ### Claim 3 (depends on 1) The method according to claim 1, wherein the determining of the security configuration is triggered in response to a request from one of the at least one node. ### Claim 4 (depends on 1) The method according to claim 1, further comprising, receiving a request for executing the security configuration; and checking whether the security configuration is supported. ### Claim 5 (depends on 1) The method according to claim 1, wherein the at least one node comprises different network slices, or different virtual network functions and virtual machines. ### Claim 6 (depends on 1) The method according to claim 1, wherein the security configuration relates to at least one of the following: algorithms, keys, parameter for algorithms, seeds, algorithm implementations, security libraries and versions of a security protocol. ### Claim 7 (depends on 1) The method according to claim 1, further comprising: before the sending, signing the instructions with a cryptographic key bound to a certificate of the server. ### Claim 8 (depends on 7) The method according to claim 7, further comprising: signing a state of the server; and sending the signed state to the at least one node. ### Claim 9 (depends on 1) The method according to claim 1, further comprises: predefining scripts for construction instructions according to a given security protocol; storing the predefined scripts; and retrieving the scripts when it is determined that the instructions to be formatted correspond to a security application using the given security protocol. ### Claim 10 An apparatus, comprising: at least one processor; at least one memory including computer program code, the memory and the computer program code configured to, working with the at least one processor, cause the apparatus to: determine a security configuration to be executed; determine at least two different security applications which is installed on at least one node and are associated with the security configuration, wherein the at least two different security applications use different security protocols; according to a security protocol used by each of the at least two different security applications, format for the security configuration, instructions corresponding to each of the at least one security application, respectively; and send the instructions to the at least one node for respective configuration for each of the at least two different security applications, wherein information of the security applications comprises address information of the at least one node, and wherein the memory and the computer program code are further configured to, working with the at least one processor, to cause the apparatus to obtain the information from a virtual network function management entity. ### Claim 11 (depends on 10) The apparatus according to claim 10, wherein the memory and the computer program code are further configured to, working with the at least one processor, to cause the apparatus to receive a request from one of the at least one node, to trigger the formatting of the instructions and the sending of the formatted instructions. ### Claim 12 (depends on 10) The apparatus according to claim 10, wherein the security configuration relates to at least one of the following: algorithms, keys, parameter for algorithms, seeds, algorithm implementations, security libraries and versions of a security protocol. ### Claim 13 (depends on 10) The apparatus according to claim 10, wherein the memory and the computer program code are further configured to, working with the at least one processor, to cause the apparatus to sign the instructions with a cryptographic key bound to a certificate of the apparatus. ### Claim 14 (depends on 13) The apparatus according to claim 13, wherein the memory and the computer program code are further configured to, working with the at least one processor, to cause the apparatus to sign a state of the apparatus, and the configuration engine is further configured to send the signed state to the nodes on which the at least one security application is installed. ### Claim 15 (depends on 10) The apparatus according to claim 10, wherein the memory and the computer program code are further configured, working with the at least one processor, to predefine scripts for constructing instructions according to a given security protocol, store the predefined scripts; and retrieve the scripts when it is determined that the instructions to be formatted correspond to a security application using the given security protocol. ### Claim 16 A non-transitory computer program product comprising instructions which when executed by at least one processor, cause the at least one processor to perform the following: determining a security configuration to be executed; determining at least two different security applications which are installed on at least one node and are associated with the security configuration, wherein the at least two different security applications use different security protocols; according to a security protocol used by each of the at least two different security applications, formatting for the security configuration, instructions corresponding to each of the at least two different security applications, respectively; and sending the instructions to the at least one node for respective configuration for each of the at least two different security applications, wherein determining at least two different security applications comprises obtaining address information of the at least one node on which the at least two different security applications are installed, and wherein the address information is obtained from a virtual network function management entity. ### Claim 17 (depends on 16) The non-transitory computer program product according to claim 16, wherein the instructions cause the at least one processor to further perform the following: predefining scripts for constructing instructions according to a given security protocol; storing the predefined scripts; and retrieving the scripts when it is determined that the instructions to be formatted correspond to a security application using the given security protocol.