Abstract: A method by a first device for providing Internet Protocol Security (IPsec) communication with a second device in a network. In response to a request for updating a first old Security Association (SA) from the second device, the method generates a first new SA, and sends, to the second device, an acknowledgement that the first new SA is available at the first device. The method uses the first old SA to encapsulate traffic data sent to the second device until receiving, from the second device, traffic data encapsulated with a second new SA generated at the second device. The method retains the first old SA to have a capability of handling traffic data encapsulated with a second old SA received from the second device until a preset condition is satisfied.

Abstract: Embodiments of the present disclosure provide methods and apparatuses for detecting and reordering disorder packets. A method performed by a first network node comprises receiving a first packet comprising a header of a first frame from a second network node. A header of the first packet comprises a first timestamp and the first frame comprises one or more second frames. The method further comprises determining respective predicted times of the one or more second frames based on the first timestamp and a time length of a second frame. The respective predicted times of the one or more second frames are used to sort the one or more second frames and/or determine a disorder alarm.

Abstract: Embodiments include methods for a first node to manage rekeying of a security association (SA) between the first node and a second node in a communication network. Such methods include sending to the second node a request indicating a rekey priority of the first node, and receiving from the second node a response indicating a rekey priority of the second node. Such methods also include selectively initiating rekeying of the SA between the first node and the second node based on the request and the response. Other embodiments include complementary methods for the second node, as well as nodes (e.g., hosts, gateways, UEs, base stations, servers, etc.) configured to perform such methods.

Abstract: The present disclosure provides a method (200) performed by a first communication device. The method (200) includes: receiving (210), from a second communication device, an Encapsulating Security Payload, ESP, packet that is an initial fragment; calculating (220), from the ESP packet, a Maximum Transmission Unit, MTU, in a path from the second communication device to the first communication device; and notifying (230) the second communication device of the calculated MTU.

Abstract: The present disclosure provides a method performed by a first communication device. The method includes: transmitting, to a second communication device, a first Internet Key Exchange, IKE, Authentication, IKE_AUTH, request; receiving, from the second communication device, a second IKE_AUTH request; transmitting, to the second communication device in response to the second IKE_AUTH request, a second IKE_AUTH response; and receiving, from the second communication device, a first IKE_AUTH response as a response to the first IKE_AUTH response. The first IKE_AUTH request and/or the second IKE_AUTH response contains a notification indicating a first policy supported by the first communication device for identifying duplicated IKE Security Associations, SAs, and the second IKE_AUTH request and/or the first IKE_AUTH response contains a notification indicating a second policy supported by the second communication device for identifying duplicated IKE SAs.

Abstract: The present disclosure provides a method (100) performed by a communication device. The method (100) includes: establishing (110) a first Internet Protocol Security, IPsec, tunnel with a first peer communication device and a second IPsec tunnel with a second peer communication device, the first IPsec tunnel being configured with a first Traffic Selector, TS, that specifies a source address range and a destination address range and has a first priority, and the second IPsec tunnel being configured with a second TS that specifies the source address range and the destination address range and has a second priority lower than the first priority; detecting (120) a failure of the first IPsec tunnel; and removing (130) the first TS for the first IPsec tunnel in response to the failure.

Abstract: The present disclosure provides a method (200) performed by a first communication device. The method (200) includes: receiving (210) a request from a second communication device, the request containing a first pair of Traffic Selectors, TSs; and transmitting (220) a response to the second communication device. When the first pair of TSs and a second pair of TSs existing at the first communication device at least partially overlap, the response contains a notification of a conflict between the first pair of TSs and the second pair of TSs.

Abstract: Methods and devices for encrypting Network Configuration Protocol (NETCONF) datastore in communication networks are disclosed. One of the methods is performed by a device using NETCONF. The method comprises enabling a function for NETCONF Datastore Security (DS-SEC). The method further comprises publishing a first indication indicating that the device supports the NETCONF DS-SEC function.

Abstract: Methods and devices for encrypting network time protocol keys in communication networks are disclosed. A method comprises obtaining an original NTP key, obtaining a local encryption key for encrypting the original NTP key, encrypting the original NTP key using the obtained local encryption key and saving the encrypted NTP key.

Abstract: A method for switching clock sources is provided. In the method, Precision Time Protocol, PTP, packets are monitored using each of PTP ports which connect to a new grandmaster (401). A frequency and a phase for the PTP port are calculated based on the PTP packets (402). In response to a successful check for the frequency and the phase, the PTP port is added to a candidate list (403). A phase calibration and a phase stability check may be introduced prior to the alternate BMCA.

Abstract: Methods and apparatuses for security communication. A method performed by a first communication device includes determining whether a length of an Internet protocol, IP, datagram is larger than a threshold. The method further includes, when the length of the IP datagram is larger than the threshold, fragmenting the IP datagram into two or more IP packets. The length of each of two or more IP packets is not larger than the threshold and each of the two or more IP packets is filled with fragmentation information. The method further includes processing the two or more IP packets to generate two or more corresponding IP security, IPsec, packets. The method further includes sending the two or more corresponding IPsec packets to a second communication device.

Abstract: A method for switching clock sources is provided. In the method, Precision Time Protocol, PTP, packets are monitored using each of PTP ports which connect to a new grandmaster (401). A frequency and a phase for the PTP port are calculated based on the PTP packets (402). In response to a successful check for the frequency and the phase, the PTP port is added to a candidate list (403). A phase calibration and a phase stability check may be introduced prior to the alternate BMCA.