Abstract: There is provided mechanisms for generating a security configuration profile for a network entity. A method is performed by a security configuration entity. The method comprises generating the security configuration profile for the network entity based on network entity information, deployment information, and feedback information for a previously generated security configuration profile. The method comprises determining, based on calculating a risk score for the generated security configuration profile, whether the security configuration profile is to be provided towards the network entity or not. The method comprises generating feedback information for the security configuration profile based on the risk score, the network entity information, and the deployment information.

Abstract: According to some embodiments, a security management entity is provided. The security management entity includes processing circuitry configured to: generate a key having a plurality of key parts, anonymize at least a first data instance at least in part by using the key with threshold cryptography, transmit a respective key part to each one of the plurality of trusted entities, store at least one key part where the stored at least one key part is different from the transmitted respective key parts, receive a message from a first trusted entity of the plurality of trusted entities for investigating the anonymized first data instance where the message includes one of the transmitted respective key parts, and deanonymize the first data instance using the stored at least one key part and the one of the transmitted respective key parts associated with the first trusted entity.

Abstract: A Security automation system (100; 400; 500) configured for security management of an Information Technology (IT) system (200), the security automation system using machine learning (ML). The system comprises a Threat engine (110), a Risk engine (120), a Policy engine (130) and a Security Adaptation engine (140). The Threat engine (110) comprises a threat catalog and detection rules for identifying threat events, wherein the detection rules are automatically adjusted and modified based on information collected from the managed IT system.

Abstract: A security management system including a first TEE and a common TEE is provided. The first TEE is a secured environment for data associated with a first entity. The common TEE is a seemed environment for data associated with any one of a plurality of entities. First anonymization parameters are shared between the first TEE and the common TEE The first anonymization parameters arc based at least in part on at least one privacy requirement of the first entity and at least one utility requirement of the security management system. The security management system includes processing circuitry configured to: anonymize first data associated with the first entity based at least in part on the first anonymization parameters, analyze at least the anonymized first data for performing data investigation, and generate analysis results based at least in part on the analysis of at least the anonymized first data.

Abstract: An apparatus and method for creating a finite blockchain is provided. The blockchain comprises a genesis block that is the first block of the blockchain. The genesis block comprising a genesis expiry time. The method comprises the steps of creating a reincarnation block when a predefined condition is satisfied and appending it to the blockchain; determining whether the genesis expiry time has elapsed based on an expiry period; if the genesis expiry time has elapsed then identifying a first reincarnation block; if the first reincarnation block is identified then deleting all the blocks preceding the first reincarnation block including the genesis block in the block chain.

Abstract: A method of verifying the integrity of a virtual machine in a cloud computing deployment comprises: creating a virtual machine image derived from a trusted virtual machine, wherein the trusted virtual machine has a Keyless Signature Infrastructure signature stored in a signature store; and verifying that a computation resource can be trusted. If it is verified that a computation resource can be trusted, the method further comprises: submitting the virtual machine image to the trusted computation resource; checking a signature of the virtual machine image against the stored signature of the trusted virtual machine; launching the virtual machine image on the trusted computation resource, and creating a Keyless Signature Infrastructure signature of the virtual machine image; and storing the signature of the virtual machine image in a signature store.

Abstract: An apparatus and method for creating a finite blockchain is provided. The blockchain comprises a genesis block that is the first block of the blockchain. The genesis block comprising a genesis expiry time. The method comprises the steps of creating a reincarnation block when a predefined condition is satisfied and appending it to the blockchain; determining whether the genesis expiry time has elapsed based on an expiry period; if the genesis expiry time has elapsed then identifying a first reincarnation block; if the first reincarnation block is identified then deleting all the blocks preceding the first reincarnation block including the genesis block in the block chain.

Abstract: The disclosure relates to a method (30) of handling a hash-tree based data signature. The method (30) is performed in a first device (13, 13a) and comprises: receiving (31), from a second device (12, 12a, 12b), a data signature generation request, the request comprising an indication on type of storage of a generated data signature; generating (32), in response to the data signature generation request, the data signature B using a hash-tree based data signing method; and providing (33), to the second device (12, 12a, 12b), a reference C to the generated data signature, wherein the generated data signature is obtainable by means of the reference C. The disclosure also relates to a method in a second device, corresponding devices, computer programs and computer program products.

Abstract: There is provided mechanisms for handling transfer of a data object between network domains. A method is performed by a first data controller of a first network domain. The method comprises obtaining a request for transmission of the data object to a second data controller of a second network domain. The method comprises obtaining an identifier identifying allowable transfer of the data object between the first network domain and the second network domain. The method comprises providing a cryptographic integrity signature to the data object. The method comprises enabling transfer of the data object to the second network domain according to the identifier.

Abstract: A method of verifying the integrity of a virtual machine in a cloud computing deployment comprises: creating a virtual machine image derived from a trusted virtual machine, wherein the trusted virtual machine has a Keyless Signature Infrastructure signature stored in a signature store; and verifying that a computation resource can be trusted. If it is verified that a computation resource can be trusted, the method further comprises: submitting the virtual machine image to the trusted computation resource; checking a signature of the virtual machine image against the stored signature of the trusted virtual machine; launching the virtual machine image on the trusted computation resource, and creating a Keyless Signature Infrastructure signature of the virtual machine image; and storing the signature of the virtual machine image in a signature store.

Abstract: The invention improves control of wear and tear of the elevators in an elevator group having a plurality of elevators and at least one group control unit. The actual usage of each elevator is recorded, and the group control unit executes at least one allocation algorithm for selecting which elevator of the elevator group is used to serve a call. The allocation algorithm compares the actual usage of at least two elevators against respective target usages and selects the elevator having its actual usage most deviating from the target usage to serve an outstanding call. With the invention, the wear and tear of elevators may be balanced, or certain elevators may be set to reach the end of the maintenance period sooner.

Abstract: The disclosure relates to a method (30) of handling a hash-tree based data signature. The method (30) is performed in a first device (13, 13a) and comprises: receiving (31), from a second device (12, 12a, 12b), a data signature generation request, the request comprising an indication on type of storage of a generated data signature; generating (32), in response to the data signature generation request, the data signature B using a hash-tree based data signing method; and providing (33), to the second device (12, 12a, 12b), a reference C to the generated data signature, wherein the generated data signature is obtainable by means of the reference C. The disclosure also relates to a method in a second device, corresponding devices, computer programs and computer program products.

Abstract: The invention is aimed to improve control of wear and tear of the elevators in an elevator group comprising a plurality of elevators and at least one group control unit. The actual usage of each elevator is recorded, and the group control unit executes at least one allocation algorithm for selecting which elevator of the elevator group is used to serve a call. The allocation algorithm is configured to compare the actual usage of at least two elevators against respective target usages and to select the elevator having its actual usage most deviating from the target usage to serve an outstanding call. With the invention, the wear and tear of elevators may be balanced, or certain elevators may be set to reach the end of the maintenance period sooner.

Abstract: A method and a wireless transmit/receive unit (WTRU) (600), including a universal subscriber identity module USIM (625), for identifying a closed subscriber group (CSG) cell are disclosed. The WTRU (600) receives a broadcast from a cell including a cell identifier (ID). If the cell ID is associated with a CSG cell, the WTRU (600) determines whether the CSG ID is programmed in the USIM (625). The cell broadcast may include a single bit information element (IE) indicating that the cell is a CSG cell. If the cell ID is a CSG ID, the cell ID may further include a plurality of fields which indicate at least one of a country, a region, an operator, and a home evolved Node-B (HeNB) number. The cell broadcast may further include a bit indicating whether the CSG cell is public or private. The cell broadcast may further include a bit indicating that emergency calls are allowed from all users.

Abstract: This invention relates to a group of novel chelating agents, novel chelates, biomolecules labeled with said chelates or chelating agents as well as solid supports conjugated with said chelates, chelating agents or labeled biomolecules. Especially the invention relates to novel chelating agents useful in solid phase synthesis of oligonucleotides or oligopeptides and the oligonucleotides and oligopeptides so obtained.

Abstract: An elevator system includes at least one shuttle elevator and at least two local elevators, the elevator cars of which are arranged to travel in the same elevator hoistway such that they can serve at least one shared transfer floor of a transfer level. The control system of the elevator system receives destination calls given from a destination call appliance, forms a plurality of route alternatives and allocates a destination call to one or more elevators by selecting the best route alternative. When allocating a destination call, the control system takes into account that the elevator cars of the local elevators that travel in the same elevator hoistway cannot simultaneously be at a shared transfer floor in cases in which the route alternative includes a part-trip with a local elevator and a change of elevator at a shared transfer floor.

Abstract: The present invention relates to a system and a method for charging in a communication network and to a communication network charging server. The system comprises a client (1) associated with the network for providing services to subscribers associated with the network. The charging server (2) is adapted to handle subscriber account information, and the said client (1) is adapted to send a first charging request message for a service, to the charging server (2) before the service is provided, using an on-line charging protocol (3). The charging server (2) is also adapted to perform pre-reservation of an amount of resources from the subscriber's account, wherein the amount depends on a requested amount included in the message about the service, and to return an answer message including information indicating whether an amount of resources is pre-reserved from said subscriber account for enabling usage of the service to the client (1) using the on-line charging protocol (3).

Abstract: This invention relates to a group of novel chelating agents, novel chelates, biomolecules labeled with said chelates or chelating agents as well as solid supports conjugated with said chelates, chelating agents or labeled biomolecules. Especially the invention relates to novel chelating agents useful in solid phase synthesis of oligonucleotides or oligopeptides and the oligonucleotides and oligopeptides so obtained.

Abstract: A method and a wireless transmit/receive unit (WTRU) (600), including a universal subscriber identity module for identifying a closed subscriber group (CSG) cell are disclosed. The WTRU (600) receives a broadcast from a cell including a cell identifier (ID). If the cell ID is associated with a CSG cell, the WTRU (600) determines whether the CSG ID is programmed in the USIM (625). The cell broadcast may include a single bit information element (IE) indicating that the cell is a CSG cell. If the cell ID is a CSG ID, the cell ID may further include a plurality of fields which indicate at least one of a country, a region, an operator, and a home evolved Node-B (HeNB) number. The cell broadcast may further include a bit indicating whether the CSG cell is public or private. The cell broadcast may further include a bit indicating that emergency calls are allowed from all users.

Abstract: The invention relates to elevator systems, in which a number of elevators operate in the same hoistway. The elevator system comprises at least one shuttle elevator and at least two local elevators, the elevator-cars of which are arranged to travel in the same elevator hoistway such that they can serve at least one shared transfer floor of a transfer level. The control system of the elevator system receives destination calls given from a destination call appliance, forms a plurality of route alternatives and allocates a destination call to one or more elevators by selecting the best route alternative. When allocating a destination call, the control system takes into account that the elevator cars of the local elevators that travel in the same elevator hoistway cannot simultaneously be at a shared transfer floor in cases in which the route alternative comprises a part-trip with a local elevator and a change of elevator at a shared transfer floor.