Protocol data unit set information identification for end-to-end encrypted traffic

Abstract

Protocol data unit set information identification for end-to-end encryption traffic. A method is provided that includes accessing an encrypted application stream, the encrypted application stream including encrypted protocol data units (PDUs). For each encrypted PDU of the one or more encrypted PDUs, the method includes performing an Internet Protocol Security (IPSec) process of the encrypted PDU, where an IPSec packet is configured to include the encrypted PDU and carry metadata including at least one of: a media type indicator of the encrypted PDU, or PDU set information on at least one PDU set to which the encrypted PDU belongs. The method further comprises transmitting the IPSec packet to a network function at which metadata can be accessed from the IPSec packet for PDU set identification and for mapping encrypted PDUs to a quality of service (QoS) flow for classification and QoS differentiation of encrypted PDUs.

Description

Technical Field

[0001] The present disclosure relates generally to telecommunications, and in particular, to protocol data unit (PDU) set processing for end-to-end encrypted services in telecommunications systems. Background Art

[0002] A telecommunications system can be considered as a facility that enables communication sessions between two or more entities (such as user terminals, base stations, and / or other nodes) by providing a bearer between the various entities involved in the communication path. A telecommunications system can be provided, for example, by means of a communication network and one or more compatible communication devices. A communication session can include, for example, data communications for carrying communications (such as voice, video, electronic mail (email), text messages, multimedia, and / or content data). Non-limiting examples of the services provided include two-way or multi-way calls, data communications or multimedia services, and access to data network systems (such as the Internet).

[0003] In a wireless telecommunications system, at least a portion of a communication session between at least two stations occurs over a wireless link. Examples of wireless systems include public land mobile networks (PLMNs), satellite-based communication systems, and various wireless local area networks, such as wireless local area networks (WLANs). Some wireless systems can be divided into cells and are therefore often referred to as cellular systems.

[0004] A user can access a telecommunications system using an appropriate communication device or terminal. A user's communication device may be referred to as user equipment (UE) or user device. The communication device is provided with appropriate signal reception and transmission means to enable communication, for example, to enable access to a communication network or direct communication with other users. The communication device can access a carrier provided by a station (e.g., a base station of a cell) and send and / or receive communications on the carrier.

[0005] Telecommunication systems and associated equipment typically operate according to a given standard or specification that lists what the various entities associated with the system are permitted to do and how it should be achieved. The communication protocols and / or parameters that will be used for the connection are also typically defined. One example of a telecommunication system is the Universal Mobile Telecommunications System (UMTS). Other examples of telecommunication systems are Long Term Evolution (LTE), Advanced LTE, and so-called 5G or New Radio (NR) networks. NR is being standardized by the Third Generation Partnership Project (3GPP). Summary of the Invention

[0006] Example implementations of the present disclosure relate to telecommunications, and in particular, to protocol data unit (PDU) set processing for end-to-end encrypted traffic in telecommunications systems.The present disclosure includes, but is not limited to, the following example implementations.

[0007] Some example implementations provide an apparatus comprising: at least one memory configured to store instructions; and at least one processing circuit configured to access the at least one memory and execute the instructions to cause the apparatus to at least: access an encrypted application stream, the encrypted application stream comprising an encrypted protocol data unit (PDU); and for each of one or more encrypted PDUs, perform Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein the IPSec packet is constructed to include the encrypted PDU and carry metadata, the metadata comprising at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; and send the IPSec packet to a network function, at which the metadata can be accessed from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a quality of service (QoS) flow for classification and QoS differentiation of the encrypted PDU.

[0008] Some example implementations provide an apparatus comprising: a component for accessing an encrypted application stream, wherein the encrypted application stream includes an encrypted protocol data unit (PDU); and, for each of one or more encrypted PDUs, a component for performing Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein an IPSec packet is constructed to include the encrypted PDU and carry metadata, the metadata comprising at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; and a component for sending the IPSec packet to a network function, at which the metadata can be accessed from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a quality of service (QoS) flow for classification and QoS differentiation of the encrypted PDU.

[0009] Some example implementations provide a method comprising: accessing an encrypted application flow, the encrypted application flow including an encrypted protocol data unit (PDU); and for each of one or more encrypted PDUs, performing Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein an IPSec packet is constructed to include the encrypted PDU and carry metadata, the metadata comprising at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; and sending the IPSec packet to a network function, at which the metadata can be accessed from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a quality of service (QoS) flow for classification and QoS differentiation of the encrypted PDU.

[0010] Some example implementations provide a computer-readable storage medium that is non-transitory and has instructions stored therein that, in response to execution by at least one processing circuit, cause an apparatus to at least: access an encrypted application stream that includes an encrypted protocol data unit (PDU); and for each of one or more encrypted PDUs, perform Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein an IPSec packet is constructed to include the encrypted PDU and carry metadata that includes at least one of: a media type indicator for the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; and send the IPSec packet to a network function at which the metadata is accessible from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a quality of service (QoS) flow for classification and QoS differentiation of the encrypted PDU.

[0011] Some example implementations provide a device comprising: at least one memory configured to store instructions; and at least one processing circuit configured to access the at least one memory and execute the instructions to cause the device to at least: receive Internet Protocol Security (IPSec) packets of an encrypted application flow, the encrypted application flow including encrypted protocol data units (PDUs); and for each of one or more IPSec packets constructed to include an encrypted PDU in the encrypted PDUs and carry metadata, access metadata carried by the IPSec packets, the metadata including at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; assign a category to the encrypted PDU based on at least one of the media type indicator or the PDU set information in the metadata; and forward the encrypted PDU with the category to a network, where, based on the category, the encrypted PDU is mapped to a quality of service (QoS) flow for classification and differentiation of the encrypted PDUs.

[0012] Some example implementations provide an apparatus comprising: a component for receiving Internet Protocol Security (IPSec) packets of an encrypted application stream, wherein the encrypted application stream includes encrypted protocol data units (PDUs); and, for each of one or more IPSec packets constructed to include an encrypted PDU in the encrypted PDUs and to carry metadata, a component for accessing metadata carried by the IPSec packets, wherein the metadata includes at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; a component for assigning a category to the encrypted PDU based on at least one of the media type indicator or the PDU set information in the metadata; and a component for forwarding the encrypted PDU with the category to a network, where, based on the category, the encrypted PDU is mapped to a quality of service (QoS) flow for classification and differentiation of the encrypted PDUs.

[0013] Some example implementations provide a method comprising: receiving Internet Protocol Security (IPSec) packets of an encrypted application flow, the encrypted application flow including encrypted protocol data units (PDUs); and for each of one or more IPSec packets constructed to include an encrypted PDU in the encrypted PDUs and to carry metadata, accessing metadata carried by the IPSec packets, the metadata comprising at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; assigning a category to the encrypted PDU based on at least one of the media type indicator or the PDU set information in the metadata; and forwarding the encrypted PDU with the category to a network, where, based on the category, the encrypted PDU is mapped to a quality of service (QoS) flow for classification and differentiation of the encrypted PDUs.

[0014] Some example implementations provide a computer-readable storage medium that is non-transitory and has instructions stored therein that, in response to execution by at least one processing circuit, cause a device to at least: receive Internet Protocol Security (IPSec) packets of an encrypted application stream, the encrypted application stream including encrypted protocol data units (PDUs); and for each of one or more IPSec packets constructed to include an encrypted PDU in the encrypted PDUs and carry metadata, access metadata carried by the IPSec packets, the metadata including at least one of the following: a media type indicator for the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; assign a category to the encrypted PDU based on at least one of the media type indicator or the PDU set information in the metadata; and forward the encrypted PDU with the category to a network, where, based on the category, the encrypted PDU is mapped to a quality of service (QoS) flow for classification and differentiation of the encrypted PDUs.

[0015] These and other features, aspects, and advantages of the present disclosure will become apparent upon reading the following detailed description and the accompanying drawings briefly described below. The present disclosure includes any combination of two, three, four, or more features or elements / components set forth in the present disclosure, regardless of whether such features or elements / components are explicitly combined or otherwise detailed in the specific example implementations described herein. The present disclosure is intended to be read as a whole so that in any aspect and example implementation of the present disclosure, any separable features or elements / components of the present disclosure should be considered combinable unless the context of the present disclosure clearly dictates otherwise.

[0016] Therefore, it will be understood that this summary is provided only for the purpose of summarizing some example implementations in order to provide a basic understanding of some aspects of the present disclosure. Therefore, it will be understood that the above example implementations are merely examples and should not be interpreted as narrowing the scope or spirit of the present disclosure in any way. Other example implementations, aspects, and advantages will become apparent from the following detailed description in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of some of the described example implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Having thus generally described example implementations of the present disclosure, reference will now be made to the accompanying drawings, which are not necessarily drawn to scale, and in which:

[0018] Figure 1 A telecommunications system including one or more public land mobile networks (PLMNs) coupled to one or more external data networks is shown according to some example implementations of the present disclosure;

[0019] Figure 2 illustrates deployment of a PLMN according to some example implementations;

[0020] Figure 3 More specifically describing the implementation according to some examples Figure 2 all aspects of the deployment of

[0021] Figure 4 illustrates a configuration of protocol data unit (PDU) set processing for extended reality (XR) services according to some example implementations;

[0022] Figure 5 illustrates a mechanism by which an Internet Protocol Security (IPSec) connection between an application server (AS) and a user plane function (UPF) may be used to exchange PDU set information on a per-PDU basis, according to some example implementations;

[0023] Figure 6 illustrates an IPSec packet formatted according to the Authentication Header (AH) protocol according to some example implementations;

[0024] Figure 7 illustrates an IPSec packet formatted according to the Encapsulating Security Payload (ESP) protocol according to some example implementations;

[0025] Figure 8 and Figure 9 illustrates the formats of an AH header and an ESP header, respectively, of an IPSec packet in which metadata is carried in dedicated fields according to some example implementations;

[0026] Figure 10 and Figure 11 illustrates the formats of an AH header and an ESP header, respectively, of an IPSec packet in which metadata is carried in an integrity check value (ICV) field according to some example implementations;

[0027] Figure 12 and Figure 13 shows the format of IPSec packets according to IPv6 in which metadata is carried in a dedicated header or within the original IP packet, respectively, according to some example implementations;

[0028] Figure 14 and Figure 15 shows the format of IPSec packets according to IPv4 with metadata carried in a dedicated header or within the original IP packet, respectively, according to some example implementations;

[0029] Figure 16A and Figure 16B is a flowchart illustrating various steps in a method according to various example implementations;

[0030] Figure 17A 、 Figure 17B and Figure 17Cis a flowchart illustrating various steps in a method according to various example implementations; and

[0031] Figure 18 Apparatus according to some example implementations is shown. DETAILED DESCRIPTION

[0032] Some implementations of the present disclosure will now be described more fully below with reference to the accompanying drawings, in which some, but not all, implementations of the present disclosure are illustrated. Indeed, various implementations of the present disclosure may be embodied in many different forms and should not be construed as limited to the implementations described herein; rather, these example implementations are provided so that this disclosure will be thorough and complete and will fully convey the scope of the disclosure to those skilled in the art. Like reference numerals refer to like elements throughout.

[0033] Unless otherwise specified or clear from the context, references to first, second, etc. should not be construed as implying a particular order. A feature described as being above another feature (unless otherwise specified or clear from the context) may actually be below the other feature, and vice versa; similarly, a feature described as being to the left of another feature may actually be to the right of the other feature, and vice versa. Furthermore, although quantitative measurements, values, geometric relationships, etc. may be mentioned herein, any one or more (if not all) of these may be absolute or approximate, unless otherwise specified, to account for acceptable variations that may occur (such as variations due to engineering tolerances, etc.).

[0034] As used herein, unless otherwise specified or clear from the context, an "or" of a set of operands is an "inclusive or," thus, true if and only if one or more of the operands is true, rather than an "exclusive or," which is false when all operands are true. Thus, for example, "[A] or [B]" is true if [A] is true, or if [B] is true, or if both [A] and [B] are true. Furthermore, the articles "a" and "an" mean "one or more," unless otherwise specified or clear from the context to refer to the singular. Furthermore, it should be understood that the terms "data," "content," "digital content," "information," and similar terms are sometimes used interchangeably unless otherwise specified. The term "network" may refer to a group of interconnected computers, including clients and servers; and within a network, these computers may be interconnected directly or indirectly through various means / components, including via one or more switches, routers, gateways, access points, etc.

[0035] This document may refer to terminology specific to particular systems, architectures, etc., but it is understood that example implementations of the present disclosure may be equally applicable to any of a number of systems, architectures, etc. For example, reference may be made to 3GPP technologies such as Global System for Mobile Communications (GSM), UMTS, LTE, LTE-Advanced, 5G NR, 5G-Advanced, and 6G; however, it is understood that example implementations of the present disclosure may be equally applicable to non-3GPP technologies such as IEEE 802, Bluetooth, and Bluetooth Low Energy.

[0036] Furthermore, as used in this application, the term "circuitry" may refer to one or more or all of the following: (a) a hardware circuit implementation only (such as an implementation of analog and / or digital circuitry only); (b) a combination of hardware circuitry and software, such as (as applicable): (i) a combination of analog and / or digital hardware circuitry and software / firmware; and (ii) any portion of a hardware processor with software (including a digital signal processor, software, and memory that work together to enable a device such as a mobile phone or server to perform various functions); or (c) a hardware circuit and / or processor, such as a microprocessor or portion of a microprocessor, that requires software (e.g., firmware) to operate, but the software may not be present when the software is not required for operation.

[0037] The above definition of "circuitry" applies to all uses of this term in this application, including in any claims. As another example, as used in this application, the term "circuitry" also covers an implementation of merely a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its accompanying software and / or firmware. The term "circuitry" also covers (for example, and if applicable to the specific claimed elements) a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or networking equipment.

[0038] Figure 1 The diagram illustrates a telecommunications system 100 implemented according to various examples of the present disclosure. The telecommunications system typically includes one or more telecommunications networks. As shown, for example, the system includes one or more public land mobile networks (PLMNs) 102 coupled to one or more other external data networks 104 - in particular, a wide area network (WAN) such as the Internet. Each of the PLMNs includes a core network (CN) 106 backbone, such as the Evolved Packet Core (EPC) of LTE, the 5G Core Network (5GC), etc.; and each of the core networks and the Internet is coupled to one or more radio access networks (RANs) 108, air interfaces, etc., that implement one or more radio access technologies (RATs). As used herein, "network equipment" refers to any suitable equipment on the network side of a telecommunications network. Examples of suitable network equipment will be described in more detail below.

[0039] In addition, the system includes one or more radio units, which may be variously referred to as user equipment (UE) 110, terminal equipment, terminal devices, mobile stations, etc. A UE is generally a device configured to communicate with a network device or another UE in a telecommunications network. A UE may be a portable computer (e.g., a laptop, a notebook, a tablet), a mobile phone (e.g., a cell phone, a smartphone), a wearable computer (e.g., a smartwatch), etc. In other examples, a UE may be an Internet of Things (IoT) device, an Industrial Internet of Things (IIoT) device, a vehicle equipped with vehicle-to-everything (V2X) communication technology, etc. In some examples, as mentioned by 3GPP, a UE may be a narrowband IoT (NB-IoT) device, an enhanced machine type communication (eMTC) device, a reduced capability (RedCap) device, an ambient IoT device, etc.

[0040] In operation, these UEs may be configured to connect to one or more RANs 108 according to their specific radio access technology, thereby accessing a specific CN 106 of the PLMN 102, or accessing one or more external data networks 104 (e.g., the Internet). The external data network may be configured to provide Internet access, operator services, third-party services, etc. For example, the International Telecommunication Union (ITU) has classified 5G mobile network services into three categories: enhanced mobile broadband (eMBB), ultra-reliable and low-latency communications (URLLC), and massive machine type communications (mMTC) or massive Internet of Things (MIoT).

[0041] Examples of radio access technologies include 3GPP radio access technologies such as GSM, UMTS, LTE, LTE-Advanced, 5G NR, 5G-Advanced, and 6G. Other examples of radio access technologies include IEEE 802 technologies such as IEEE 802.11 (Wi-Fi), IEEE 802.15 (including 802.15.1 (WPAN / Bluetooth), 802.15.4 (Zigbee), and 802.15.6 (WBAN), Bluetooth, Bluetooth Low Energy (BLE), Ultra-Wideband (UWB), etc. In general, a radio access technology may refer to any 2G, 3G, 4G, 5G, 6G, or higher generation mobile communication technology and different versions thereof, as well as any other radio access technology that may be configured to interoperate with such mobile communication technology to provide access to the CN 106 of a mobile network operator (MNO).

[0042] In various examples, the RAN 108 may be configured as one or more macro cells, micro cells, pico cells, femto cells, and the like. The RAN may generally include one or more radio access nodes configured to interact with the UE 110. In various examples, the radio access nodes may be referred to as base stations (BSs), access points (APs), base transceiver stations (BTSs), Node Bs (NBs), evolved NBs (eNBs), macro BSs, mobile NBs (MNBs) or eNBs (MeNBs), home / home BSs, NBs (HNBs) or eNBs (HeNBs), next-generation NBs (gNBs), enhanced gNBs (en-gNBs), next-generation eNBs (ng-eNBs), and the like. The RAN may include some type of network control / management entity responsible for controlling the radio access nodes. The network control / management entity and the radio access nodes may be separate or integrated into a single device. The network control / management entity may include processing circuitry, etc., configured to perform various management functions. The processing circuitry may be associated with a memory, a computer-readable storage medium, or a database for maintaining information required for the management functions.

[0043] The RAN 108 can be centralized or distributed. In various examples, components of the RAN can be interconnected via Ethernet, Gigabit Ethernet, asynchronous transfer mode (ATM), fiber, dark fiber, passive wavelength division multiplexing (WDM), WDM passive optical network (WDM-PON), optical transport network (OTN), time-sensitive network (TSN), and / or any other data link layer network (possibly including radio links). The RAN can be connected to the CN 106 via one or more gateways, network functions, etc.

[0044] As will be appreciated, the PLMN 102 can be deployed in a variety of different ways. In a 4G LTE deployment, the EPC is the CN 106 and the Evolved UMTS Terrestrial Radio Access Network (E-UTRAN) is the RAN 108; and the E-UTRAN includes one or more eNBs (radio access nodes) configured to connect the UE 110 to the E-UTRAN, thereby accessing the EPC. Figure 2 A deployment 200, such as a 5G or 6G deployment, is shown. As shown, a 5GC 202 is a CN, and a Next Generation (NG) Radio Access Network (NG-RAN) 204 is a RAN. The NG-RAN includes one or more gNBs 206 (radio access nodes) configured to connect a UE 208 to the NG-RAN and thereby access the 5GC. The term "gNB" in 5G can correspond to an eNB in 4G LTE.

[0045] Some 4G LTE and 5G deployments are considered standalone (SA) deployments. Other deployments combine 4G LTE and 5G technologies and are referred to as non-standalone (NSA) deployments. In some deployments, the E-UTRAN includes one or more ng-eNBs that are configured to communicate with the 5GC and may also be configured to communicate with one or more gNBs. Similarly, in another deployment, the NG-RAN may include one or more en-gNBs that are configured to communicate with the EPC and may also be configured to communicate with one or more eNBs. In various cases, a single UE 110 (dual-mode or multi-mode UE) may support multiple (two or more) RANs - and thereby be configured to connect to multiple RANs such as 4G LTE and 5G.

[0046] Figure 3 Aspects of an MNO deployment 200 according to some example implementations are depicted in greater detail. As shown, the deployment includes a 5GC 202 and an NG-RAN 204 with one or more gNBs 206 configured to connect a UE 208 to the NG-RAN, thereby accessing the 5GC. The 5GC may include multiple network functions (NFs) divided between the control plane and the user plane. In particular, the 5GC may include, for example, an access and mobility management function (AMF) 302, a session management function (SMF) 304, a user plane function (UPF) 306, a network exposure function (NEF) 308, a policy control function (PCF) 310, and / or an application function (AF) 312. Other examples of suitable NFs include a network repository function (NRF), a network slice selection function (NSSF), a policy control function (PCF), a unified data management (UDM), and the like. Also shown is a server hosting applications, referred to as an application server (AS) 314.

[0047] In the control plane, the AMF 302 is configured to provide UE-based authentication, authorization, mobility management, etc. The SMF 304 is configured to provide various functions, including session management (SM), UE Internet Protocol (IP) address allocation and management, selection and control of the UPF 306, policy enforcement and quality of service (QoS) control part, lawful interception, termination of the SM part of the NAS message, downlink data notification (DNN), roaming function, handling local implementation to apply QoS for service level agreement (SLA), charging data collection and charging interface, etc. If the UE 208 has multiple sessions, a different SMF can be assigned to each session to manage them separately, and different functions may be provided for each session.

[0048] The UPF 306 supports various user plane operations and functions, such as packet routing and forwarding, traffic processing (e.g., QoS implementation), an anchor point for intra-RAT / inter-RAT mobility (where applicable), packet inspection and policy rule implementation, lawful interception (UP collection), traffic accounting and reporting, etc. The UPF is the interconnection point between the 5GC and at least one external data network (DN) 316 (i.e., the ingress or egress point for the DN) and routes packets to and from the DN, such as through the N6 reference point between the UPF and the DN. The DN can be configured to provide Internet access, operator services, third-party services, etc.

[0049] PCF 310 may be responsible for policy implementation and management, controlling QoS, and implementing policy rules defined by the MNO or service provider. PCF may promote efficient resource usage, optimize network performance, and provide a high-quality user experience.

[0050] The AF 312 can interact with the 5GC 202 to enable the deployment of specific services and applications. The AF communicates with other NFs to request and manage network resources, ensuring that the network adapts to the requirements of different applications and services. The NEF 308 allows authorized third-party applications and services to access specific network functions and services in a controlled manner. The NEF enables network capabilities to be exposed to external entities, thereby promoting innovation and the development of new services.

[0051] In some deployments, such as deployment 200, operations of the gNB 206 or other radio access node may be performed, at least in part, in a central / centralized unit (CU) (such as a server, host, or node) that is operatively coupled to a distributed unit (DU) (such as a radio head / node). Node operations may also be distributed among multiple servers, hosts, or nodes. It should also be understood that the division of labor between 5GC 202 (or other CN) operations and gNB (or other radio access node) operations may vary depending on the implementation.

[0052] The 5G network architecture may be based on a so-called CU-DU split. A gNB-CU (central node) may control one or more gNB-DUs. A gNB-CU may control multiple spatially separated gNB-DUs, which at least act as transmit / receive (Tx / Rx) nodes. However, in some example implementations, a gNB-DU (also referred to as a DU) may include, for example, the radio link control (RLC), media access control (MAC) layer, and physical (PHY) layer, while a gNB-CU (also referred to as a CU) may include layers above the RLC layer, such as the packet data convergence protocol (PDCP), radio resource control (RRC), and internet protocol (IP). Other functional splits are also possible. It is assumed that skilled artisans are familiar with the Open Systems Interconnection (OSI) model and the functions within each layer.

[0053] In some example implementations, a server or CU can generate a virtual network through which the server communicates with the radio nodes. In general, virtual networking can involve the process of combining hardware and software network resources and network functions into a single, software-based management entity (virtual network). Such a virtual network can provide flexible operation allocation between the server and the radio head / node. In practice, any digital signal processing task can be performed in the CU or DU, and the boundary of transferring responsibilities between the CU and DU can be selected based on the implementation.

[0054] For some time, data in the PLMN 102 has been sent in small units called "packets," which serve as discrete blocks of information that carry data from one point to another. In the context of 5G and advanced networking, data is sent in protocol data units (PDUs). A PDU may include one or more headers and a service data unit (SDU), which is actually the payload of the PDU.

[0055] In a communication session, referred to as a PDU session, which is a communication channel established to facilitate data exchange, data packets such as PDUs are transferred between the UE 208 and the DN 316. The PDU session may be anchored at the UPF 306 in the 5GC 202. In this regard, a PDU session anchor (PSA) is a term sometimes used to refer to a PDU session anchor in the UPF.

[0056] Networks, including 5G, are now beginning to support interactive media services such as extended reality (XR), which includes virtual reality (VR), augmented reality (AR), and mixed reality (MR). For these services, a PDU set may include one or more PDUs that are grouped together to carry data for one unit of information generated at the application level (e.g., a video frame or video slice for an XR service). In this regard, a PDU set may include PDUs that work together to convey a specific information segment / block or a complete data unit at the application level, such as an image, a video frame, or a fragment of a file. The PDUs in a PDU set may be sent within the same Quality of Service (QoS) flow.

[0057] To support XR applications, mechanisms for integrated and differentiated PDU set processing have been investigated. Figure 4 A configuration 400 for PDU set processing for XR services implemented according to some examples of the present disclosure is shown. For downlink XR services, support for detection of PDU sets by the PSA UPF 306 and subsequent marking of downlink General Packet Radio System (GPRS) Tunneling Protocol User Plane (GTP-U) packets sent by the UPF to the NG-RAN 204 has been agreed upon in 3GPP. Integration and differentiated processing can be performed in the NG-RAN based on new QoS parameters applicable to the groups of PDUs that make up the PDU set.

[0058] The AF 312 may send a request to the NEF 308 / PCF 310 to provide values for PDU Set QoS parameters and protocol description information indicating the application protocol (e.g., Real-time Transport Protocol (RTP) / Secure RTP (SRTP)), header (e.g., Frame Marker Header Extension), and payload type (e.g., H.264) used by the service data flow sent on the downlink to the UPF 306. If the PCF authorizes the AF request, the PCF may include the AF information in a Policy and Charging Control (PCC) rule sent to the SMF 304. Alternatively, the PDU Set QoS parameters and protocol description may be configured more statically in the 5G Telecommunication System (5GS).

[0059] The SMF 304 can determine the QoS flow for the XR service data flow and send new PDU set QoS parameters to the NG-RAN 204. The SMF can also send protocol description information in the packet data rule (PDR) and / or an indication in the forwarding action rule (FAR) to the PSA UPF 306 (i.e., PDU set information will be sent to the NG-RAN). The PSA UPF can use the protocol description information and implementation-specific rules to inspect the RTP / SRTP header and payload of the downlink PDU, determine the PDU set, and extract the PDU set information. The PDU set information may include an indication of the end PDU of the PDU set, an indication of the end of the data burst that includes the PDU set, an indication of the importance of the PDU set, a PDU set sequence number, a sequence number of the encrypted PDU within the PDU set, and / or a PDU set size. Alternatively, even if the UPF does not receive specific protocol description information (e.g., for proprietary application protocols other than RTP), PSA UPF implementation-specific procedures can be used to identify the PDU set.

[0060] In the case of end-to-end encrypted XR traffic, the application payload may be encrypted from the AS 314 to the UE 208. For example, the application payload may include an encrypted Quick User Datagram Protocol (UDP) Internet Connection (QUIC) / UDP / IP connection (stream) with RTP, RTP Control Protocol (RTCP), or other protocols inside. In this case, the UPF 306 may not be able to decode or read the protocol header of each PDU to read the protocol information in the RTP / SRTP header, determine the PDU set and PDU set information. Currently, when the XR media stream is end-to-end encrypted, there is no mechanism for transmitting PDU set information on a per-PDU basis to identify the PDU set for downlink PDUs received at the UPF.

[0061] Thus, an example implementation of the present disclosure provides a mechanism by which an Internet Protocol Security (IPSec) connection between AS 312 and UPF 306 can be used to exchange PDU set information on a per-PDU basis. As is known, IPSec is a secure network protocol that authenticates and / or encrypts data packets to provide secure, encrypted communications between two computers over an IP network. IPSec includes protocols for establishing mutual authentication between agents at the start of a session and for negotiating encryption keys to be used during the session. IPSec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host).

[0062] Relevant to example implementations of the present disclosure, IPSec is a protocol that has its own key management and encryption mechanisms. IPSec is in-band (no orchestrator is required), and IPSec can enable a payload-independent solution. Recent hardware has IP processing on the fast path because the hardware is able to handle IP packet processing directly on the fast path without involving slower software-based processing. Some of these hardware devices also have a dedicated central processing unit (CPU) allocated to handle IP processing paths on the fast path, which can include IPSec processing, where encryption / decryption is handled by explicit hardware accelerators.

[0063] According to some example implementations, PDU set information may be transmitted as metadata in an IPSec packet on a per-PDU basis. Authentication Header (AH) and Encapsulating Security Payload (ESP) are two IP-based transport layer protocols used by IPSec to provide security services such as authentication and encryption. In this regard, PDU set information may be transmitted as metadata in an IPSec header (such as an AH header or an ESP header). In some examples, the metadata may be encrypted and include a string with the PDU set information. In some examples, the metadata may be encrypted using the same keying mechanism as the underlying IPSec protocol, thereby alleviating the need for explicit key management. It may also be assumed that not all PDUs will include PDU set information, and therefore in some examples, the metadata may include a media type indicator in addition to or instead of the PDU set information.

[0064] Some example implementations may be based on multiple proposals, such as end-to-end payload encryption remaining intact, with packet decapsulation not occurring until the IP layer. The metadata may also be protected in a manner that only allows the UPF 306 to read the metadata and use it. Furthermore, metadata may be exchanged between the AS 312 and the UPF using on-path mechanisms and in-band signaling. The metadata exchange format / encoding / container may be extensible to allow for future definition of PDU set metadata. PDU set information may be transmitted on a per-PDU basis to enable classification of PDUs into PDU sets, and the PDU set information may be secure (encrypted).

[0065] According to some example implementations, such as Figure 5As shown in , an IPSec connection can be established between AS 312 and UPF 306. Some deployments support tunneling between PLMN and DN, so IPSec can be used from the UPF to tunnel dedicated Access Point Name (APN) / Data Network Name (DNN) traffic to a specific location / network. Therefore, some example implementations can selectively tunnel specific flows between the AS and UPF. To this end, the IPSec tunneling protocol can be used, where additional data about specific packets can be carried at the tunnel header level. However, IPSec is more than just a tunneling protocol, as IPSec can also operate in transport mode.

[0066] In various example implementations, the establishment of an IPSec connection can be preconfigured or can be dynamically established in tunnel mode or transport mode. Between 3GPP nodes (including UPF 306), Internet Key Exchange version 2 (IKEv2) is currently used for IPSec establishment; and it can be assumed that AS 314 supports IPSec. In some examples, the UPF can initiate an IPSec security association between the UPF and the AS to transfer metadata. The end-to-end payload can be encrypted, but not necessarily via IPSec. The end-to-end payload can also be encrypted via any of a variety of different application protocols (such as SRTP, QUIC, etc.).

[0067] In some examples, the UPF 306 can receive IPSec packets and use the protocol number (e.g., IPv6, IPv4) in the IP header to identify the AH and ESP headers. The UPF can also identify the presence of metadata in the IPSec packet. The UPF can be configured to identify the presence of metadata in a variety of different ways. In some examples, during IKE establishment, the AS 304 and the UP negotiate a security association, where the AS can indicate that the security association includes<protocol X> ,<length of metadata> , <metadata>; or as part of the security association configuration between the AS and the UPF, the configuration parameters may indicate that the packets sent according to the security association include metadata related information.

[0068] In some examples, the IPSec connection can be established to operate in tunnel mode, where an IP packet (encrypted PDU) can be encapsulated within another packet and transmitted to the destination. In addition, in some examples, metadata can be carried in an AH header rather than an ESP header because, as described below, AH is used for authentication but not for encryption of IP traffic. This can avoid some performance issues with IPSec that arise from the encryption / decryption of all packets associated with the security association (SA) between AS 312 and UPF 306 for the IPSec connection.

[0069] Thus, some example implementations of the present disclosure provide an AS 314 configured to access an encrypted application flow including an encrypted PDU. For each of one or more encrypted PDUs, the AS may be configured to perform IPSec processing of the encrypted PDU, wherein an IPSec packet is constructed to include the encrypted PDU and carry metadata, the metadata including a media type indicator for the encrypted PDU and / or PDU set information about at least one PDU set to which the encrypted PDU belongs; and in some examples, the metadata may be encrypted. The AS may, in turn, be configured to send the IPSec packet to a network function, such as the UPF 306.

[0070] The UPF 306 may be configured to receive IPSec packets of an encrypted application flow including an encrypted PDU. For each of one or more IPSec packets including an encrypted PDU in these encrypted PDUs and carrying metadata, the UPF may be configured to access (and decrypt) the metadata carried by the IPSec packets. The UPF may be configured to assign a category to the encrypted PDU based on the media type indicator and / or PDU set information in the metadata. In some examples where the metadata c includes the media type indicator and PDU set information, the UPF may identify the PDU set to which the encrypted PDU belongs and may assign a category to the encrypted PDU based on its PDU set. The UPF may be configured to forward the encrypted PDU with the category to the network (e.g., NG-RAN 204), where, based on the category, the encrypted PDU is mapped to a QoS flow for classification and differentiation of the encrypted PDU.

[0071] As described above, the media type indicator and appropriate PDU set information can be transmitted as metadata in an IPSec packet (such as an AH header or ESP header). In this regard, encapsulation is the process of adding AH or ESP fields to the original IP packet for packet authentication and encryption. This process can be implemented in transport or tunnel mode. IPSec transport mode works by inserting an AH or ESP header between the IP header and the transport layer protocol header to protect the payload. IPSec tunnel mode works by encrypting and authenticating the entire IP packet (including the IP header and payload).

[0072] Figure 6 An IPSec packet 600 formatted according to the AH protocol in AH transport mode according to some example implementations is shown. AH is used to authenticate IP traffic, but does not encrypt IP traffic. As shown, the IPSec packet includes a standard IP header 602, an AH header 604, and an authenticated application payload 606 (in this case, an encrypted PDU of an encrypted application stream). The standard IP header includes information such as source and destination IP addresses. The AH header contains information required for authentication and integrity verification of the packet. The AH header can also be constructed to carry metadata. The authenticated application payload can include an encrypted PDU of an end-to-end encrypted application stream, which can be encrypted via any of a variety of different application protocols (such as SRTP, QUIC, etc.).

[0073] Figure 7 An IPSec packet 700 formatted according to the ESP protocol in ESP tunnel mode according to some example implementations is shown. In IPSec, ESP provides encryption and optional authentication; and in tunnel mode, the original IP packet can be encapsulated with an added outer (new) packet header. As shown, the IPSec packet can then include an outer IP header 702, an ESP header 704, and an encrypted (and possibly authenticated) application payload 706, which is encrypted via IPSec.

[0074] The outer IP header 702 of the IPSec packet 700 contains information such as the source and destination IP addresses. The ESP header 704 provides confidentiality, integrity, and authentication for the encapsulated encrypted application payload. The ESP header can also be configured to carry metadata. The encrypted application payload 706 can include the original, unprocessed IP header 708, the TCP header 710, and data 712 of the encrypted PDU of the end-to-end encrypted application stream (encrypted via, for example, SRTP, QUIC, etc.). Therefore, the encrypted PDU can also be transmitted via IPSec in ESP tunnel mode. In addition, as shown in the figure, the IPSec packet includes an ESP tail 714 and ESP authentication data 716.

[0075] In some examples, metadata can be carried in an IPSec header (which can be an AH header or an ESP header). In other examples, in tunnel mode, metadata can be carried in an outer packet header (tunnel header) of IPSec; and in other examples, metadata can be carried in a dedicated header of an IPSec packet, between multiple or one header and the payload of an IPSec packet, or within the payload of an IPSec packet. In these and other examples, metadata can be carried in a variety of different ways. In some examples where metadata is carried in an IPSec header, metadata can be carried in a field of the IPSec header dedicated to metadata. This dedicated field can be a new (variable, optional) field, an extension of the existing AH / ESP header, and its size can be a multiple of 32 bits.

[0076] In various examples, the media type indicator and PDU set information can be arranged in a string from which metadata can be formed, and the metadata can be formed using an encapsulation key used for IPSec establishment using a key. As described below, the media type indicator and PDU set information can be arranged in a string in a specific order so that when the dedicated fields in the IPSec header (e.g., an AH header or an ESP header) are decapsulated, the content can be extracted and read in that specific order. In the case of encrypted application streams that internally multiplex RTP, RTCP, or other protocols (e.g., a QUIC / UDP / IP connection), metadata for each media type (media type plus PDU set information) can be added one by one in a dedicated field. In some examples, the dedicated field can be a multiple of 32 bits.

[0077] Figure 8 and Figure 9 8 and 9, respectively, show the formats of an AH header 800 and an ESP header 900 of an IPSec packet in which metadata is carried in dedicated fields according to some example implementations. In some examples, the AH header 800 may correspond to the AH header 604. Figure 8 As shown in FIG, an AH header 800 may include a plurality of fields (which are standard fields in IPSec), such as Next Header 802, Payload Length 804, Reserved 806, Security Parameter Index (SPI) 808, Sequence Number 810, and ICV 812. According to an example implementation, the AH header may also include a dedicated field 814, which is structured to carry metadata including a media type indicator and / or PDU set information (<Application_Media_Type,PDU Set Information> ). This dedicated field can be arranged in a variety of different ways with other fields, such as between the serial number and ICV fields.

[0078] Similar to AH header 800, which may correspond to AH header 604, in some examples, ESP header 900 may correspond to ESP header 704. Figure 9 As shown in FIG, ESP header 900 may include a plurality of fields (which are standard fields in IPSec), such as SPI 902, sequence number 904, payload data 906, padding 908, padding length 910, next header 912, and ICV 914. According to an example implementation, the ESP header may also include a dedicated field 916, which is structured to carry metadata including a media type indicator and / or PDU set information (<Application_Media_Type,PDU Set Information> ). This dedicated field can be arranged with other fields in a variety of different ways, such as between the padding length, next header, and ICV fields.

[0079] In other examples, the metadata may be carried in the ICV field of the IPSec header, which is a variable length field. Figure 10 and 11 10. The formats of an AH header 1000 and an ESP header 1100 of an IPSec packet are shown, respectively, in which metadata is carried in the ICV field 812 according to some example implementations. As described above, the ICV field is a standard field in IPSec. The ICV field is a variable field used for authentication and integrity checking on the receiver side based on a comparison of the ICV value received in the IPSec header with a corresponding ICV value generated on the receiver side. According to some example implementations, the ICV field can be reused for metadata, where, instead of an integrity check value, the ICV field can carry metadata including a media type indicator and / or PDU set information (<Application_Media_Type,PDU Set Information> ).

[0080] Similar to the above, in various examples, the media type indicator and PDU set information can be arranged in a string from which metadata can be formed, and the metadata can be formed using the encapsulation key used for IPSec establishment using a key. The media type indicator and PDU set information can be arranged in a string in a specific order so that when the ICV field in the IPSec header (e.g., an AH header or an ESP header) is decapsulated, the content can be extracted and read in that specific order. In the case of an encrypted application stream that multiplexes RTP, RTCP, or other protocols internally (e.g., a QUIC / UDP / IP connection), metadata for each media type (media type plus PDU set information) can be added one by one in the ICV field.

[0081] In some examples where metadata is carried in the ICV field, the UPF 306 can be on the receiver side in the downlink. The UPF can be configured to compare the ICV value in the ICV field 812, 914 with the generated value. When the UPF determines that the values do not match, the UPF can attempt to decrypt the content in the ICV field (for examples where the metadata is encrypted), such as by using an encryption key, and attempt to read the content as metadata, rather than discarding the IPSec packet (as in standard IPSec). In addition, in some examples, metadata can be formed from an information string in a specific value; and in these examples, the UPF can determine that the string format is as expected. If the string format is not as expected, the UPF can discard the IPSec packet. It can also be noted that if the variable content of the PDU set information is in order, then in addition to extracting metadata, the ICV can also be used for authentication checks of encrypted application flows, thereby satisfying both authentication and metadata encryption with one common variable.

[0082] Figure 12 and Figure 13 The format of an IPSec packet 1200, 1300 according to IPv6 in which metadata may be carried according to some example implementations is shown. As shown, the IPSec packet adopts IPSec tunnel mode and includes an outer (new) IPv6 header 1202 and an IPSec header 1204 (here, an AH header). The IPSec packet also includes an inner (original) IPv6 header 1206 and a payload 1208. Figure 12 As shown in , metadata can be carried in a dedicated header 1210 within an IPSec tunnel (such as in front of the original IP packet). Figure 13 As shown in , metadata may be carried within the original IPv6 packet (such as at a location before or within the payload).

[0083] Figure 14 and Figure 15 The format of an IPSec packet 1400, 1500 according to IPv4 in which metadata may be carried is shown according to some example implementations. As shown, the IPSec packet adopts IPSec tunnel mode and includes an outer (new) IPv4 header 1402 and an IPSec header 1404 (which is an AH header in this case). The IPSec packet also includes an inner (original) IPv4 header 1406 and a payload 1408. Figure 14 As shown in , metadata can be carried in a dedicated header 1410 within an IPSec tunnel (such as in front of the original IP packet). Figure 15 As shown in , metadata can be carried within the original IPv4 packet (such as at a location before or within the payload 1508).

[0084] exist Figure 12-14 In the example shown in , the IPSec packet can be constructed according to the AH protocol (and include an AH header), and thus the IPSec packet can be authenticated. In other examples, the IPSec packet can be constructed according to the ESP protocol (and include an ESP header), and the IP packet can be encrypted (and possibly authenticated).

[0085] Furthermore, as described above, in some examples, metadata may include a media type indicator (e.g., applicationID, ApplicationID_MediaType) and PDU set information, which are arranged in a string in a specific order, which may be referred to as metadata. The metadata has a variable structure and is defined as {Metadata_Length,<actual_metadata> An example of a suitable order for the media type indicator and PDU set information is as follows (along with an example number of bits that may be used to represent the information):

[0086] <Length of Metadata>

[0087] <metadata>{

[0088] ApplicationID_Media Type[E](4bit)

[0089] <PDU Set Information>

[0090] }

[0091] In some examples, the media type can be or include RTP profile for audio and video (RTP / AVP) audio, haptic data, RTCP, Simple Traversal of UDP through NAT (STUN), video i-frames, video p-frames, etc. In various examples, the PDU set information (<PDU Set Information> ) is an element that enables XR applications to perceive the 5G network. In XR, video frames such as I and P frames can be encoded in PDU sets, which should be handled differently by the network. More specific examples of PDU set information can be given in 3GPP TS 26.522. When extracting the above information, the UPF 306 can check whether each line is in the correct order in the string, and can also check the end of the line (assuming that the size does not change for each RTP header). This can enable verification of the integrity of the string.

[0092] The length of the information in the metadata can also be variable in nature. AS 314 can determine what information can be included in the metadata to classify the encrypted PDUs into PDU sets at UPF 306. As mentioned above, it can also be assumed that not all encrypted PDUs will carry PDU set information. For example, PDU set information can include information such as "PDU Sequence Number within a PDU Set," which may be required for every PDU, while other information may only be required at the start or end PDU of a PDU set.

[0093] To further illustrate some example implementations of the present disclosure, a detailed process for end-to-end encrypted XR services may be as follows. Before sending the XR service, the AS 314 (e.g., XR application server) configures IPSec on its N6 interface with the UPF 306 and initiates an IPSec security association between the AS and the UPF. In other examples, the UPF may initiate an IPSec security association between the UPF and the AS. The AS sends an encrypted XR packet with an IPSec header containing metadata (application ID / media type + PDU set information) to the (PSA) UPF. The PSA UPF receives the encrypted XR packet with the metadata included in the IPSec header and decrypts the metadata in the IPSec header using the same key used for encryption on the AS side.

[0094] The UPF 306 interprets the application ID + media type to determine whether each PDU belongs to a PDU set. For example, the media type can be RTP / AVP audio, tactile data, RTCP, STUN, video i-frame, video p-frame, etc. Since audio / RTCP / STUN PDUs may not belong to a PDU set, the PDU set information in the metadata of these PDUs may be empty or omitted, but the metadata may still carry the application ID / media type. Therefore, the UPF can determine whether each PDU belongs to any PDU set based on the metadata. The IPSec header for non-XR services can be formatted as standard IPSec, or otherwise do not include metadata, which can enable the UPF to distinguish between XR services and non-XR services.

[0095] Figure 16A and 16B 16 is a flow chart illustrating various steps in a method 1600 according to various example implementations. The method includes accessing an encrypted application stream, the encrypted application stream including an encrypted protocol data unit (PDU), such as Figure 16A The method further includes, for each of the one or more encrypted PDUs, performing Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein an IPSec packet is constructed to include the encrypted PDU and to carry metadata, the metadata including at least one of: a media type indicator of the encrypted PDU, or PDU set information regarding at least one PDU set to which the encrypted PDU belongs, as shown in block 1602. Furthermore, the method includes sending the IPSec packet to a network function, where the metadata is accessible from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a Quality of Service (QoS) flow for classification and QoS differentiation of the encrypted PDU, as shown in block 1606.

[0096] In some examples, the metadata carried in the IPSec packet includes a media type indicator and PDU set information. In some of these examples, the PDU set information includes one or more of: an indication of an end PDU of the PDU set, an indication of an end of a data burst that includes the PDU set, an indication of the importance of the PDU set, a PDU set sequence number, a sequence number of the encrypted PDU within the PDU set, or a PDU set size.

[0097] In some examples, the method 1600 further includes: encrypting metadata carried in the IPSec packet, such as Figure 16B As shown in box 1608.

[0098] In some examples, the IPSec packet includes an IPSec header, and the metadata is carried in a field of the IPSec header dedicated to metadata. In other examples, the metadata is carried in an integrity check value (ICV) field of the IPSec header.

[0099] Figures 17A-17C 1700 is a flowchart illustrating various steps in a method 1700 according to various example implementations. The method includes receiving an Internet Protocol Security (IPSec) packet of an encrypted application flow, the encrypted application flow including an encrypted protocol data unit (PDU), such as Figure 17A The method includes, as shown in block 1702, for each of the one or more IPSec packets that are structured to include an encrypted PDU among the encrypted PDUs and to carry metadata, accessing metadata carried by the IPSec packet, the metadata including at least one of a media type indicator for the encrypted PDU or PDU set information regarding at least one PDU set to which the encrypted PDU belongs, as shown in block 1704. The method includes assigning a category to the encrypted PDU based on at least one of the media type indicator or the PDU set information in the metadata, as shown in block 1706. Furthermore, the method includes forwarding the encrypted PDU with the category to a network, where the encrypted PDU is mapped to a Quality of Service (QoS) flow based on the category for classification and differentiation of the encrypted PDU, as shown in block 1708.

[0100] In some examples, the metadata carried in the IPSec packet includes a media type indicator and PDU set information, and the method 1700 further includes: identifying at least one PDU set to which the encrypted PDU belongs, such as Figure 17B 17. In some of these examples, at block 1706, the encrypted PDU is assigned a category based on at least one PDU set to which the encrypted PDU belongs.

[0101] In some examples, the metadata carried by the IPSec packet is encrypted. The method includes accessing the metadata, including: at block 1714, decrypting the metadata, such as Figure 17C As shown in box 1712.

[0102] In some examples, the IPSec packet includes an IPSec header, and the metadata is accessed from a field of the IPSec header dedicated to metadata. In other examples, the metadata is accessed from an integrity check value (ICV) field of the IPSec header.

[0103] According to example implementations of the present disclosure, telecommunication system 100 or PLMN 102 and its components, such as UE 110, CN 106, RAN 108, 5GC 202, NG-RAN 204, gNB 206, UE 208, AMF 302, SMF 304, UPF 306, NEF 308, PCF 310, AF 312, and / or AS 314, can be implemented by various means / components. Components for implementing the system and its components may include hardware, firmware, software, or a combination thereof. In some examples, one or more devices may be configured to function as or otherwise implement the system and its components as shown and described herein. In examples involving more than one device, the respective devices may be connected or otherwise communicate with each other in a variety of different ways, for example, directly or indirectly via a wired or wireless network, etc.

[0104] According to some example implementations, Figure 16A and Figure 16B At least some of the described method 1600 may be performed by an apparatus comprising means for performing functions corresponding to the steps of the method. Figures 17A-17C At least some of the described method 1700 may be performed by a device including means for performing functions corresponding to the steps of the method. Examples of suitable devices may include a UPF, an AF, an AS, or any suitable device such as a server, a host, or a node.

[0105] Figure 18 An apparatus 1800 is illustrated according to some example implementations of the present disclosure, wherein the components for performing various functions include hardware, either independently or under the direction of one or more computer programs from a computer-readable storage medium or other memory (such as a computer memory). The apparatus may include one or more of each of a variety of components, such as, for example, a processing circuit 1802 connected to a computer-readable storage medium or other memory 1804.

[0106] Processing circuitry 1802 may be comprised of one or more processors alone, or in combination with one or more computer-readable storage media. A processing circuit is generally any computer hardware component capable of processing information (such as, for example, data, a computer program, and / or other suitable electronic information). A processing circuit is comprised of a collection of electronic circuits, some of which may be packaged as an integrated circuit or multiple interconnected integrated circuits (integrated circuits are sometimes more commonly referred to as "chips"). The processing circuitry may be configured to execute a computer program, which may be stored on the processing circuitry or otherwise stored in memory 1804 (of the same device or another device).

[0107] The processing circuit 1802 can be a plurality of processors, a multi-core processor, or some other type of processor, depending on the specific implementation. In addition, the processing circuit can be implemented using multiple heterogeneous processor systems, wherein a main processor and one or more secondary processors are present on a single chip. As another illustrative example, the processing circuit can be a symmetric multi-processor system containing multiple processors of the same type. In yet another example, the processing circuit can be embodied as or otherwise include one or more ASICs, FPGAs, etc. Therefore, although the processing circuit may be capable of executing a computer program to perform one or more functions, the processing circuits of various examples may be capable of performing one or more functions without the assistance of a computer program. In either case, the processing circuit can be appropriately programmed to perform functions or operations according to the example implementations of the present disclosure.

[0108] Memory 1804 is generally any computer hardware component capable of temporarily and / or permanently storing information such as, for example, data, computer programs, instructions 1806 (e.g., computer-readable program code), and / or other suitable information. The memory may include volatile and / or nonvolatile memory and may be fixed or removable. Examples of suitable memory include a recording medium, random access memory (RAM), read-only memory (ROM), a hard drive, flash memory, a thumb drive, a removable computer floppy disk, an optical disk, or some combination thereof.

[0109] Memory 1804 is a non-transitory device capable of storing information. An example of a suitable memory is a computer-readable storage medium, which is distinct from a computer-readable transmission medium that can carry information from one location to another. Examples of suitable computer-readable transmission media include electronic carrier signals, telecommunications signals, software distribution packages, or some combination thereof. As used herein, the term "non-transitory" is a limitation on the medium itself (i.e., tangible, rather than a signal), rather than a limitation on the persistence of data storage (e.g., RAM versus ROM). Computer-readable media, as described herein, generally refers to computer-readable storage media or computer-readable transmission media. A computer-readable medium is any entity or device capable of storing and carrying information (such as one or more computer programs or portions thereof).

[0110] In addition to the memory 1804 (e.g., a computer-readable storage medium), the processing circuit 1802 may also be connected to one or more interfaces for displaying, sending, and / or receiving information. The interface may include a communication interface 1808 and / or one or more user interfaces (e.g., a display, a user input interface). The communication interface may be configured to send information to other devices, networks, etc. and / or receive information from other devices, networks, etc. The communication interface may be configured to send and / or receive information via a physical (wired) and / or wireless communication link. Examples of suitable communication interfaces include a network interface controller (NIC), a wireless NIC (WNIC), etc.

[0111] The processing circuit 1802 executes the instructions 1806 or stores the instructions in the memory 1804 to support a combination of operations for implementing the example implementations of the present disclosure. In this manner, the apparatus 1800 may include at least one processing circuit and at least one memory coupled to the at least one processing circuit, wherein the at least one processing circuit is configured to execute the instructions stored in the at least one memory. It will also be understood that one or more functions and combinations of functions may be implemented by a dedicated hardware computer system and / or processing circuit that performs the specified functions, or a combination of dedicated hardware and program code instructions.

[0112] Some example implementations of the present disclosure can also be performed in the form of a computer process defined by one or more computer programs or parts thereof. The example implementations of the present disclosure can be performed by executing at least a portion of a computer program comprising instructions. The computer program can be in source code form, object code form, or some intermediate form. The computer program can be stored in a computer-readable medium readable by a computer, a processing circuit or other suitable device. As described above, for example, the computer program can be stored in a memory (such as a computer-readable storage medium). Additionally or alternatively, for example, the computer program can be stored in a computer-readable transmission medium. The coding of the software for executing the example implementations of the present disclosure is fully within the scope of those of ordinary skill in the art.

[0113] As will be understood, any suitable instructions can be loaded from a memory or computer-readable medium (e.g., a computer-readable storage medium, a computer-readable transmission medium) onto a computer, processing circuit, or other programmable device to produce a specific machine so that the specific machine becomes a component for implementing the functions described herein. Instructions can also be stored in a computer-readable medium, which can direct a computer, processing circuit, or other programmable device to operate in a particular manner, thereby generating a specific machine or a specific manufactured product. In some examples, the instructions stored in a computer-readable medium can produce a manufactured product, wherein the manufactured product becomes a component for implementing the functions described herein. Instructions can be retrieved from a computer-readable medium and loaded into a computer, processing circuit, or other programmable device to configure the computer, processing circuit, or other programmable device to perform operations to be performed on or by the computer, processing circuit, or other programmable device.

[0114] The retrieval, loading, and execution of instructions (including program code instructions) may be performed sequentially such that one instruction is retrieved, loaded, and executed at a time. In some example implementations, the retrieval, loading, and / or execution may be performed in parallel such that multiple instructions are retrieved, loaded, and / or executed together. The execution of the program code instructions may produce a computer-implemented process such that the instructions executed by a computer, processing circuit, or other programmable device provide operations for implementing the functionality described herein.

[0115] As explained above and reiterated below, the present disclosure includes, but is not limited to, the following example implementations.

[0116] Clause 1. A device comprising: at least one memory configured to store instructions; and at least one processing circuit configured to access the at least one memory and execute the instructions to cause the device to at least: access an encrypted application stream, the encrypted application stream comprising an encrypted protocol data unit (PDU); and for each of one or more encrypted PDUs, perform Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein the IPSec packet is constructed to include the encrypted PDU and carry metadata, the metadata comprising at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; and send the IPSec packet to a network function, at which the metadata can be accessed from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a quality of service (QoS) flow for classification and QoS differentiation of the encrypted PDU.

[0117] Clause 2. An apparatus according to clause 1, wherein the metadata carried in the IPSec packet includes a media type indicator and PDU set information, and wherein the PDU set information includes one or more of: an indication of an end PDU of the PDU set, an indication of the end of a data burst that includes the PDU set, an indication of the importance of the PDU set, a PDU set sequence number, a sequence number of an encrypted PDU within the PDU set, or a PDU set size.

[0118] Clause 3. The apparatus of clause 1 or clause 2, wherein the at least one processing circuit is configured to execute instructions to cause the apparatus to further encrypt metadata carried in the IPSec packet.

[0119] Clause 4. The apparatus of any of clauses 1 to 3, wherein the IPSec packet includes an IPSec header and carries the metadata in a field of the IPSec header dedicated to metadata.

[0120] Clause 5. The apparatus of any of clauses 1 to 4, wherein the IPSec packet includes an IPSec header and carries the metadata in an integrity check value (ICV) field of the IPSec header.

[0121] Clause 6. An apparatus comprising: means for accessing an encrypted application stream, wherein the encrypted application stream includes an encrypted protocol data unit (PDU); and, for each of one or more encrypted PDUs, means for performing Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein an IPSec packet is constructed to include the encrypted PDU and to carry metadata, the metadata comprising at least one of: a media type indicator for the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; and means for sending the IPSec packet to a network function, at which the metadata is accessible from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a quality of service (QoS) flow for classification and QoS differentiation of the encrypted PDU.

[0122] Clause 7. An apparatus according to clause 6, wherein the metadata carried in the IPSec packet includes a media type indicator and PDU set information, and wherein the PDU set information includes one or more of the following: an indication of an end PDU of the PDU set, an indication of the end of a data burst that includes the PDU set, an indication of the importance of the PDU set, a PDU set sequence number, a sequence number of the encrypted PDU within the PDU set, or a PDU set size.

[0123] Clause 8. The apparatus of clause 6 or clause 7, further comprising means for encrypting metadata carried in the IPSec packet.

[0124] Clause 9. The apparatus of any of clauses 6 to 8, wherein the IPSec packet includes an IPSec header and carries the metadata in a field of the IPSec header dedicated to metadata.

[0125] Clause 10. The apparatus of any of clauses 6 to 9, wherein the IPSec packet includes an IPSec header and carries the metadata in an integrity check value (ICV) field of the IPSec header.

[0126] Clause 11. A method comprising: accessing an encrypted application flow, the encrypted application flow including an encrypted protocol data unit (PDU); and for each of one or more encrypted PDUs, performing Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein an IPSec packet is constructed to include the encrypted PDU and carry metadata, the metadata including at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; and sending the IPSec packet to a network function, at which the metadata is accessible from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a quality of service (QoS) flow for classification and QoS differentiation of the encrypted PDU.

[0127] Clause 12. The method of clause 11, wherein the metadata carried in the IPSec packet includes a media type indicator and PDU set information, and wherein the PDU set information includes one or more of: an indication of an end PDU of the PDU set, an indication of the end of a data burst that includes the PDU set, an indication of the importance of the PDU set, a PDU set sequence number, a sequence number of an encrypted PDU within the PDU set, or a PDU set size.

[0128] Clause 13. The method of clause 11 or clause 12, further comprising encrypting metadata carried in the IPSec packet.

[0129] Clause 14. The method of any of clauses 11 to 13, wherein the IPSec packet includes an IPSec header and the metadata is carried in a field of the IPSec header dedicated to metadata.

[0130] Clause 15. The method of any of clauses 11 to 14, wherein the IPSec packet includes an IPSec header and carries the metadata in an integrity check value (ICV) field of the IPSec header.

[0131] Clause 16. A computer-readable storage medium that is non-transitory and has instructions stored therein that, in response to execution by at least one processing circuit, cause a device to at least: access an encrypted application stream, the encrypted application stream comprising an encrypted protocol data unit (PDU); and for each of one or more encrypted PDUs, perform Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein the IPSec packet is constructed to include the encrypted PDU and carry metadata, the metadata comprising at least one of the following: a media type indicator for the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; and send the IPSec packet to a network function, at which the metadata is accessible from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a quality of service (QoS) flow for classification and QoS differentiation of the encrypted PDU.

[0132] Clause 17. A computer-readable storage medium as described in clause 16, wherein the metadata carried in the IPSec packet includes a media type indicator and PDU set information, and wherein the PDU set information includes one or more of the following: an indication of the end PDU of the PDU set, an indication of the end of a data burst that includes the PDU set, an indication of the importance of the PDU set, a PDU set sequence number, a sequence number of the encrypted PDU within the PDU set, or a PDU set size.

[0133] Clause 18. A computer-readable storage medium according to clause 16 or clause 17, wherein the computer-readable storage medium further has instructions stored therein that, in response to execution by at least one processing circuit, cause the apparatus to further encrypt metadata carried in the IPSec packet.

[0134] Clause 19. The computer-readable storage medium of any of Clauses 16 to 18, wherein the IPSec packet includes an IPSec header and carries the metadata in a field of the IPSec header dedicated to metadata.

[0135] Clause 20. The computer-readable storage medium of any of clauses 16 to 19, wherein the IPSec packet includes an IPSec header and carries the metadata in an integrity check value (ICV) field of the IPSec header.

[0136] Clause 21. An apparatus comprising means for performing the method of any one of clauses 11 to 15.

[0137] Clause 22. A computer readable medium comprising computer readable program code which, in response to being executed by at least one processing circuit, causes an apparatus to perform the method of any one of clauses 11 to 15.

[0138] Clause 23. A computer-readable storage medium comprising computer-readable program code, the computer-readable program code in response to being executed by at least one processing circuit, causing an apparatus to perform the method of any one of clauses 11 to 15.

[0139] Clause 24. A computer program comprising computer readable program code which, in response to being executed by at least one processing circuit, causes an apparatus to perform the method of any one of clauses 11 to 15.

[0140] Clause 25. A device comprising: at least one memory configured to store instructions; and at least one processing circuit configured to access the at least one memory and execute the instructions to cause the device to at least: receive Internet Protocol Security (IPSec) packets of an encrypted application flow, the encrypted application flow including encrypted protocol data units (PDUs); and for each of one or more IPSec packets constructed to include an encrypted PDU in the encrypted PDUs and carry metadata, access metadata carried by the IPSec packets, the metadata including at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; assign a category to the encrypted PDU based on at least one of the media type indicator or the PDU set information in the metadata; and forward the encrypted PDU with the category to a network, where, based on the category, the encrypted PDU is mapped to a quality of service (QoS) flow for classification and differentiation of the encrypted PDUs.

[0141] Clause 26. The apparatus of clause 25, wherein the metadata carried in the IPSec packet includes a media type indicator and PDU set information, and the at least one processing circuit is configured to execute instructions to cause the apparatus to further identify at least one PDU set to which the encrypted PDU belongs, and wherein the category is assigned to the encrypted PDU based on the at least one PDU set to which the encrypted PDU belongs.

[0142] Clause 27. The apparatus of clause 25 or clause 26, wherein the metadata carried by the IPSec packets is encrypted, and causing the apparatus to access the metadata comprises causing the apparatus to decrypt the metadata.

[0143] Clause 28. The apparatus of any of clauses 25 to 27, wherein the IPSec packet includes an IPSec header, and the metadata is accessed from a field of the IPSec header dedicated to metadata.

[0144] Clause 29. The apparatus of any of clauses 25 to 28, wherein the IPSec packet includes an IPSec header, and the metadata is accessed from an integrity check value (ICV) field of the IPSec header.

[0145] Clause 30. An apparatus comprising: means for receiving Internet Protocol Security (IPSec) packets of an encrypted application stream, wherein the encrypted application stream includes encrypted protocol data units (PDUs); and for each of one or more IPSec packets constructed to include an encrypted PDU in the encrypted PDUs and to carry metadata, means for accessing metadata carried by the IPSec packets, wherein the metadata includes at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; means for assigning a category to the encrypted PDU based on at least one of the media type indicator or the PDU set information in the metadata; and means for forwarding the encrypted PDU with the category to a network, where, based on the category, the encrypted PDU is mapped to a quality of service (QoS) flow for classification and differentiation of the encrypted PDUs.

[0146] Clause 31. An apparatus according to clause 30, wherein the metadata carried in the IPSec packet includes a media type indicator and PDU set information, and the apparatus further comprises: a component for identifying at least one PDU set to which the encrypted PDU belongs, and wherein the category is assigned to the encrypted PDU based on the at least one PDU set to which the encrypted PDU belongs.

[0147] Clause 32. The apparatus of clause 30 or clause 31, wherein the metadata carried by the IPSec packets is encrypted, and the means for accessing the metadata comprises means for decrypting the metadata.

[0148] Clause 33. The apparatus of any of clauses 30 to 32, wherein the IPSec packet includes an IPSec header, and the metadata is accessed from a field of the IPSec header dedicated to metadata.

[0149] Clause 34. The apparatus of any of clauses 30 to 33, wherein the IPSec packet includes an IPSec header, and the metadata is accessed from an integrity check value (ICV) field of the IPSec header.

[0150] Clause 35. A method comprising: receiving Internet Protocol Security (IPSec) packets of an encrypted application flow, the encrypted application flow including encrypted protocol data units (PDUs); and for each of one or more IPSec packets constructed to include an encrypted PDU in the encrypted PDUs and to carry metadata, accessing metadata carried by the IPSec packets, the metadata comprising at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; assigning a category to the encrypted PDU based on at least one of the media type indicator or the PDU set information in the metadata; and forwarding the encrypted PDU with the category to a network, where, based on the category, the encrypted PDU is mapped to a quality of service (QoS) flow for classification and differentiation of the encrypted PDUs.

[0151] Clause 36. A method according to clause 35, wherein the metadata carried in the IPSec packet includes a media type indicator and PDU set information, and the method further comprises: identifying at least one PDU set to which the encrypted PDU belongs, and wherein the category is assigned to the encrypted PDU based on the at least one PDU set to which the encrypted PDU belongs.

[0152] Clause 37. The method of clause 35 or clause 36, wherein the metadata carried by the IPSec packets is encrypted, and accessing the metadata comprises decrypting the metadata.

[0153] Clause 38. The method of any of clauses 35 to 37, wherein the IPSec packet includes an IPSec header, and the metadata is accessed from a field of the IPSec header dedicated to metadata.

[0154] Clause 39. The method of any of clauses 35 to 38, wherein the IPSec packet includes an IPSec header, and the metadata is accessed from an integrity check value (ICV) field of the IPSec header.

[0155] Clause 40. A computer-readable storage medium that is non-transitory and has instructions stored therein that, in response to execution by at least one processing circuit, cause a device to at least: receive Internet Protocol Security (IPSec) packets of an encrypted application stream, the encrypted application stream including encrypted protocol data units (PDUs); and for each of one or more IPSec packets constructed to include an encrypted PDU in the encrypted PDUs and to carry metadata, access metadata carried by the IPSec packets, the metadata including at least one of: a media type indicator for the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; assign a category to the encrypted PDU based on at least one of the media type indicator or the PDU set information in the metadata; and forward the encrypted PDU with the category to a network, where, based on the category, the encrypted PDU is mapped to a quality of service (QoS) flow for classification and differentiation of the encrypted PDUs.

[0156] Clause 41. A computer-readable storage medium as described in clause 40, wherein the metadata carried in the IPSec packet includes a media type indicator and PDU set information, and the computer-readable storage medium further has instructions stored therein that, in response to execution by at least one processing circuit, cause the device to further identify at least one PDU set to which the encrypted PDU belongs, and wherein the category is assigned to the encrypted PDU based on the at least one PDU set to which the encrypted PDU belongs.

[0157] Clause 42. The computer-readable storage medium of clause 40 or clause 41, wherein the metadata carried by the IPSec packets is encrypted, and causing the device to access the metadata comprises causing the device to decrypt the metadata.

[0158] Clause 43. The computer-readable storage medium of any of clauses 40 to 42, wherein the IPSec packet includes an IPSec header, and the metadata is accessed from a field of the IPSec header dedicated to metadata.

[0159] Clause 44. The computer-readable storage medium of any of clauses 40 to 43, wherein the IPSec packet includes an IPSec header, and the metadata is accessed from an integrity check value (ICV) field of the IPSec header.

[0160] Clause 45. An apparatus comprising means for performing the method of any one of clauses 35 to 39.

[0161] Clause 46. A computer readable medium comprising computer readable program code which, in response to being executed by at least one processing circuit, causes an apparatus to perform the method of any one of clauses 35 to 39.

[0162] Clause 47. A computer-readable storage medium comprising computer-readable program code that, in response to being executed by at least one processing circuit, causes an apparatus to perform the method of any one of clauses 35 to 39.

[0163] Clause 48. A computer program comprising computer readable program code which, in response to execution by at least one processing circuit, causes an apparatus to perform the method of any one of clauses 35 to 39.

[0164] With the benefit of the teachings presented in the foregoing description and the associated drawings, those skilled in the art to which the present disclosure is related will appreciate many modifications and other implementations of the present disclosure described herein. Therefore, it will be understood that the present disclosure is not limited to the specific implementation disclosed, and that these modifications and other implementations are intended to be included within the scope of the appended claims. In addition, although the foregoing description and the associated drawings describe example implementations in the context of certain example combinations of elements / elements and / or functions, it will be understood that different combinations of elements / elements and / or functions may be provided by alternative implementations without departing from the scope of the appended claims. In this regard, for example, combinations different from the above-mentioned explicitly described elements / elements and / or functions as may be set forth in some of the appended claims are also contemplated. Although specific terms are used herein, they are used only in a general and descriptive sense, and not for the purpose of limitation.< / metadata> < / metadata>

Claims

1. A device comprising: means for accessing an encrypted application stream, wherein the encrypted application stream comprises an encrypted protocol data unit (PDU); and For each of the one or more encrypted PDUs, means for performing Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein an IPSec packet is constructed to include the encrypted PDU and to carry metadata, the metadata comprising at least one of: a media type indicator of the encrypted PDU, or PDU set information regarding at least one PDU set to which the encrypted PDU belongs; and Means for sending the IPSec packet to a network function, where the metadata is accessible from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a Quality of Service (QoS) flow for classification and QoS differentiation of the encrypted PDU.

2. The device according to claim 1, wherein The metadata carried in the IPSec packet includes the media type indicator and the PDU set information, and The PDU set information includes one or more of the following: an indication of the end PDU of the PDU set, an indication of the end of a data burst of the PDU set, an indication of the importance of the PDU set, a PDU set sequence number, a sequence number of the encrypted PDU within the PDU set, or a PDU set size.

3. The device according to claim 1 or claim 2, wherein: The device further comprises: means for encrypting the metadata carried in the IPSec packet.

4. A method comprising: Accessing an encrypted application stream, wherein the encrypted application stream includes an encrypted protocol data unit (PDU); as well as For each of the one or more encrypted PDUs, performing Internet Protocol Security (IPSec) processing of the encrypted PDU, wherein an IPSec packet is constructed to include the encrypted PDU and carry metadata, the metadata including at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; as well as The IPSec packet is sent to a network function where the metadata is accessible from the IPSec packet for PDU set identification and for mapping the encrypted PDU to a Quality of Service (QoS) flow for classification and QoS differentiation of the encrypted PDU.

5. The method according to claim 4, wherein The metadata carried in the IPSec packet includes the media type indicator and the PDU set information, and The PDU set information includes one or more of the following: an indication of the end PDU of the PDU set, an indication of the end of a data burst of the PDU set, an indication of the importance of the PDU set, a PDU set sequence number, a sequence number of the encrypted PDU within the PDU set, or a PDU set size.

6. The method according to claim 4 or claim 5, wherein: The method further comprises: The metadata carried in the IPSec packet is encrypted.

7. A device comprising: means for receiving Internet Protocol Security (IPSec) packets of an encrypted application stream, wherein the encrypted application stream comprises encrypted protocol data units (PDUs); and For each of the one or more IPSec packets constructed to include the encrypted PDU in the encrypted PDU and carry metadata, means for accessing the metadata carried by the IPSec packet, wherein the metadata comprises at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; means for assigning a category to the encrypted PDU based on at least one of the media type indicator in the metadata or the PDU set information; and means for forwarding said encrypted PDU having said class to a network, where said encrypted PDU is mapped to a Quality of Service (QoS) flow based on said class for classification and differentiation of said encrypted PDU.

8. The device according to claim 7, wherein The metadata carried in the IPSec packet includes the media type indicator and the PDU set information, and the apparatus further comprises: a component for identifying the at least one PDU set to which the encrypted PDU belongs, and The category is assigned to the encrypted PDU according to the at least one PDU set to which the encrypted PDU belongs.

9. A method comprising: receiving an Internet Protocol security (IPSec) packet of an encrypted application flow, wherein the encrypted application flow includes an encrypted protocol data unit (PDU); as well as For each of the one or more IPSec packets constructed to include the encrypted PDU in the encrypted PDU and carry metadata, Accessing the metadata carried by the IPSec packet, the metadata comprising at least one of the following: a media type indicator of the encrypted PDU, or PDU set information about at least one PDU set to which the encrypted PDU belongs; assigning a category to the encrypted PDU based on at least one of the media type indicator in the metadata or the PDU set information; as well as The encrypted PDUs with the class are forwarded to a network, where the encrypted PDUs are mapped to quality of service (QoS) flows based on the class for classification and differentiation of the encrypted PDUs.

10. The method according to claim 9, wherein: The metadata carried in the IPSec packet includes the media type indicator and the PDU set information, and the method further comprises: identifying the at least one PDU set to which the encrypted PDU belongs, and The category is assigned to the encrypted PDU according to the at least one PDU set to which the encrypted PDU belongs.

Images