Abstract: A computer-implemented method, performed by a first node (111). The method is for handling encrypted traffic in a communications system (100). The first node (111) receives (304), from a second node (112) one or more keys to enable decryption by a third node (113) of traffic. The traffic is routed between two or more endpoints (130, 120) and is encrypted between the endpoints (130, 120) The first node (111) also receives (304) the one or more indications. The one or more indications indicate a respective protocol to be used with the one or more keys to enable decryption of the traffic. The first node (111) also initiates (305) sending the one or more keys and the one or more indications to the third node (113), thereby enabling decryption of the traffic. The first node (111) and the third node (113) are different from any of the two or more endpoints (130, 120).

Abstract: The embodiments herein relate to a method performed by a UPF (303) for handling pre-configured profiles for sets of detection and enforcement rules. The UPF (303) comprises one or more pre-configured profiles applicable to any user session. Each pre-configured profile comprises a set of detection and enforcement rules. Each pre-configured profile comprises a profile ID and the set of detection or enforcement rules. The UPF (303) receives, from a CPF (301) a first request for session establishment comprising at least one indication for profile activation. The at least one indication profile activation comprises the profile ID of the pre-configured profile to be activated. The UPF (303) establishes the session indicated in the first request. For the established session, the UPF (303) activates the at least one pre-configured profile identified by the profile ID by instantiating the set of detection and enforcement rules for the pre-configured profile.

Abstract: Various embodiments of the present disclosure provide a method for traffic detection. The method which may be performed by a first network node includes receiving a message from a second network node. The method further includes determining packet flow description information for traffic detection according to the message. The packet flow description information may indicate a combination criterion for two or more packet flow descriptions, and/or a protocol matching criterion for a domain name in a packet flow description. According to the embodiments of the present disclosure, the packet flow description definition can be extended to support more accurate traffic detection.

Abstract: Periodic requests for to Packet Flow Description, PFD, data updates on all Application Ids generate a constant background load in several network function nodes, even if applications have not been updated. There is provided a mechanism to optimize PFD management updates in a telecommunication network, whereby PFD data for a selected number of applications are stored and updated permanently, whilst PFD data for other applications are only temporarily stored so that storage and updates are released when these other applications are not in use. A list of permanent Application Ids is configured for the most frequently used applications. When a control rule specifies an Application Id not included in the list of permanent Application Ids, the specified Application Id is included in a list of temporary Application Ids, which are periodically checked and, when not used, are removed from the list of temporary Application Ids.

Abstract: Various embodiments of the present disclosure provide a method for traffic detection. The method which may be performed by a first network node includes receiving a message from a second network node. The method further includes determining packet flow description information for traffic detection according to the message. The packet flow description information may indicate a combination criterion for two or more packet flow descriptions, and/or a protocol matching criterion for a domain name in a packet flow description. According to the embodiments of the present disclosure, the packet flow description definition can be extended to support more accurate traffic detection.

Abstract: The embodiments herein relate to optimized procedure for Packet Flow Description (PFD) management. In one embodiment, there proposes a method (800) for managing Packet Flow Description (PFD), comprising: receiving (S801) from a Session Management Function (SFM) (201) or a User Plane Function (UPF) (302) a demand message indicating the demand for at least one PFD mle for an application; detecting (S802) the at least one PFD mle for the application; and notifying (S803) information regarding the at least one PFD rule to the SMF (201) or the UPF (302). The embodiments herein may achieve an optimized procedure for PFD Management which optimizes the delivery of PFD rules, by reducing the amount of signaling and by reducing the number of hops between the producer (AF) and the consumer (UPF).

Abstract: A method, an operator network (101) and nodes (120, 140, 160) for managing trafficare disclosed. The network exposure node (160) receives (A010) a Packet Flow Description (PFD) rule for a server application (190). The PFD rule comprises one or more protocol parameters for classification of traffic using a protocol related to said one or more protocol parameters. The one or more protocol parameters comprise for example an indication relating to common names (CNS), an indication relating to a domain name system (DNS) domain name, a server name indication (SNI), an indication relating to fraud prevention, an indication relating to a server IP address. The network exposure node (160)transmits (A020) the PFD rule to the session node (140), which transmits (A040), towards the user data node (120), a management request comprising the PFD rule. The user data node (120) receives (A080), from the client application (115), traffic destined to the server application (190).

Abstract: The embodiments herein relate to a method performed by a UPF (303) for handling pre-configured profiles for sets of detection and enforcement rules. The UPF (303) comprises one or more pre-configured profiles applicable to any user session. Each pre-configured profile comprises a set of detection and enforcement rules. Each pre-configured profile comprises a profile ID and the set of detection or enforcement rules. The UPF (303) receives, from a CPF (301) a first request for session establishment comprising at least one indication for profile activation. The at least one indication profile activation comprises the profile ID of the pre-configured profile to be activated. The UPF (303) establishes the session indicated in the first request. For the established session, the UPF (303) activates the at least one pre-configured profile identified by the profile ID by instantiating the set of detection and enforcement rules for the pre-configured profile.

Abstract: Various embodiments of the present disclosure provide a method for traffic detection. The method which may be performed by a first network node includes receiving a message from a second network node. The method further includes determining packet flow description information for traffic detection according to the message. The packet flow description information may indicate a combination criterion for two or more packet flow descriptions, and/or a protocol matching criterion for a domain name in a packet flow description. According to the embodiments of the present disclosure, the packet flow description definition can be extended to support more accurate traffic detection.

Abstract: Periodic requests for to Packet Flow Description, PFD, data updates on all Application Ids generate a constant background load in several network function nodes, even if applications have not been updated. There is provided a mechanism to optimize PFD management updates in a telecommunication network, whereby PFD data for a selected number of applications are stored and updated permanently, whilst PFD data for other applications are only temporarily stored so that storage and updates are released when these other applications are not in use. A list of permanent Application Ids is configured for the most frequently used applications. When a control rule specifies an Application Id not included in the list of permanent Application Ids, the specified Application Id is included in a list of temporary Application Ids, which are periodically checked and, when not used, are removed from the list of temporary Application Ids.

Abstract: A method and a managing node for managing exchange of information relating to Packet Flow Descriptors, PFDs, between an application server and a network exposure node are disclosed. The managing node receives a message comprising a PFD with a PFD identifier, an external application identifier associated with the PFD, a server identifier of the application server, a transaction identifier, and a network exposure identifier identifying an operator network. The managing node stores received information. The managing node selects, based on the network exposure identifier, a network exposure node. When a PFD selection identifier is included in the message, the managing node selects, based on the PFD selection identifier, a further PFD amongst the set of stored PFDs. The managing node also determines an action for the further PFD. The managing node further transmits, towards the network exposure node, the PFD and an indication of the action.

Abstract: A method, an operator network (101) and nodes (120, 140, 160) for managing trafficare disclosed. The network exposure node (160) receives (A010) a Packet Flow Description (PFD) rule for a server application (190). The PFD rule comprises one or more protocol parameters for classification of traffic using a protocol related to said one or more protocol parameters. The one or more protocol parameters comprise for example an indication relating to common names (CNS), an indication relating to a domain name system (DNS) domain name, a server name indication (SNI), an indication relating to fraud prevention, an indication relating to a server IP address. The network exposure node (160)transmits (A020) the PFD rule to the session node (140), which transmits (A040), towards the user data node (120), a management request comprising the PFD rule. The user data node (120) receives (A080), from the client application (115), traffic destined to the server application (190).

Abstract: A method and a managing node for managing exchange of information relating to Packet Flow Descriptors, PFDs, between an application server and a network exposure node are disclosed. The managing node receives a message comprising a PFD with a PFD identifier, an external application identifier associated with the PFD, a server identifier of the application server, a transaction identifier, and a network exposure identifier identifying an operator network. The managing node stores received information. The managing node selects, based on the network exposure identifier, a network exposure node. When a PFD selection identifier is included in the message, the managing node selects, based on the PFD selection identifier, a further PFD amongst the set of stored PFDs. The managing node also determines an action for the further PFD. The managing node further transmits, towards the network exposure node, the PFD and an indication of the action.

Abstract: Network signalling apparatus and methods use at least an SCCP protocol layer of Signalling System number 7 (SS7) and other protocol layers. The SCCP protocol layer supports connectionless and connection-oriented protocol services, and network management procedures are carried out on a per protocol service basis, that is, network management procedures at SCCP are independently treated for connectionless and for connection-oriented protocol services.

Abstract: Network signalling apparatus and methods use at least an SCCP protocol layer of Signalling System number 7 (SS7) and other protocol layers. The SCCP protocol layer supports connectionless and connection-oriented protocol services, and network management procedures are carried out on a per protocol service basis, that is, network management procedures at SCCP are independently treated for connectionless and for connection-oriented protocol services.