Abstract: There is provided a method for network address translation. The method is performed by a gateway. The method comprises acquiring an in-packet Bloom Filter (iBF) representation of a node. The method comprises embedding an indication of the iBF representation in an IP address, thereby enabling translation of the iBF representation of the node to an IP address of the node. There is also presented a gateway configured to perform such a method and a computer program comprising computer program code which, when run on a processing unit of the gateway, causes the processing unit to perform such a method.

Abstract: A method performed by a machine-to-machine, M2M, server for managing communication with a M2M device is disclosed. The method comprising configuring the M2M device with a finite number of predetermined states and predetermined transitions for moving the M2M device into one of its predetermined states, and sending a message to the M2M device for executing at least one of the predetermined transitions.

Abstract: A method performed in a node comprised in a communication network is disclosed. The method includes obtaining a set of coordinates of a coordinate system used by the communication network, which set of coordinates specifies a geographical position held by the node. The method includes obtaining a first identifier for the node. The identifier comprises at least a part of the obtained set of coordinates, where the identifier can specify to the communication network a first geographical area in which the node is positioned. The method includes uploading data to a server in the communication network, the data being associated with the obtained identifier when uploaded to the server. The first identifier specifies to the network, such as other nodes in the communication network, a geographical area in which the node is positioned/located. The geographical area may be of any size, but includes the place where the node is positioned.

Abstract: A method performed by a machine-to-machine, M2M, server for managing communication with a M2M device is disclosed. The method comprising configuring the M2M device with a finite number of predetermined states and predetermined transitions for moving the M2M device into one of its predetermined states, and sending a message to the M2M device for executing at least one of the predetermined transitions.

Abstract: There is provided mechanisms for handling acknowledgements from nodes in a wireless radio ad-hoc network. A method is performed by a gateway of the wireless radio ad-hoc network. The method comprises transmitting radio signalling to nodes in the wireless radio ad-hoc network. The transmitted radio signalling is addressed to, and requiring acknowledgement from, at least one node in the wireless radio ad-hoc network. The method comprises receiving radio signalling from a node in the wireless radio ad-hoc network. The received radio signalling comprises one in-packet Bloom Filter comprising acknowledgement of the transmitted radio signalling from at least one of the nodes.

Abstract: A method in a coordinator in a radio communication network. The method comprises obtaining a token identifying a radio device. The method also comprises obtaining information confirming that the radio device is authorized to connect to the coordinator. The method also comprises calculating a device filter comprising a plurality of tokens, wherein the plurality of tokens include the obtained token of the radio device and identifies a plurality of devices authorized to connect to the coordinator. The method also comprises sending a broadcast radio signal comprising the device filter. The method also comprises allowing the radio device to connect to the coordinator. The present disclosure also relates to a coordinator, as well as to a radio device and a method of a radio device.

Abstract: There is described a system for authenticating a client device in a network having a plurality of IDM components. One or more of the IDM components subscribes (using the publish-subscribe message pattern) to authentication requests published by client devices. The client device publishes an authentication request into the network. The most appropriate IDM component to process the published authentication request is selected, and the authentication request forwarded to the selected IDM component. The selected IDM component is then operated to negotiate with and authenticate the client device.

Abstract: There is provided a method for network address translation. The method is performed by a gateway. The method comprises acquiring an in-packet Bloom Filter (iBF) representation of a node. The method comprises embedding an indication of the iBF representation in an IP address, thereby enabling translation of the iBF representation of the node to an IP address of the node. There is also presented a gateway configured to perform such a method and a computer program comprising computer program code which, when run on a processing unit of the gateway, causes the processing unit to perform such a method.

Abstract: In order to delegate location update signaling responsibility from a Mobile Node to a Mobile Router, the Mobile Router is provided with a second symmetric key generated by a Mobile Node using a first symmetric key shared between the Mobile Node and a Peer Node. The Mobile Router is additionally provided with a “certificate” authenticating the second symmetric key using the first symmetric key. In this way, the mobile router can sign location update related messages sent to the Peer Node with the second symmetric key, and can provide the Peer Node with the certificate in order to allow the Peer Node to authenticate the right of the Mobile Router to act on behalf of the Mobile Node.

Abstract: A method of determining routing of a data packet to network nodes providing services in a communications network, a method of routing a data packet to network nodes providing services in a communications network, a device for determining routing of a data packet to network nodes providing services in a communications network, and a device for routing a data packet to network nodes providing services in a communications network.

Abstract: The present disclosure relates to a method performed in a node 2 comprised in a communication network 1. The method comprises obtaining a set of coordinates of a coordinate system used by the communication network, which set of coordinates specifies a geographical position held by the node. The method also comprises obtaining a first identifier for the node. The identifier comprises at least a part of the obtained set of coordinates such that the identifier can specify to the communication network a first geographical area in which the node is positioned. The method also comprises uploading data to a server 3 comprised in the communication network, said data being associated with the obtained identifier when uploaded to the server. The first identifier can thus specify to the network, such as other nodes in the communication network, a geographical area in which the node is positioned/located. The geographical area may be of any size, but includes the place where the node is positioned.

Abstract: There is described a system for authenticating a client device in a network having a plurality of IDM components. One or more of the IDM components subscribes (using the publish-subscribe message pattern) to authentication requests published by client devices. The client device publishes an authentication request into the network. The most appropriate IDM component to process the published authentication request is selected, and the authentication request forwarded to the selected IDM component. The selected IDM component is then operated to negotiate with and authenticate the client device.

Abstract: A method in a coordinator in a radio communication network. The method comprises obtaining a token identifying a radio device. The method also comprises obtaining information confirming that the radio device is authorized to connect to the coordinator. The method also comprises calculating a device filter comprising a plurality of tokens, wherein the plurality of tokens include the obtained token of the radio device and identifies a plurality of devices authorized to connect to the coordinator. The method also comprises sending a broadcast radio signal comprising the device filter. The method also comprises allowing the radio device to connect to the coordinator. The present disclosure also relates to a coordinator, as well as to a radio device and a method of a radio device.

Abstract: A method of making data, published on a first publication/subscribe (pubsub) network, available to hosts within a second publication/subscribe network where the networks are interconnected via the Internet. The method comprises registering a publication identity of said data within a rendezvous system located within the Internet, forwarding Subscribe requests associated with said publication identity from said second network to said rendezvous system and, at the rendezvous system, identifying a location of said data within said first network. The Subscribe request can then be forwarded to said first network, and said data delivered from said first network to said second network via the Internet.

Abstract: A first packet is received from a client over an internal network destined for a remote node of an external network. The first packet includes a source IP address having an internal network portion that identifies a location of the client in the internal network and an external network portion that identifies a location of the internal network accessible by the external network. An obfuscation operation is performed on the internal network portion of the source IP address of the first packet to conceal the location of the client in the internal network and the internal network portion of the source IP address of the first packet is rewritten with the obfuscated internal network portion while maintaining the current external network portion of the source IP address. Thereafter, the first packet is transmitted to the remote node over the external network.

Abstract: A method of configuring a plurality of rendezvous servers to provide a Host Identity Protocol, HIP, based mobility service to HIP nodes, where the servers are arranged in a hierarchical branching structure. For each HIP node, a Host Identity Tag, HIT,-and contact address mapping is registered with a rendezvous server (101). That server then identifies itself and the HIT to each higher level server within the same branch, without explicitly identifying the contact address to those higher level servers (103) wherein, in use, when a first rendezvous server receives a HIP contact message addressed to a given HIT (201), if that first server is unaware of the destination HIT, it forwards the message to a higher level server within the same branch (204), and if the first server is not the server at which the HIT is registered but is aware of the HIT, it forwards the contact message to the neighbouring rendezvous server corresponding to the HIT (203).

Abstract: A method of configuring a plurality of rendezvous servers to provide a Host Identity Protocol, HIP, based mobility service to HIP nodes, where the servers are arranged in a hierarchical branching structure. For each HIP node, a Host Identity Tag, HIT, and contact address mapping is registered with a rendezvous server. That server then identifies itself and the HIT to each higher level server within the same branch, without explicitly identifying the contact address to those higher level servers wherein, in use, when a first rendezvous server receives a HIP contact message addressed to a given HIT, if that first server is unaware of the destination HIT, it forwards the message to a higher level server within the same branch and if the first server is not the server at which the HIT is registered but is aware of the HIT, it forwards the contact message to the neighbouring rendezvous server corresponding to the HIT.

Abstract: A method of handling IP packets transmitted from a correspondent node to a mobile node via an intermediate node using the IPsec security protocol. The method comprises, at the correspondent node, identifying specified selector information within the part of the packet to be encrypted, and incorporating the identified information or a digest thereof into a header part of the packet which is to be sent unencrypted, transmitting the packet from the correspondent node to said intermediate node, and, at the intermediate node, receiving the transmitted packet and identifying a policy to be applied to the packet using said information or digest contained in the packet, and applying the policy to the packet.

Abstract: A method of providing packet routing information comprises: encoding routing information from a source node to one or more destination nodes into a compact representation of set membership; and putting the compact representation of sets into a header of a packet that is to be sent from the source node to the destination node(s). The compact representation may be obtained by: generating d representations of a set of identifiers; generating d candidate compact representations of set membership from the d representations of the identifiers; and selecting one of the candidate compact representation of set membership. The selection may be made on the basis of which of the candidate compact representations has the lowest rate of returning false positives.

Abstract: A method and apparatus of at least partially securing communications between first and second hosts using the Host Identity Protocol (HIP) is provided. The first host is not HIP enabled and the second host is HIP enabled. A persistent HIP identity is associated with the first host and maintained at a remote server. A public part of the persistent HIP identity is obtained from the remote server together with a certificate authorizing a gateway node between the first and second hosts to use a temporary HIP identity associated with the first host. A secure HIP identity is negotiated between the gateway node and the second host using at least part of each of the persistent HIP identity, the temporary HIP identity, and the certificate.