Data session specific monitoring

Abstract

The present application relates to a method for controlling detection of a plurality of packet data sessions present in a user plane of a cellular network, comprising determining one or more types of possible security threats, network configuration data of the cellular network comprising a topology of the cellular network, and security objects to be applied to the plurality of packet data sessions. A detection profile is determined based on the determined information, the detection profile including at least one detection criterion indicating which of the plurality of packet data sessions in the user plane should be monitored for what type of security threat and for which security object. The detection profile is sent to the user plane entities, and a detection report is received from one of the user plane entities, and the detection report is further processed.

Description

Technical Field

[0001] The present application relates to a method performed at a control entity configured to control the detection of a plurality of packet data sessions present in the user plane of a cellular network, and to a method performed at a user plane entity configured to handle a plurality of packet data sessions. In addition, corresponding control entities and user plane entities are provided. Further, a system including a control entity and a user plane entity, a computer program including program code, and a carrier including the computer program are provided. Background Art

[0002] Today, traffic in mobile networks is mainly dominated by web-based traffic characterized by UEs (User Equipment) accessing Internet servers. This is the case for Mobile Broadband (MBB) traffic in the public networks of Communication Service Providers (CSPs), but it is also the main connection model for Non-Public Networks (NPNs) such as Mission Critical and / or industrial deployments.

[0003] Figure 1 A conventional UE-Internet connection model for MBB traffic on a 3GPP NR radio access network (RAN) is shown, which has a decomposed gNB architecture using NR dual connectivity via 2 gNBs.

[0004] UE 10 is connected to a master gNB, MgNB 20 and a secondary radio access node 30SgNB, where AMF 40 is connected to the master gNB, providing SMF 50 and UPF 60, and the UPF is connected to the Internet 70. In Figure 1 the case shown, the UE can connect to services provided on the Internet. In the conventional MBB traffic model, the traffic is mainly dominated by the downlink.

[0005] Generally, the same connection model can be observed among early adopters of industrial use cases. As Figure 2As shown, the robot or any device 15 uses the same connectivity as the primary wireless access node 20 and the secondary node 30. The difference is that in many cases in industrial deployments, the data network DN is accessed on the local data center 80 residing in the industrial facility or campus, so the user plane data stream does not leave the company's area, and the propagation delay to a potential remote data center is eliminated. For example, the device 15 of the robot is connected to the control service on the company intranet. The dedicated application-specific control protocol runs over an IP or Ethernet connection. The feature called "UE post-routing" allows multiple devices and sensors to access the network via one UE, thus increasing the attack surface. The traffic is no longer necessarily dominated by downlink traffic, and limiting packet delay is essential. Any compromised device 15 such as a robot can be used to gain access to the industrial network. One option to overcome this problem is to place security devices such as intrusion detection, malware detection, or firewalls on the IT infrastructure of the N6 interface of the connection Figure 2 and potentially block the traffic from the device in case of anomalies. The increased security requirements for many of these non-public networks, such as in industrial environments, are addressed by running appropriate security software in the IT domain on the local data center 80. Thus, compromised devices sending malicious traffic can be identified and action can be taken. One of the reasons for not placing the security software on the robot or device is the limited processing power on the device, and especially for non-fixed devices, the battery life is crucial for industrial use cases.

[0006] However, for the communication model, it is no longer possible to protect the data stream through the security instance in the local data center when transferring from the traditional UE-Internet model to direct UE-UE communication. At the same time, the constraints on the processing power and battery life on the UE remain valid.

[0007] Figure 3 The communication between two UEs such as device 15 and device 16 is shown, where device 15 is connected to the primary wireless node 20 and the secondary wireless node 30, while device 16 is connected to the primary wireless node 21 and the secondary wireless node 31. Devices 15 and 16 can also be served by the same wireless access node. As Figure 3 shown, in such a communication scenario, the data stream between devices 15 and 16 does not leave the mobile network, especially it does not cross the IT domain, so any security software in the IT domain will not be able to detect malicious content and thus does not have the ability to detect compromised devices.

[0008] Existing security solutions do not have fine-grained visibility to protect selected data flows individually, such as PDU sessions or Quality of Service (QoS) flows. Existing solutions either apply to all data flows of all users or, in more advanced cases, they are able to associate data flows with specific users and apply security policies to all data flows of that user. For future advanced features and services, this per-UE granularity is considered too coarse because it does not take into account attributes such as network slices, target domain names, or other industry-specific attributes. Another example where a finer granularity of differentiation is needed is the case where multiple different devices using different service types are hidden behind a UE acting as a common access device. In this case, there may be many flows that do not need to be detected, but a few flows with higher security requirements need to be identified. Without this fine-grained differentiation, the radio access network node needs to unnecessarily spend more valuable processing power than required for the security function, thus limiting the overall performance of the radio access network node. This will result in a lower energy efficiency implementation and will result in a higher cost per transmitted byte, leading to a higher total cost for the owner. Summary of the Invention

[0009] Therefore, it is necessary to overcome the above problems and provide the possibility of implementing monitoring of data packet flows with finer granularity.

[0010] This need is met by the features of the independent claims. Further aspects are described in the dependent claims.

[0011] According to a first aspect, there is provided a method performed at a control entity that controls the detection of a plurality of packet data sessions present in a user plane of a cellular network. The method includes the steps of determining one or more types of security threats. Further, determining network configuration data of the cellular network, including the topology of the cellular network. Determining security objects to be applied to the plurality of data sessions and determining a detection profile based on the determined one or more types of possible security threats, the security objects, and the network configuration data, wherein the detection profile includes at least one detection criterion indicating for what type of security threat and for which security object, e.g., for which one of the plurality of packet data sessions, to monitor which of the plurality of packet data sessions in the user plane. Sending the determined detection profile to a user plane entity in a radio access part of the cellular network and further receiving from at least one of the user plane entities a detection report generated in response to the sent detection profile, wherein the detection report reports at least one packet data session among the plurality of packet data sessions that satisfies the at least one detection criterion. Then, the control entity can process the received detection report.

[0012] In addition, corresponding control entities are provided, which operate as discussed above or as discussed in further detail below. The control entity can be a new node in the network and operate as an intelligent security control function, which ensures that the security software is only invoked for selected data flows. These selected data flows are present in the detection profile. Based on the topology, the type of possible security threats, and the security objects, a very specific detection profile can be generated, which is then used by the user plane entity to detect a specific packet data session.

[0013] In addition, a method is provided for execution at a user plane entity configured to handle multiple packet data sessions, wherein the user plane entity receives a detection profile from a control entity configured to control the detection of multiple packet data sessions, the detection profile including at least one detection criterion that indicates for what type of security threat and for which security object to monitor which of the multiple packet data sessions in the user plane. Then, the user plane entity monitors the packet data sessions processed in the user plane entity and determines that at least one of the multiple packet data sessions satisfies the at least one detection criterion, wherein a detection report is sent to the control entity, and the detection report indicates that the detection criterion is satisfied for the at least one packet data session.

[0014] In addition, corresponding user plane entities are provided, which operate as discussed above or as discussed in further detail below. In addition, a system including a control entity and a user plane entity is provided.

[0015] It should be understood that, without departing from the scope of the present invention, the features mentioned above and the features to be explained below can be used not only in the respective combinations indicated, but also in other combinations or alone. The features of the above aspects and the embodiments described below can be combined with each other in other embodiments, unless otherwise explicitly mentioned. Description of the Drawings

[0016] The foregoing and additional features and effects of the present invention will become apparent when the following detailed description is read in conjunction with the accompanying drawings, in which like reference numerals represent like elements.

[0017] Figure 1 A schematic diagram showing the architecture when a UE is connected to a radio access network for mobile broadband services using dual connectivity known in the art.

[0018] Figure 2 A schematic diagram showing the architecture when a device such as a robot is connected to a non-public network known in the art.

[0019] Figure 3A schematic diagram of an architecture is shown in which two devices use a UE-to-UE communication scheme known in the art.

[0020] Figure 4 A schematic architectural view of a system including a control entity is shown, the control entity being configured to provide and control the monitoring of packet data sessions with fine granularity.

[0021] Figure 5 A schematic diagram is shown including Figure 4 a flowchart of steps performed by the control entity shown.

[0022] Figure 6 A schematic diagram is shown including Figure 4 a flowchart of steps performed at a user plane entity of the architecture shown.

[0023] Figure 7 A schematic diagram is shown Figure 4 of a schematic architectural view of the control entity shown.

[0024] Figure 8 A schematic diagram is shown Figure 4 of a schematic architectural view of the user plane entity shown. Detailed Description of the Invention

[0025] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. It should be understood that the following description of the embodiments should not be construed in a limiting sense. The scope of the present invention is not intended to be limited by the embodiments or the drawings described below, and the drawings are merely illustrative.

[0026] The drawings are considered to be schematic representations, and the elements shown in the drawings are not necessarily shown to scale. Instead, the various elements are shown such that their functions and general purposes are made apparent to those skilled in the art. Any connection or coupling between the components of the functional blocks, devices, physical or functional units shown in the drawings and described hereinafter can also be achieved by indirect connection or coupling. The coupling between the components can be established by wired or wireless connections. The functional blocks can be implemented in hardware, software, firmware, or a combination thereof.

[0027] In the context of the present application, the term "mobile entity" or "user equipment" (UE) refers to a device, for example, used by a person (i.e., a user) for his or her personal communication. It can be a device of the telephone type, such as a telephone or a Session Initiation Protocol (SIP) or Voice over IP (VoIP) telephone, a cellular phone, a mobile station, a cordless phone, or a device of the personal digital assistant type, such as a laptop, notebook, notepad, or tablet equipped with a wireless data connection. The UE can also be associated with non-humans such as animals, plants, or machines. The UE can be equipped with a SIM (Subscriber Identity Module) or an eSIM, which includes a unique identity associated with the user using the UE, such as an IMSI (International Mobile Subscriber Identity), a TMSI (Temporary Mobile Subscriber Identity), or a GUTI (Globally Unique Temporary UE Identity). The presence of the SIM within the UE uniquely customizes the UE using the user's subscription.

[0028] For clarity, note that there is a difference between a user and a subscriber, but there is also a close connection. A user obtains access to the network by obtaining a subscription to the network and thereby becomes a subscriber within the network. The network then identifies the subscriber (e.g., by IMSI, TMSI, or GUTI, etc.) and uses the associated subscription to identify the relevant subscriber data. The user is the actual user of the UE, and the user can also be the owner of the subscription, but the user and the owner of the subscription can also be different. For example, the subscription owner can be a parent, and the actual user of the UE can be the parent's child.

[0029] Part of the solution is to place security software inside the radio access network user plane processing node. The detection of such security threats also applies to encrypted traffic such as https, which is dominant in today's traffic, without the need to decrypt and re-encrypt the traffic. This has been shown and proven in some articles, such as:

[0030] 1. Detection of HTTPS Malware Traffic, from Stfasak, F, Garcia, S (2017), Bachelor's Thesis

[0031] 2. Malware Detection through HTTPS Traffic Analysis, from Paul Prasse, Gerrit Gruben, Lukas Machlika, Tomas Pevny, Michal Sofka, Tobias Scheffer, University of Potsdam

[0032] Advanced methods for detecting security threats in encrypted traffic are less intensive than traditional decryption and re-encryption of the payload, but they still consume additional capabilities.

[0033] Accordingly, as will be explained below, the present invention provides a method in a system for optimizing the use of scarce processing capabilities in a radio access network node. This is achieved by adding a control entity that acts as an intelligent security controller function. This control entity ensures that security software is only invoked for selected data flows.

[0034] Figure 4 A schematic overview of the architecture is provided, in which a control entity 100 is provided that ensures that any security software is only invoked for selected data flows. An important aspect is that information about the UE and its data flows, such as PDU sessions or QoS flows from the core network CN and radio access network RAN, is combined to identify which data flows or packet data sessions should be monitored. This decision is made in the control entity 100. This entity can be regarded as a logical instance or function and is part of an existing node or function in the 3GPP or O-RAN architecture. It can also be implemented as a new node or function. A possible implementation of such a control entity 100 can be an independent function or, alternatively but not limited to, the "rAPP" in the O-RAN Service Management and Orchestration SMO function. Refer to Figure 4 , the initialization and initial configuration of the control entity 100 are performed in steps S11 and S12. In this first initialization or initial configuration step, the control entity 100 interacts with the network management system NMS 91 to learn about the topology and configuration information of the network, such as packet core nodes, connected radio access network nodes, their operation and maintenance addresses, and locations, etc. Thus, in this step, the control entity is notified of the existence of radio access node 300 with a centralized control plane entity 320, user plane entity 200 with a distributed unit 310, and radio access node 400 including a corresponding centralized control plane entity 420, user plane entity 200, and distributed unit 410. Each radio access node is configured to receive a packet data session and forward it to the user plane function 94. In addition, the existence and location of the AMF 92 or SMF 93 are determined in this case.

[0035] As an example, the network configuration information includes information about the serving radio access nodes, here nodes 300 and 400 and the user plane entity 200. In addition, the UE IP address allocation policy and UE IP address range, such as the IP address for each domain name DN, are determined, possible network slice information S-NSSAI, URSP, and location information, such as cell identifier, geographical location, and serving node.

[0036] In step S13, a detection profile is generated. Here, the control entity creates a detection profile. The detection profile uses a security policy defined by a communication service provider (CSP) as input. The detection profile defines what types of security threats, such as malware, intrusion, or denial of service (DoS), the security software in the radio access network user plane should detect, and against which objects. There can be different security objects. As an example, the security policy can detect all traffic between machines in a defined geographical area using Ethernet-type communication. Another example is to detect all traffic in a defined network slice. Other security objects or criteria can be used, such as PDU session type, UE IP address range, PDU session ID or session ID range as a separate ID, S-NSSAI, IAB (integrated access and backhaul) node indication, and indication such as UE post-routing.

[0037] In step S14, the created detection profile is used to update the radio access network nodes. The control entity 100 determines which of the radio access network nodes need to know which detection profile, for example based on geographical information or connectivity information, and then sends the detection profile to the affected radio nodes, such as nodes 300 and 400, and here specifically to Figure 4 the user plane entity 200 shown. The control entity 100 does not need to know the UE connectivity details in the radio access network, such as dual-connectivity usage mode, bearer type, carrier aggregation configuration, etc. In the example shown, the radio access network nodes adopt a dual-connectivity usage mode. It should be understood that the present invention is not limited to using two radio access network nodes, and a single node such as node 300 can also be used without node 400.

[0038] Step S15 involves the establishment or modification of a data packet session / data flow. During the establishment or modification of a data flow such as a PDU session or a QoS flow, the node 200 compares the detection profile with its local information about the UE and its data flow. Based on the received detection profile, the most suitable radio node gNB / CU-UP (centralized unit - user plane) decides whether the data flow needs to be detected by the security software. Generally, if detection is considered necessary, the activation of the security software in the data flow will be the radio access node, the centralized unit - user plane serving the N3 interface. In the embodiment shown, the separation of the control plane and the user plane is performed, and each centralized unit CU includes one or more distributed units, such as unit 310 or 410.

[0039] In step S16, any suspicious activity in the packet data session is reported. In the case where the security software detects suspicious activity or a file in the monitored data stream, the control entity 100 is notified of the observation with the event, which includes available context information such as the UE identifier in the radio access network, the serving radio access network node, the serving core node, the IP address or the endpoint address of the MAC, the domain name DN, the data stream establishment time or the detection timestamp.

[0040] In step S17, the reported event is further processed. Thus, after receiving the report, the reported event is evaluated in the control entity 100 and, for example, visualized to a security expert for further analysis. It is also possible to take automatic actions, such as isolating the device, routing the traffic to a sandbox for monitoring or analysis or blocking UE-to-UE communication, and such further actions may require additional operations of the control entity 100 on the traffic handling node 200.

[0041] In summary, the present invention allows per-data-stream activation of additional security for selected UEs in a radio access network. This is obtained by combining knowledge from the core network and radio access network nodes in a logical entity named the control entity 100. The control entity 100 provides the information necessary for security activation to the involved radio access network nodes.

[0042] In Figure 5 more detail, some of the main steps performed by the control entity 100 in the above solution are shown. In step S51, the control entity 100 determines one or more types of possible security threats to detect, for example, malware, intrusion or denial of service. Further, in step S52, the control entity 100 determines the network configuration data of the cellular network, where the network configuration data at least includes the topology of the cellular network. In step S53, the security object is determined, which means which type of packet data session should be monitored, for example, a session of a predefined PDU type or a session with a specific IP address or address range, a session with a specific session identifier, etc. Step S54 determines a detection profile based on the security threats to be detected, the security object and the network configuration data. The detection profile includes detection criteria, which indicate which packet data sessions should be monitored for what type of security threat and for which security object. In step S55, the generated detection profile is sent to the user plane node 200. When the user plane node detects traffic that meets one of the detection criteria, the node 200 sends a detection report, which is received by the control entity 100 in step S56. This report reports the data packet sessions that comply with the detection criteria. In step S57, the detection report is further processed, meaning that any countermeasure can be taken, or the report is simply indicated to the user of the system.

[0043] Figure 6 summarizes some steps performed by the Figure 4 user plane entity shown in Figure 4 . The entity 200 receives a detection profile in step S61, monitors data packets processed by the user plane entity in step S62, and in step S63 may determine that at least one of the packet data sessions from the monitored sessions meets at least one of the detection criteria mentioned in the detection profile. In this case, a detection report is transmitted to the control entity 100 in step S64.

[0044] Generally, the term "determine" as used in this context includes obtaining, receiving, or actively retrieving the required information segment from another entity or from another entity or storage location.

[0045] Figure 7 shows a schematic architectural view of the control entity 100, which relates to the steps discussed in conjunction with Figure 4 The control entity can be an independent unit or can be implemented in any other node as described above. The control entity 100 includes an interface 110, which is provided for transmitting control messages or any other data to other entities, such as the involved radio access network nodes that process user plane data. In the same way, the interface 110 is provided for receiving messages such as detection reports from other entities. The entity 100 also includes a processing unit 120 responsible for the operation of the control entity 100. The processing unit 120 may include one or more processors and may execute instructions stored on a memory 130, where the memory may include read-only memory, random access memory, mass storage, hard disk, etc. or any other type of memory. The memory may also include suitable program code to be executed by the processing unit 120 in order to implement the above-mentioned functionality involved in the control entity 100.

[0046] Figure 8 shows a schematic architectural view of the user plane entity 200 that processes a packet data session and receives a detection profile from the control entity 100. The user plane entity 200 includes an interface 210, which is provided for sending user data such as a data packet session to other entities and is provided for receiving user data or control messages from other entities, such as from other user plane nodes or from the control entity 100. The user plane entity 200 includes a processing unit 220, which is responsible for the operation of the user plane entity 200. The processing unit 220 includes one or more processors and may execute instructions stored on a memory 230, where the memory may include read-only memory, random access memory, mass storage, hard disk, etc. The memory 230 may also include suitable program code to be executed by the processing unit 220 in order to implement the above-mentioned functions involved in the user plane entity 200.

[0047] Some general conclusions can be drawn from the above:

[0048] In terms of the control entity, the detection profile determined by the control entity may request the user plane entity to only detect and monitor at least one data packet session that meets at least one detection criterion from among multiple packet data sessions, without monitoring packet data sessions from multiple packet data sessions that do not meet the detection criterion.

[0049] Determining network configuration data may mean requesting topology information from a network management entity such as Figure 4 the NMS 91 shown, and may include accessing a session management entity such as the SMF 93 based on the requested topology information to request at least some network configuration data from the SMF. Examples of topologies may be packet core nodes, connected radio access network nodes and their operation and maintenance addresses, and the locations of different nodes.

[0050] When determining network configuration data, it is generally possible to determine available packet core network nodes, serving radio access network nodes, the IP address allocation policy for user equipment in the cellular network, the IP address range for each domain name allocated in the cellular network, the network slice information for new network slices of the cellular network, or the geographical location data of the services and nodes present in the cellular network.

[0051] When determining security objects, the following information may be determined: packet data sessions of specific or certain PDU types, packet data sessions with IP addresses within a predefined IP address or range of IP addresses, data packet sessions with a predefined session identifier, packet data sessions with a predefined slice identifier, packet data sessions with a "UE post-routing" indicator, packet data sessions with an integrated access and backhaul IAB indicator. The detection criteria may include the type of data packet session and possible security threats.

[0052] When determining the detection profile, it can be determined which type of security threat is to be detected on which entity operating in the cellular network.

[0053] The received detection report received by the control entity 100 may contain the following information: which detection profile triggered the received detection report, which detection criteria were matched, the identifier of the user equipment involved in the packet data session, the serving radio access node handling the packet data session, the serving core network node, the addresses of the endpoints of the packet data session, the domain name, or a time indicator of when the packet data session was established or detected.

[0054] In addition, the processing of the received detection profile may include actions such as visualization of the detection report, isolation of the user equipment involved in at least one packet data, and routing of the packets to a predefined destination or blocking data packets sent by or received by the user equipment involved in at least one packet data session. The last step may be initiated by a control entity and then finally executed by the user plane entity 200.

[0055] Compared with known solutions, the main advantage of the above solution is that the processing capabilities in the radio access network nodes are only used to monitor or protect the selected data flows with special security requirements. Data flows that are less interesting or have already been monitored elsewhere in the user plane processing path can bypass the detection in the RAN, and thus scarce RAN processing capabilities are left to handle other traffic. Thereby, the processing in the RAN nodes is optimized, resulting in minimized power consumption, or if a constant processing power is assumed, the capabilities can be used to process more data flows, resulting in increased node data flow processing capabilities.

Claims

1. A method performed at a control entity (100), the control entity being configured to control the detection of a plurality of packet data sessions present in the user plane of a cellular network, the method comprising: - determining one or more types of possible security threats, - determining network configuration data of the cellular network including the topology of the cellular network, - determining security objects to be applied to the plurality of packet data sessions, - determining a detection profile based on the determined one or more types of possible security threats, the security objects, and the network configuration data, the detection profile including at least one detection criterion indicating which of the plurality of packet data sessions in the user plane should be monitored for what type of security threat and for which security object; - sending the detection profile to a user plane entity (200) in a radio access part of the cellular network; - receiving from at least one of the user plane entities a detection report generated in response to the sent detection profile, the detection report reporting at least one packet data session among the plurality of packet data sessions that meets the at least one detection criterion; and - processing the received detection report.

2. The method according to claim 1, wherein The detection profile requests the user plane entity to only detect and monitor at least one packet data session among the plurality of packet data sessions that meets the at least one detection criterion, without monitoring packet data sessions among the plurality of packet data sessions that do not meet the detection criterion.

3. The method according to claim 1 or 2, characterized in that, Determining network configuration data includes requesting topology information from a network management entity of the cellular network and accessing a session management entity based on the requested topology information to request at least some of the network configuration data from the session management entity.

4. The method according to any one of the preceding claims, wherein Determining network configuration data includes determining at least one of the following: - available packet core network nodes, - serving radio access network nodes, - an IP address allocation policy for user equipment in the cellular network, - an IP address range for each domain name allocated in the cellular network, - network slice information of a network slice of the cellular network, or - geographical location data of cells and nodes present in the cellular network.

5. The method according to any one of the preceding claims, wherein, The security objects include at least one of the following: - a packet data session of a predefined PDU type, - a packet data session having an IP address in a predefined IP address or a predefined IP address range, - a packet data session having a predefined session identifier, - a packet data session having a predefined slice identifier, - a packet data session having a "UE post-routing" indicator, or - a packet data session having an "integrated access and backhaul" indicator.

6. The method according to any one of the preceding claims, wherein, The detection criterion includes the type of the packet data session and the possible security threat.

7. The method according to any one of the preceding claims, wherein, Determining the security profile includes determining on which entity to operate in the cellular network to detect what type of security threat.

8. The method according to any one of the preceding claims, wherein, The received detection report includes at least one of the following: - which detection profile triggered the received detection report, - which detection criterion was matched, - an identifier of the user equipment involved in the packet data session, - The serving radio access node that processes the packet data session, - The serving core network node, - The address of the endpoint of the packet data session, - The domain name, or - A time indicator of when the packet data session is established or detected.

9. The method according to any one of the preceding claims, wherein, The processing of the received detection profile includes at least one of the following: - Visualizing the detection report, - Isolating the user equipment involved in the at least one packet data session, - Routing the packets of the packet data session to a predefined destination, or - Blocking the packet data session sent to or received from the user equipment involved in the packet data session.

10. A method performed at a user plane entity configured to process multiple packet data sessions, the method comprising: - Receiving, from a control entity configured to control the detection of multiple packet data sessions, a detection profile that includes at least one detection criterion, the at least one detection criterion indicating which of the multiple packet data sessions in the user plane should be monitored for what type of security threat and against which security object, - Monitoring the packet data sessions processed by the user plane entity, - Determining that at least one packet data session among the multiple packet data sessions meets the at least one detection criterion, and - Sending a detection report to the control entity, the detection report indicating that the at least one packet data session meets the detection criterion.

11. The method according to claim 10, wherein, The security object includes at least one of the following pieces of information: - A packet data session of a predefined PDU type, - A packet data session having an IP address within a predefined IP address or a range of predefined IP addresses, or other transport network address, - A packet data session having a predefined session identifier, - A packet data session having a predefined slice identifier, - A packet data session having a "post-UE routing" indicator, or - A packet data session having an "integrated access and backhaul" indicator.

12. The method according to claim 10 or 11, wherein The sent detection report includes at least one of the following: - The identifier of the user equipment involved in the packet data session, - The serving radio access node identifier that processes the packet data session, - The serving core network node identifier, - The address of the endpoint of the packet data session, - The domain name, or - A time indicator of when the packet data session is established or detected.

13. A control entity (100) configured to control the detection of multiple packet data sessions present in the user plane of a cellular network, the control entity comprising a processing unit and a memory, the memory including instructions executable by the at least one processing unit, the control entity being configured to: - Determine one or more types of security threats to detect, - Determine the network configuration data of the cellular network including the topology of the cellular network, - Determine the security objects to be applied to the multiple packet data sessions, - Determine a detection profile based on the identified one or more types of possible security threats, the security object, and the network configuration data, the detection profile including at least one detection criterion indicating which of the plurality of packet data sessions in the user plane should be monitored for what type of security threat and for which security object. - Send the detection profile to a user plane entity (200) in the radio access part of the cellular network. - Receive from at least one of the user plane entities a detection report generated in response to the sent detection profile, the report reporting at least one packet data session among the plurality of packet data sessions that meets the at least one detection criterion, and - Process the received detection report.

14. The control entity according to claim 13, wherein, The detection profile requests the user plane entity to only detect and monitor at least one packet data session among the plurality of packet data sessions that meets the at least one detection criterion, and not to monitor the packet data sessions that do not meet the detection criterion among the plurality of packet data sessions.

15. The control entity according to claim 13 or 14, further configured to request topology information from a network management entity of the cellular network for determining network configuration data, and access a session management entity based on the requested topology information to request at least some of the network configuration data from the session management entity.

16. The control entity according to any one of claims 13 to 15, further configured to determine at least one of the following for determining network configuration data: - Available packet core network nodes, - Serving radio access network nodes, - IP address allocation policy for user equipment in the cellular network, - IP address range for each domain name allocated in the cellular network, - Network slice information of network slices of the cellular network, or - Geographic location data of cells and nodes existing in the cellular network.

17. The control entity according to any one of claims 13 to 16, wherein The security object includes at least one of the following: - A packet data session of a predefined PDU type, - A packet data session having an IP address in a predefined IP address or a predefined IP address range, - A packet data session having a predefined session identifier, - A packet data session having a predefined slice identifier, - A packet data session having a "UE post-routing" indicator, or - A packet data session having an "integrated access and backhaul" indicator.

18. The control entity according to any one of claims 13 to 17, wherein, The detection criterion includes the type of the packet data session and the possible security threat.

19. The control entity according to any one of claims 13 to 18, further configured to determine on which entity to be operated in the cellular network to detect what type of security threat for determining the detection profile.

20. The control entity according to any one of claims 13 to 19, further configured to, for processing the received detection profile, - Visualize the detection report, - Isolate the user equipment involved in the at least one packet data session, - Route the packets of the packet data session to a predefined destination, or - Block the packet data session sent to or received from the user equipment involved in the packet data session.

21. A user plane entity configured to handle multiple packet data sessions, the user plane entity comprising a processing unit and a memory, the memory comprising instructions executable by the at least one processing unit, the user plane entity being configured to: - Receive a detection profile from a control entity configured to control the detection of multiple packet data sessions, the detection profile comprising at least one detection criterion, the at least one detection criterion indicating which of the multiple packet data sessions in the user plane should be monitored for what type of security threat and against which security object, - Monitor the packet data sessions processed by the user plane entity, - Determine that the at least one detection criterion is met for at least one of the multiple packet data sessions, and - Transmit a detection report to the control entity, the detection report indicating that the detection criterion is met for the at least one packet data session.

22. The user plane entity according to claim 21, wherein, The security object comprises at least one of the following pieces of information: - A packet data session of a predefined PDU type, - A packet data session having an IP address in a predefined IP address or range of predefined IP addresses, or other transport network address, - A packet data session having a predefined session identifier, - A packet data session having a predefined slice identifier, - A packet data session having a "UE post-routing" indicator, or - A packet data session having an "integrated access and backhaul" indicator.

23. The user plane entity according to claim 21 or 22, wherein, The transmitted detection report comprises at least one of the following: - An identifier of the user equipment involved in the packet data session, - A serving radio access node identifier handling the packet data session, - A serving core network node identifier, - An address of an endpoint of the packet data session, - A domain name, or - A time indicator of when the packet data session was established or detected.

24. A system comprising a control entity as claimed in any one of claims 13 to 20 and a user plane entity as claimed in any one of claims 21 to 23.

25. A computer program comprising program code to be executed by a processing unit of a control entity, wherein execution of the program code causes the at least one processing unit to perform the method as claimed in any one of claims 1 to 9.

26. A computer program comprising program code to be executed by a processing unit of a user plane entity, wherein execution of the program code causes the at least one processing unit to perform the method as claimed in any one of claims 10 to 13.

27. A carrier comprising the computer program as claimed in claim 25 or 26, wherein the carrier is one of an electronic signal, an optical signal, a wireless signal and a computer-readable storage medium.

Images