Handling of Performance Monitoring Data

A method for handling performance monitoring data in a communication network, the communication network comprising a plurality of network nodes;

• the performance monitoring data being generated by a network node;
• the performance monitoring data being a stream of data characterizing the performance of the network node;
• the method comprising:
• determining, by the network node, whether an encryption condition for encrypting the performance monitoring data is fulfilled;
• based on the result of determining, encrypting the performance monitoring data by the network node;
• subsequent to the encrypting, sending, by the network node, the encrypted performance monitoring data to a performance monitoring data collector;
• authorizing, by a security network operation center, the performance monitoring data collector to decrypt the encrypted performance monitoring data.

A method, in a security network operation center, for handling performance monitoring data in a communication network, the communication network comprising a plurality of network nodes;

• the performance monitoring data being generated by a network node;
• the performance monitoring data being a stream of data characterizing the performance of the network node;
• the method comprising:
• agreeing with the network node on an encryption key and a corresponding decryption key, the network node being authorized to negotiate the encryption key and a corresponding decryption key;
• and
• delivering the decryption key to a performance monitoring data collector, the performance monitoring data collector being authorized to receive the decryption key.

A method, in a performance monitoring data collector, for handling performance monitoring data in a communication network comprising a plurality of network nodes;

• the performance monitoring data being generated by a network node;
• the performance monitoring data being a stream of data characterizing the performance of the network node;
• the method comprising:
• determining whether a decryption condition for decrypting the performance monitoring data is fulfilled, the performance monitoring data being received from the network node;
• requesting, based on the result of determining, a decryption key from a security network operation center;
• decrypting the performance monitoring data with a decryption key received from the security network operation center;
• and
• providing the decrypted performance monitoring data to a performance analysis function.

A network node for handling performance monitoring data in a communication network comprising a plurality of network nodes;

• the performance monitoring data being generated by a network node;
• the performance monitoring data being a stream of data characterizing the performance of the network node, the network node comprising:
• one or more processing circuits configured to:
• generate performance monitoring data;
• determine sensitive data elements of the performance monitoring data;
• encrypt the sensitive data elements of the performance monitoring data using an encryption key;
• send the performance monitoring data to a performance monitoring data collector;
• agree with an authenticated security network operation center on an encryption key and a corresponding decryption key;
• authenticate the security network operation center;
• store an agreed encryption key;
• and
• monitor expiration of the encryption key.

A security network operation center for handling performance monitoring data in a communication network comprising a plurality of network nodes;

• the performance monitoring data being generated by a network node;
• the performance monitoring data being a stream of data characterizing the performance of the network node, the security network operation center comprising:
• one or more processing circuits configured to:
• agree with a network node on an encryption key and a corresponding decryption key;
• authenticate the network node;
• store an agreed decryption key;
• authorize a performance monitoring data collector;
• provide the decryption key to the authorized performance monitoring data collector;
• and
• monitor expiration of the decryption key.

A performance monitoring data collector for handling performance monitoring data in a communication network comprising a plurality of network nodes;

• the performance monitoring data being generated by a network node;
• the performance monitoring data being a stream of data characterizing the performance of the network node, the performance monitoring data collector comprising:
• one or more processing circuits configured to:
• receive performance monitoring data from a network node;
• store the performance monitoring data;
• determine whether performance monitoring data is encrypted;
• request a decryption key from a security network operation center;
• authorize to a security network operation center;
• decrypt encrypted performance monitoring data;
• and
• provide the decrypted performance monitoring data to a performance analysis function.

A system for handling performance monitoring data in a communication network comprising a plurality of network nodes, the system comprising:

• at least one network node;
• at least one security network operation center;
• at least one performance monitoring data collector;
• wherein the network node comprises one or more processing circuits configured to:
• generate performance monitoring data;
• the performance monitoring data being a stream of data characterizing the performance of the network node;
• determine sensitive data elements of the performance monitoring data;
• encrypt the sensitive data elements of the performance monitoring data using an encryption key;
• send the performance monitoring data to the performance monitoring data collector;
• agree with an authenticated security network operation center on an encryption key and a corresponding decryption key;
• authenticate the security network operation center;
• store an agreed encryption key;
• and
• monitor expiration of the encryption key;
• wherein the security network operation center comprises one or more processing circuits configured to:
• agree with the network node on the encryption key and the corresponding decryption key;
• authenticate the network node;
• store the agreed decryption key;
• authorize the performance monitoring data collector;
• provide the decryption key to the authorized performance monitoring data collector;
• and
• monitor expiration of the decryption key;
• wherein the performance monitoring data collector comprises one or more processing circuits configured to:
• receive performance monitoring data from a network node;
• store the performance monitoring data;
• determine whether performance monitoring data is encrypted;
• request a decryption key from the security network operation center;
• authorize to the security network operation center;
• decrypt encrypted performance monitoring data;
• and
• provide the decrypted performance monitoring data to the performance analysis function.

A computer program product stored in a non-transitory computer readable medium for handling performance monitoring data in a communication network, the communication network comprising a plurality of network nodes;

• the performance monitoring data being generated by a network node;
• the performance monitoring data being a stream of data characterizing the performance of the network node;
• the computer program product comprising software instructions which, when run on one or more processors, causes:
• the network node to determine whether an encryption condition for encrypting the performance monitoring data is fulfilled;
• the network node to, based on the result of determining, encrypt the performance monitoring data;
• the network node to, subsequent to the encrypting, send the encrypted performance monitoring data to a performance monitoring data collector;
• a security network operation center to authorize the performance monitoring data collector to decrypt the encrypted performance monitoring data.