# US 12,192,208 B2 · Apparatus, method, and computer program of protecting communications between networks using predefined security profiles > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,208 B2 - Document ID: US12192208B2 - Status: Granted - Kind: B2 - Application number: 17/716,028 - Filed: 2022-04-08 - Published: 2022-10-20 - Granted: 2025-01-07 - Earliest claimed: 2021-04-16 - Assignees: Nokia Technologies Oy - Applicants: Nokia Technologies Oy - Inventors: Anja Jerichow; German Peinado Gomez - Web page: https://patentgrep.com/patent/US12192208B2 ## CPC - H04L 63/102: {Entity profiles} - H04L 63/0281: {Proxies} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 8/12: between location registers or mobility servers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract An apparatus comprises means for: causing information indicating a first security protocol profile of a first security protocol from a first security node of a first network to be sent from a first security node of a first network to a second security node of a second network, wherein the first security profile has one or more of: a modification policy; a data type policy; and a cipher suite; and causing the first security node to communicate with the second security node in accordance with the first security profile. ## Claims ### Claim 1 An apparatus configured to protect communications between a first network and a second network, the apparatus being a first security node of the first network and comprising: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to: cause, when a first security mechanism is selected to protect communications between the first security node and a second security node of the second network, information indicating one or more predefined security profiles to be sent towards the second security node in a security parameter exchange request of a parameter exchange procedure, wherein a predefined security profile of the one or more predefined security profiles includes pre-populated parameters for a modification policy and a data type encryption policy; and cause the first security node to communicate with the second security node in accordance with one or more selected security profiles selected from the one or more predefined security profiles. ### Claim 2 (depends on 1) The apparatus as claimed in claim 1, wherein the security parameter exchange request includes an information element that indicates a list of the one or more predefined security profiles supported by the first security node for the first security mechanism. ### Claim 3 (depends on 2) The apparatus as claimed in claim 2, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to receive a security parameter exchange response of the parameter exchange procedure from the second security node indicating the one or more selected security profiles selected by the second security node. ### Claim 4 (depends on 3) The apparatus as claimed in claim 3, wherein the security parameter exchange response includes an information element that indicates a list of the one or more selected security profiles selected by the second security node. ### Claim 5 (depends on 1) The apparatus as claimed in claim 1, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to receive information indicating which of the one or more predefined security profiles are supported by the second security node. ### Claim 6 (depends on 1) The apparatus as claimed in claim 1, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to, prior to causing information indicating the one or more predefined security profiles to be sent, receive information indicating which of the one or more predefined security profiles are supported by the second security node. ### Claim 7 (depends on 1) The apparatus as claimed in claim 1, wherein the first security mechanism comprises a protocol for N32 interconnect security (PRINS). ### Claim 8 (depends on 1) The apparatus as claimed in claim 1, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to provide information indicating the one or more selected security profiles to one or more intermediate internet protocol exchange service nodes. ### Claim 9 (depends on 1) The apparatus as claimed in claim 1, wherein the predefined security profile of the one or more predefined security profiles includes: a default modification policy; a default data type encryption policy and list of information elements to be protected; and a preselected cipher suite. ### Claim 10 (depends on 1) The apparatus as claimed in claim 1, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to cause information indicating support of security profiles by the first security node to be sent to the second security node during a security capability negotiation procedure. ### Claim 11 An apparatus configured to protect communications between a first network and a second network, the apparatus being a second security node of the second network and comprising: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to: receive, when a first security mechanism is selected to protect communications between a first security node of the first network and the second security node, information indicating one or more predefined security profiles from the first security node in a security parameter exchange request of a parameter exchange procedure, wherein a predefined security profile of the one or more predefined security profiles includes pre-populated parameters for a modification policy and a data type encryption policy; select one or more selected security profiles from the one or more predefined security profiles; and cause the second security node to communicate with the first security node in accordance with the one or more selected security profiles. ### Claim 12 (depends on 11) The apparatus as claimed in claim 11, wherein the security parameter exchange request includes an information element that indicates a candidate list of the one or more predefined security profiles supported by the first security node for the first security mechanism. ### Claim 13 (depends on 12) The apparatus as claimed in claim 12, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to cause information indicating the one or more selected security profiles to be sent towards the first security node in a security parameter exchange response of the parameter exchange procedure. ### Claim 14 (depends on 13) The apparatus as claimed in claim 13, wherein the security parameter exchange response includes an information element that indicates a list of the one or more selected security profiles selected by the second security node. ### Claim 15 (depends on 11) The apparatus as claimed in claim 11, wherein the first security mechanism comprises a protocol for N32 interconnect security (PRINS). ### Claim 16 A method comprising: causing, when a first security mechanism is selected to protect communications between a first security node of a first network and a second security node of a second network, information indicating one or more predefined security profiles to be sent from the first security node towards the second security node in a security parameter exchange request of a parameter exchange procedure, wherein a predefined security profile of the one or more predefined security profiles includes pre-populated parameters for one or more of: a modification policy and a data type encryption policy; and causing the first security node to communicate with the second security node in accordance with one or more selected security profiles selected from the one or more predefined security profiles. ### Claim 17 (depends on 16) The method as claimed in claim 16, wherein the security parameter exchange request includes an information element that indicates a list of the one or more predefined security profiles supported by the first security node for the first security mechanism. ### Claim 18 (depends on 17) The method as claimed in claim 17, further comprising: receiving, at the first security node, a security parameter exchange response of the parameter exchange procedure from the second security node indicating the one or more selected security profiles selected by the second security node. ### Claim 19 (depends on 18) The method as claimed in claim 18, wherein the security parameter exchange response includes an information element that indicates a list of the one or more selected security profiles selected by the second security node. ### Claim 20 A method comprising: receiving, when a first security mechanism is selected to protect communications between a first security node of the first network and the second security node of a second network, information indicating one or more predefined security profiles at the second security node sent by the first security node in a security parameter exchange request of a parameter exchange procedure, wherein a predefined security profile of the one or more predefined security profiles includes pre-populated parameters for a modification policy and a data type encryption policy; selecting, at the second security node, one or more selected security profiles from the one or more predefined security profiles; and causing the second security node to communicate with the first security node in accordance with the one or more selected security profiles.