Domain name service (DNS)-based NWDAF assisted application detection

Abstract

Embodiments include a method for a Network Data Analysis Function (NWDAF) configured to assist application detection in a communications network. Such a method includes receiving, from a consumer network function (cNF) of the communication network, an analysis request related to assisted application detection, and sending, based on the analysis request, an open request to an event related to a fully defined domain name (FQDN)-to-address mapping to a first DNS parser associated with the communication network, the FQDN-to-address mapping is used for an application server associated with an application. Such a method also includes receiving a first FQDN associated with the first application from the first DNS parser in accordance with the open request, and determining one or more packet flow descriptions (PFDs) associated with the first application based on the first FQDN. Such a method also includes transmitting an analysis result including the one or more PFDs to the cNF in accordance with the analysis request.

Description

Technical Field

[0001] The present application generally relates to the field of communication networks, and more specifically to techniques for detecting and / or classifying applications associated with encrypted user traffic in communication networks (e.g., 5G networks). Background Art

[0002] At a high level, the 5G system (5GS) consists of an access network (AN) and a core network (CN). The AN provides the UE with connectivity to the CN, for example via a base station such as a gNB or ng-eNB described below. The CN includes various network functions (NFs) that provide a wide range of different functions, such as session management, connection management, charging, authentication, etc.

[0003] Figure 1 A high-level view of an exemplary 5G network architecture is illustrated, which consists of a next-generation radio access network (NG-RAN) 199 and a 5G core (5GC) 198. The NG-RAN 199 may include one or more gNodeBs (gNBs) connected to the 5GC via one or more NG interfaces, such as gNBs 100, 150 connected via interfaces 102, 152, respectively. More specifically, the gNBs 100, 150 may be connected to one or more access and mobility management functions (AMFs) in the 5GC 198 via respective NG-C interfaces. Similarly, the gNBs 100, 150 may be connected to one or more user plane functions (UPFs) in the 5GC 198 via respective NG-U interfaces. Various other network functions (NFs) may be included in the 5GC 198, as described in more detail below.

[0004] In addition, the gNBs may be connected to each other via one or more Xn interfaces, such as Xn interface 140 between gNBs 100 and 150. The radio technology used for NG-RAN is generally referred to as "New Radio" (NR). With respect to the NR interface to the UE, each of the gNBs may support frequency division duplex (FDD), time division duplex (TDD), or a combination thereof. Each of the gNBs may serve a geographic coverage area comprising one or more cells, and in some cases may also provide coverage in individual cells using various directional beams.

[0005] NG-RAN 199 is layered into Radio Network Layer (RNL) and Transport Network Layer (TNL). The NG-RAN architecture, i.e., NG-RAN logical nodes and the interfaces between them, is defined as part of the RNL. For each NG-RAN interface (NG, Xn, F1), the relevant TNL protocols and functions are specified. TNL provides services for user plane transport and signaling transport.

[0006] Figure 1 The NG RAN logical nodes shown in FIG. 1 include a central unit (CU or gNB-CU) and one or more distributed units (DU or gNB-DU). For example, gNB 100 includes gNB-CU 110 and gNB-DUs 120 and 130. CU (e.g., gNB-CU 110) is a logical node that hosts higher layer protocols and performs various gNB functions (such as controlling the operation of DU). DU (e.g., gNB-DU 120, 130) is a decentralized logical node that hosts lower layer protocols and may include various subsets of gNB functions depending on the functional partitioning options.

[0007] gNB-CU through the corresponding F1 logical interface (such as Figure 1 The F1 interface is connected to one or more gNB-DUs (see interfaces 122 and 132 shown in FIG. 1 ). However, a gNB-DU can only be connected to a single gNB-CU. The gNB-CU and the connected gNB-DU(s) are visible only to other gNBs and the 5GC as a gNB. In other words, the F1 interface is not visible outside the gNB-CU.

[0008] Another change in 5G networks (e.g., 5GC) is that the traditional point-to-point interfaces and protocols found in previous generation networks are modified and / or replaced by a service-based architecture (SBA), in which a network function (NF) provides one or more services to one or more service consumers. This can be achieved, for example, through a hypertext transfer protocol / representational state transfer (HTTP / REST) ​​application programming interface (API). In general, various services are self-contained functions that can be changed and modified in an isolated manner without affecting other services.

[0009] Furthermore, services consist of various "service operations" which are finer-grained divisions of the overall service functionality. The interactions between service consumers and producers can be of "request / response" or "subscribe / notify" type. In 5G SBA, the Network Repository Function (NRF) allows each network function to discover services provided by other network functions, and the Data Storage Function (DSF) allows each network function to store its context. The 5G SBA model is based on principles including modularity, reusability, and self-containment of NFs, which enables network deployments to leverage recent virtualization and software technologies.

[0010] Two 5GC NFs of particular interest are the UPF and the Network Data Analysis Function (NWDAF). The UPF handles user plane (UP) services, including packet inspection, packet routing and forwarding, service usage reporting, QoS processing, etc. A packet flow description (PFD) is a collection of information that enables UPF detection of application services. Each PFD is identified by a unique PFD ID, which can be associated with a specific application. The NWDAF interacts with other NFs to collect relevant data and provide network analysis information (e.g., statistics and / or prediction information of past events) to other NFs.

[0011] Domain Name Service (DNS) is a fundamental Internet building block used when users visit websites, send emails, conduct IM sessions, or do almost anything else online. When a user opens an application, the DNS client retrieves the server IP address(es) for that application domain from the DNS resolver. Currently, most of today's DNS traffic is sent unencrypted over UDP / TCP, but there are different IETF drafts proposing DNS encryption to prevent intermediate reading of DNS traffic between endpoints. Various proposals include DNS over HTTP / 2 (DOH), DNS over TLS, DNSCrypt, etc. With these proposals, only the DNS resolver has insight into the DNS messages. Summary of the invention

[0012] End-to-end encryption is used for most user services carried by the 5G network, making it impossible for the UPF to identify the service type directly from the user service. In addition, the proposed DNS service encryption also prevents the UPF from identifying user services based on the PFD domain name used for the DNS protocol, or prevents the UPF from generating its own PFD based on the DNS service. This may lead to various problems, issues and / or difficulties for identifying and classifying application services, which are desirable and / or necessary for the proper operation of the 5G network.

[0013] Embodiments of the present disclosure address these and other problems, issues and / or difficulties, thereby facilitating proper operation of communication networks (e.g., 5G networks) even when DNS traffic is encrypted.

[0014] Some embodiments include example methods (e.g., processes) for a NWDAF configured to assist in application detection in a communication network (e.g., 5GC).

[0015] The example methods may include receiving, from a consumer network function (cNF) of a communication network, an analysis request related to the assisted application detection. The example methods may also include, based on the analysis request, sending, to a first DNS resolver associated with the communication network, an open request for events related to a mapping of a fully qualified domain name (FQDN) to an address for an application server associated with the application. The example methods may also include receiving, from the first DNS resolver, a first FQDN associated with the first application, based on the open request. The example methods may also include determining, based on the first FQDN, one or more PFDs associated with the first application, and sending, to the cNF, analysis results including the one or more PFDs, based on the analysis request.

[0016] In some embodiments, the cNF is a Network Open Function (NEF), or a unit or sub-function of a NEF (eg, PFDF).

[0017] In some embodiments, the analysis request includes one or more of the following parameters that define filters for the requested analysis: an area of ​​interest (AOI), single network slice selection assistance information (S-NSSAI), and a data network name (DNN). In some of these embodiments, these exemplary methods may also include sending a discovery request for a DNS resolver associated with the communication network to a network repository function (NRF) of the communication network. The discovery request includes one or more parameters that define filters for the requested analysis. In some variations, these exemplary methods may also include, in response to the discovery request, receiving an identifier of a first DNS resolver and a profile for the first DNS resolver from the NRF. In such a case, sending an open request to the first DNS resolver is based on at least one of the received identifier and profile.

[0018] In some embodiments, determining the one or more PFDs based on the first FQDN includes determining an application identifier corresponding to the first FQDN and selecting the one or more PFDs based on an association of the one or more PFDs with the application identifier. In some of these embodiments, determining the application identifier corresponding to the first FQDN includes sending the first FDQDN to a network open function (NEF) of a communication network and receiving a response from the NEF including the application identifier.

[0019] Other embodiments include methods (e.g., processes) for a DNS resolver configured to assist in application detection in a communication network (e.g., 5GC).

[0020] These example methods may include receiving, from a NWDAF of a communication network, an open request for an event related to a mapping of an FQDN to an address for an application server associated with an application. These example methods may also include subsequently mapping the first FQDN to an address for an application server associated with the first application (e.g., based on a DNS request from an application client). These example methods may also include sending the first FQDN to the NWDAF in accordance with the open request.

[0021] In some embodiments, these exemplary methods may further include sending a request to the NRF of the communication network to register the capabilities of the DNS resolver. The open request is received based on the registration of the capabilities. In some embodiments, the request to register the capabilities of the DNS resolver is an Nnrf_Registration Request message including the following information:

[0022] The DNS resolver identifier (DNS-ID);

[0023] DNS resolver support for opening indication of events related to FQDN-to-address mappings; and

[0024] Configuration information for a DNS resolver, including one or more of: Area of ​​Interest (AOI), Single Network Slice Selection Assistance Information (S-NSSAI), and Data Network Name (DNN).

[0025] Other embodiments include NWDAFs and DNS resolvers (or network nodes hosting NWDAFs and DNS resolvers) configured to perform operations corresponding to the exemplary methods described herein. Other embodiments also include non-transitory computer-readable media storing computer-executable instructions that, when executed by a processing circuit, configure such NWDAFs and DNS resolvers to perform operations corresponding to the exemplary methods described herein.

[0026] Other embodiments include a communication network (e.g., such as a 5GC) that includes a NWDAF and a network repository function (NRF). The NRF is configured to receive a request for registering capabilities of a first DNS resolver from a first DNS resolver associated with the communication network, and store the capabilities of the first DNS resolver in a profile for the first DNS resolver based on the request. The NRF is also configured to receive a discovery request for a DNS resolver associated with the communication network from the NWDAF. The discovery request includes one or more parameters that define an analysis filter. The NRF is also configured to determine that the stored capabilities of the first DNS resolver match one or more parameters included in the discovery request, and to send a discovery response including an identifier of the first DNS resolver and a profile for the first DNS resolver to the NWDAF.

[0027] In some embodiments, the communication network may further include a consumer network function (cNF) configured to send an analysis request related to the assisted application detection to the NWDAF, and receive an analysis result including one or more packet flow descriptions (PFDs) associated with the first application from the NWDAF according to the analysis request. For example, the discovery request received by the NRF is based on the analysis request sent by the cNF, and the analysis request includes one or more parameters defining the analysis filter.

[0028] In some embodiments, the communication network may further include a unified data repository (UDR). The cNF is further configured to send one or more PFDs associated with the first application to the UDR for storage, and the UDR is configured to store the received one or more PFDs as application data for the first application. In some embodiments, the communication network may further include a first DNS resolver.

[0029] These and other embodiments described herein may enable a communication network (e.g., a 5G network) to properly classify encrypted UE application traffic, including encrypted DNS traffic. Furthermore, embodiments may enable these operations without requiring an application service provider (ASP) to install and / or maintain associated PFDs in a NEF or similar network repository. Additionally, embodiments may enable an ASP to define a less complex PFD based on domain names rather than IP addresses, even when encrypted DNS is used.

[0030] These and other objects, features and advantages of the present disclosure will become apparent upon reading the following detailed description in view of the accompanying drawings which are briefly described below. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1-2 Various aspects of an exemplary 5G network architecture are illustrated.

[0032] Figure 3 (including Figures 3A-3C ) illustrates exemplary processes between various entities operating in a communication network according to various embodiments of the present disclosure.

[0033] Figure 4 An exemplary method (eg, process) for NWDAF of a communication network according to various embodiments of the present disclosure is shown.

[0034] Figure 5 Exemplary methods (eg, processes) for a DNS resolver associated with a communication network are shown according to various embodiments of the present disclosure.

[0035] Figure 6 Exemplary methods (eg, processes) for a consumer network function (cNF) of a communication network according to various embodiments of the present disclosure are shown.

[0036] Figure 7 Exemplary methods (eg, processes) for NRF of a communication network according to various embodiments of the present disclosure are shown.

[0037] Figure 8 Exemplary methods (eg, processes) for a UDR of a communication network according to various embodiments of the present disclosure are shown.

[0038] Fig. 9 A communication system according to various embodiments of the present disclosure is shown.

[0039] Fig.10 A UE according to various embodiments of the present disclosure is shown.

[0040] Fig.11 A network node according to various embodiments of the present disclosure is shown.

[0041] Fig.12 A host computing system is shown in accordance with various embodiments of the present disclosure.

[0042] Fig.13 is a block diagram of a virtualization environment in which functionality implemented by some embodiments of the present disclosure may be virtualized.

[0043] Fig.14 Communications between a host computing system, a network node, and a UE via multiple connections are illustrated according to various embodiments of the present disclosure. DETAILED DESCRIPTION

[0044] The embodiments briefly summarized above will now be described more fully with reference to the accompanying drawings. These descriptions are provided by way of example to explain the subject matter to those skilled in the art, and should not be construed as limiting the scope of the subject matter to only the embodiments described herein. More specifically, examples illustrating the operation of various embodiments according to the advantages discussed above are provided below.

[0045] Generally, all terms used in this article should be interpreted according to their common meaning in the relevant technical field, unless different meanings are clearly given and / or implied from the context in which the term is used. All references to one / the element, device, component, means, step, etc. should be openly interpreted as referring to at least one instance of the element, device, component, means, step, etc., unless otherwise clearly stated. The steps of any method and / or process disclosed herein do not have to be performed in the exact order disclosed, unless a step is clearly described as after or before another step and / or a step is implied to be after or before another step. As long as it is appropriate, any feature of any embodiment disclosed herein can be applied to any other embodiment. Similarly, any advantage of any embodiment can be applied to any other embodiment, and vice versa. According to the following description, other purposes, features and advantages of the disclosed embodiment will be obvious.

[0046] Furthermore, the following terms are used throughout the description given below:

[0047] Core network node: As used herein, a "core network node" is any type of node in a core network. Some examples of core network nodes include, for example, a mobility management entity (MME), a serving gateway (SGW), a packet data network gateway (P-GW), etc. A core network node may also be a node that implements a specific core network function (NF), such as an access and mobility management function (AMF), a session management function (AMF), a user plane function (UPF), a service capability exposure function (SCEF), etc.

[0048] Network node: As used herein, a "network node" is any node that is part of the core network of a telecommunications network (e.g., the core network node discussed above). Functionally, a network node is a device that is capable of, configured to, arranged to, and / or operable to communicate directly or indirectly with wireless or wired devices and / or other network nodes or devices in a telecommunications network, enable and / or provide wireless or wired access to telecommunications devices, and / or perform other functions (e.g., management) in a telecommunications network.

[0049] Node: As used herein, the term “node” (without any prefix) may be any type of node capable of operating in or with a telecommunications network (including the RAN and / or core network), including a radio access node (or equivalent terms), a core network node, or a telecommunications device.

[0050] • Service: As used herein, the term "service" generally refers to a collection of data associated with one or more applications that is to be transmitted over a network with certain specific delivery requirements that need to be met in order for the application to be successful.

[0051] Component: As used herein, the term "component" generally refers to any component required in order to deliver a service. Examples of components are RAN (e.g., E-UTRAN, NG-RAN, or parts thereof, such as eNB, gNB, base station (BS), etc.), CN (e.g., EPC, 5GC, or parts thereof, including all types of links between RAN and CN entities), and cloud infrastructure with associated resources (such as computing, storage). In general, each component may have a "manager", which is an entity (e.g., a RAN manager) that can collect historical information about resource utilization and provide information about the current availability and predicted future availability of resources associated with the component.

[0052] Note that the description given herein focuses on 3GPP telecommunication systems, and therefore, 3GPP terminology or terminology similar to 3GPP terminology is generally used. However, the concepts disclosed herein are not limited to 3GPP systems. Other wireless systems, including but not limited to Wideband Code Division Multiple Access (WCDMA), Worldwide Interoperability for Microwave Access (WiMax), Ultra Mobile Broadband (UMB), and Global System for Mobile Communications (GSM), may also benefit from the concepts, principles, and / or embodiments described herein.

[0053] Additionally, functions and / or operations described herein as being performed by a telecommunication device or a network node may be distributed across multiple telecommunication devices and / or network nodes.

[0054] Figure 2 An exemplary non-roaming reference architecture for a 5GC (200) with a service-based interface and various 3GPP-defined NFs within a control plane (CP) is shown, including the following NFs:

[0055] The Application Function (AF, with the Naf interface) interacts with the 5GC to supply information to the network operator and subscribe to certain events occurring in the operator's network. The AF provides control of flow resources to applications for which services are delivered in a layer different from the layer that has requested the service (i.e., the signaling layer), based on what has been negotiated with the network. The AF communicates dynamic session information to the PCF (via the N5 interface), including a description of the media to be delivered by the transport layer.

[0056] The Policy Control Function (PCF, with Npcf interface) supports a unified policy framework to manage network behavior by providing PCC rules (e.g., regarding the processing of each service data flow under PCC control) to the SMF via the N7 reference point. The PCF provides policy control decisions and flow-based charging control to the SMF, including service data flow detection, gating, QoS, and flow-based charging (except credit management). The PCF receives session and media-related information from the AF and notifies the AF of service (or user) plane events.

[0057] The User Plane Function (UPF) supports the processing of user plane services based on rules received from the SMF, including packet inspection and different implementation actions (such as event detection and reporting). The UPF communicates with the RAN (such as NG-RAN) via the N3 reference point, with the SMF (discussed below) via the N4 reference point, and with the external packet data network (PDN) via the N6 reference point. The N9 reference point is used for communication between two UPFs.

[0058] The Session Management Function (SMF, with Nsmf interface) interacts with the decoupled service (or user) plane, including creating, updating and removing protocol data unit (PDU) sessions, and managing session context with the User Plane Function (UPF), such as for event reporting. For example, the SMF performs data flow detection (based on filter definitions included in PCC rules), online and offline charging interactions, and policy enforcement.

[0059] The Charging Function (CHF, with Nchf interface) is responsible for converged online and offline charging functions. It provides quota management (for online charging), re-authorization triggers, rating conditions, etc., and is informed of usage reports from the SMF. Quota management involves granting a specific number of units (e.g. bytes, seconds) for a service. The CHF also interacts with the billing system.

[0060] Access and Mobility Management Function (AMF, with Namf interface) terminates the RAN CP interface and handles all mobility and connection management of the UE (similar to the MME in EPC). The AMF communicates with the UE via the N1 reference point and with the RAN (e.g., NG-RAN) via the N2 reference point.

[0061] Network Exposure Function (NEF, 220) with Nnef interface - acts as an entry point into the operator's network by securely exposing 5GC functions and events to the AF inside and outside the 5GC and providing the AF with a way to securely provide information to the 3GPP network. For example, the NEF provides a service that allows the AF to provision specific subscription data (e.g., expected UE behavior) for various UEs.

[0062] • Network Repository Function (NRF, 230) with Nnrf interface—provides service registration and discovery, enabling NFs to identify appropriate services available from other NFs.

[0063] Network Slice Selection Function (NSSF) with Nnssf interface - A "network slice" is a logical partition of a 5G network that provides specific network capabilities and features, e.g. to support a specific service. A network slice instance is a collection of NF instances and required network resources (e.g. compute, storage, communication) that provide the capabilities and features of that network slice. NSSF enables other NFs (e.g. AMF) to identify the appropriate network slice instance for the service desired by the UE.

[0064] Authentication Server Function (AUSF) with Nausf interface - based on the user's home network (HPLMN),

[0065] It performs user authentication and computes secure keying material for various purposes.

[0066] • Network Data Analysis Function (NWDAF, 210) with Nnwdaf interface, which is described in more detail above and below.

[0067] Location Management Function (LMF) with Nlmf interface - supports various functions related to the determination of the UE location, including for location determination of the UE and obtaining any of the following: DL location measurements or location estimates from the UE; UL location measurements from the NG RAN; and non-UE related assistance data from the NG RAN.

[0068] The Unified Data Management (UDM) function supports the generation of 3GPP authentication credentials, user identity handling, access authorization based on subscription data, and other subscriber-related functions. To provide this functionality, UDM uses subscription data (including authentication data) stored in the 5GC Unified Data Repository (UDR). In addition to UDM, UDR also supports the storage and retrieval of policy data by PCF and the storage and retrieval of application data by NEF.

[0069] An additional function or capability of NEF is to manage Packet Flow Descriptions (PFDs). A PFD is a collection of information related to the service associated with a specific application. Each PFD can be identified by a PFD ID, which is unique within the scope of a specific application identifier. However, an application identifier can be associated with multiple PFD types and corresponding PFD IDs.

[0070] 3GPP TS29.551 (v17.6.0) describes the conditions under which the PFD ID is included in the PFD. In addition to the PFD ID, the PFD may also include one or more of the following:

[0071] (One or more) 3-tuples, including the protocol, server IP address, and port number;

[0072] The significant part of the URL to match (e.g. the hostname); and

[0073] • Domain names (e.g., DNS) that match standards and information about applicable protocols.

[0074] The NEF can receive PFDs from the AF associated with various applications. The PFD function (PFDF) of the NEF creates, updates, or removes PFDs in the NEF and distributes the PFDs to the UPF via the SMF. In particular, the SMF receives the PFD from the NEF and converts it into applications and filters in a packet detection rule (PDR), which is sent to the UPF. These features can be used when the UPF is configured to detect specific applications provided by an application service provider (ASP).

[0075] As mentioned above, 3GPP TS23.288 (v17.2.0) specifies that NWDAF is the primary network function for computing analytics reports. The 5G system architecture allows any NF to obtain analytics from NWDAF using the Data Collection Coordination Function (DCCF) and associated Ndccf services. NWDAF can also perform:

[0076] Data collection based on event subscriptions provided by AMF, SMF, PCF, UDM, AF (directly or via NEF) and Operation / Administration / Maintenance (OAM);

[0077] • Retrieve information from data repositories (e.g., retrieve subscriber-related information from UDR via UDM, retrieve analytics-related information from the Analytics Data Repository Function (ADRF));

[0078] ·Store analysis information in ADRF;

[0079] Retrieve NF-related information (e.g., from the NRF and / or NSSF); and

[0080] Deliver analytics to consumers on demand.

[0081] DNS is a fundamental Internet building block used when users visit websites, send emails, conduct IM sessions, or do almost anything else online. When a user opens an application, the DNS client retrieves the server IP address(es) for that application domain from the DNS resolver. Currently, most of today's DNS traffic is sent unencrypted over UDP / TCP, but there are different IETF drafts proposing DNS encryption to prevent intermediate reading of DNS traffic between endpoints. Various proposals include DNS over HTTP / 2 (DOH), DNS over TLS, DNSCrypt, etc. With these proposals, only the DNS resolver has insight into the DNS messages.

[0082] End-to-end encryption is used for most user traffic carried by 5G networks, making it impossible for the UPF to identify the traffic type directly from the user traffic. There has been some discussion on 3GPP Rel-18 enhancements for NWDAF-assisted application detection, where the NWDAF uses UPF data to detect new PFDs. In addition, the proposed DNS traffic encryption also prevents the UPF from identifying user traffic based on the PFD domain name used for the DNS protocol, or prevents the UPF from generating its own PFD based on the DNS traffic. In addition, the proposed DNS traffic encryption also hinders NWDAF-assisted application detection of new PFDs using UPF data.

[0083] Therefore, embodiments of the present disclosure address these and other problems, issues, and / or difficulties by extending NWDAF-assisted application detection to include data collected from DNS resolvers, thereby facilitating NWDAF derivation of PFDs to detect application traffic.

[0084] An embodiment can be summarized at a high level as follows. A DNS resolver registers its capabilities in the NRF using a new event open service. A consumer (e.g., NEF) requests or subscribes to the NWDAF for an analysis ID to obtain auxiliary classification detection by triggering the Nnwdaf_AnalyticsSubscription_Request service operation or the Nnwdaf_AnalyticsInfo_Request service operation, respectively. The NWDAF discovers (one or more) DNS resolver instances based on the analysis request and triggers the collection of data from (one or more) DNS resolver instances relative to new events regarding the mapping of fully qualified domain names (FQDN or QNAME) to server IP addresses. If necessary, the NWDAF can trigger the collection of data from the NEF to obtain an application identifier for the FQDN.

[0085] Based on the collected data, NWDAF runs an analysis process, derives PFDs, and provides them to consumers (e.g., NEFs) as requested or subscribed. Consumers store the derived PFDs in UDRs, e.g., as application data. The derived PFDs are then distributed to UPFs to match incoming services.

[0086] Embodiments may provide various benefits and / or advantages. For example, embodiments may enable a communication network (e.g., a 5G network) to properly classify encrypted UE application traffic, including encrypted DNS traffic. Furthermore, embodiments may enable these operations without requiring an application service provider (ASP) to install and / or maintain associated PFDs in an NEF or similar repository. Additionally, embodiments may enable an ASP to define a less complex PFD based on domain names rather than IP addresses, even when encrypted DNS is used.

[0087] Figure 3 (including Figures 3A-3C ) illustrates an exemplary process between various entities operating in a communication network (300) according to various embodiments of the present disclosure. In particular, the exemplary process is between a UE (310), a UPF (320), a DNS resolver (330), a NWDAF (340), a consumer NF (cNF, 350), a UDR (360), and an NRF (370). Although the operations of the process are given numerical labels, this is intended to facilitate explanation and does not require or imply any particular order unless expressly stated to the contrary.

[0088] In operation 1-2, the DNS resolver registers in the NRF by sending an Nnrf_Registration Request message including the following information:

[0089] DNS resolver instance identifier (DNS-ID);

[0090] DNS resolver instance capabilities, including event exposure services; and

[0091] DNS resolver instance configuration information, such as Area of ​​Interest (AOI), Single Network Slice Selection Assistance Information (S-NSSAI), Data Network Name (DNN), etc.

[0092] In operation 3-4, the NRF stores the information received in operation 2 as part of the NF profile for DNS and indicates a successful operation to respond to the DNS resolver.

[0093] In operations 5-6, the cNF (e.g., NEF / PFDF acting as a cNF) subscribes to NWDAF analytics for assisted application detection (e.g., Analytic-ID=AssistedApplicationDetection) by sending a Nnwdaf_AnalyticsSubscription_Subscribe Request message including parameters representing Analytic-Filter (e.g., AOI, S-NSSAI, DNN). In operation 7, the NWDAF responds to the cNF indicating a successful operation.

[0094] The analysis request sent / received in operation 6 triggers the data collection process in the NWDAF, which determines what data is needed and whether the required data is already available or needs to be collected. In an embodiment of the present disclosure, the data to be collected (if not already available) includes data from the DNS resolver.

[0095] In operation 8-11, the NWDAF discovers contact information for the DNS entity from which the NDWAF needs to collect data. In particular, the NWDAF sends an Nnrf_Discovery Request message identifying DNS as the NF type of interest (NFtype) and includes filter parameters, such as the filter parameters received from the cNF in operation 6. The NRF looks up a registered DNS resolver instance that matches the filter parameters and sends a response with an identification (DNS-ID) and profile information (NFprofile) for the selected DNS resolver instance. In general, operation 8-11 can use a conventional NRF discovery service.

[0096] Based on the received NFprofile, the NWDAF triggers data collection from the DNS resolver by sending an Ndns_EventExposure Request message including the requested event (i.e., Event-ID=QNAME_IP_Mapping) in operation 12. In operation 13, the DNS resolver sends a response indicating a successful operation.

[0097] In operation 14, based on the collected data, the NWDAF identifies a new PFD and generates analysis results. The PFD is defined for each application identifier. The relationship or mapping between the application identifier and the FQDN in the DNS event notification may have been locally configured in the NWDAF. Alternatively, the information may be available in the NEF as information provided by the AF, as a locally configured PFD, or as edge application server (EAS) deployment information as described in 3GPP TS23.548 (v17.3.0). The analysis is enhanced to use data from the NEF for this purpose.

[0098] If the relationship between the application identifier and the FQDN is available in the NEF, the NWDAF selects the relevant NEF(s) to contact and uses the existing NEF services for PFD and EAS deployment information retrieval to perform data collection from the selected NEF(s). The NWDAF then uses the information collected from the NEFs and the event information collected from the DNS to identify the new PFD and generate analysis in operation 14.

[0099] In operation 15, the NWDAF sends a Nnwdaf_AnalyticsSubscription_Notify Request message including the identified PFD as an analysis result to the cNF (eg, NEF / PFDF). In operation 16, the cNF responds to the NWDAF by indicating a successful operation.

[0100] In operations 17-18, the cNF (e.g., NEF / PFDF) sends a Nudr_Store Request message including the PFD received from the NWDAF to the UDR. In operation 19, the UDR stores the received information as an extension to the existing application data structure. In operation 20, the UDR responds to the cNF by indicating a successful operation. In operations 21-22, the cNF (e.g., NEF / PFDF) distributes the exported PFD to the UPF. In operation 23, the UPF activates the received PFD to match the incoming service.

[0101] The above described embodiments can refer to Figure 4-8 To further illustrate, Figure 4-8 Exemplary methods (eg, processes) are depicted for NWDAF, DNS resolver, NEF, NRF, and UDR, respectively. In other words, various features of the operations described below correspond to the various embodiments described above. Figure 4-8The exemplary methods shown in the can be used in conjunction (e.g., with each other and with other processes described herein) to provide benefits, advantages, and / or solutions to the problems described herein. Figure 4-8 Specific blocks in a specific order are shown in the figure, but the operations corresponding to the blocks can be performed in an order different from the order shown, and can be combined and / or divided into blocks and / or operations with different functions from the blocks and / or operations shown. Optional blocks and / or operations are indicated by dotted lines.

[0102] In particular, Figure 4 An exemplary method (e.g., process) for a NWDAF configured to assist in application detection in a communication network (e.g., 5GC) according to various embodiments of the present disclosure is illustrated. Figure 4 The exemplary methods shown in may be performed by a NWDAF or a network node hosting a NWDAF, such as described elsewhere herein.

[0103] The exemplary method may include the operation of block 410, in which the NWDAF may receive an analysis request related to the assisted application detection from a consumer network function (cNF) of the communication network. The exemplary method may also include the operation of block 440, in which, based on the analysis request, the NWDAF may send an open request for an event related to a mapping of an FQDN to an address for an application server associated with the application to a first DNS resolver associated with the communication network. The exemplary method may also include the operation of block 450, in which the NWDAF may receive a first FQDN associated with the first application from the first DNS resolver according to the open request. The exemplary method may also include the operation of block 460, in which, based on the first FQDN, the NWDAF may determine one or more packet flow descriptions (PFDs) associated with the first application. The exemplary method may also include the operation of block 470, in which the NWDAF may send an analysis result including one or more PFDs to the cNF according to the analysis request.

[0104] In some embodiments, the cNF is a Network Open Function (NEF), or a unit or sub-function of a NEF (eg, PFDF).

[0105] In some embodiments, the analysis request (e.g., in block 410) includes one or more of the following parameters that define filters for the requested analysis: area of ​​interest (AOI), single network slice selection assistance information (S-NSSAI), and data network name (DNN). In some of these embodiments, the exemplary method may also include the operation of block 420, in which the NWDAF may send a discovery request for a DNS resolver associated with the communication network to the NRF of the communication network. The discovery request includes one or more parameters that define filters for the requested analysis. In some variants, the exemplary method may also include the operation of block 430, in which, in response to the discovery request, the NWDAF may receive an identifier of a first DNS resolver and a profile for the first DNS resolver from the NRF. In such a case, sending an open request to the first DNS resolver (e.g., in block 440) is based on at least one of the identifier and profile received in block 430.

[0106] In some embodiments, determining one or more PFDs based on the first FQDN in block 460 includes operations of sub-blocks 461-462, in which the NWDAF may determine an application identifier corresponding to the first FQDN and select the one or more PFDs based on an association of the one or more PFDs with the application identifier. In some of these embodiments, determining the application identifier corresponding to the first FQDN in sub-block 461 includes sending the first FDQDN to a NEF of the communication network and receiving a response from the NEF including the application identifier.

[0107] in addition, Figure 5 An exemplary method (e.g., process) for a DNS resolver configured to assist in application detection in a communication network (e.g., 5GC) according to various embodiments of the present disclosure is illustrated. For example, Figure 5 The exemplary methods shown in may be performed by a DNS resolver function or a network node hosting a DNS resolver, such as described elsewhere herein.

[0108] The exemplary method may include the operation of block 520, in which the DNS resolver may receive an open request for an event related to a mapping of an FQDN to an address for an application server associated with an application from a NWDAF of the communication network. The exemplary method may also include the operation of block 530, in which the DNS resolver may then map the first FQDN to an address for an application server associated with the first application (e.g., based on a DNS request from an application client). The exemplary method may also include the operation of block 540, in which the DNS resolver may send the first FQDN to the NWDAF based on the open request.

[0109] In some embodiments, the exemplary method may further include the operation of block 510, in which the DNS resolver may send a request to the NRF of the communication network to register the capabilities of the DNS resolver. In block 520, an open request is received based on the registration of the capabilities. In some embodiments, the request to register the capabilities of the DNS resolver is an Nnrf_Registration Request message including the following information:

[0110] The DNS resolver identifier (DNS-ID);

[0111] DNS resolver support for opening indication of events related to FQDN-to-address mappings; and

[0112] Configuration information for the DNS resolver, including one or more of the following: Area of ​​Interest (AOI), Single Network Slice Selection Assistance Information (S-NSSAI), and Data Network Name (DNN).

[0113] in addition, Figure 6 An exemplary method (e.g., process) for a consumer network function (cNF) of a communication network (e.g., 5GC) according to various embodiments of the present disclosure is illustrated. For example, Figure 6 The exemplary methods shown in may be performed by any suitable cNF or network node hosting such a cNF, such as described elsewhere herein.

[0114] The exemplary method may include the operation of block 610, in which the cNF may send an analysis request related to the assisted application detection to the NWDAF of the communication network. The exemplary method may also include the operation of block 620, in which the cNF may receive, from the NWDAF according to the analysis request, an analysis result including one or more PFDs associated with the first application.

[0115] In some embodiments, the cNF is a Network Open Function (NEF), or a unit or sub-function of a NEF (eg, PFDF).

[0116] In some embodiments, the exemplary method may further include the operation of block 630, where the cNF may send one or more PFDs associated with the first application to a unified data repository (UDR) of the communication network for storage. In some embodiments, the exemplary method may further include the operation of block 640, where the cNF may send one or more PFDs associated with the first application to a user plane function (UPF) of the communication network.

[0117] In some embodiments, the analysis request (eg, in block 610 ) includes one or more of the following parameters that define filters for the requested analysis: AOI, S-NSSAI, and DNN.

[0118] in addition, Figure 7 An exemplary method (e.g., process) for NRF of a communication network (e.g., 5GC) according to various embodiments of the present disclosure is illustrated. For example, Figure 7 The exemplary methods shown in may be performed by an NRF or a network node hosting an NRF, such as described elsewhere herein.

[0119] The exemplary method may include the operation of block 710, in which the NRF may receive a request for registering capabilities of the first DNS resolver from a first DNS resolver associated with the communication network. The exemplary method may also include the operation of block 720, in which the NRF may store the capabilities of the first DNS resolver in a profile for the first DNS resolver according to the request. The exemplary method may also include the operation of block 730, in which the NRF may receive a discovery request for a DNS resolver associated with the communication network from a NWDAF of the communication network. The discovery request includes one or more parameters defining an analysis filter. The exemplary method may also include the operation of block 740, in which the NRF may determine that the stored capabilities of the first DNS resolver match the one or more parameters included in the discovery request. The exemplary method may also include the operation of block 750, in which the NRF may send a discovery response to the NWDAF, the discovery response including an identifier of the first DNS resolver and a profile for the first DNS resolver.

[0120] In some embodiments, the request to register the capabilities of the first DNS resolver is an Nnrf_Registration Request message including the following information:

[0121] The identifier of the first DNS resolver (DNS-ID);

[0122] An indication that the first DNS resolver supports an open event related to FQDN-to-address mapping; and

[0123] Configuration information for the first DNS resolver, including one or more of the following: AOI, S-NSSAI, and DNN.

[0124] in addition, Figure 8 An exemplary method (e.g., process) for a UDR of a communication network (e.g., 5GC) according to various embodiments of the present disclosure is illustrated. For example, Figure 8The exemplary methods shown in may be performed by a UDR or a network node hosting a UDR, such as described elsewhere herein.

[0125] The exemplary method may include the operation of block 810, in which the UDR may receive one or more PFDs associated with the first application from a cNF of the communication network. The exemplary method may also include the operation of block 820, in which the UDR may store the one or more PFDs as application data for the first application.

[0126] In some embodiments, the cNF is a Network Open Function (NEF), or a unit or sub-function of a NEF (eg, PFDF).

[0127] In some embodiments, the exemplary method may also include the operations of blocks 830-840, in which the UDR may receive a request for application data associated with the first application from a second cNF of the communication network, and in response to the request, retrieve one or more stored PFDs and send the retrieved one or more PFDs to the second cNF.

[0128] Although various embodiments are described above in this document from the perspective of methods, devices, equipment, computer-readable media, and receivers, a person skilled in the art will readily understand that such methods may be embodied through various combinations of hardware and software in various communication networks, communication devices, computing devices, control devices, devices, non-transitory computer-readable media, and the like.

[0129] For example, an embodiment includes a communication network including a NWDAF and an NRF, wherein the NRF is configured to perform the same as described above with respect to Figure 7 In some embodiments, the communication network may further include a first DNS resolver with which the NRF communicates. In some embodiments, the communication network may further include a cNF (e.g., NEF or a sub-function thereof such as PFDF) configured to perform operations corresponding to the exemplary method described above with respect to Figure 6 In some embodiments, the communication network may further include a UDR configured to perform operations corresponding to the exemplary method described above. Figure 8 FIG3 shows a more specific example of a communication network including NFs configured in this way.

[0130] As another example, Fig. 9A communication system 900 according to some embodiments is shown. The communication system 900 includes a telecommunications network 902 including an access network 904 such as a radio access network (RAN) and a core network 906 including one or more core network nodes 908. The access network 904 includes one or more access network nodes, such as network nodes 910a and 910b (one or more of which may be generally referred to as network nodes 910), or any other similar 3GPP access nodes or non-3GPP access points. The network nodes 910 facilitate direct or indirect connection of UEs, such as by connecting UEs 912a, 912b, 912c, and 912d (one or more of which may be generally referred to as UEs 912) to the core network 906 via one or more wireless connections.

[0131] As specific examples, one or more core network nodes 908 may be configured to perform operations attributed to an NWDAF, NRF, cNF, UDR, and / or DNS resolver in the description of various methods or processes herein.

[0132] Example wireless communications over wireless connections include sending and / or receiving wireless signals using electromagnetic waves, radio waves, infrared waves, and / or other types of signals suitable for transferring information without the use of wires, cables, or other material conductors. In addition, in different embodiments, the communication system 900 may include any number of wired or wireless networks, network nodes, UEs, and / or any other components or systems that may facilitate or participate in the communication of data and / or signals, whether via a wired connection or a wireless connection. The communication system 900 may include and / or interface with any type of communication, telecommunication, data, cellular, radio network, and / or other similar types of systems.

[0133] UE 912 may be any of a variety of communication devices, including wireless devices that are arranged, configured and / or operable to communicate wirelessly with network node 910 and other communication devices. Similarly, network node 910 is arranged, capable, configured and / or operable to communicate directly or indirectly with UE 912 and / or with other network nodes or devices in telecommunication network 902 to enable and / or provide network access (such as wireless network access) and / or perform other functions (such as management in telecommunication network 902).

[0134] In the depicted example, the core network 906 connects the network node 910 to one or more hosts, such as the host 916. These connections may be direct or indirect connections via one or more intermediate networks or devices. In other examples, the network node may be directly coupled to the host. The core network 906 includes one or more core network nodes (e.g., core network node 908) constructed with hardware and software components. The features of these components may be substantially similar to those described with respect to the UE, network nodes, and / or hosts, so that their descriptions are generally applicable to the corresponding components of the core network node 908. The example core network node includes a mobile switching center (MSC), a mobility management entity (MME), a home subscriber server (HSS), an access and mobility management function (AMF), a session management function (SMF), an authentication server function (AUSF), a subscription identifier de-hiding function (SIDF), a unified data management (UDM), a security edge protection agent (SEPP), a network open function (NEF), and / or a user plane function (UPF) One or more functions.

[0135] The host 916 may be under the ownership or control of a service provider other than the operator or provider of the access network 904 and / or the telecommunications network 902, and may be operated by or on behalf of the service provider. The host 916 may host various applications to provide one or more services. Examples of such applications include real-time and pre-recorded audio / video content, data collection services (such as retrieving and editing data about various environmental conditions detected by multiple UEs), analysis functions, social media, functions for controlling or otherwise interacting with remote devices, functions for alarm and monitoring centers, or any other such functions performed by a server.

[0136] As a specific example, host 916 may be configured to perform the operations attributed to a DNS resolver in the description of various methods or processes herein.

[0137] As a whole, Fig. 9The communication system 900 implements the connection between UE, network node and host. In this sense, the communication system can be configured to operate according to predefined rules or procedures such as specific standards, including but not limited to: Global System for Mobile Communications (GSM); Universal Mobile Telecommunications System (UMTS); Long Term Evolution (LTE), and / or other suitable 2G, 3G, 4G, 5G standards, or any applicable future generation standards (e.g., 6G); Wireless Local Area Network (WLAN) standards, such as Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards (WiFi); and / or any other appropriate wireless communication standards, such as Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, Near Field Communication (NFC), ZigBee, LiFi and / or any low power wide area network (LPWAN) standards such as LoRa and Sigfox.

[0138] In some examples, the telecommunication network 902 is a cellular network implementing 3GPP standardized features. Therefore, the telecommunication network 902 can support network slicing to provide different logical networks to different devices connected to the telecommunication network 902. For example, the telecommunication network 902 can provide ultra-reliable low-latency communication (URLLC) services to some UEs, while providing enhanced mobile broadband (eMBB) services to other UEs, and / or provide massive machine type communication (mMTC) / massive IoT services to other UEs.

[0139] In some examples, the UE 912 is configured to send and / or receive information without direct human interaction. For example, when triggered by an internal or external event, or in response to a request from the access network 904, the UE can be designed to send information to the access network 904 according to a predetermined schedule. Additionally, the UE can be configured to operate in a single RAT or multi-RAT or multi-standard mode. For example, the UE can operate using any one or a combination of Wi-Fi, NR (New Radio), and LTE, i.e., configured for multi-radio dual connectivity (MR-DC), such as E-UTRAN (Evolved UMTS Terrestrial Radio Access Network) New Radio-Dual Connectivity (EN-DC).

[0140] In this example, the hub 914 communicates with the access network 904 to facilitate indirect communication between one or more UEs (e.g., UE 912c and / or 912d) and a network node (e.g., network node 910b). In some examples, the hub 914 can be a controller, a router, a content source and analysis, or any of the other communication devices described herein with respect to the UE. For example, the hub 914 can be a broadband router that enables the UE to access the core network 906. As another example, the hub 914 can be a controller that sends commands or instructions to one or more actuators in the UE. The commands or instructions can be received from the UE, the network node 910, or received through executable code, scripts, processes, or other instructions in the hub 914. As another example, the hub 914 can be a data collector that acts as a temporary storage device for UE data, and in some embodiments, analysis or other processing of the data can be performed. As another example, the hub 914 can be a content source. For example, for a UE that is a VR headset, display, speaker, or other media delivery device, the hub 914 can retrieve VR assets, video, audio, or other media or data related to sensory information via a network node, and then the hub 914 provides it to the UE directly, after performing local processing, and / or after adding additional local content. In another example, the hub 914 acts as a proxy server or coordinator for the UE, particularly when one or more of the UEs are low-energy IoT devices.

[0141] The hub 914 may have a constant / persistent or intermittent connection to the network node 910b. The hub 914 may also allow different communication schemes and / or scheduling between the hub 914 and the UE (e.g., UE 912c and / or 912d) and between the hub 914 and the core network 906. In other examples, the hub 914 is connected to the core network 906 and / or one or more UEs via a wired connection. In addition, the hub 914 may be configured to be connected to an M2M service provider via the access network 904 and / or to another UE via a direct connection. In some scenarios, the UE may establish a wireless connection with the network node 910 while still being connected via a wired or wireless connection via the hub 914. In some embodiments, the hub 914 may be a dedicated hub, that is, its main function is to route communications from the network node 910b to the UE / from the UE to the network node 910b. In other embodiments, hub 914 may be a non-dedicated hub, that is, a device operable to route communications between UEs and network node 910b, but also capable of operating as a communications origin and / or endpoint for certain data channels.

[0142] Fig.10UE 1000 according to some embodiments is shown. As used herein, UE refers to a device capable of, configured, arranged and / or operable to wirelessly communicate with a network node and / or other UEs. Examples of UEs include, but are not limited to, smart phones, mobile phones, cellular phones, voice over IP (VoIP) phones, wireless local loop phones, desktop computers, personal digital assistants (PDAs), wireless cameras, game consoles or devices, music storage devices, playback devices, wearable terminal devices, wireless endpoints, mobile stations, tablet computers, laptops, laptop embedded devices (LEEs), laptop mounted devices (LMEs), smart devices, wireless customer premises equipment (CPEs), vehicle-mounted or vehicle embedded / integrated wireless devices, etc. Other examples include any UE identified by the Third Generation Partnership Project (3GPP), including narrowband Internet of Things (NB-IoT) UEs, machine type communications (MTC) UEs, and / or enhanced MTC (eMTC) UEs.

[0143] The UE may support device-to-device (D2D) communications, for example by implementing 3GPP standards for sidelink communications, dedicated short-range communications (DSRC), vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), or vehicle-to-everything (V2X). In other examples, the UE may not necessarily have a user in the sense of a human user owning and / or operating the associated device. Instead, the UE may represent a device that is intended to be sold to or operated by a human user, but the device may not be associated with a particular human user, or may not initially be associated with that particular human user (e.g., a smart sprinkler controller). Alternatively, the UE may represent a device that is not intended to be sold to or operated by an end user, but the device may be associated with a user or operated for the benefit of a user (e.g., a smart meter).

[0144] UE 1000 includes a processing circuit 1002, which is operatively coupled to an input / output interface 1006, a power supply 1008, a memory 1010, a communication interface 1012, and / or any other components, or any combination thereof, via a bus 1004. Some UEs may utilize Fig.10 All or a subset of the components shown in . The level of integration between components may vary from one UE to another UE. In addition, some UEs may contain multiple instances of a component, such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0145] The processing circuit 1002 is configured to process instructions and data, and may be configured to implement any sequential state machine operable to execute instructions stored in the memory 1010 as a machine-readable computer program. The processing circuit 1002 may be implemented as one or more hardware-implemented state machines (e.g., in discrete logic, field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), etc.); programmable logic and appropriate firmware; one or more stored computer programs, general-purpose processors such as microprocessors or digital signal processors (DSPs), and appropriate software; or any combination of the above. For example, the processing circuit 1002 may include multiple central processing units (CPUs).

[0146] In this example, the input / output interface 1006 can be configured to provide one or more interfaces to an input device, an output device, or one or more input and / or output devices. Examples of output devices include speakers, sound cards, video cards, displays, monitors, printers, actuators, transmitters, smart cards, another output device, or any combination thereof. An input device can allow a user to capture information into the UE 1000. Examples of input devices include touch-sensitive or presence-sensitive displays, cameras (e.g., digital cameras, digital video cameras, web cameras, etc.), microphones, sensors, mice, trackballs, directional pads, trackpads, rollers, smart cards, etc. A presence-sensitive display can include a capacitive or resistive touch sensor to sense input from a user. The sensor can be, for example, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetometer, an optical sensor, a proximity sensor, a biometric sensor, etc., or any combination thereof. An output device can use an interface port of the same type as an input device. For example, a universal serial bus (USB) port can be used to provide input devices and output devices.

[0147] In some embodiments, the power supply 1008 is configured as a battery or a battery pack. Other types of power supplies may be used, such as an external power supply (e.g., an electrical socket), a photovoltaic device, or a power battery. The power supply 1008 may also include a power circuit for delivering power from the power supply 1008 itself and / or an external power supply to various parts of the UE 1000 via an input circuit or an interface such as a power cable. The delivered power may be used, for example, to charge the power supply 1008. The power circuit may perform any formatting, conversion, or other modification to the power from the power supply 1008 so that the power is suitable for various components of the UE 1000 to which the power is supplied.

[0148] The memory 1010 may be or be configured to include a memory such as a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic disk, an optical disk, a hard disk, a removable tape cartridge, a flash drive, etc. In one example, the memory 1010 includes one or more application programs 1014, such as an operating system, a web browser application, a widget, a gadget engine, or other application, and corresponding data 1016. The memory 1010 may store any of a variety of operating systems or a combination of operating systems for use by the UE 1000.

[0149] The memory 1010 may be configured to include a plurality of physical drive units, such as a redundant array of independent disks (RAID), a flash memory, a USB flash drive, an external hard drive, a thumb drive, a pen drive, a key drive, a high-density digital versatile disk (HD-DVD) optical drive, an internal hard drive, a Blu-ray optical drive, a holographic digital data storage (HDDS) optical drive, an external mini dual in-line memory module (DIMM), a synchronous dynamic random access memory (SDRAM), an external micro DIMM SDRAM, a smart card memory (such as a tamper-proof module in the form of a universal integrated circuit card (UICC), including one or more user identity modules (SIMs), such as USIM and / or ISIM), other memories, or any combination thereof. The UICC may be, for example, an embedded UICC (eUICC), an integrated UICC (iUICC), or a removable UICC commonly referred to as a “SIM card”. The memory 1010 may allow the UE 1000 to access instructions, applications, etc. stored on a temporary or non-temporary storage medium to offload data or upload data. An article of manufacture, such as an article of manufacture utilizing a communication system, may be tangibly embodied as or in memory 1010, which may be or include a device-readable storage medium.

[0150] The processing circuit 1002 may be configured to communicate with an access network or other network using a communication interface 1012. The communication interface 1012 may include one or more communication subsystems and may include an antenna 1022 or be communicatively coupled to the antenna 1022. The communication interface 1012 may include one or more transceivers for communication, such as by communicating with one or more remote transceivers of another device capable of wireless communication (e.g., another UE or network node in the access network). Each transceiver may include a transmitter 1018 and / or a receiver 1020 suitable for providing network communications (e.g., optical, electrical, frequency allocation, etc.). In addition, the transmitter 1018 and the receiver 1020 may be coupled to one or more antennas (e.g., antenna 1022) and may share circuit components, software or firmware, or may be implemented separately alternatively.

[0151] In the illustrated embodiment, the communication functionality of the communication interface 1012 may include cellular communication, Wi-Fi communication, LPWAN communication, data communication, voice communication, multimedia communication, short-range communication such as Bluetooth, near field communication, location-based communication such as using a global positioning system (GPS) to determine location, another similar communication functionality, or any combination thereof. Communication may be implemented according to one or more communication protocols and / or standards, such as IEEE 802.11, code division multiple access (CDMA), wideband code division multiple access (WCDMA), GSM, LTE, new radio (NR), UMTS, WiMax, Ethernet, transmission control protocol / Internet protocol (TCP / IP), synchronous optical networking (SONET), asynchronous transfer mode (ATM), QUIC, hypertext transfer protocol (HTTP), and the like.

[0152] Regardless of the type of sensor, the UE may provide an output of data captured by its sensor via a wireless connection to a network node through its communication interface 1012. The data captured by the UE's sensor may be transmitted to the network node via another UE via a wireless connection. The output may be periodic (e.g., every 15 minutes if it reports a sensed temperature), random (e.g., in order to load balance reports from multiple sensors), in response to a trigger event (e.g., sending an alarm when moisture is detected), in response to a request (e.g., a user-initiated request), or a continuous stream (e.g., a live video feed of a patient).

[0153] As another example, the UE includes an actuator, motor, or switch associated with a communication interface configured to receive wireless input from a network node via a wireless connection. In response to the received wireless input, the state of the actuator, motor, or switch can change. For example, the UE can include a motor that adjusts a control surface or rotor of a drone in flight based on the received input, or adjusts a robotic arm performing a medical procedure based on the received input.

[0154] When in the form of an Internet of Things (IoT) device, a UE may be a device used in one or more application areas including, but not limited to, urban wearable technology, extended industrial applications, and healthcare. Non-limiting examples of such IoT devices are the following devices or devices embedded in the following devices: a connected refrigerator or freezer, a television, connected lighting, an electric meter, a robotic vacuum cleaner, a voice-activated smart speaker, a home security camera, a motion detector, a thermostat, a smoke detector, a door / window sensor, a flood / humidity sensor, an electric door lock, a connected doorbell, an air conditioning system (such as a heat pump), an autonomous vehicle, a surveillance system, a weather monitoring device, a vehicle parking monitoring device, an electric vehicle charging station, a smart watch, a fitness tracker, a head-mounted display for augmented reality (AR) or virtual reality (VR), a wearable device for tactile enhancement or sensory enhancement, a sprinkler, an animal or item tracking device, a sensor for monitoring plants or animals, an industrial robot, an unmanned aerial vehicle (UAV), and any kind of medical device (such as a heart rate monitor or a remotely controlled surgical robot). In addition to the description of Fig.10 In addition to the other components described for the UE 1000 shown in FIG. 1 , a UE in the form of an IoT device includes circuitry and / or software depending on the intended application of the IoT device.

[0155] As another specific example, in an IoT scenario, a UE may represent a machine or other device that performs monitoring and / or measurement and sends the results of such monitoring and / or measurement to another UE and / or a network node. In this case, the UE may be an M2M device, which may be referred to as an MTC device in the 3GPP context. As a specific example, a UE may implement the 3GPP NB-IoT standard. In other scenarios, a UE may represent a vehicle, such as a car, bus, truck, ship, and airplane, or other device that is capable of monitoring and / or reporting its operating status or capable of performing other functions associated with its operation.

[0156] In practice, any number of UEs may be used together with respect to a single use case. For example, a first UE may be or be integrated into a drone and provide the drone's speed information (obtained via a speed sensor) to a second UE that is a remote controller for operating the drone. When the user makes changes from the remote controller, the first UE may adjust the throttle on the drone (e.g., by controlling an actuator) to increase or decrease the speed of the drone. The first and / or second UE may also include more than one of the above functions. For example, the UE may include a sensor and an actuator and handle the communication of data for the speed sensor and the actuator.

[0157] Fig.11 A network node 1100 according to some embodiments is shown. As used herein, a network node refers to a device capable of, configured, arranged and / or operable to communicate directly or indirectly with a UE and / or other network nodes or devices in a telecommunications network. Examples of network nodes include, but are not limited to, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs), and NRNodeBs (gNBs)).

[0158] Base stations may be classified based on the amount of coverage they provide (or, stated differently, based on their transmit power level), and thus may be referred to as a femto base station, a pico base station, a micro base station, or a macro base station, depending on the amount of coverage provided. A base station may be a relay node or a relay donor node that controls a relay. A network node may also include one or more (or all) parts of a distributed radio base station, such as a centralized digital unit and / or a remote radio unit (RRU), which is sometimes referred to as a remote radio head (RRH). Such a remote radio unit may or may not be integrated with an antenna as an antenna-integrated radio. Portions of a distributed radio base station may also be referred to as nodes in a distributed antenna system (DAS).

[0159] Other examples of network nodes include a multi-transmission point (multi-TRP) 5G access node, a multi-standard radio (MSR) device such as an MSR BS, a network controller such as a radio network controller (RNC) or a base station controller (BSC), a base transceiver station (BTS), a transmission point, a transmission node, a multi-cell / multicast coordination entity (MCE), an operation and maintenance (O&M) node, an operation support system (OSS) node, a self-organizing network (SON) node, a positioning node (e.g., an evolved serving mobile positioning center (E-SMLC)) and / or a minimization of drive tests (MDT).

[0160] The network node 1100 includes a processing circuit 1102, a memory 1104, a communication interface 1106, and a power supply 1108. The network node 1100 may be composed of multiple physically separated components (e.g., a NodeB component and an RNC component, or a BTS component and a BSC component, etc.), each of which may have its own corresponding components. In certain scenarios where the network node 1100 includes multiple separated components (e.g., BTS and BSC components), one or more of the separated components may be shared between several network nodes. For example, a single RNC may control multiple NodeBs. In such a scenario, each unique NodeB and RNC pair may be considered as a single separated network node in some cases. In some embodiments, the network node 1100 may be configured to support multiple radio access technologies (RATs). In such an embodiment, some components may be repeated (e.g., separate memories 1104 for different RATs), and some components may be reused (e.g., the same antenna 1110 may be shared by different RATs). The network node 1100 may also include multiple sets of various illustrated components for different wireless technologies, such as GSM, WCDMA, LTE, NR, WiFi, Zigbee, Z-wave, LoRaWAN, radio frequency identification (RFID), or Bluetooth wireless technologies, integrated into the network node 1100. These wireless technologies may be integrated into the same or different chips or chipsets and other components within the network node 1100.

[0161] The processing circuit 1102 may include a combination of one or more of a microprocessor, a controller, a microcontroller, a central processing unit, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software and / or encoded logic that is operable to provide the functionality of the network node 1100 alone or in conjunction with other network node 1100 components (such as memory 1104).

[0162] In some embodiments, processing circuitry 1102 includes a system on a chip (SOC). In some embodiments, processing circuitry 1102 includes one or more of radio frequency (RF) transceiver circuitry 1112 and baseband processing circuitry 1114. In some embodiments, radio frequency (RF) transceiver circuitry 1112 and baseband processing circuitry 1114 may be on separate chips (or chipsets), boards, or units, such as a radio unit and a digital unit. In alternative embodiments, part or all of RF transceiver circuitry 1112 and baseband processing circuitry 1114 may be on the same chip or chipset, board, or unit.

[0163] The memory 1104 may include any form of volatile or non-volatile computer-readable memory, including, but not limited to, persistent storage, solid-state memory, remotely mounted memory, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), mass storage media (e.g., hard disk), removable storage media (e.g., flash drive, compact disk (CD), or digital video disk (DVD)), and / or any other volatile or non-volatile, non-transitory device-readable and / or computer-executable memory device that stores information, data, and / or instructions that can be used by the processing circuit 1102. The memory 1104 may store any suitable instructions, data, or information, including computer programs, software, applications, including one or more of logic, rules, codes, tables, and / or other instructions (collectively, computer program products 1104a) that can be executed by the processing circuit 1102 and utilized by the network node 1100. The memory 1104 may be used to store any calculations made by the processing circuit 1102 and / or any data received via the communication interface 1106. In some embodiments, processing circuit 1102 and memory 1104 are integrated.

[0164] The communication interface 1106 is used for wired or wireless communication of signaling and / or data between network nodes, access networks and / or UEs. As shown, the communication interface 1106 includes one or more ports / terminals 1116, for example, sending data to the network and receiving data from the network via a wired connection. The communication interface 1106 also includes a radio front-end circuit 1118, which can be coupled to the antenna 1110, or in some embodiments is a part of the antenna 1110. The radio front-end circuit 1118 includes a filter 1120 and an amplifier 1122. The radio front-end circuit 1118 can be connected to the antenna 1110 and the processing circuit 1102. The radio front-end circuit can be configured to adjust the signal transmitted between the antenna 1110 and the processing circuit 1102. The radio front-end circuit 1118 can receive digital data to be sent to other network nodes or UEs via a wireless connection. The radio front-end circuit 1118 can use a combination of a filter 1120 and / or an amplifier 1122 to convert the digital data into a radio signal with appropriate channel and bandwidth parameters. The radio signal can then be sent via the antenna 1110. Similarly, when receiving data, antenna 1110 may collect radio signals, which are then converted into digital data by radio front end circuit 1118. The digital data may be passed to processing circuit 1102. In other embodiments, the communication interface may include different components and / or different combinations of components.

[0165] In certain alternative embodiments, the network node 1100 does not include a separate radio front end circuit 1118, but rather the processing circuit 1102 includes the radio front end circuit and is connected to the antenna 1110. Similarly, in some embodiments, all or part of the RF transceiver circuit 1112 is part of the communication interface 1106. In other embodiments, the communication interface 1106 includes one or more ports or terminals 1116, the radio front end circuit 1118, and the RF transceiver circuit 1112 as part of a radio unit (not shown), and the communication interface 1106 communicates with the baseband processing circuit 1114 as part of a digital unit (not shown).

[0166] Antenna 1110 may include one or more antennas or antenna arrays configured to send and / or receive wireless signals. Antenna 1110 may be coupled to radio front end circuit 1118 and may be any type of antenna capable of wirelessly sending and receiving data and / or signals. In some embodiments, antenna 1110 is separate from network node 1100 and may be connected to network node 1100 via an interface or port.

[0167] Antenna 1110, communication interface 1106 and / or processing circuit 1102 may be configured to perform any receiving operation and / or certain acquisition operations described herein as being performed by a network node. Any information, data and / or signal may be received from a UE, another network node and / or any other network device. Similarly, antenna 1110, communication interface 1106 and / or processing circuit 1102 may be configured to perform any sending operation described herein as being performed by a network node. Any information, data and / or signal may be sent to a UE, another network node and / or any other network device.

[0168] The power supply 1108 provides power to the various components of the network node 1100 in a form suitable for the various components (e.g., at the voltage and current levels required by each corresponding component). The power supply 1108 may further include or be coupled to a power management circuit to supply power to the components of the network node 1100 for performing the functions described herein. For example, the network node 1100 may be connected to an external power source (e.g., a power grid, an electrical outlet) via an input circuit or interface such as a cable, whereby the external power source supplies power to the power circuit of the power supply 1108. As another example, the power supply 1108 may include a power source in the form of a battery or battery pack, which is connected to the power circuit or integrated in the power circuit. If the external power source fails, the battery can provide backup power.

[0169] An embodiment of the network node 1100 may include Fig.11Additional components beyond those shown are used to provide certain aspects of the functionality of the network node, including any of the functionality described herein and / or any functionality necessary to support the subject matter described herein. For example, the network node 1100 may include a user interface device to allow information to be input into the network node 1100 and to allow information to be output from the network node 1100. This may allow a user to perform diagnostics, maintenance, repair, and other management functions of the network node 1100.

[0170] As specific examples, one or more network nodes 1100 may be configured to perform operations attributed to an NWDAF, NRF, cNF, UDR, and / or DNS resolver in the description of various methods or processes herein.

[0171] Fig.12 is a block diagram of a host 1200 according to various aspects described herein, and the host 1200 may be Fig. 9 1200 is an embodiment of a host 916. As used herein, the host 1200 can be or include various combinations of hardware and / or software, including processing resources in a standalone server, a blade server, a cloud-implemented server, a distributed server, a virtual machine, a container, or a server farm. The host 1200 can provide one or more services to one or more UEs.

[0172] Host 1200 includes processing circuitry 1202, which is operably coupled to input / output interface 1206, network interface 1208, power supply 1210, and memory 1212 via bus 1204. Other components may be included in other embodiments. The features of these components may be substantially similar to those described with respect to previous figures (such as Fig.10 and Fig.11 ) so that its description is generally applicable to corresponding components of the host 1200.

[0173] The memory 1212 may include one or more computer programs, including one or more host applications 1214 and data 1216, which may include user data (e.g., data generated by the UE for the host 1200 or data generated by the host 1200 for the UE). An embodiment of the host 1200 may utilize only a subset or all of the components shown. The host application 1214 may be implemented in a container-based architecture and may provide support for video codecs (e.g., generic video coding (VVC), high efficiency video coding (HEVC), advanced video coding (AVC), MPEG, VP9) and audio codecs (e.g., FLAC, advanced audio coding (AAC), MPEG, and G.711), including code conversion for multiple different categories, types, or implementations of UEs (e.g., mobile phones, desktop computers, wearable display systems, head-up display systems). The host application 1214 may also provide user authentication and license checks, and may periodically report health status, routing, and content availability to a central node (such as a device in a core network or on the edge). Thus, the host 1200 can select and / or indicate different hosts for over-the-top services for the UE. The host application 1214 can support various protocols, such as HTTP Live Streaming (HLS) protocol, Real-time Messaging Protocol (RTMP), Real-time Streaming Protocol (RTSP), Dynamic Adaptive Streaming over HTTP (MPEG-DASH), etc.

[0174] As a specific example, host 1200 may be configured to perform the operations attributed to a DNS resolver in the description of the various methods or processes herein.

[0175] Fig.13 1300 is a block diagram showing a virtualized environment, in which the functions implemented by some embodiments can be virtualized. In this context, virtualization means creating a virtual version of a device or equipment, which can include virtualizing a hardware platform, a storage device, and a network resource. As used herein, virtualization can be applied to any device or component thereof described herein, and relates to such an implementation, in which at least a portion of a function is implemented as one or more virtual components. Some or all of the functions described herein can be implemented as virtual components executed by one or more virtual machines (VMs), which are implemented in one or more virtual environments 1300 hosted by one or more hardware nodes (such as hardware computing devices operating as network nodes, UEs, core network nodes, or hosts). In addition, in embodiments where a virtual node does not require a radio connection (e.g., a core network node or a host), the node can be fully virtualized.

[0176] Application 1302 (which may be alternatively referred to as a software instance, a virtual device, a network function, a virtual node, a virtual network function, etc.) runs in the virtualized environment 1200 to implement some features, functions and / or benefits of some embodiments disclosed herein. As a specific example, the NWDAF, NRF, cNF, UDR and / or DNS resolver described in other figures herein may be implemented as a virtual network function 1902 in the virtualized environment 1300.

[0177] The hardware 1304 includes processing circuitry, memory storing software and / or instructions (collectively referred to as computer program product 1304a) executable by the hardware processing circuitry, and / or other hardware devices described herein, such as network interfaces, input / output interfaces, etc. The software may be executed by the processing circuitry to instantiate one or more virtualization layers 1306 (also referred to as hypervisors or virtual machine monitors (VMMs)), provide VMs 1308a and 1308b (one or more of which may be generally referred to as VMs 1308), and / or perform any of the functions, features, and / or benefits described in connection with some of the embodiments described herein. The virtualization layer 1306 may present a virtual operating platform that appears to be network hardware to the VMs 1308.

[0178] The VMs 1308 include virtual processing, virtual memory, virtual networking or interfaces, and virtual storage, and may be run by a corresponding virtualization layer 1306. Different embodiments of instances of virtual devices 1302 may be implemented on one or more of the VMs 1308, and may be implemented in different ways. Virtualization of hardware is referred to in some contexts as network function virtualization (NFV). NFV may be used to consolidate many network device types onto industry-standard high-volume server hardware, physical switches, and physical storage, which may be located in data centers and customer premises equipment.

[0179] In the context of NFV, VMs 1308 may be software implementations of physical machines that run programs as if they were executed on a physical, non-virtualized machine. Each of VMs 1308 and the portion of hardware 1304 on which the VM executes, whether hardware dedicated to the VM and / or hardware shared by the VM with other VMs in the VM, form a separate virtual network element. Still in the context of NFV, a virtual network function is responsible for handling a specific network function running in one or more VMs 1308 on top of hardware 1304 and corresponds to an application 1302.

[0180] Hardware 1304 can be implemented in a standalone network node with general or specific components. Hardware 1304 can implement some functions via virtualization. Alternatively, hardware 1304 can be part of a larger hardware cluster (e.g., in a data center or CPE), where many hardware nodes work together and are managed via management and coordination 1310, where management and coordination 1310 particularly oversees the life cycle management of application 1302. In some embodiments, hardware 1304 is coupled to one or more radio units, each of which includes one or more transmitters and one or more receivers that can be coupled to one or more antennas. The radio unit can communicate directly with other hardware nodes via one or more appropriate network interfaces, and can be used in combination with virtual components to provide radio capabilities to virtual nodes such as radio access nodes or base stations. In some embodiments, a control system 1312 can be used to provide some signaling, which can be alternatively used for communication between hardware nodes and radio units.

[0181] Fig.14 A communication diagram showing a host 1402 communicating with a UE 1406 via a network node 1404 over a partial wireless connection according to some embodiments.

[0182] Now refer to Fig.14 Describes the UE (such as Fig. 9 UE912a and / or Fig.10 UE 1000), network nodes (such as Fig. 9 The network node 910a and / or Fig.11 network nodes 1100) and hosts (such as Fig. 9 Host 916 and / or Fig.12 An example implementation of host 1200).

[0183] Similar to the host 1200, an embodiment of the host 1402 includes hardware, such as a communication interface, a processing circuit, and a memory. The host 1402 also includes software stored in or accessible by the host 1402 and executable by the processing circuit. The software includes a host application that is operable to provide services to a remote user, such as a UE 1406 connected via an over-the-top transfer (OTT) connection 1450 extending between the UE 1406 and the host 1402. In providing services to the remote user, the host application can provide user data sent using the OTT connection 1450.

[0184] The network node 1404 includes hardware that enables it to communicate with the host 1402 and the UE 1406. The connection 1460 can be direct or through a core network (such as Fig. 9The core network 906 of the present invention) and / or one or more other intermediate networks, such as one or more public, private or managed networks. For example, the intermediate network can be a backbone network or the Internet.

[0185] UE 1406 includes hardware and software that is stored in or accessible by UE 1406 and can be executed by the processing circuit of UE. The software includes a client application, such as a web browser or an operator-specific "application", which is operable to provide services to human or non-human users via UE 1406 with the support of host 1402. In host 1402, the executing host application can communicate with the executing client application via an OTT connection 1450 that terminates at UE 1406 and host 1402. In the process of providing services to the user, the client application of the UE can receive request data from the host application of the host and provide user data in response to the request data. OTT connection 1450 can transmit request data and user data. The client application of the UE can interact with the user to generate user data that it provides to the host application via OTT connection 1450.

[0186] The OTT connection 1450 may extend via a connection 1460 between the host 1402 and the network node 1404 and via a wireless connection 1470 between the network node 1404 and the UE 1406 to provide connectivity between the host 1402 and the UE 1406. The connection 1460 and the wireless connection 1470 over which the OTT connection 1450 may be provided are drawn abstractly to illustrate communications between the host 1402 and the UE 1406 via the network node 1404 without explicit reference to any intermediate devices and the precise routing of messages via those devices.

[0187] As an example of sending data via the OTT connection 1450, in step 1408, the host 1402 provides user data, which can be performed by executing a host application. In some embodiments, the user data is associated with a specific human user interacting with the UE 1406. In other embodiments, the user data is associated with the UE 1406, which shares data with the host 1402 without explicit human interaction. In step 1410, the host 1402 initiates a transmission carrying the user data to the UE 1406. The host 1402 may initiate the transmission in response to a request sent by the UE 1406. The request may be caused by human interaction with the UE 1406 or by the operation of a client application executed on the UE 1406. According to the teachings of the embodiments described throughout the present disclosure, the transmission may be through the network node 1404. Therefore, according to the teachings of the embodiments described throughout the present disclosure, in step 1412, the network node 1404 sends the user data carried in the transmission initiated by the host 1402 to the UE 1406. In step 1414 , UE 1406 receives the user data carried in the transmission, which may be performed by a client application executing on UE 1406 that is associated with a host application executed by host 1402 .

[0188] In some examples, UE 1406 executes a client application that provides user data to host 1402. The user data may be provided in reaction to or in response to data received from host 1402. Thus, in step 1416, UE 1406 may provide the user data, which may be performed by executing the client application. In providing the user data, the client application may further consider user input received from a user via an input / output interface of UE 1406. Regardless of the specific manner in which the user data is provided, in step 1418, UE 1406 initiates transmission of the user data to host 1402 via network node 1404. In step 1420, in accordance with the teachings of the embodiments described throughout the present disclosure, network node 1404 receives user data from UE 1406 and initiates transmission of the received user data to host 1402. In step 1422, host 1402 receives the user data carried in the transmission initiated by UE 1406.

[0189] One or more of the various embodiments improves the performance of OTT services provided to UE 1406 using an OTT connection 1450 in which a wireless connection 1470 forms the last leg. More specifically, the disclosed embodiments may enable a communication network (e.g., a 5G network) to appropriately classify encrypted UE application traffic (including encrypted DNS traffic). Furthermore, the embodiments facilitate these operations without requiring an ASP to install and / or maintain associated PFDs in an NEF or similar network repository. Additionally, the embodiments enable an ASP to define a less complex PFD based on a domain name rather than an IP address, even when encrypted DNS is used. In this way, the embodiments improve network functionality for handling traffic for OTT services, which increases the value of such services to both end users and service providers (e.g., ASPs).

[0190] In an example scenario, host 1402 may collect and analyze plant status information. As another example, host 1402 may process audio and video data that may have been retrieved from the UE for use in creating a map. As another example, host 1402 may collect and analyze real-time data to help control vehicle congestion (e.g., control traffic lights). As another example, host 1402 may store surveillance videos uploaded by the UE. As another example, host 1402 may store media content (such as video, audio, VR, or AR) that it may broadcast, multicast, or unicast to the UE, or control access to the media content. As other examples, host 1402 may be used for energy pricing, remote control of non-time-critical power loads to balance power generation demand, positioning services, presentation services (such as compiling charts based on data collected from remote devices, etc.), or any other function of collecting, retrieving, storing, analyzing, and / or sending data.

[0191] In some examples, a measurement process may be provided for the purpose of monitoring data rates, delays, and other factors improved by one or more embodiments. There may also be an optional network function for reconfiguring the OTT connection 1450 between the host 1402 and the UE 1406 in response to changes in the measurement results. The measurement process and / or network function for reconfiguring the OTT connection may be implemented in software and hardware of the host 1402 and / or the UE 1406. In some embodiments, sensors (not shown) may be deployed in or associated with other devices through which the OTT connection 1450 passes; the sensors may participate in the measurement process by supplying the values ​​of the monitored quantities illustrated above or supplying the values ​​of other physical quantities according to which the software can calculate or estimate the monitored quantities. The reconfiguration of the OTT connection 1450 may include message formats, retransmission settings, preferred routes, etc.; the reconfiguration does not require direct changes to the operation of the network node 1404. Such processes and functions may be known and practiced in the art. In some embodiments, the measurement may involve dedicated UE signaling, which facilitates the host 1402 to measure throughput, propagation time, delay, etc. The measurements may be achieved by software causing messages, particularly empty or "dummy" messages, to be sent using the OTT connection 1450 while monitoring propagation times, errors, etc.

[0192] The foregoing merely illustrates the principles of the present disclosure. In view of the teachings herein, various modifications and changes to the described embodiments will be apparent to those skilled in the art. Therefore, it will be appreciated that those skilled in the art will be able to design many systems, arrangements, and processes that, although not explicitly shown or described herein, embody the principles of the present disclosure and therefore may be within the spirit and scope of the present disclosure. As will be appreciated by those of ordinary skill in the art, the various embodiments may be used together with each other, and may be used interchangeably.

[0193] As used herein, the term "unit" may have a conventional meaning in the field of electronics, electrical devices and / or electronic devices, and may include, for example, electrical and / or electronic circuits, devices, modules, processors, memories, logical solid-state and / or discrete devices, computer programs or instructions for performing corresponding tasks, processes, calculations, output and / or display functions, etc. (such as those described herein).

[0194] Any suitable steps, methods, features, functions or benefits disclosed herein may be performed by one or more functional units or modules of one or more virtual devices. Each virtual device may include a plurality of these functional units. These functional units may be implemented via a processing circuit, which may include one or more microprocessors or microcontrollers, and other digital hardware that may include a digital signal processor (DSP), dedicated digital logic, etc. The processing circuit may be configured to execute program codes stored in a memory, which may include one or more types of memory, such as a read-only memory (ROM), a random access memory (RAM), a cache memory, a flash memory device, an optical storage device, etc. The program code stored in the memory includes program instructions for executing one or more telecommunications and / or data communication protocols, and instructions for executing one or more of the technologies described herein. In some implementations, the processing circuit may be used to cause the corresponding functional units to perform the corresponding functions according to one or more embodiments of the present disclosure.

[0195] As described herein, the device and / or apparatus may be represented by a semiconductor chip, a chipset, or a (hardware) module including such a chip or chipset; however, this does not exclude the possibility that the function of the device or apparatus is not implemented by hardware, but is implemented as a software module, such as a computer program or a computer program product, which includes an executable software code portion for executing or being run on a processor. In addition, the function of the device or apparatus may be implemented by any combination of hardware and software. The device or apparatus may also be regarded as an assembly of multiple devices and / or apparatuses, whether they are mutually cooperative or independent in function. In addition, the device and apparatus may be implemented in a distributed manner throughout the system, as long as the function of the device or apparatus is retained. Such and similar principles are considered to be known to those skilled in the art.

[0196] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those commonly understood by those of ordinary skill in the art to which the present disclosure belongs. It will be further understood that the terms used herein should be interpreted as having the same meaning as they have in the context of this specification and the relevant art, and will not be interpreted in an idealized or overly formal sense unless explicitly defined as such in this article.

[0197] In addition, certain terms used in this disclosure, including the specification and drawings, may be used synonymously in some cases (e.g., "data" and "information"). It should be understood that although these terms (and / or other terms that may be synonymous with each other) may be used synonymously herein, there may be situations where such words are not intended to be used synonymously.

[0198] Embodiments of the techniques and devices described herein also include, but are not limited to, the following enumerated examples:

[0199] A1. A method for a network data analysis function (NWDAF) configured to assist in application detection in a communication network, the method comprising:

[0200] receiving an analysis request related to assisted application detection from a consumer network function (cNF) of a communication network;

[0201] Based on analyzing the request, sending an open request to a first DNS resolver associated with the communication network for events related to a mapping of a fully qualified domain name (FQDN) to an address for an application server associated with the application;

[0202] Receiving, from the first DNS resolver, a first FQDN associated with the first application in response to the open request;

[0203] Based on the first FQDN, determining one or more packet flow descriptions (PFDs) associated with the first application; and

[0204] According to the analysis request, the analysis result including the one or more PFDs is sent to the cNF.

[0205] A2. A method as described in embodiment A1, wherein the analysis request includes one or more of the following parameters that define filters for the requested analysis: area of ​​interest (AOI), single network slice selection auxiliary information (S-NSSAI), and data network name (DNN).

[0206] A3. The method as described in Example A2 also includes: sending a discovery request for a DNS resolver associated with the communication network to a network repository function (NRF) of the communication network, wherein the discovery request includes one or more parameters defining filters for the requested analysis.

[0207] A4. The method as described in embodiment A3 also includes: in response to the discovery request, receiving an identifier of the first DNS resolver and a profile for the first DNS resolver from the NRF, wherein sending the open request to the first DNS resolver is based on at least one of the identifier and the profile.

[0208] A5. The method of any one of embodiments A1-A4, wherein determining the one or more PFDs based on the first FQDN comprises:

[0209] determining an application identifier corresponding to the first FQDN; and

[0210] The one or more PFDs are selected based on an association of the one or more PFDs with the application identifier.

[0211] A6. The method of embodiment A5, wherein determining an application identifier corresponding to the first FQDN comprises:

[0212] sending the first FDQN to a network opening function (NEF) of the communication network; and

[0213] A response including the application identifier is received from the NEF.

[0214] A7. A method as described in any one of embodiments A1-A5, wherein the cNF is a network open function (NEF) of the communication network, or a unit or sub-function of the NEF.

[0215] B1. A method for a domain name service (DNS) resolver configured to assist in application detection in a communication network, the method comprising:

[0216] receiving, from a network data analysis function (NWDAF) of a communication network, an open request for an event related to a mapping of a fully qualified domain name (FQDN) to an address for an application server associated with an application;

[0217] subsequently mapping the first FQDN to an address for an application server associated with the first application; and

[0218] Based on the open request, the first FQDN is sent to the NWDAF.

[0219] B2. The method as described in embodiment B1 also includes: sending a request for registering the capabilities of the DNS resolver to a network repository function (NRF) of the communication network, wherein the open request is received based on the registration of the capabilities.

[0220] B3. The method of embodiment B2, wherein the request for registering the capabilities of the DNS resolver is an Nnrf_Registration Request message including the following information:

[0221] The identifier of the DNS resolver (DNS-ID);

[0222] Supports indication of events related to FQDN to address mapping; and

[0223] DNS resolver configuration information including one or more of the following: Area of ​​Interest (AOI), Single Network Slice Selection Assistance Information (S-NSSAI), and Data Network Name (DNN).

[0224] C1. A method for a consumer network function (cNF) of a communication network, the method comprising:

[0225] sending an analysis request related to the assisted application detection to a network data analysis function (NWDAF) of the communication network; and

[0226] According to the analysis request, analysis results including one or more packet flow descriptions (PFDs) associated with the first application are received from the NWDAF.

[0227] C2. The method as described in embodiment C1 also includes: sending one or more PFDs associated with the first application to a unified data repository (UDR) of the communication network for storage.

[0228] C3. The method as described in any one of embodiments C1-C2 also includes: sending one or more PFDs associated with the first application to a user plane function (UPF) of the communication network.

[0229] C4. A method as described in any one of embodiments C1-C3, wherein the analysis request includes one or more of the following parameters that define filters for the requested analysis: area of ​​interest (AOI), single network slice selection auxiliary information (S-NSSAI), and data network name (DNN).

[0230] C5. The method of any one of embodiments C1-C4, wherein the cNF is a network open function (NEF), or a unit or sub-function of an NEF.

[0231] D1. A method for a network repository function (NRF) of a communication network, the method comprising:

[0232] receiving, from a first domain name service (DNS) resolver associated with a communication network, a request to register capabilities of the first DNS resolver;

[0233] storing capabilities of the first DNS resolver in a profile for the first DNS resolver in accordance with the request;

[0234] receiving, from a network data analysis function (NWDAF) of the communication network, a discovery request for a DNS resolver associated with the communication network, wherein the discovery request includes one or more parameters defining an analysis filter;

[0235] determining that the stored capabilities of the first DNS resolver match one or more parameters included in the discovery request; and

[0236] A discovery response is sent to the NWDAF, the discovery response including an identifier of the first DNS resolver and a profile for the first DNS resolver.

[0237] D2. The method of embodiment B2, wherein the request for registering the capabilities of the DNS resolver is an Nnrf_Registration Request message including the following information:

[0238] an identifier of the first DNS resolver (DNS-ID);

[0239] Supports indication of events related to FQDN to address mapping; and

[0240] DNS resolver configuration information including one or more of the following: Area of ​​Interest (AOI), Single Network Slice Selection Assistance Information (S-NSSAI), and Data Network Name (DNN).

[0241] E1. A method for a unified data repository (UDR) for a communication network, the method comprising:

[0242] receiving one or more packet flow descriptions (PFDs) associated with a first application from a consumer network function (cNF) of the communication network; and

[0243] The one or more PFDs are stored as application data for a first application.

[0244] E2. The method as described in Example E1, further comprising:

[0245] receiving, from a second cNF of the communication network, a request for application data associated with the first application; and

[0246] In response to the request, the stored one or more PFDs are retrieved and the retrieved one or more PFDs are sent to the second cNF.

[0247] E3. The method of any one of embodiments E1-E2, wherein the cNF is a network open function (NEF), or a unit or sub-function of a NEF.

[0248] F1. A network data analysis function (NWDAF) configured to assist in application detection in a communication network, wherein:

[0249] The NWDAF is implemented by operatively coupled communication interface circuitry and processing circuitry; and

[0250] The processing circuit and the interface circuit are configured to perform operations corresponding to any of the methods described in Embodiments A1-A7.

[0251] F2. A network data analysis function (NWDAF) configured to assist in application detection in a communication network, the NWDAF being further configured to perform operations corresponding to any of the methods described in embodiments A1-A7.

[0252] F3. A non-transitory computer-readable medium storing computer-executable instructions which, when executed by a processing circuit associated with a network data analysis function (NWDAF) configured to assist in application detection in a communication network, configure the NWDAF to perform operations corresponding to any of the methods described in Examples A1-A7.

[0253] F4. A computer program product comprising computer executable instructions which, when executed by a processing circuit associated with a network data analysis function (NWDAF) configured to assist application detection in a communication network, configure the NWDAF to perform operations corresponding to any of the methods described in Examples A1-A7.

[0254] G1. A domain name service (DNS) resolver configured to assist in application detection in a communication network, wherein:

[0255] The DNS resolver is implemented by operatively coupled communication interface circuitry and processing circuitry; and

[0256] The processing circuit and the interface circuit are configured to perform operations corresponding to any of the methods described in embodiments B1-B3.

[0257] G2. A domain name service (DNS) resolver configured to assist in application detection in a communication network, the DNS resolver being further configured to perform operations corresponding to any of the methods described in embodiments B1-B3.

[0258] G3. A non-temporary computer-readable medium storing computer-executable instructions which, when executed by a processing circuit associated with a domain name service (DNS) resolver configured to assist application detection in a communication network, configure the DNS resolver to perform operations corresponding to any of the methods described in Examples B1-B3.

[0259] G4. A computer program product comprising computer executable instructions which, when executed by a processing circuit associated with a domain name service (DNS) resolver configured to assist application detection in a communication network, configure the DNS resolver to perform operations corresponding to any of the methods described in Examples B1-B3.

[0260] H1. A network opening function (NEF) configured to operate in a communication network, wherein:

[0261] The NEF is implemented by operatively coupled communication interface circuitry and processing circuitry; and

[0262] The processing circuit and the interface circuit are configured to perform operations corresponding to any of the methods described in embodiments C1-C5.

[0263] H2. A network open function (NEF) configured to operate in a communication network, the NEF being further configured to perform operations corresponding to any of the methods described in embodiments C1-C5.

[0264] H3. A non-temporary computer-readable medium storing computer-executable instructions which, when executed by a processing circuit associated with a network open function (NEF) configured to operate in a communications network, configure the NEF to perform operations corresponding to any of the methods described in Examples C1-C5.

[0265] H4. A computer program product comprising computer executable instructions which, when executed by a processing circuit associated with a network open function (NEF) configured to operate in a communication network, configure the NEF to perform operations corresponding to any of the methods described in Examples C1-C5.

[0266] I1. A network repository function (NRF) configured to operate in a communication network, wherein:

[0267] The NRF is implemented by operatively coupled communication interface circuitry and processing circuitry; and

[0268] The processing circuit and the interface circuit are configured to perform operations corresponding to any of the methods described in embodiments D1-D2.

[0269] I2. A network repository function (NRF) configured to operate in a communication network, the NRF further configured to perform operations corresponding to any of the methods described in embodiments D1-D2.

[0270] I3. A non-transitory computer-readable medium storing computer-executable instructions which, when executed by a processing circuit associated with a network repository function (NRF) configured to operate in a communications network, configure the NRF to perform operations corresponding to any of the methods described in embodiments D1-D2.

[0271] I4. A computer program product comprising computer executable instructions which, when executed by a processing circuit associated with a network repository function (NRF) configured to operate in a communication network, configure the NRF to perform operations corresponding to any of the methods described in embodiments D1-D2.

[0272] J1. A unified data repository (UDR) configured to operate in a communication network, wherein:

[0273] The UDR is implemented by operatively coupled communication interface circuitry and processing circuitry; and

[0274] The processing circuit and the interface circuit are configured to perform operations corresponding to any of the methods described in embodiments E1-E3.

[0275] J2. A unified data repository (UDR) configured to operate in a communication network, the UDR further configured to perform operations corresponding to any of the methods described in embodiments E1-E3.

[0276] J3. A non-temporary computer-readable medium storing computer-executable instructions which, when executed by a processing circuit associated with a unified data repository (UDR) configured to operate in a communication network, configure the UDR to perform operations corresponding to any of the methods described in Examples E1-E3.

[0277] J4. A computer program product comprising computer executable instructions which, when executed by a processing circuit associated with a unified data repository (UDR) configured to operate in a communication network, configure the UDR to perform operations corresponding to any of the methods described in Examples E1-E3.

Claims

1. A method for a network data analysis function (NWDAF) configured to assist application detection in a communication network, the method comprising: receiving (410) an analysis request related to the assisted application detection from a consumer network function cNF of the communication network; Based on the analysis request, sending (440) to a first DNS resolver associated with the communication network an open request for events related to a mapping of a fully qualified domain name (FQDN) to an address for an application server associated with an application; receiving (450) a first FQDN associated with a first application from the first DNS resolver in response to the open request; Based on the first FQDN, determining (460) one or more packet flow descriptions (PFDs) associated with the first application; as well as According to the analysis request, an analysis result including the one or more PFDs is sent (470) to the cNF.

2. The method of claim 1, wherein: The analysis request comprises one or more of the following parameters defining filters for the requested analysis: Area of ​​Interest AOI; Single Network Slice Selection Auxiliary Information S-NSSAI; and Data Network Name DNN.

3. The method of claim 2, further comprising: A discovery request for DNS resolvers associated with the communication network is sent (420) to a network repository function (NRF) of the communication network, wherein the discovery request comprises the one or more parameters defining the filters for the requested analysis.

4. The method of claim 3, further comprising: In response to the discovery request, an identifier of the first DNS resolver and a profile for the first DNS resolver are received (430) from the NRF, wherein sending (440) the open request to the first DNS resolver is based on at least one of the identifier and the profile.

5. The method according to any one of claims 1 to 4, wherein: Determining (460) the one or more PFDs based on the first FQDN includes: determining (461) an application identifier corresponding to the first FQDN; and The one or more PFDs are selected (462) based on the association of the one or more PFDs with the application identifier.

6. The method of claim 5, wherein: Determining (461) an application identifier corresponding to the first FQDN includes: sending the first FDQN to a network opening function NEF of the communication network; and A response including the application identifier is received from the NEF.

7. The method according to any one of claims 1 to 5, wherein: The cNF is a network open function NEF, or a unit or sub-function of NEF.

8. A method for a Domain Name Service (DNS) resolver configured to assist in application detection in a communication network, the method comprising: receiving (520) from a network data analysis function NWDAF of the communication network an open request for an event related to a mapping of a fully qualified domain name FQDN to an address for an application server associated with an application; then mapping (530) the first FQDN to an address for an application server associated with the first application; as well as According to the open request, the first FQDN is sent (540) to the NWDAF.

9. The method of claim 8, further comprising: A request for registering capabilities of the DNS resolver is sent (510) to a network repository function (NRF) of the communication network, wherein the open request is received based on the registration of the capabilities.

10. The method of claim 9, wherein: The request for registering the capabilities of the DNS resolver is a Nnrf_RegistrationRequest message including the following information: An identifier DNS-ID of the DNS resolver; an indication of support for opening events related to FQDN-to-address mapping; and Configuration information for the DNS resolver, comprising one or more of: an area of ​​interest AOI; single network slice selection auxiliary information S-NSSAI; and a data network name DNN.

11. A network data analysis function (NWDAF) (210, 340, 908, 1100, 1302) configured to assist in application detection in a communication network (198, 200, 300, 902), the NWDAF comprising: A communication interface circuit (1106, 1304) configured to communicate with a network function NF of the communication network and a first domain name service DNS resolver (330, 916, 1200, 1302); as well as A processing circuit (1102, 1304) operably coupled to the communication interface circuit, whereby the processing circuit and the communication interface circuit are configured to: receiving an analysis request related to the assisted application detection from a consumer network function cNF (220, 350, 908, 1100, 1302) of the communication network; Based on the analysis request, sending an open request to a first DNS resolver associated with the communication network for an event related to a mapping of a fully qualified domain name (FQDN) to an address for an application server associated with an application; receiving, from the first DNS resolver, a first FQDN associated with a first application in accordance with the open request; Based on the first FQDN, determining one or more packet flow descriptions (PFDs) associated with the first application; as well as According to the analysis request, an analysis result including the one or more PFDs is sent to the cNF.

12. The NWDAF of claim 11, wherein: The processing circuit and the communication interface circuit are further configured to perform operations corresponding to the method of any one of claims 2-7.

13. A network data analysis function (NWDAF) (210, 340, 908, 1100, 1302) configured to assist in application detection in a communication network (198, 200, 300, 902), the NWDAF being further configured to: receiving an analysis request related to the assisted application detection from a consumer network function cNF (220, 350, 908, 1100, 1302) of the communication network; Based on the analysis request, sending an open request for events related to mappings of fully qualified domain names (FQDNs) to addresses for application servers associated with an application to a first DNS resolver (330, 916, 1200, 1302) associated with the communication network; receiving, from the first DNS resolver, a first FQDN associated with a first application in accordance with the open request; Based on the first FQDN, determining one or more packet flow descriptions (PFDs) associated with the first application; as well as According to the analysis request, an analysis result including the one or more PFDs is sent to the cNF.

14. The NWDAF of claim 13, further configured to perform operations corresponding to the method of any one of claims 2-7.

15. A non-transitory computer-readable medium (1104, 1304) storing computer-executable instructions, which, when executed by a processing circuit (1102, 1304) associated with a network data analysis function (NWDAF) (210, 340, 908, 1100, 1302) configured to assist application detection in a communication network (198, 200, 300, 902), configures the NWDAF to perform operations corresponding to the method described in any one of claims 1-7.

16. A computer program product (1104a, 1304a) comprising computer executable instructions which, when executed by a processing circuit (1102, 1304) associated with a network data analysis function (NWDAF) (210, 340, 908, 1100, 1302) configured to assist application detection in a communication network (198, 200, 300, 902), configure the NWDAF to perform operations corresponding to the method described in any one of claims 1-7.

17. A domain name service (DNS) resolver (330, 916, 1200, 1302) configured to assist in application detection in a communication network (198, 200, 300, 902), the DNS resolver comprising: a communication interface circuit (1208, 1304) configured to communicate with a network function NF of the communication network; as well as A processing circuit (1102, 1304) operably coupled to the communication interface circuit, whereby the processing circuit and the communication interface circuit are configured to: receiving, from a network data analysis function NWDAF (210, 340, 908, 1100, 1302) of the communication network, an open request for an event related to a mapping of a fully qualified domain name (FQDN) to an address for an application server associated with an application; subsequently mapping the first FQDN to an address for an application server associated with the first application; as well as According to the open request, the first FQDN is sent to the NWDAF.

18. The DNS resolver of claim 17, wherein: The processing circuit and the communication interface circuit are further configured to perform operations corresponding to the method of any one of claims 9-10.

19. A domain name service (DNS) resolver (330, 916, 1200, 1302) configured to assist in application detection in a communication network (198, 200, 300, 902), the DNS resolver further configured to: receiving, from a network data analysis function NWDAF (210, 340, 908, 1100, 1302) of the communication network, an open request for an event related to a mapping of a fully qualified domain name (FQDN) to an address for an application server associated with an application; subsequently mapping the first FQDN to an address for an application server associated with the first application; as well as According to the open request, the first FQDN is sent to the NWDAF.

20. The DNS resolver of claim 19, further configured to perform operations corresponding to the method of any one of claims 9-10.

21. A non-transitory computer-readable medium (1212, 1304) storing computer-executable instructions which, when executed by a processing circuit (1202, 1304) associated with a domain name service (DNS) resolver (330, 916, 1200, 1302) configured to assist in application detection in a communication network (198, 200, 300, 902), configure the DNS resolver to perform operations corresponding to the method of any one of claims 8-10.

22. A computer program product (1214, 1304a) comprising computer executable instructions which, when executed by a processing circuit (1202, 1304) associated with a domain name service (DNS) resolver (330, 916, 1200, 1302) configured to assist application detection in a communication network (198, 200, 300, 902), configure the DNS resolver to perform operations corresponding to the method of any one of claims 8-10.

23. A communication network (198, 200, 300, 902), comprising: a network data analysis function NWDAF (210, 340, 908, 1100, 1302) configured to assist in application detection in said communication network; as well as The network repository function NRF (220, 370, 908, 1100, 1302) is configured to: receiving, from a first domain name service (DNS) resolver (330, 916, 1200, 1302) associated with the communication network, a request to register capabilities of the first DNS resolver; storing capabilities of the first DNS resolver in a profile for the first DNS resolver in accordance with the request; receiving, from the NWDAF, a discovery request for a DNS resolver associated with the communication network, wherein the discovery request includes one or more parameters defining an analysis filter; determining that the stored capabilities of the first DNS resolver match the one or more parameters included in the discovery request; and A discovery response including an identifier of the first DNS resolver and the profile for the first DNS resolver is sent to the NWDAF.

24. The communication network of claim 23, wherein: The request for registering the capabilities of the first DNS resolver is a Nnrf_Registration Request message including the following information: An identifier DNS-ID of the first DNS resolver; The first DNS resolver supports an indication of an event related to mapping of a fully qualified domain name (FQDN) to an address; and Configuration information for the first DNS resolver, which includes one or more of the following: an area of ​​interest AOI; single network slice selection auxiliary information S-NSSAI; and a data network name DNN.

25. A communication network as claimed in any one of claims 23 to 24, wherein: The one or more parameters defining the analysis filter include one or more of: an area of ​​interest AOI; single network slice selection auxiliary information S-NSSAI; and a data network name DNN.

26. The communication network according to any one of claims 23 to 25, further comprising: The consumer network function cNF (220, 350, 908, 1100, 1302) is configured as: Sending an analysis request related to the assisted application detection to the NWDAF; as well as According to the analysis request, an analysis result including one or more packet flow descriptions (PFDs) associated with the first application is received from the NWDAF.

27. A communications network as claimed in claim 26, wherein: The discovery request received by the NRF is based on the analysis request sent by the cNF; and The analysis request includes the one or more parameters defining the analysis filter.

28. A communication network as claimed in any one of claims 26 to 27, wherein: The cNF is a network open function NEF, or a unit or sub-function of NEF.

29. The communication network according to any one of claims 26 to 28, further comprising: Unified Data Repository UDR (360, 908, 1100, 1302), where: The cNF is further configured to send the one or more PFDs associated with the first application to the UDR for storage; and The UDR is configured to store the received one or more PFDs as application data for the first application.

30. The communication network of claim 29, wherein: The UDR is also configured to: receiving, from a second cNF of the communication network, a request for application data associated with the first application; and In response to the request, the stored one or more PFDs are retrieved and the retrieved one or more PFDs are sent to the second cNF.

31. The communication network according to any one of claims 23 to 30, further comprising: The first DNS resolver.

32. A communication network as claimed in any one of claims 23 to 31, wherein: Each of the NWDAF and the NRF is implemented by: a communication interface circuit (1106, 1304) configured to communicate with a network function NF of the communication network; and A processing circuit (1102, 1304) is operably coupled to the communication interface circuit.

Images