Abstract: Methods (700,800,900), devices (12,20,30,40), and systems (500,540,560,570,600) for managing a federated network slice (602) providing an extension of one or more virtual network functions (620) from a first network domain (502,608) to a second network domain (504,610). One method (700), by a second orchestration manager (20,512) of the second network domain (504,610), includes accessing (702) a first virtual network function management component (514,562) for extension of the one or more virtual network functions (620) from the first network domain (502,608) to the second network domain (504,610). The method (700) further includes initiating registration (704) of the first virtual network function management component (514,562) with a look-up service (518) to generate a first association between a first name of the first virtual network function management component and a first location of the first virtual network function management component in the second network domain (504,610).

Abstract: Methods (700,800,900), devices (12,20,30,40), and systems (500,540,560,570,600) for managing a federated network slice (602) providing an extension of one or more virtual network functions (620) from a first network domain (502,608) to a second network domain (504,610). One method (700), by a second orchestration manager (20,512) of the second network domain (504,610), includes accessing (702) a first virtual network function management component (514,562) for extension of the one or more virtual network functions (620) from the first network domain (502,608) to the second network domain (504,610). The method (700) further includes initiating registration (704) of the first virtual network function management component (514,562) with a look-up service (518) to generate a first association between a first name of the first virtual network function management component and a first location of the first virtual network function management component in the second network domain (504,610).

Abstract: A method implemented in a user equipment (UE) includes connecting to a WLAN access point. The method further includes constructing a domain name for a packet system network, the domain name including network partition information for the packet system network. The method further includes transmitting, to a DNS server via the WLAN access point, the constructed domain name. The method further includes receiving, from the server, at least one address corresponding to a network node associated with the network partition information.

Abstract: A core network node identifies a non-USIM based authentication procedure to be utilized by a wireless communication device, WCD, being served by the core network node. The node obtains a session key associated with the identified non-USIM based authentication procedure. The node converts the session key associated with the identified non-USIM based authentication procedure to i) a first key, K1, for use by the WCD and a base station serving the WCD to derive an encryption or integrity protection key, Kenc/int, for enabling encryption or integrity protection of a communication between the WCD and the base station or ii) a second key, K2, for use by the WCD and the core network node to derive the first key K1. The node then send i) K1 to the base station or ii) K2 to another core network node that is configured to derive K1 from K2.

Abstract: A method implemented in a control node includes receiving a message from a first node. The method further includes determining whether the received message corresponds to one or more network partitions based at least in part on the partition selection information. The method further includes selecting, in response to determining that the message corresponds to the one or more network partitions, a particular network partition from the one or more network partitions using the partition selection information, and routing the message to a second node associated with the selected particular network partition.

Abstract: This disclosure relates to a method, and an arrangement and a computer program for updating a prioritization level of a service data flow between a user node and a network node. The method comprises obtaining a traffic size per time unit of detected data packets of the service data flow, and updating the prioritization level of the service data flow, based on the obtained traffic size per time unit. It is an advantage that embodiments provide a possibility to determine a trade-off between the need to optimize response times for short-lived data sessions and limiting the impact on other users when prioritizing long-lived high volume sessions. It is advantageous that the embodiments are applicable to situations in which a direct classification, using IP 5-tuple or deep packet inspection is not meaningful.

Abstract: A method is performed in a network control entity that manages network connections for a network. The method includes receiving a network attachment request from a network access entity or a user equipment for connecting the user equipment to the network. The method further includes obtaining a network partition ID associated with the UE, the network partition ID identifying a network partition that includes a predetermined group of network entities included in the network. The method also includes transmitting, to a network storage entity, a notification containing the network partition ID.

Abstract: A method is described for associating a data packet (DP) with a packet bearer (PB) in a user equipment (UE1) of a communication network. The data packet is sent in a data flow from an application function of the user equipment, the packet bearer (PB) is established with the user equipment to transmit the data packet (DP) over the communication network towards a further entity, and the user equipment is adapted to establish different packet bearers.

Abstract: A method is performed in a network control entity that manages network connections for a network. The method includes receiving a network attachment request from a network access entity or a user equipment for connecting the user equipment to the network. The method further includes obtaining a network partition ID associated with the UE, the network partition ID identifying a network partition that includes a predetermined group of network entities included in the network. The method also includes transmitting, to a network storage entity, a notification containing the network partition ID.

Abstract: A method implemented in a user equipment (UE) includes connecting to a WLAN access point. The method further includes constructing a domain name for a packet system network, the domain name including network partition information for the packet system network. The method further includes transmitting, to a DNS server via the WLAN access point, the constructed domain name. The method further includes receiving, from the server, at least one address corresponding to a network node associated with the network partition information.

Abstract: A node in a first network domain and a method performed thereby for transmitting a data packet to a VPN client in a second network domain, the node and the VPN client being part of a VPN, wherein the first and second network domain are connected by means of a third network domain are provided. The method comprises receiving, from an application server, a first packet comprising a first IP header and a payload; and determining a DCSP. The method further comprises adding a second header comprising the determined DCSP and an IP address of a VPN client resulting in a second packet and encrypting the second packet. Further the method comprises adding a third header to the encrypted second packet resulting in a third packet, the third header comprising a destination address of a node in the second network domain, and transmitting the third packet in an IP tunnel terminating at the node in the second network domain.

Abstract: A method implemented in a control node includes receiving a message from a first node. The method further includes determining whether the received message corresponds to one or more network partitions based at least in part on the partition selection information. The method further includes selecting, in response to determining that the message corresponds to the one or more network partitions, a particular network partition from the one or more network partitions using the partition selection information, and routing the message to a second node associated with the selected particular network partition.

Abstract: A core network node identifies a non-USIM based authentication procedure to be utilized by a wireless communication device, WCD, being served by the core network node. The node obtains a session key associated with the identified non-USIM based authentication procedure. The node converts the session key associated with the identified non-USIM based authentication procedure to i) a first key, K1, for use by the WCD and a base station serving the WCD to derive an encryption or integrity protection key, Kenc/int, for enabling encryption or integrity protection of a communication between the WCD and the base station or ii) a second key, K2, for use by the WCD and the core network node to derive the first key K1. The node then send i) K1 to the base station or ii) K2 to another core network node that is configured to derive K1 from K2.

Abstract: For transmitting data between a node (100) of a mobile network and a further node (200), the further node sends downlink data packets to the node (100) of the mobile network. The downlink data packets carry a destination address corresponding to a user equipment (10) connected to the mobile network. For implementing an inband data channel between the node (100) of the mobile network and the further node (200), the further node (200) inserts data destined to the node (100) of the mobile network into at least one of the downlink data packets and marks this downlink data packet as including data destined to the node (100) of the mobile network. The node (100) of the mobile network receives the downlink data packets from the further node (200) and identities, on the basis of the marking, the least one downlink data packet including data destined to the node (100) of the mobile network. The node (100) of the mobile network then extracts the data from the identified downlink data packet.

Abstract: A method for transmitting data packets of a data traffic between a sending device (10, 80) and a receiving device (80, 10) via a VPN client (200) and a VPN server (500) over a network using a secure encapsulation of the data packets, the method comprising the steps of determining a Quality of Service, QoS, parameter for the data packets of said data traffic, selecting, for the data packets, either a first tunnel (91) connecting the VPN client (200) and the VPN server (500) or a second tunnel (92) connecting the VPN client (200) and the VPN server (500) based on determined Quality of Service.

Abstract: A method is described for associating a data packet (DP) with a packet bearer (PB) in a user equipment (UE1) of a communication network. The data packet is sent in a data flow from an application function of the user equipment, the packet bearer (PB) is established with the user equipment to transmit the data packet (DP) over the communication network towards a further entity, and the user equipment is adapted to establish different packet bearers.

Abstract: Systems and methods according to these exemplary embodiments provide for methods and systems for allowing a variety of devices desiring Internet Protocol (IP) addresses from potentially different locations to all operate on the same local area network. For example, a node, e.g., a gateway device, can receive a request for an IP address and determine whether that request was issued by a locally addressable device or a wide area network (WAN) addressable device. The node can then selectively locally provide an IP address or request an IP address, e.g., from a WAN, based on the determination.

Abstract: This disclosure relates to a method, and an arrangement and a computer program for updating a prioritization level of a service data flow between a user node and a network node. The method comprises obtaining a traffic size per time unit of detected data packets of the service data flow, and updating the prioritization level of the service data flow, based on the obtained traffic size per time unit. It is an advantage that embodiments provide a possibility to determine a trade-off between the need to optimize response times for short-lived data sessions and limiting the impact on other users when prioritizing long-lived high volume sessions. It is advantageous that the embodiments are applicable to situations in which a direct classification, using IP 5-tuple or deep packet inspection is not meaningful.

Abstract: Methods, a user node and an arrangement for adapting a quality of service of a network connection during a user application session. A whole network connection between a user node and a network node, for instance a VPN tunnel, is assigned to a single QoS level at any given time, after which this assignment may be modified dynamically based on detected data traffic belonging to certain applications. Furthermore, by correlating an identity as obtained from the detected data traffic with authentication information, the identity of the user for which an adaptation of the QoS shall be requested is obtained. The QoS of an encrypted or scrambled network connection during an application session is adapted for the identified user.

Abstract: The disclosure concerns a method for providing communication with a mobile station (12) via a first wireless access point (10) as well as the access point. The mobile station (12) has a first identifier for use in a first communication network (14) and the wireless access point comprises a first wireless interface for a first type of wireless communication with mobile stations in relation to the first communication network (14), a second wireless interface for a second type of wireless communication with mobile stations in relation to a second communication network (16), a mapping unit associating the first type of wireless communication for the mobile station with the second type of wireless communication for the mobile station based on the first identifier and a traffic control unit transporting traffic of wireless communication of the second type for the mobile station through the first communication network (14) based on the association.