Http / 2 stream multiplexing optimization and attack prevention

Abstract

Systems and methods are disclosed that relate to Hyper-Text Transfer Protocol version 2 (HTTP / 2) stream multiplexing optimization and attack prevention. In one embodiment, a method performed by a first HTTP / 2 node comprises establishing a Transport Control Protocol (TCP) connection with a second HTTP / 2 node and receiving, from the second HTTP / 2 node, a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter to a first value. The method further comprises, while the TCP connection is established, sending, to the second HTTP / 2 node, an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter to a second value that is different than the first value. In this manner, the second HTTP / 2 node (e.g., a HTTP / 2 peer) is able to request a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter.

Description

HTTP / 2 STREAM MULTIPLEXING OPTIMIZATION AND ATTACK PREVENTIONTechnical Field

[0001] The present disclosure relates to Hyper-Text Transfer Protocol version 2 (HTTP / 2) multiplexing of concurrent streams on a Transport Control Protocol (TCP) connection and, more specifically, to updating a maximum number of concurrent streams for a TCP connection, e.g. for optimization and attack prevention.Background

[0002] Fifth Generation (5G) networks improve operational efficiency and customer experience and provide a wide range of high-bandwidth and low-latency services. This was possible through the adoption of a Service Based Architecture (SBA) that is based on cloudnative deployment supported by a set of enabling virtualization technologies such as Network Function Virtualization (NFV), Software Defined Networking (SDN), etc. Leveraging virtualization technologies enables better flexibility, scalability, and automated service management in 5G networks as the 5G Network Functions (NFs) are virtualized. The realization of 5G networks was also accompanied by the adoption of a standardized set of REpresentational State Transfer (RESTful) Application Programming Interfaces (APIs) combined with web-based technologies including the Transport Control Protocol (TCP) / Transport Layer Security (TLS) / Hyper-Text Transfer Protocol version 2 (HTTP / 2) / JavaScript Object Notation (JSON) protocol suit to enable reliable and secure communication between its NFs, in addition to providing high efficiency through reduced resources consumption and simplified 5G system implementation. The use of web-based technologies and protocols, in particular the adoption of HTTP / 2 in 5G SBA extends the attack surface of the latter and makes it vulnerable to multiple HTTP / 2 attacks such as the stream multiplexing attack. In the following, an overview of 5G SBA as well as that of the HTTP / 2 protocol and its usage in 5G networks is presented. Then, the HTTP / 2 stream multiplexing attack in 5G networks as well as some of the related cybersecurity challenges are discussed.1 5G Service Based Architecture

[0003] Figure 1 illustrates the 5G network architecture. The 5G network architecture decouples the control plane from the data plane while promoting an SBA for the control plane. The SBA architecture consists of virtualized and interconnected NFs in which the Service Based Interfaces (SBIs) can be easily extended without the need for introducing new reference points.Each NF in the 5G SBA provides a set of services through well-defined and standardized APIs. The communication, also known as 5G signaling, between the 5G NFs is enabled by the HTTP / 2 protocol with JSON as the application layer serialization protocol and TCP as the transport protocol. To enable secure communication between these NFs, TES 1.2 or TLS 1.3 is supported.

[0004] To access each other’s services, 5G NFs first get authorization of the Network Repository Function (NRF). The NRF issues an Open Authorization (OAuth) 2.0 authorization token to the NF requesting the service. The latter is known as NF service consumer (NFc). In fact, the NRF maintains an NF profile that includes a list of available NF instances and their services. This allows an NFc that wishes to access the service of another NF, known as NF service producer (NFp), to discover the NFp instances and services by consulting the NRF.

[0005] Once an NFc has discovered an NFp instance, the NFc can directly consume authorized services through the APIs exposed by the NFp. These 3rdGeneration Partnership Project (3GPP) standardized APIs can be either in the form of Request-Response or Subscribe- Notify. In a Request-Response scenario, a request is issued by an NFc and a response is provided by an NFp. However, in a Subscribe-Notify scenario, an NFc subscribes to an event of an NFp. Upon the occurrence of such event, the NFp notifies the NFc.

[0006] Finally, it is important to note that signaling between 5G NFs can be based on direct communication or indirect communication through a Service Communication Proxy (SCP). The SCP not only routes the requests and responses between the NFcs and the NFps but also provides load balancing, overload handling, traffic prioritization, and message manipulation functionalities. In a roaming scenario, a Security Edge Protection Proxy (SEPP) is deployed at the edge of the network as a gateway between roaming partners to prevent any unauthorized access to the home network from outsiders. The SEPP ensures secure communication between roaming partners NFs through providing application-layer security, traffic filtering, end-to-end authentication, confidentiality, and integrity protection via signatures and encryption of HTTP / 2 messages.2 HTTP / 2 ProtocolA. Overview

[0007] HTTP / 2 is an application-layer protocol selected as the signaling protocol in the 5G SBA due to its support of a large number of transactions (i.e., streams) per service, its bidirectional (i.e., request / response) and reliable communication, its improved end-user latency, and its extensibility to provide new features (i.e., settings, error codes, etc.).

[0008] An HTTP / 2 connection is an application-layer connection established over a TCP connection between an HTTP / 2 client and an HTTP / 2 server. In contrast to HTTP version 1.1 HTTP / 1.1 which allows a request and a response message over a single TCP connection, HTTP / 2 enables multiplexing multiple requests / responses over the same TCP connection. HTTP / 2 introduces the notion of a “stream” and defines it as a request / response tuple. Streams can be multiplexed and prioritized over a single TCP connection. A stream represents a bidirectional channel on which frames are transmitted. A frame replaces the HTTP / 1.1 header and body format. It is the basic HTTP / 2 data unit and adopts a binary encoding. A frame can be of different types such as, for example:• HEADERS: HEADERS frame is used to open a stream and carries different header fields in the form of <key, value> pair.• DATA: DATA frame holds the HTTP / 2 request and response payload.• SETTINGS: SETTINGS frame is used by an HTTP / 2 client and server to convey configuration parameters affecting their communication.• WINDOW UPDATE: WINDOW_UPDATE is used for flow control.• PRIORITY: PRIORITY frame is used to modify a stream priority.B. HTTP / 2 Standard and Custom Headers

[0009] The HTTP / 2 HEADERS frame can hold standard and custom header fields. HTTP / 2 provides a set of standard headers used in both requests and responses. These standard headers include, for example:• path: The path is used in a request and includes the path and query parts of the target Uniform Resource Identifier (URI) (i.e., API URI).• scheme: The scheme is used in a request and declares the version of HTTP used (e.g., http or https).• Authorization: The authorization header is used in a request and holds the OAuth 2.0 access token provided by the NRF to the NFc. The NFp validates this token (i.e., validate the token, its expiry date and access scope) before granting the NFc access to the requested resource.• WWW- Authenticate: WWW- Authenticate header is used by an NFp in a response upon its rejection of the corresponding request. WWW-Authenticate allows an NFp to specify to an NFc the reason for the rejection of its request (i.e., invalid token, insufficient scope).• status: The status is used in a response and carries the HTTP status code.

[0010] HTTP / 2 can be extended through the addition of new frame types, settings, and error codes. In fact, 3GPP extends HTTP / 2 by adding a list of custom header fields specific for 5G networks. From these custom headers, the following are some of the custom headers that enable 5G NFs to communicate their load information for the purpose of controlling their load and overload:• 3gpp_Sbi_Lci: 3gpp_Sbi_Lci can be used by an NFp / SCP / SEPP to send Load Control Information (LCI) to an NFc. This allows an NFc to decide whether or not to send further requests to the NFp or to simply opt to send its new requests to another NFp instance, thus enabling better load balancing in the network.• 3gpp _Sbi_Oci: 3gpp_Sbi_Oci allows an NFp / NFc / SCP / SEPP to signal to its peer its Overload Control Information (OCI). Using this header, the overloaded NFp / NFc instructs its peer to throttle the service / notification requests in order to reduce its signalling load.• 3gpp-Sbi-Message-Priority: 3gpp-Sbi-Message-Priority specifies the HTTP / 2 message priority for 3GPP SBIs. 3gpp-Sbi-Message-Priority allows assigning the response a priority that differs from that of the request unlike the PRIORITY frame that determines the priority of the whole stream (request and response). The SBI Message Priority (SMP) assists NFp / NFc / proxies when making throttling decisions related to an overload control or when routing messages through proxies.C. HTTP / 2 Features

[0011] HTTP / 2 introduces a set of features in comparison to HTTP / 1.1 in order to improve latency. These features include:• Multiplexing: The multiplexing feature enables multiple streams to be concurrently carried over a single TCP connection. An HTTP / 2 client / server can limit the maximum number of concurrent streams over a single TCP connection with its peers using the HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS setting.• Header compression: The header compression feature uses the HPACK protocol to compress HTTP / 2 redundant headers across multiplexed streams using a combination of compression schemes (static Huffman coding and context adaptive coding). This feature enables lower bandwidth utilization.• Stream dependency and prioritization: Stream dependency and prioritization feature is a set of mechanisms that allow HTTP / 2 clients and servers to signal how to transmit objects to each other. An HTTP / 2 client can use the PRIORITY frame toassign a priority to each stream in order to determine the order in which it wishes the server to process them. The client can also determine dependency between streams in order to dictate to the server the relative proportion of available resources that it has to allocate to them.• Resource push: The resource push mechanism facilitates pushing resources from HTTP / 2 servers to their clients without the need to wait for the clients to request these resources.

[0012] Despite the benefits introduced by HTTP / 2 features, the latter can be exploited by attackers to launch attacks on the 5G network. An example of these attacks is the HTTP / 2 stream multiplexing attack, which is described in the following section.3 HTTP / 2 Stream Multiplexing Attack

[0013] The use of HTTP / 2 in 5G SB A extends the attack surface of 5G networks. As a result, 5G networks have become vulnerable to HTTP / 2 based attacks such as the stream multiplexing attack. The new HTTP / 2 stream multiplexing feature enhances the service time of 5G networks as it allows multiplexing multiple streams over the same TCP connection. This allows an NFc acting as an HTTP / 2 client to send multiple requests and receive their responses over the same TCP connection with an NFp acting as an HTTP / 2 server. The maximum number of streams allowed per connection is directional and specified by each peer using the SETTINGS_MAX_CONCURRENT_STREAMS setting frame. The value of this setting applies to the number of streams that the sender permits the receiver to create. In Request for Comments (RFC) 7540, the Internet Engineering Task Force (IETF) recommends a minimum value of 100 streams for SETTINGS_MAX_CONCURRENT_STREAMS to not limit parallelism. While no upper limit has been specified for this setting, its maximum value can go up to 2,147,483,647 streams as the setting frame value is designed to be on 32 bits.

[0014] While network operators can determine the value of the SETTINGS_MAX_CONCURRENT_STREAMS setting and opt for a relatively small value (i.e., around 100 streams per connection) for their HTTP / 2 nodes, the choice of such value is highly dependent on the computing and network resources allocated to those nodes. This setting is usually pre-configured for each HTTP / 2 node and requires a network administrator to reconfigure it when needed. Attackers can exploit the stream multiplexing feature to launch an HTTP / 2 stream multiplexing attack that causes a Denial of Service (DoS) on the network. In 5G networks, an attacker can launch many computationally expensive requests, that can go up to 2,147,483,647 streams per connection, from an NFc towards an NFp to cause a DoS on the NFp.The attacker can exploit multiple APIs (i.e., NFp services) to make the attack look stealthy. The attacker can also scale the attack by initiating multiple TCP connections with the NFp and exploit the SETTINGS_MAX_CONCURRENT_STREAMS setting in each of them.A. Applicability in 5G Networks

[0015] The stream multiplexing attack can take place in any network using the HTTP / 2 protocol. It can be launched from the HTTP / 2 client towards the HTTP / 2 server and vice versa as the SETTINGS_MAX_CONCURRENT_STREAMS setting is directional. Given the different security features introduced in 5G networks (see Section 1 of the Background above) such as mutual authentication capabilities, enhanced subscriber protection, signaling data integrity through the SEPP deployed between roaming partners, token-based authorization for service accessibility, among others, one may question the feasibility of this attack in 5G SBA.

[0016] In fact, the use of virtualization technologies in 5G SBA extends its attack surface. The willingness of mobile operators to move to the public cloud increases the chances of cyber security attacks. In fact, several standardization documents and surveys discuss threat agents in 5G networks and present a threat analysis on virtual NFs and network services during their life cycle. An attacker can exploit these vulnerabilities and use them to compromise 5G NFs and launch a stream multiplexing attack.

[0017] Another possible attack scenario is related to a breach of isolation between two network slices belonging to the same or different Mobile Network Operators (MNOs) and sharing one or many NFs. The breach of isolation can be either a result of an attack or simply due to a misconfiguration. In such scenarios, the attack on the shared NF(s) from one slice can impact the functionality of the other slice.

[0018] Finally, the stream multiplexing attack can originate from a malicious roaming partner and remain undetected by the filtering techniques applied at the SEPP. These filtering techniques either account for upper layer filtering to detect interface misuse, hijacking and prevent roaming partners from extending their services / features. Upper layer filtering also includes filtering based on information element (e.g., Subscription Permeant Identifier (SUPI), Subscription Concealed Identifier (SUCI), etc.) or location-based filtering, velocity and time check or application content filtering (i.e., SMS). Lower layer filtering is also available at the SEPP and is based on HTTP / 2 JSON correctness check and network level inspection at the Internet Protocol (IP) layer. These filtering techniques overlook the number of connections initiated by a roaming partner towards a specific NF and do not evaluate the number of streams exploited per connection. Further, uponthe use of multiple APIs throughout a connection, the stream multiplexing attack may remain stealthy and undetected.

[0019] Thus, in light of the above assumptions and as an example, Figure 2 illustrates an example stream multiplexing attack launched by an attacker who compromised an NFc to attack an NFp. In this example, the NFc is a Session Management Function (SMF) that is requesting the services of an Access and Mobility Management Function (AMF) acting as an NFp.B. Stream Multiplexing Attack Assumptions

[0020] In the present disclosure, it is considered that the stream multiplexing attack can take place in a roaming scenario between two different MNOs, or in a non-roaming scenario within the same MNO’s network. In both cases, the following is assumed with respect to the stream multiplexing attack:• The attacker compromised an NFc (e.g., SMF) and used it to launch an attack on an NFp (e.g., AMF). This can be done by exploiting vulnerabilities in virtualization technologies and / or network slicing. The attacker can also be an insider who compromised an NFc TLS key and impersonated it.• The NFc and NFp can belong to the same MNO or to different roaming partners.• The NFc and NFp can communicate directly or indirectly through SCP and / or SEPP (i.e., in a roaming scenario).• The NFc and NFp are mutually authenticated using TLS. As it is assumed that the legitimate NFc is compromised or is impersonated, it is assumed that the attacker also has access to the NFc private key to perform the authentication with the NFp.• The NFc is authorized by the NRF to use the services of the NFp. As the legitimate NFc is compromised or impersonated, it can be authenticated and authorized by the NRF to use the NFp services.

[0021] In the following, the terms compromised NFc and impersonated NFc are used interchangeably.C. Attack Description

[0022] Considering the above assumptions, the attacker can launch the stream multiplexing attack by following the below steps:• The attacker starts by establishing a TCP connection with the NFp (e.g., AMF).• The attacker floods the NFp (e.g., AMF) with multiple, different and computationally expensive HTTP / 2 requests over the established connection to make the attack look stealthy.• The NFp (e.g., AMF) receives the spoofed requests from the compromised NFc (e.g., SMF) in the form of streams and allocates a thread per stream to execute for their execution. As the received requests originate from an authorized and authenticated NFc, the NFp fails to detect that it is being attacked. As the requests are computationally expensive, they consume the majority of the NFp resources for a potentially long period of time, thus depleting the NFp resources.• The attacker exploits the limit of the SETTINGS_MAX_CONCURRENT_STREAMS setting enforced by the NFp (e.g., AMF) at the beginning of the connection by multiplexing as many streams as this setting allows.• The attacker repeats the above steps by creating multiple TCP connections with the NFp (e.g., AMF) to scale the attack and cause a DoS on the NFp and the 5G network.

[0023] In 5G networks, the stream multiplexing attack is a signaling attack that can be launched by any compromised NFc toward an NFp and vice versa given that the SETTINGS_MAX_CONCURRENT_STREAMS is directional and is enforced by the receiver towards the sender. Further, this attack can also be launched by a botnet that will trigger an NFc to exploit the multiplexing feature with an NFp to respond to the malicious User Equipment’s (UE’s) demands. Thus, it is crucial to prevent this attack in 5G networks.

[0024] Systems and methods are disclosed that relate to Hyper-Text Transfer Protocol version 2 (HTTP / 2) stream multiplexing optimization and attack prevention. In one embodiment, a method performed by a first HTTP / 2 node comprises establishing a Transport Control Protocol (TCP) connection with a second HTTP / 2 node and receiving, from the second HTTP / 2 node, a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a first value. The method further comprises transmitting data to the second HTTP / 2 node over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter. The method further comprises, while the TCP connection is established, sending, to the second HTTP / 2 node, an update framethat requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a second value that is different than the first value. In this manner, the second HTTP / 2 node (e.g., a HTTP / 2 peer) is able to request a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter.

[0025] In one embodiment, the method further comprises, while the TCP connection is established, receiving, from the second HTTP / 2 node, a second settings frame responsive to the update frame, wherein the second settings frame sets the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to the second value.

[0026] In one embodiment, the method further comprises, while the TCP connection is established, receiving, from the second HTTP / 2 node, a second settings frame responsive to the update frame, wherein the second settings frame sets the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a third value that is different than both the first value and the second value.

[0027] In one embodiment, the method further comprises, after sending the update frame but prior to receiving the second settings frame, receiving a second update frame from the second HTTP / 2 node that acknowledges the update frame. In one embodiment, the third value is in a range of values between the first value and the second value. In one embodiment, the second update frame accepts the request to change the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection.

[0028] In one embodiment, the method further comprises receiving a second update frame from the second HTTP / 2 node that rejects the request to change the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection.

[0029] In one embodiment, the second value is greater than the first value. In another embodiment, the second value is less than the first value.

[0030] In one embodiment, the first HTTP / 2 node is a first network node in a core network of a cellular communications system, and the second HTTP / 2 node is a second network node in the core network of the cellular communications system. In one embodiment, the method further comprises receiving load control information from the second network node and deciding, based on the load control information received from the second network node, to request an increase in the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection. In addition, sending the update frame comprises sending the update frame to the second network node responsive to deciding to request an increase in the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection.

[0031] Corresponding embodiments of a first HTTP / 2 node are also disclosed. In one embodiment, a first HTTP / 2 node is adapted to establish a TCP connection with a second HTTP / 2 node and receive, from the second HTTP / 2 node, a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a first value. The first HTTP / 2 node is further adapted to transmit data to the second HTTP / 2 node over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter. The first HTTP / 2 node is further adapted to, while the TCP connection is established, send, to the second HTTP / 2 node, an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a second value that is different than the first value.

[0032] In one embodiment, a first HTTP / 2 node comprises a network interface and processing circuitry associated with the network interface. The processing circuitry is configured to cause the first HTTP / 2 node to establish a TCP connection with a second HTTP / 2 node and receive, from the second HTTP / 2 node, a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a first value. The processing circuitry is further configured to cause the first HTTP / 2 node to transmit data to the second HTTP / 2 node over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for theSETTINGS J AX_CONCURRENT_STREAMS parameter. The processing circuitry is further configured to cause the first HTTP / 2 node to, while the TCP connection is established, send, to the second HTTP / 2 node, an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a second value that is different than the first value.

[0033] Corresponding embodiments of a computer program, a carrier, and a non-transitory computer readable medium are also disclosed.

[0034] Embodiments of a method performed by a second HTTP / 2 node are also disclosed. In one embodiment, a method performed by a second HTTP / 2 node comprises establishing a TCP connection with a first HTTP / 2 node and sending, to the first HTTP / 2 node, a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a first value. The method further comprises receiving data from the first HTTP / 2 node over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter. The method further comprises, while the TCP connection is established, receiving, from the first HTTP / 2 node, an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a second value that is different than the first value.

[0035] In one embodiment, the method further comprises, while the TCP connection is established, sending, to the first HTTP / 2 node, a second settings frame responsive to the update frame, wherein the second settings frame sets the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to the second value.

[0036] In one embodiment, the method further comprises, while the TCP connection is established, sending, to the first HTTP / 2 node, a second settings frame responsive to the update frame, wherein the second settings frame sets the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a third value that is different than both the first value and the second value.

[0037] In one embodiment, the method further comprises, after receiving the update frame but prior to sending the second settings frame, sending a second update frame from the second HTTP / 2 node that acknowledges the update frame. In one embodiment, the third value is in a range of values between the first value and the second value. In one embodiment, the second update frame accepts the request to change the value of the SETTINGS J AX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection.

[0038] In one embodiment, the method further comprises sending a second update frame to the first HTTP / 2 node that rejects the request to change the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection.

[0039] In one embodiment, the second value is greater than the first value. In another embodiment, the second value is less than the first value.

[0040] In one embodiment, the first HTTP / 2 node is a first network node in a core network of a cellular communications system, and the second HTTP / 2 node is a second network node in the core network of the cellular communications system. In one embodiment, the method further comprises sending load control information to the first network node.

[0041] Corresponding embodiments of a second HTTP / 2 node are also disclosed. In one embodiment, a second HTTP / 2 node is adapted to establish a TCP connection with a first HTTP / 2 node and sending, to the first HTTP / 2 node, a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a first value. The second HTTP / 2 node is further adapted to receive data from the first HTTP / 2 node over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter. The second HTTP / 2 node is further adapted to, while the TCP connection is established, receive, from the first HTTP / 2 node, an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a second value that is different than the first value.

[0042] In one embodiment, a second HTTP / 2 node comprises a network interface and processing circuitry associated with the network interface. The processing circuitry is configuredto cause the second HTTP / 2 node to establish a TCP connection with a first HTTP / 2 node and sending, to the first HTTP / 2 node, a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a first value. The processing circuitry is further configured to cause the second HTTP / 2 node to receive data from the first HTTP / 2 node over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter. The processing circuitry is further configured to cause the second HTTP / 2 node to, while the TCP connection is established, receive, from the first HTTP / 2 node, an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node to the second HTTP / 2 node on the TCP connection to a second value that is different than the first value.

[0043] Corresponding embodiment of a computer program, carrier, and non-transitory computer readable medium are also disclosed.

[0044] Embodiments of method of an HTTP / 2 node for optimizing a parameter that defines a maximum number of concurrent streams for a connection are also disclosed. In one embodiment, a method performed by an HTTP / 2 node comprises establishing a TCP connection with a peer HTTP / 2 node. The method further comprises, while the TCP connection is established, determining a new value for a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection, based on any one or more of the following: current available resources at the HTTP / 2 node, predicted future available resources at the HTTP / 2 node, current priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node, and predicted priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node. The method further comprises sending, to the peer HTTP / 2 node, a settings frame that sets a value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection to the new value.

[0045] In one embodiment, the current available resources at the HTTP / 2 node comprise any one or more of the following: a current amount of available processing resources, a current amount of available memory resources, a current number of available processing threads, and an amount of resources currently estimated to be consumed by one or more peer HTTP / 2 nodes.

[0046] In one embodiment, the method further comprises detecting a triggering condition for determining the new value for the SETTINGS J AX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection and sending the settings frame that sets the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection to the new value. In one embodiment, the triggering condition comprises: establishment of a new HTTP / 2 connection, closing one or more existing HTTP / 2 connections, a periodic triggering condition based on a configuration of the HTTP / 2 node, a triggering condition associated to a network or HTTP / 2 node self-healing procedure, or a management request.

[0047] Corresponding embodiments of an HTTP node are also disclosed. In one embodiment, an HTTP / 2 node is adapted to establish a TCP connection with a peer HTTP / 2 node. The HTTP / 2 node is further adapted to, while the TCP connection is established, determine a new value for a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection, based on any one or more of the following: current available resources at the HTTP / 2 node, predicted future available resources at the HTTP / 2 node, current priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node, and predicted priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node. The HTTP / 2 node is further adapted to send, to the peer HTTP / 2 node, a settings frame that sets a value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection to the new value.

[0048] In one embodiment, an HTTP / 2 node comprises a network interface and processing circuitry associated with the network interface. The processing circuitry is configured to cause the HTTP / 2 node to establish a TCP connection with a peer HTTP / 2 node. The processing circuitry is further configured to cause the HTTP / 2 node to, while the TCP connection is established, determine a new value for a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection, based on any one or more of the following: current available resources at the HTTP / 2 node, predicted future available resources at the HTTP / 2 node, current priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node, and predicted priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node. The processing circuitry is further configured to cause the HTTP / 2 node to send, to the peer HTTP / 2 node, asettings frame that sets a value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection to the new value.

[0049] Corresponding embodiments of a computer program, carrier, and non-transitory computer readable medium are also disclosed.Brief Description of the Drawings

[0050] The accompanying drawing figures incorporated in and forming a part of this specification illustrate several aspects of the disclosure, and together with the description serve to explain the principles of the disclosure.

[0051] Figure 1 illustrates the 5thGeneration (5G) Service-Based Architecture (SBA);

[0052] Figure 2 illustrates an example stream multiplexing attack launched by an attacker who compromised a Network Function (NF) consumer to attack an NF producer;

[0053] Figure 3 illustrates a current option for updating the maximum number of concurrent streams for a Transport Control Protocol (TCP) connection currently defined in the Hyper-Text Transfer Protocol version 2 (HTTP / 2) protocol;

[0054] Figure 4 illustrates another option for updating the maximum number of concurrent streams for a TCP connection currently defined in the HTTP / 2 protocol;

[0055] Figure 5 illustrates one example of a 5G specificSETTINGS_MAX_CONCURRENT_STREAMS update procedure in accordance with an embodiment of the present disclosure;

[0056] Figures 6 and 7 illustrate examples of 5G specific custom headers;

[0057] Figure 8 is a flow chart that illustrates the operation of the HTTP / 2 node and the HTTP / 2 peer of Figure 5 in more detail, in accordance with one example embodiment of the present disclosure;

[0058] Figure 9 illustrates an example MAX_CONCURRENT_STREAMS_UPDATE payload format, in accordance with an embodiment of the present disclosure;

[0059] Figure 10 illustrates an example procedure pertaining to increasing the value of SETTINGS JVIAX_CONCURRENT_STREAMS setting following a request from an HTTP / 2 peer to an HTTP / 2 node, in accordance with an embodiment of the present disclosure;

[0060] Figure 11 is a flow chart that illustrates the operation of the HTTP / 2 node and HTTP / 2 peer to perform the 5G specific SETTINGS_MAX_CONCURRENT_STREAMS update procedure in the case of increasing its value, in accordance with one embodiment of the present disclosure;

[0061] Figure 12 is a flow chart that illustrates one example of an HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS optimization mechanism, in accordance with an embodiment of the present disclosure;

[0062] Figure 13 illustrates an example of a triggering event for HTTP / 2 SETTINGS_MAX_CURRENT_STREAMS optimization, in accordance with an embodiment of the present disclosure;

[0063] Figure 14 illustrates one example of a cellular communications system in which embodiments of the present disclosure may be implemented;

[0064] Figures 15 and 16 illustrate example embodiments in which the cellular communication system of Figure 14 is a 5G System (5GS);

[0065] Figure 17 is a schematic block diagram of a network node according to some embodiments of the present disclosure;

[0066] Figure 18 is a schematic block diagram that illustrates a virtualized embodiment of the network node of Figure 17 according to some embodiments of the present disclosure; and

[0067] Figure 19 is a schematic block diagram of the network node of Figure 17 according to some other embodiments of the present disclosure.Detailed Description

[0068] The embodiments set forth below represent information to enable those skilled in the art to practice the embodiments and illustrate the best mode of practicing the embodiments. Upon reading the following description in light of the accompanying drawing figures, those skilled in the art will understand the concepts of the disclosure and will recognize applications of these concepts not particularly addressed herein. It should be understood that these concepts and applications fall within the scope of the disclosure.

[0069] Radio Node: As used herein, a “radio node” is either a radio access node or a wireless communication device.

[0070] Radio Access Node: As used herein, a “radio access node” or “radio network node” or “radio access network node” is any node in a Radio Access Network (RAN) of a cellular communications network that operates to wirelessly transmit and / or receive signals. Some examples of a radio access node include, but are not limited to, a base station (e.g., a New Radio (NR) base station (gNB) in a Third Generation Partnership Project (3GPP) Fifth Generation (5G) NR network or an enhanced or evolved Node B (eNB) in a 3GPP Long Term Evolution (LTE) network), a high-power or macro base station, a low-power base station (e.g., a micro base station, a pico base station, a home eNB, or the like), a relay node, a network node thatimplements part of the functionality of a base station or a network node that implements a gNB Distributed Unit (gNB-DU)) or a network node that implements part of the functionality of some other type of radio access node.

[0071] Core Network Node: As used herein, a “core network node” is any type of node in a core network or any node that implements a core network function. Some examples of a core network node include, e.g., a Mobility Management Entity (MME), a Packet Data Network Gateway (P-GW), a Service Capability Exposure Function (SCEF), a Home Subscriber Server (HSS), or the like. Some other examples of a core network node include a node implementing an Access and Mobility Function (AMF), a User Plane Function (UPF), a Session Management Function (SMF), an Authentication Server Function (AUSF), a Network Slice Selection Function (NSSF), a Network Exposure Function (NEF), a Network Function (NF) Repository Function (NRF), a Policy Control Function (PCF), a Unified Data Management (UDM), or the like.

[0072] Communication Device: As used herein, a “communication device” is any type of device that has access to an access network. Some examples of a communication device include, but are not limited to: mobile phone, smart phone, sensor device, meter, vehicle, household appliance, medical appliance, media player, camera, or any type of consumer electronic, for instance, but not limited to, a television, radio, lighting arrangement, tablet computer, laptop, or Personal Computer (PC). The communication device may be a portable, hand-held, computer- comprised, or vehicle-mounted mobile device, enabled to communicate voice and / or data via a wireless or wireline connection.

[0073] Wireless Communication Device: One type of communication device is a wireless communication device, which may be any type of wireless device that has access to (i.e., is served by) a wireless network (e.g., a cellular network). Some examples of a wireless communication device include, but are not limited to: a User Equipment device (UE) in a 3GPP network, a Machine Type Communication (MTC) device, and an Internet of Things (loT) device. Such wireless communication devices may be, or may be integrated into, a mobile phone, smart phone, sensor device, meter, vehicle, household appliance, medical appliance, media player, camera, or any type of consumer electronic, for instance, but not limited to, a television, radio, lighting arrangement, tablet computer, laptop, or PC. The wireless communication device may be a portable, hand-held, computer-comprised, or vehicle-mounted mobile device, enabled to communicate voice and / or data via a wireless connection.

[0074] Network Node: As used herein, a “network node” is any node that is either part of the RAN or the core network of a cellular communications network / system.

[0075] Note that the description given herein focuses on a 3GPP cellular communications system and, as such, 3GPP terminology or terminology similar to 3GPP terminology is oftentimes used. However, the concepts disclosed herein are not limited to a 3GPP system.

[0076] Note that, in the description herein, reference may be made to the term “cell”; however, particularly with respect to 5G NR concepts, beams may be used instead of cells and, as such, it is important to note that the concepts described herein are equally applicable to both cells and beams.

[0077] There exist certain challenges. 5G networks are complex and highly dynamic given their need to accommodate a high number of loT devices belonging to different vertical industries with varying Quality of Service (QoS) requirements. This entails that 5G networks require automated management and scaling of resources that can be accomplished by the virtualization technologies such as Network Function Virtualization (NFV). For instance, a 5G NF instance such as the AMF that is allocated a certain amount of computing resources at a specific time may need to be scaled up / down to accommodate for increasing / decreasing load in the network. This scaling should be accompanied with an adjustment of the SETTINGS_MAX_CONCURRENT_STREAMS setting that this NF allows per Transport Control Protocol (TCP) connection as it has a direct impact on the NF resources consumption. More precisely, scaling down the computing resources of a NF producer (NFp) while keeping the value of SETTINGS_MAX_CONCURRENT_STREAMS setting to a high value (e.g., 2,147,483,647 streams per TCP connection) increases the opportunity of an NF consumer (NFc) to deplete the NFp resources, overload it, and prevent the access of other NFc(s) to its services. Further, this also increases the opportunity of an attacker to launch a stream multiplexing attack and cause a Denial of Service (DoS) on the NFp and the 5G network with only a few TCP connections. Hence, it is imperative to optimize the SETTINGS_MAX_CONCURRENT_STREAMS setting value of the different 5G NFs dynamically and automatically to accommodate for the fluctuating 5G traffic and to prevent stream multiplexing attacks and NFs overload.

[0078] Currently, there does not seem to be any existing works which address Hyper-Text Transport Protocol version 2 (HTTP / 2) stream multiplexing attack prevention and mitigation. However, the work in U.S. Patent No. 10,587,668 to Dhanabalan and U.S. Patent No. 11,025,699 to Dhanabalan (hereinafter referred to as “the Dhanabalan Patents”) proposes optimizing the number of HTTP / 2 streams that may be multiplexed over a single TCP connection to avoid unnecessary congestion-based network delays. The authors of the Dhanabalan Patents explain that the multiplexed streams over a TCP connection can lead to a significant growth of thecongestion window compared to a network congestion window corresponding to multiple TCP connections, each carrying a single application layer stream. In case of packet loss occurrence, the congestion window reduction differences can greatly reduce data throughput between communicating peers and negatively affects the users Quality of Experience (QoE). To prevent this problem, the authors of the Dhanabalan Patents propose optimizing (i.e., increasing / decreasing) the SETTINGS_MAX_CONCURRENT_STREAMS setting per connection based on the monitored network bandwidth and packet loss rates of the connection. While this approach balances the throughput and provides congestion avoidance and reduced performance impairment, it does not prevent stream multiplexing attacks nor is adapted for 5G networks. In fact, the proposed approach optimizes the SETTINGS_MAX_CONCURRENT_STREAMS value for each TCP connection which leads to sub-optimal solution related to the consumption of HTTP / 2 server resources by multiple TCP connections of the HTTP / 2 client in question and across multiple clients. A malicious client may exploit the SETTINGS_MAX_CONCURRENT_STREAMS over many TCP connections without necessarily exceeding the bandwidth and packet loss thresholds determined to activate the proposed SETTINGS_MAX_CONCURRENT_STREAMS optimization solution. This allows the malicious client to either cause a stream multiplexing attack on the server that results in its DoS or permits the malicious client to cause resources starving for other connected clients by depleting the server resources.

[0079] Other existing work discusses the problem of NF overload control in 5G networks to avoid over-provisioning of NF resources which leads to a higher cost on the Mobile Network Operators (MNOs). The authors of Rajaneesh Shetty et al., "Intelligent Strategies for Overload Detection & Handling for 5G Network," 2021 IEEE 4th 5G World Forum (5GWF), IEEE, October 13-15, 2021 discuss a 5G NFs overload detection, control, and prevention mechanism. For overload detection, they suggest that the Service Communication Proxy (SCP) queries the NRF for load information of some NFs to decide on which to select for traffic handling. They also propose using Load Control Information (LCI) and Overload Control Information (OCI) along with 3gpp-Sbi-Message-Priority custom header to provide load balancing across 5G NFs. While their work is adapted for 5G networks and leverages 3GPP custom headers, it does not prevent HTTP / 2 stream multiplexing attacks nor optimize the SETTINGS_MAX_CONCURRENT_STREAMS.

[0080] Considering the above shortcomings of existing solutions, there is a need for a dynamic and efficient SETTINGS_MAX_CONCURRENT_STREAMS setting optimization approach that can:prevent and mitigate stream multiplexing attack, provide load balancing across multiple 5G NFs instances, adapt to fluctuating 5G traffic, and• ensure fair resources allocation of the different 5G NFs while accounting for requests criticality based on the sender importance with respect to the different 5G procedures.

[0081] Systems and methods are disclosed that address the aforementioned and / or other challenges. 5G networks adopt a cloud-native Service-Based Architecture (SBA) that leverages virtualization technologies and a unified web-based protocol suit that includes TCP / Transport Layer Security (TLS) / HTTP / 2 / JavaScript Object Notation (JSON) protocols used for signaling between its virtualized NFs. As discussed above, the use of HTTP / 2 as the 5G SBA signaling protocol extends the 5G network attack surface and exposes it to potential HTTP / 2 signaling attacks such as the stream multiplexing attack. The stream multiplexing attack exploits the SETTINGS JVIAX_CONCURRENT_STREAMS setting in the HTTP / 2 protocol. It specifies the maximum number of concurrent streams a sender can send to a receiver throughout their HTTP / 2 connection. As the value of this setting can go up to 2,147,483,647 streams per connection, an attacker can exploit it to simultaneously launch computationally expensive requests towards a receiver to overload it and cause its DoS.

[0082] In 5G networks, the sender and the receiver are 5G NFs. Thus, preventing the stream multiplexing attack is crucial to ensure 5G network high availability. Further, as 5G NFs can consume and provide different services standardized by 3GPP through Application Programming Interfaces (APIs), they can have different priorities and different criticality based on the 5G procedures they are involved in. Thus, enforcing the same value of the SETTINGS_MAX_CONCURRENT_STREAMS setting for all the senders can lead to sub- optimal resources allocation of the receiver and even incur delays and resource starvation of the requests incoming from critical senders. Hence, there is a need to optimize the value of the SETTINGS_MAX_CONCURRENT_STREAMS setting across the senders towards a receiver and adapt it based on the computing and network resources allocated to the receiver and its current and future estimated workload.

[0083] Embodiments of systems and methods are disclosed herein that provide stream multiplexing attack prevention and mitigation solutions. In some embodiments, a SETTINGS_MAX_CONCURRENT_STREAMS setting optimization mechanism is also provided. In some embodiments, the stream optimization mechanism allows enforcing different values for the SETTINGS_MAX_CONCURRENT_STREAMS setting for each HTTP / 2 connection, HTTP / 2 sender, and across senders while accounting for 5G NFs services and theircriticality. In some embodiments, 5G NFs are augmented with a self- automated load balancing mechanism to adapt for the fluctuating 5G traffic and their automated resource management and scaling. More precisely, in some embodiments, a real time optimization mechanism is provided that adjusts the value of SETTINGS_MAX_CONCURRENT_STREAMS setting for a newly established connection based on the available receiver resources and / or priority of the new sender in comparison to others that the receiver is currently serving. Embodiments of a proactive optimization mechanism are also disclosed for optimizing the value of SETTINGS_MAX_CONCURRENT_STREAMS setting that can serve in estimating the benefits of re-optimizing the network resources especially upon the prediction of possible future attacks and the need for a self-healing control.

[0084] Embodiments of the present disclosure may include any one or more of the following aspects:• A procedure that allows an HTTP / 2 peer to request a modification (increase / decrease) of the value of SETTINGS_MAX_CONCURRENT_STREAMS setting on its connection with an HTTP / 2 node using a new proposed HTTP / 2 frame “MAX_CONCURRENT_STREAMS_UPDATE” frame. The decision to grant or refuse the request is left to the HTTP / 2 node.• A procedure that allows an HTTP / 2 node to optimize the value of SETTINGS_MAX_CONCURRENT_STREAMS setting for its existing and / or predicted connections based on, e.g.: o a real-time optimization approach that optimizesSETTINGS JVIAX_CONCURRENT_STREAMS value based on HTTP / 2 node available resources and its HTTP / 2 peer priorities; and / or o a proactive optimization approach that optimizesSETTINGS_MAX_CONCURRENT_STREAMS value based on predicted HTTP / 2 node forecasted resources availability and / or predicted HTTP / 2 peer number, types, and / or priorities.• 5G specific SETTINGS_MAX_CONCURRENT_STREAMS value update procedures that combine the update of SETTINGS_MAX_CONCURRENT_STREAMS value and the proposed MAX_CONCURRENT_STREAMS_UPDATE frame with none, one, or many of HTTP / 2 custom headers, such as 3gpp_Sbi_Lci and 3gpp_Sbi_Oci to enable 5G NFs to perform load balancing and prevent / mitigate HTTP / 2 stream multiplexing attack. For example:o A 5G specific SETTINGS_MAX_CONCURRENT_STREAMS value decrease procedure is provided that enforces an HTTP / 2 peer to perform load control and / or overload control for the HTTP / 2 node. o A 5G specific SETTINGS_MAX_CONCURRENT_STREAMS value increase procedure is provided that enables an HTTP / 2 peer to better handle its increased load and decide whether to request an increase of SETTINGS J AX_CONCURRENT_STREAMS value on its HTTP / 2 connection with its HTTP / 2 node or to establish new connections with other HTTP / 2 nodes.

[0085] While not limited by or to any advantage, embodiments of the present disclosure may provide a number of advantages over existing technology. The advantages of embodiments of the proposed solutions may include any one or more of the following:• allow an HTTP / 2 peer (i.e., sender) to request the modification of SETTINGS_MAX_CONCURRENT_STREAMS setting value throughout a connection with an HTTP / 2 node (i.e., receiver);• prevent and mitigate HTTP / 2 stream multiplexing attacks;• provide HTTP / 2 nodes (e.g., 5G NFs) with self-automated load balancing mechanism;• optimize HTTP / 2 nodes (e.g., 5G NFs) resources usage across connections with an HTTP / 2 peer and / or across peers while accounting for: o message priority; o peer priority / criticality with respect to other currently connected peers; o peer priority / criticality with respect to other expected peers that will connect at a future time; o currently available HTTP / 2 node resources; and / or o forecasted HTTP / 2 node resources availability;• provide a recommendation mechanism for HTTP / 2 peers (i.e., senders) to prevent them from experiencing additional latencies that can be incurred by delays in processing their requests through: o sharing with them the HTTP / 2 node (i.e., receiver) load and overload control information; and o decreasing / increasing the value of SETTINGS_MAX_CONCURRENT_STREAMS setting;• ensure QoS / QoE;• adapt to 5G networks by accounting for 5G NFs messages priorities and criticality while leveraging 3GPP custom headers.

[0086] Now, a more detailed description of embodiments of the present disclosure will be provided. Importantly, while the description here focuses on preferred embodiments in which the disclosed systems and methods are implemented via HTTP / 2 nodes / peers, the present disclosure is not limited to HTTP / 2; rather, the embodiments disclosed herein can be utilized in other existing or future versions of HTTP or similar protocols.1 Overview of SETTINGS_MAX_CONCURRENT_STREAMS

[0087] The HTTP / 2 protocol defines the SETTINGS_MAX_CONCURRENT_STREAMS setting as part of the SETTINGS frame. In the following, some characteristics of the SETTINGS frame as defined by the HTTP / 2 protocol are discussed. Then, the SETTINGS_MAX_CONCURRENT_STREAMS setting will be presented. Finally, a discussion is provided regarding how the characteristics of the SETTINGS frame when applied to SETTINGS_MAX_CONCURRENT_STREAMS setting impact 5G networks QoS and motivate embodiments of the present disclosure.1.1 SETTINGS Frame Characteristics

[0088] SETTINGS frames are used in HTTP / 2 to convey configuration parameters that describe how endpoints communicate. Configuration parameters, also referred to as “settings”, include but are not limited to SETTINGS_HEADER_TABLE_SIZE, SETTINGS_ENABLE_PUSH, SETTINGS_MAX_CONCURRENT_STREAMS, among others.• SETTINGS frames: o apply to a connection and never to a single stream; o adopt a stream identifier of zero; o must be sent by both endpoints at the beginning of a connection; and o may be sent at any other time by either endpoint over the lifetime of a connection, in which case, the new value of the exchanged SETTINGS parameter replaces any existing value for that parameter.• SETTINGS parameters (e.g., SETTINGS_MAX_CONCURRENT_STREAMS): o are not negotiable; o describe the characteristics of the sender that are used by the receiver; o different values of those parameters can be advertised by each peer; and o need to be acknowledged by their recipient (acknowledgement of receipt and application) which sends another SETTINGS frame with the ACK flag set to one and an empty payload.1.2 SETTINGS _MAX_C ON CURRENT _STRE AMS

[0089] SETTINGS_MAX_CONCURRENT_STREAMS setting indicates the maximum number of concurrent streams that the sender will allow the receiver to create. Like any other setting in HTTP / 2, SETTINGS_MAX_CONCURRENT_STREAMS is non-negotiable and directional. Thus, an NFc (i.e., HTTP / 2 client) in a 5G network can set a high value for the SETTINGS J AX_CONCURRENT_STREAMS setting while the NFp (i.e., HTTP / 2 server) may specify a lower value to conserve its computing and network resources. While the value of this setting is determined at the beginning of a connection, it can be modified at any other time during that connection. HTTP / 2 protocol specifies that an endpoint which likes to reduce the value of this setting to one that is below the current number of open / half-open streams can either close streams that exceed the new value or allow streams to complete. However, such behavior might be sub-optimal, especially in a 5G network where QoS guarantees are crucial. Closing open and incomplete streams without providing any prior notice to their sender may disrupt the functionality of the latter and the QoS it experiences.1.3 SETTINGS JMAX_CONCURRENT_STREAMS Characteristics Impact on5G Networks

[0090] Despite being exploited to launch HTTP / 2 stream multiplexing attack, reducing the value of SETTINGS_MAX_CONCURRENT_STREAMS setting to a value that is lower than the number of current open streams may disrupt 5G network QoS especially when the additional streams are closed or resent over a new connection. In a 5G network, this can translate, for example, to an SMF closing streams pertaining to an Nsmf_PDUSession_UpdateSMContext request sent by an AMF following a service request from a UE. This will cause a disruption of the QoS provided to the corresponding UE, as the AMF will either retry sending the request to the SMF over the same connection or will establish a new connection with that SMF to send the same request. Retrying the request or establishing a new connection introduces additional latency (a TCP handshake is required in case of a new connection establishment) that can cause a breach of the QoS guarantees. Further, there is no guarantee that the stream sent over the new connection or the retried one will be successfully processed by the SMF. In fact, the SMF might close the new stream without processing it as a result of an overload, for example. Embodiments of the present disclosure address this concern by providing procedures that allow an endpoint to reduce the value of SETTINGS_MAX_CONCURRENT_STREAMS setting without causing QoS disruption, e.g., by leveraging 3GPP custom headers. Avoiding the QoS disruption is done by allowing the endpoint which is modifying the value ofSETTINGS J AX_CONCURRENT_STREAMS parameter to advise its peer, using 3GPP custom headers, that it is overloaded and might incur some additional delays on new streams that will be received during a defined time. This will provide the peer the flexibility to decide whether it can handle the additional delays or is better to send the streams to another NF instance to process them. This solution serves the prevention and mitigation of the stream multiplexing attack and allows the endpoint modifying the value of SETTINGS_MAX_CONCURRENT_STREAMS parameter, to perform load balancing efficiently.

[0091] While decreasing the value of SETTINGS JVIAX_CONCURRENT_STREAMS setting is more likely to happen as NFs can be overloaded, increasing this value is less likely to be applied automatically by an NF. In fact, an NF with decreased load will have more free resources that can be allocated to additional streams. Such NF will prefer to preserve these freed resources for new connections rather than assigning them to existing ones which may not use them. Further, a peer that needs to send additional streams that exceed the SETTINGS_MAX_CONCURRENT_STREAMS value, will create a new connection to send those streams. However, the latter approach incurs additional delays as TCP connection creation and maintenance is expensive when compared to the creation of a stream. To overcome this limitation while making efficient use of the HTTP / 2 stream multiplexing features, embodiments of the present disclosure allow an endpoint to request an increase of the value of SETTINGS_MAX_CONCURRENT_STREAMS setting from its peer without introducing any negotiation on the new value so as not to violate the protocol specification stating that SETTINGS parameters are not negotiable. This proposed approach prevents an NF from reserving its resources for another which does not need them while providing reduced latency and better resource utilization.2 HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS - Update Procedure

[0092] In light of the above discussion, embodiments of an update procedure for updating the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter are disclosed. In one embodiment, this update is driven based on a need or desire for change (e.g., increase or decrease) of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter. The update can include a decrease or an increase of the value of this setting, e.g., with respect to multiple criteria that are described in detail below.

[0093] In the following description, the term “HTTP / 2 node” refers to a receiver that determines the value of SETTINGS_MAX_CONCURRENT_STREAMS setting for its connection with an “HTTP / 2 peer” that represents a sender.2.1 HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS - Value DecreaseA. Concurrent Streams Number Decrease Reasons

[0094] Throughout a HTTP / 2 (or TCP) connection, an HTTP / 2 node can decide to decrease the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that the HTTP / 2 node enforces for its peer (where the current value of the parameter prior to the decrease was previously set, e.g., at the beginning of the connection) for any reason. This reason may be, but is not limited to, any one of the following reasons:• the HTTP / 2 node is overloaded;• the HTTP / 2 node needs to re-balance its load and re-optimize its resources allocation (i.e., internal triggering events (e.g., need to accommodate new incoming, higher priority peers, etc.) or external triggering events (e.g., management request) (see, e.g., Section 4 of the Detailed Description below)); or• the HTTP / 2 node detects suspicious activity from its peer (i.e., possible HTTP / 2 stream multiplexing attack, etc.).B. Variables’ Definition

[0095] Multiple scenarios can occur when choosing to decrease the value of the SETTINGS_MAX_CONCURRENT_STREAMS setting. To better illustrate these scenarios, the following variables are defined:• max _str earns: Let max_streams be the current value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter the HTTP / 2 node sets for its peer. This can be either the value of this setting that was exchanged at the beginning of the connection between the HTTP / 2 peers or any value that has overridden the latter.• current _streams: Let current_streams be the current number of streams that count towards the SETTINGS_MAX_CONCURRENT_STREAMS setting (i.e., max_streams) the HTTP / 2 node sets for its peer (open, half-closed streams).• new _max_str earns: Let new_max_streams be the new value of the SETTINGS_MAX_CONCURRENT_STREAMS setting the HTTP / 2 node would like to set for its peer and which overrides any previous value for this setting.• max_str earns _request-. Let max_streams_request be the new value of SETTINGS_MAX_CONCURRENT_STREAMS parameter requested by the HTTP / 2 peer.C. Existing SETTINGS_MAX_CONCURRENT_STREAMS Decrease Options and Procedure

[0096] In this section, the existing procedure for decreasing the value of SETTINGS_MAX_CONCURRENT_STREAMS setting is described. The SETTINGS J AX_CONCURRENT_STREAMS decrease options are:• Option 1: current _streams < new _max_str earns < max _str earns

[0097] In this option, the HTTP / 2 node opts for updating the max_streams to a lower value that exceeds the number of current_streams (i.e., open, half -closed streams). This can be done as defined in the HTTP / 2 protocol by sending a SETTINGS frame with the new_max_streams value for the SETTINGS_MAX_CONCURRENT_STREAMS setting that replaces the existing max_streams value as detailed in Figure 3. Note that in such a scenario, the HTTP / 2 peer that wishes to open new streams that exceed the new_max_streams can either create a new connection with the same HTTP / 2 node or wait till one of the current concurrent streams is closed to open a new one that counts towards the new_max_streams value. However, in both cases, the HTTP / 2 peer will experience additional delays resulting from opening a new TCP connection or waiting for a stream on the current connection to be fully processed and closed.• Option 2: ne _max_streams < current _str earns < max _str earns

[0098] In this option, the HTTP / 2 node opts for updating the max_streams to a value that is lower than the number of current_streams (i.e., open, half-closed streams). This can be done as defined in the HTTP / 2 protocol by sending a SETTINGS frame with the new_max_streams value for the SETTINGS_MAX_CONCURRENT_STREAMS setting that replaces the existing max_streams value as detailed in Figure 4. Note that in such a scenario, the HTTP / 2 node can either opt to close streams that exceeds the new_max_streams value or complete them. Choosing to complete existing streams will guarantee the QoS required by the HTTP / 2 peer. This is highly beneficial in 5G networks where seamless latency is required. Closing streams, however, can disrupt the QoS provided to the HTTP / 2 peer. Nonetheless, closing streams can yield a beneficial approach to mitigate suspicious HTTP / 2 peer activities. Thus, closing streams is beneficial in a scenario where an anomaly detection alert has been raised suspecting a malicious HTTP / 2 peer.D. New 5G-Specific Procedure for decreasing SETTINGS_MAX_CONCURRENT_STREAMS value

[0099] To overcome the delays that can be introduced to the HTTP / 2 peer due to the decrease in the value of SETTINGS JVIAX_CONCURRENT_STREAMS setting of an HTTP / 2 node such as an NFp, in one embodiment, the exchange of this setting is combined with one or more 3GPP custom headers that assist the HTTP / 2 peer such as an NFc in deciding the approach to implement following the new enforced setting. Note that unlike the existing SETTINGS_MAX_CONCURRENT_STREAMS decrease procedure discussed above that is general to any HTTP / 2 node, the following procedure is 5G specific as it uses one or more 3GPP custom headers. However, the solution can be adapted to any other use case (e.g., web or cloud HTTP / 2 nodes) upon the replacement of the 3GPP custom headers with other custom headers defined for the same purpose.

[0100] Hence, in a 5G SBA, the decrease of SETTINGS_MAX_CONCURRENT_STREAMS value is combined with one or more 3GPP custom headers containing information that is indicative (explicitly or implicitly) of the reason for this decrease. The indicated reason may be, for example, any one of the reasons noted above in Section 2.1(A) of the Detailed Description.

[0101] Figure 5 illustrates one example of a 5G specificSETTINGS_MAX_CONCURRENT_STREAMS update procedure in accordance with an embodiment of the present disclosure. Note that the stream identifiers are noted in Figure 5. All streams initiated by an HTTP / 2 client (i.e., NFc) should have an odd identifier. This explains the current_streams =50 in the illustrated example.

[0102] The procedure of Figure 5 involves a HTTP / 2 node 500 and an HTTP / 2 peer 502. Note that optional steps are represented by dashed lines / boxes. The steps of the procedure are described below.

[0103] Step 504: The HTTP / 2 node 500 and the HTTP / 2 peer 502 operate to establish a TCP connection.

[0104] Step 506 (OPTIONAE): The HTTP / 2 peer 502 sends, to the HTTP / 2 node 500, a SETTINGS frame that sets the SETTINGS_MAX_CONCURRENT_STREAMS parameter to a value of 3000. The value of the SETTINGS_MAX_CONCURRENT_STREAMS_ VAEUE parameter included in the SETTINGS frame of step 506 defines a value for this parameter to be enforced by the HTTP / 2 peer 502 for the number of concurrent streams from the HTTP / 2 node 500 to the HTTP / 2 peer 502.

[0105] Step 508: The HTTP / node 500 sends, to the HTTP / 2 peer 502, a SETTINGS frame that sets the SETTINGS_MAX_CONCURRENT_STREAMS parameter to a value of 200. Thevalue of the SETTINGS_MAX_CONCURRENT_STREAMS_ VALUE parameter included in the SETTINGS frame of step 508 defines a value for this parameter to be enforced by the HTTP / 2 node 500 for the number of concurrent streams from the HTTP / 2 peer 502 to the HTTP / 2 node 500.

[0106] Step 510 (OPTIONAL): The HTTP / node 500 sends a SETTINGS frame with an ACK responsive to the SETTINGS frame of step 506.

[0107] Step 512: The HTTP / 2 peer 502 sends, to the HTTP / 2 node 500, a SETTINGS frame with an ACK responsive to the SETTINGS frame of step 508.

[0108] Step 514: The HTTP / 2 peer 502 sends data to the HTTP / 2 node via the TCP connection over, in this example, 50 concurrent streams, which is less than the maximum value of 200 set in step 508.

[0109] Step 516: In order to update the value of the SETTINGS_MAX_CONCURRENT_STREAMS_ VALUE parameter that defines the maximum number of current streams enforced by the HTTP / 2 node 500 (i.e., the maximum number of concurrent streams from the HTTP / 2 peer 502 to the HTTP / 2 node 500 on the TCP connection), the HTTP / 2 node 500 sends, to the HTTP / 2 peer 502, a SETTINGS frame that sets the value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter to new_max_streams value (e.g., 100 in this example). This allows mitigating any experienced overload resulting or not from a malicious peer. In fact, decreasing the value of SETTINGS_MAX_CONCURRENT_STREAMS parameter is preferably performed when an alert of a malicious HTTP / 2 peer is raised (e.g., detection of HTTP / 2 stream multiplexing attack). In such a scenario, decreasing the value of SETTINGS_MAX_CONCURRENT_STREAMS parameter provides enough time to investigate whether the alert is a true positive while containing the attack and limiting its damage. If the alert is deemed a false positive, the possible disruption of the QoS that might be incurred by reducing the value of SETTINGS_MAX_CONCURRENT_STREAMS parameter is negligeable in comparison to the damage that could have been experienced as a result of an ignored true positive alert (i.e., attack).

[0110] Step 518: The HTTP / 2 peer 502 sends a SETTINGS frame including an ACK for the new value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter.

[0111] Step 520: The HTTP / 2 node 500 sends, to the HTTP / 2 peer node 502, a 3gpp_Sbi_Oci custom header (see, e.g., Figure 6) to convey to the HTTP / 2 peer 502 that it is or will be overloaded. The 3gpp_Sbi_Oci can be used by an HTTP / 2 node which is an NFp, an NFc, an SCP, or a Security Edge Protection Proxy (SEPP). The overloaded HTTP / 2 node uses 3gpp_Sbi_Oci to require from the HTTP / 2 peer an overload reduction of a certain percentagespecified in the overload metric reduction parameter of the 3gpp_Sbi_Oci header. The scope of the OCI is also specified as a parameter of the 3gpp_Sbi_Oci and can vary between HTTP / 2 node instance, set of NFs, etc. and is as specified in “Technical Specification Group Core Network and Terminals; 5G System; Technical Realization of Service Based Architecture; Stage 3 (Release 16),” Technical Specification 29.500, Version 16.4.0, June 2020, 3GPP Organization Partners. Hence, the scope of OCI will specify to the HTTP / 2 peer the scope of overload control enforcement required and which includes reducing the number of request messages by the percentage specified in the overload reduction metric through redirecting them to an alternate destination (another NF instance if the scope was the NF instance or another NF set if the OCI scope was a NF set, etc.) or by failing the requests and treating them as if they were rejected.

[0112] Note that 3gpp_Sbi_Oci custom header is optional and might not necessarily be supported by the HTTP / 2 peer 502. Hence, if the HTTP / 2 peer 502 does not support this header, the HTTP / 2 peer 502 will disregard it and keep sending its requests towards the overloaded HTTP / 2 node 500, which may reject them by closing the related streams without executing them. For this reason, it is advisable to use the 3gpp_Sbi_Oci with theSETTINGS J AX_CONCURRENT_STREAMS value update. This will allow:• the HTTP / 2 node 500 to manage its overload without solely depending on the HTTP / 2 peer 502, which might not support 3gpp_Sbi_Oc ,• the HTTP / 2 peer 502, if it does not support 3gpp_Sbi_Oci: o To understand that the HTTP / 2 node 500 is experiencing some difficulties executing its messages; o To redirect its load to an alternative NF. The choice of the alternative NF(s) can be optimized by querying the NRF which also shares the LCI of the possible NFs alternatives. This option is highly advisable if the new _max_st re ms < current _str earns < max_streams as it might indicate that the HTTP / 2 peer is likely to be overloaded. However, this option can also be applied when current_streams < new_max_streams < max_streams o To establish a new TCP connection with the HTTP / 2 node 500 to handle its additional streams. This option is advisable when current_streams < new_max_streams < max_streams as it reduces the delays incurred by querying the NRF for a new HTTP / 2 instance and then establishing a TCP connection with that new instance.• HTTP / 2 peer 502, if it does support 3gpp_Sbi_Oci:o To understand that the HTTP / 2 node 500 is overloaded and requires an overload reduction; o To be forced to enforce overload control by:■ Redirecting its load that counts towards its overload reduction metric to an alternative NF(s). The choice of the alternative NF(s) is based on the scope of the OCI and can be optimized by querying the NRF which also shares the LCI of the possible NFs alternatives;■ Failing the request messages that count towards the overload reduction metric and treating them as if they were rejected by the overloaded HTTP / 2 node; o To avoid QoS disruption of its messages especially when the OCIs are shared before the HTTP / 2 node overload takes place, as it will have enough time to establish a new TCP connection with an alternative NF to send its new envisioned load.

[0113] In step 520, the HTTP / 2 node 500 additionally or alternatively sends, to the HTTP / 2 peer 502, a 3gpp_Sbi_Lci custom header (see, e.g., Figure 7) to convey its LCI to the HTTP / 2 peer 502 to advise it to adaptively balance the load across different NFp(s) along with its communicating HTTP / 2 node 500. Sending 3gpp_Sbi_Lci custom header can only be performed by the HTTP / 2 node if it is an NFp, an SCP or an SEPP. Note that 3gpp_Sbi_Lci custom header is optional and might not necessarily be supported by the HTTP / 2 peer 502 (i.e., NFc). Hence, an HTTP / 2 peer that does not support this header will disregard it and keep sending its requests towards the HTTP / 2 node that may reject them by closing the related streams without executing them. For this reason, it is advisable to use the 3gpp_Sbi_Lci custom header with the SETTINGS J AX_CONCURRENT_STREAMS value update. This will allow:• HTTP / 2 node 500 to: o Guarantee the QoS for its HTTP / 2 peer 502 as it will advise it with its LCI so it can better assess the need to redirect part or all its foreseen load to an alternative NF; o Demand the HTTP / 2 peer 502, if it supports 3gpp_Sbi_Lci custom header, to provide assistance in reducing its load while avoiding the disturbance of its QoS. This is especially true when current _str earns < new_max_streams < max_streams as in such scenario the HTTP / 2 node 500 did not need to close streams without executing them.• HTTP / 2 peer 502, if it does not support 3gpp_Sbi_Lci:o To understand that the HTTP / 2 node 500 is experiencing some difficulties executing its messages; o To redirect its load to an alternative NF. This option is highly advisable if the new_max_streams < current _str earns < max_streams as it might indicate that the HTTP / 2 peer is likely to be overloaded. However, this option can also be applied when current_streams < new_max_streams < max_streams. o To establish a new TCP connection with the HTTP / 2 node 500 to handle its additional streams. This option is advisable when current_streams < new _max_streams < max_streams as it reduces the delays incurred by querying the NRF for a new NF instance and then establishing a TCP connection with that new instance.• HTTP / 2 peer 502, if it does support 3gpp_Sbi_Lcv. o To know the load experienced on the HTTP / 2 node 500 through the load metric parameter of the 3gpp_Sbi_Lci which specifies the current load level of the scope of the LCI. The scope of LCI is another parameter of 3gpp_Sbi_Lci that identifies the components of the LCI sender (i.e., HTTP / 2 node) to which the LCI relates to. The LCI scope can be a NF instance, set, service instance or service set as detailed by 3GPP. o To detect an overload of the HTTP / 2 node 500 by correlating the LCI of the HTTP / 2 node 500 with the new_max_streams value. Thus, if the load control metric was relatively high (e.g., 75%) while the new_max_streams < current _streams < max_streams the HTTP / 2 peer 502 can assume that the HTTP / 2 node 500 is overloaded and might resort to triggering some overload control techniques such as redirecting a percentage of its load to alternative NFs. Note that 3GPP explains that 3gpp_Sbi_Lci does not trigger overload mitigation by default even if the load metric of the HTTP / 2 node 500 is deemed high. However, triggering overload mitigation actions (e.g., throttling messages, redirecting the load) based on the correlation between LCI and the new_max_streams is very beneficial when the HTTP / 2 peer 502 does not support 3gpp_Sbi_Ocr, o To enforce load control by performing load balancing while accounting for the load control metric and scope received from the HTTP / 2 node 500. For instance, if the load metric was a bit high (e.g., < 65%), the HTTP / 2peer 502 may choose to continue sending high priority messages (i.e., message priority can be known through 3gpp-Sbi-Message-Priority or through PRIORITY frame) to the HTTP / 2 node 500 in order to avoid QoS breaches for those messages if they were to be sent to a new NF with which no TCP connection exists. However, other lower priority messages may be sent on to an alternative NF instance as they can tolerate some delays; o To avoid QoS disruption of its messages through performing better load balancing decisions based on the LCIs of the multiple NF instances available.

[0114] Step 522: The HTTP / 2 peer 502 performs one or more actions based on the new value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter and the information contained in the 3GPP custom header(s) of step 520. Examples of such actions are provided in the description above and, as such, are not repeated here. However, it should be understood that the examples above are applicable to step 522.

[0115] Updating the value of SETTINGS_MAX_CONCURRENT_STREAMS setting can be done by any HTTP / 2 node as specified in Section 2.1(C) of the Detailed Description.However, in a 5G network, combining the decrease of the value of SETTINGS_MAX_CONCURRENT_STREAMS setting with one or both of 3gpp_Sbi_Oci and 3gpp_Sbi_Lci custom headers is preferred based on the following use cases:• If the HTTP / 2 node 500 is an NFp, an SCP, or an SEPP and is overloaded, sending the updated value of SETTINGS_MAX_CONCURRENT_STREAMS setting along with 3gpp_Sbi_Oci and 3gpp_Sbi_Lci custom headers is preferred. Sending both custom headers to the HTTP / 2 peer increases the chances of load and overload control enforcement and management for the HTTP / 2 node 500 as its HTTP / 2 peer 502 might not support both custom headers but may support one of them. Ultimately, if the HTTP / 2 peer 502 supports both custom headers, sharing them is beneficial for diversifying the load and overload control enforcement options that can be implemented by the HTTP / 2 peer 502 especially if the LCI and OCI scopes are different.

[0116] Example: Consider the example of an overloaded SMF acting as an NFp (i.e., HTTP / 2 node 500) and providing the nsmf-PDUSession service to an AMF (i.e., HTTP / 2 peer 502) acting as an NFc. The overloaded SMF reduces the valueSETTINGS_MAX_CONCURRENT_STREAMS setting on its connection with the AMF while also sending a 3gpp_Sbi_Oci header with NF-Service-Instance as the OCI scope (Figure 5) and a3gpp_Sbi_Lci with NF-Instance as the LCI scope (Figure 6). Through the 3gpp_Sbi_Oci header, the SMF enforces the AMF to perform overload control by notifying it that the PDU session management service (i.e., nsmf-PDUSession) is overloaded on all the NF instances of the mentioned set (i.e., NF-Service-Set parameter in Figure 5). Through this header, the SMF requires the AMF to reduce its load of this service on all NF instances of the set by 50% (Reduction_Metric parameter in Figure 6). However, through the 3gpp_Sbi_Lci header, the SMF enforces the AMF to perform load control on the mentioned NF instance (i.e., SMF which ID is mentioned in NF-Service-Instance parameter in Figure 7). Hence, if the AMF supports only the 3gpp-Sbi-Lci, it might choose not to perform any changes on its load towards the SMF as the Load-Metric on that SMF is only 25%. The AMF might as well redirect part of its load including nsmf-PDUSession requests to another SMF instance that can belong to the same set of its current SMF peer. This will lead to sub-optimal solution as the AMF will continue requiring the nsmf- PDUSession service that is causing an overload on the SMF and may incur delays and QoS breaches due to the rejection of nsmf-PDUSession requests by the overloaded SMF peer. However, if the AMF supports the 3gpp_Sbi_Oci as well, it will redirect 50% of its nsmf- PDUSession requests to SMF instances that do not belong to the set noted in NF-Service-Set while keeping other requests directed to its peer SMF. This will provide better load balancing across the SMF instances in the network while preventing the rejection of nsmf-PDUSession requests by the overloaded SMF peer.• If the HTTP / 2 node 500 is an NFp, an SCP, or an SEPP and is not overloaded, sending the updated value of SETTINGS J AX_CONCURRENT_STREAMS setting along with 3gpp_Sbi_Lci custom header is preferred. Sharing the 3gpp_Sbi_Lci with the HTTP / 2 peer 502 provides the latter with insights on the load experienced by the HTTP / 2 node 500. This allows the HTTP / 2 peer 502 to balance its load across many HTTP / 2 nodes and provides better load balancing for the HTTP / 2 node 500.• If the HTTP / 2 node 500 is an NFc and is overloaded, sending the updated value of SETTINGS_MAX_CONCURRENT_STREAMS setting along with 3gpp_Sbi_Oci custom header is preferred. This allows the overloaded HTTP / 2 node 500 to force its HTTP / 2 peer 502 to reduce its load and hence, leads to better load control and management across the different 5G NFs.

[0117] Note that while SETTINGS_MAX_CONCURRENT_STREAMS setting is carried on a SETTINGS frame, 3gpp_Sbi_Oci and 3gpp_Sbi_Lci custom headers are piggybacked in the HEADERS frame of a signaling message sent to the HTTP / 2 peer 502. This avoids any additional delays that can be incurred by their transmission. Figure 5 shows an example ofmessages exchange pertaining to decreasing the value ofSETTINGS J AX_CONCURRENT_STREAMS setting while sending a 3gpp_Sbi_Oci and a 3gpp_Sbi_Lci custom headers as part of the header of stream of id 99.

[0118] Figure 8 is a flow chart that illustrates the operation of the HTTP / 2 node 500 and the HTTP / 2 peer 502 in more detail, in accordance with one example embodiment of the present disclosure. The steps of the procedure of Figure 8 are as follows:

[0119] Step 800: The HTTP / 2 node 500 determines that it requires, or desires, a decrease in the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter for the TCP connection.

[0120] Step 802: In response to the determination of step 800, the HTTP / 2 node 500 sends, to the HTTP / 2 peer 502, a SETTINGS frame with the new value of the SETTINGS JVIAX_CONCURRENT_STREAMS parameter.

[0121] Step 804: The HTTP / 2 peer 502 responds to the HTTP / 2 node 500 with a SETTINGS frame having the ACK flag set to “1” and an empty payload to acknowledge receipt and application of the new value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter.

[0122] Steps 806, 808, 810, and 812: If the HTTP / 2 node 500 is an NFp, SCP, or SEPP (step 806, YES) and is overloaded (step 808, YES), the HTTP / 2 node 500 sends, to the HTTP / 2 peer 502, a 3gpp_Sbi_Oci custom header in a HEADERS frame (step 810). Responsive to the new value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter received in step 802 and the 3gpp_Sbi_Oci custom header received in step 810, the HTTP / 2 peer 502 performs one or more overload control enforcement actions (step 812).

[0123] Steps 814, 816, 818: If the HTTP / 2 node 500 is an NFc, SCP, or SEPP (step 814, YES), the HTTP / 2 node 500 sends, to the HTTP / 2 peer 502, a 3gpp_Sbi_Lci custom header in a HEADERS frame (step 816). Responsive to the new value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter received in step 802 and the 3gpp_Sbi_Lci custom header received in step 816, the HTTP / 2 peer 502 performs one or more load control enforcement actions (step 818).2.2 HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS - Value IncreaseA. Existing SETTINGS_MAX_CONCURRENT_STREAMS increase procedure

[0124] Increasing the value of the SETTINGS_MAX_CONCURRENT_STREAMS setting is allowed by the HTTP / 2 protocol and can be done using a SETTINGS frame that holds the new increased value of this parameter. The related message exchange between the HTTP / 2 node and its peer is similar to the case in which the value of this parameter is decreased as shown in Figure3 and Figure 4. Nonetheless, the motivation for an HTTP / 2 node to increase the number of concurrent streams on an HTTP / 2 connection was not discussed in the literature especially since an HTTP / 2 peer that requires exchanging additional concurrent streams with the HTTP / 2 node can establish a new HTTP / 2 connection with it. As HTTP / 2 SETTINGS as currently defined in HTTP / 2 specifications are non-negotiable and are enforced by the HTTP / 2 node, an HTTP / 2 peer cannot request the modification of an HTTP / 2 setting such as the SETTINGS_MAX_CONCURRENT_STREAMS.B. Proposed Procedure for Increasing the Value of SETTINGS_MAX_CONCURRENT_STREAMS

[0125] In one embodiment of the present disclosure, increasing the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter is advantageous in situations where the initial value of this parameter was relatively low compared to the number of requests that are usually initiated by the HTTP / 2 peer. In fact, in case of high load, an HTTP / 2 node may assign a low value for SETTINGS_MAX_CONCURRENT_STREAMS setting, which can be disadvantageous for its HTTP / 2 peer. However, after a certain time, the load on the HTTP / 2 node may decrease, in which case increasing the value of SETTINGS J AX_CONCURRENT_STREAMS setting may be possible for its HTTP / 2 peers. In one embodiment, initiating the value increase of the SETTINGS JVIAX_CONCURRENT_STREAMS setting can be done by the HTTP / 2 node following an external trigger such as, e.g., a resource management trigger from the NFV Management and Orchestration (MANO) framework. Depending only on such triggers may lead to sub-optimal resource utilization and QoS guarantees as those triggers are bound to an evaluation of the overall network state rather than a specific network node. For instance, an HTTP / 2 peer that was assigned a low value of SETTINGS_MAX_CONCURRENT_STREAMS setting by an HTTP / 2 node will resort to connecting to another node to meet its requirement. While this may provide a good solution, it can lead to a higher resource utilization compared to allowing the HTTP / 2 peer to request increasing the value of SETTINGS_MAX_CONCURRENT_STREAMS setting from its HTTP / 2 node after a certain time and freeing the other HTTP / 2 node which can be scaled down and perhaps removed from the network.

[0126] Hence, in one embodiment, an HTTP / 2 peer is enabled to request increasing the value of the SETTINGS_MAX_CONCURRENT_STREAMS setting from its connected HTTP / 2 node without allowing negotiation of the new value, in order to abide by the HTTP / 2 protocol. Thus, in one embodiment, the HTTP / 2 protocol is extended by adding a new frame that is referred to bythe exemplary (and non-limiting) name “MAX_CONCURRENT_STREAMS_UPDATE”. The proposed MAX_CONCURRENT_STREAMS_UPDATE frame has one or more, but potentially all, of the following features:• The MAX_CONCURRENT_STREAMS_UPDATE frame is assigned a frame type identified by 8 -bit type code (for example, type=0xl0).• The MAX_CONCURRENT_STREAMS_UPDATE frame is designed to be sent by an HTTP / 2 peer to request an increase of the maximum number of concurrent streams allowed by its connected HTTP / 2 node on a specific HTTP / 2 connection. However, it can be used to request a decrease of the value of SETTINGS_MAX_CONCURRENT_STREAMS setting as well.• The MAX_CONCURRENT_STREAMS_UPDATE frame conveys a new value of SETTINGS_MAX_CONCURRENT_STREAMS setting requested by the HTTP / 2 peer, which is referred to herein as “max_streams_request" .• The MAX_CONCURRENT_STREAMS_UPDATE frame is also used to acknowledge the receipt of the new value by the receiving HTTP / 2 node. To enable this, in one embodiment, the MAX_CONCURRENT_STREAMS_UPDATE frame defines the following flags: o ACK (0x1): When set, bit 0 indicates that this frame acknowledges receipt and evaluation of the request. That is the node receiving the MAX_CONCURRENT_STREAMS_UPDATE frame with the new requested value of SETTINGS J AX_CONCURRENT_STREAMS setting, acknowledges the receipt of the new value, is evaluating the possibility of updating the SETTINGS JVIAX_CONCURRENT_STREAMS setting and will send a followup SETTINGS_MAX_CONCURRENT_STREAMS setting frame with the updated value. When this bit is set, the payload of the MAX_CONCURRENT_STREAMS_UPDATE frame must be empty and other flags should be set to zero. Receipt of a MAX_CONCURRENT_STREAMS_UPDATE frame with the ACK flag set and a length field value other than 0 and / or other flags set MUST be treated as a connection error of type FRAME_SIZE_ERROR. o REJECT(0x2): When set, bit 0 indicates that this frame acknowledges receipt of the request and rejects it. This reject is a result of a network or node configuration that is enforced by the network management plane for example. When this bit is set, the payload of the MAX_CONCURRENT_STREAMS_UPDATE frame mustbe empty and other flags should be set to zero. Receipt of a MAX_CONCURRENT_STREAMS_UPDATE frame with the REJECT flag set and a length field value other than 0 and / or other flags set MUST be treated as a connection error of type FRAME_SIZE_ERROR.• The MAX_CONCURRENT_STREAMS_UPDATE frame cannot force the HTTP / 2 node to update the value SETTINGS J AX_CONCURRENT_STREAMS setting.• The MAX_CONCURRENT_STREAMS_UPDATE frame has a payload consisting of an unsigned bit value, e.g., an unsigned 32-bit value. An example MAX_CONCURRENT_STREAMS_UPDATE payload format is represented in Figure 9.• The MAX_CONCURRENT_STREAMS_UPDATE frame always applies to a connection, and not to a single stream. In the preferred embodiment, the stream identifier for a MAX_CONCURRENT_STREAMS_UPDATE frame must be zero (0x0). If an endpoint receives a MAX_CONCURRENT_STREAMS_UPDATE frame whose stream identifier field is anything other than 0x0, the endpoint must respond with a connection error of type PROTOCOL_ERROR.

[0127] Figure 10 illustrates an example embodiment of a procedure pertaining to increasing the value of SETTINGS_MAX_CONCURRENT_STREAMS setting following a request from an HTTP / 2 peer 1000 to an HTTP / 2 node 1002. The steps of the procedure are as follows.

[0128] Step 1004: The HTTP / 2 peer 1000 and the HTTP / 2 node 1002 operate to establish a TCP connection.

[0129] Step 1006 (OPTIONAL): The HTTP / 2 peer 1000 sends, to the HTTP / 2 node 1002, a SETTINGS frame that sets the SETTINGS_MAX_CONCURRENT_STREAMS parameter to a value of, in this example, 3000. The value of the SETTINGS_MAX_CONCURRENT_STREAMS_ VALUE parameter included in the SETTINGS frame of step 1006 defines a value for this parameter to be enforced by the HTTP / 2 peer 1000 for the number of concurrent streams from the HTTP / 2 node 1002 to the HTTP / 2 peer 1000.

[0130] Step 1008: The HTTP / 2 node 1002 sends, to the HTTP / 2 peer 1000, a SETTINGS frame that sets the SETTINGS_MAX_CONCURRENT_STREAMS parameter to a value of, in this example, 200. The value of the SETTINGS_MAX_CONCURRENT_STREAMS_ VALUE parameter included in the SETTINGS frame of step 1008 defines a value for this parameter to be enforced by the HTTP / 2 node 1002 for the number of concurrent streams from the HTTP / 2 peer 1000 to the HTTP / 2 node 1002.

[0131] Step 1010 (OPTIONAL): The HTTP / 2 node 1002 sends, to the HTTP / 2 peer 1000, a SETTINGS frame with an ACK responsive to the SETTINGS frame of step 1006.

[0132] Step 1012: The HTTP / 2 peer 1000 sends, to the HTTP / 2 node 1002, a SETTINGS frame with an ACK responsive to the SETTINGS frame of step 1008.

[0133] Step 1014: The HTTP / 2 peer 1000 sends data to the HTTP / 2 node 1002 via the TCP connection over, in this example, 135 concurrent streams.

[0134] Step 1015 (OPTIONAL): The HTTP / 2 peer 1000 optionally receives LCI from the HTTP / 2 node 1002 and decides, based on the LCI, to request an increase in the value of the SETTINGS J AX_CONCURRENT_STREAMS_ VALUE parameter.

[0135] Step 1016: In order to update (i.e., increase or decrease) the value of the SETTINGS_MAX_CONCURRENT_STREAMS_ VALUE parameter that defines the maximum number of current streams enforced by the HTTP / 2 node 1002 (i.e., the maximum number of concurrent streams from the HTTP / 2 peer 1000 to the HTTP / 2 node 1002 on the TCP connection), the HTTP / 2 peer 1000 sends, to the HTTP / 2 node 1002, a MAX_CONCURRENT_STREAMS_UPDATE frame that requests a new value for the SETTINGS_MAX_CONCURRENT_STREAMS_ VALUE parameter. In this example, the new value requested by the HTTP / 2 peer 1000 is 300. Thus, in step 1016, the HTTP / 2 peer 1000 that wishes to change (i.e., in this example increase) the value of SETTINGS_MAX_CONCURRENT_STREAMS parameter enforced by the HTTP / 2 node 1002 on the TCP connection, sends the MAX_CONCURRENT_STREAMS_UPDATE frame that includes the new requested value of SETTINGS_MAX_CONCURRENT_STREAMS parameter.

[0136] Step 1018: The HTTP / 2 node 1002 receives the MAX_CONCURRENT_STREAMS_UPDATE frame from the HTTP / 2 peer 1000 and either acknowledges its receipt or refuses the request by replying with a MAX_CONCURRENT_STREAMS_UPDATE frame with either the ACK flag set to 1 and an empty payload or a REJECT flag set to 1 and an empty payload.

[0137] Step 1020: In the case where the HTTP / 2 node 1002 acknowledges receipt of the MAX_CONCURRENT_STREAMS_UPDATE frame (i.e., ACK flag set to 1 with empty payload), the HTTP / 2 node 1002 sends, to the HTTP / 2 peer 1000, a SETTINGS frame with the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to a new value referred to herein as new_max_streams. The new_max_streams can be equal to or not equal to the requested value (i.e., max_streams_request). The value new_max_streams can also have the same value of max_streams of the SETTINGS_MAX_CONCURRENT_STREAMS setting. Thelatter case depicts that the HTTP / 2 node 1002 refusing to abide by the new requested value included in the MAX_CONCURRENT_STREAMS_UPDATE frame of step 1016.

[0138] Step 1022: Upon the receipt of the new SETTINGS_MAX_CONCURRENT_STREAMS setting from the HTTP / 2 node 1002, the HTTP / 2 peer 1000 acknowledges its receipt and application by replying with a SETTINGS frame having the ACK flag set to 1 and an empty payload.C. Proposed 5G and Beyond Procedure for Increasing the value of SETTINGS_MAX_CONCURRENT_STREAMS

[0139] The SETTINGS_MAX_CONCURRENT_STREAMS value increase procedure described in Section 2.2(B) of the Detailed Description is a general approach that can be applied to any HTTP / 2 node including 5G SBA NFs. However, for additional benefits in 5G SB A, in one embodiment, this solution is augmented with the usage of 3GPP custom headers.

[0140] As explained in Section 2.2(B) of the Detailed Description, it is unlikely that an HTTP / 2 node that experiences a load decrease will increase the value of SETTINGS_MAX_CONCURRENT_STREAMS setting for its HTTP / 2 peers. In general, the system is provisioned with a given number of streams, and resources that are usually requested via the establishment of a new TCP connection. That TCP connection can be established between the two exact same nodes or between other nodes implementing the service. When possible, that is when enough resources are available, it is proposed herein that streams be increased as opposed to a new session being established. In order to provide information about whether enough resources are available or not, in one embodiment, an HTTP / 2 node, which is an NFp, an SEPP, or an SCP and which supports 3gpp_Sbi_Lci custom header, uses the latter to advertise its load information. The HTTP / 2 node load information can be used by an HTTP / 2 peer that supports 3gpp_Sbi_Lci custom header to decide whether or not to request or not an increase of the SETTINGS_MAX_CONCURRENT_STREAMS value, e.g., based its needs.

[0141] In 5G SBA, it is assumed that the HTTP / 2 peer is an NFc, an SEPP, or an SCP and that the HTTP / 2 node is an NFp of a specific type (i.e., AMF, SMF, etc.) or an SEPP or an SCP. To fulfill its need, the HTTP / 2 peer can request increasing the value of the SETTINGS_MAX_CONCURRENT_STREAMS setting on an HTTP / 2 connection already established with an HTTP / 2 node of the required type, by following the general procedure detailed in Section 2.2(B) of the Detailed Description. This is advisable if the HTTP / 2 peer does not know and / or cannot inquire about the load (e.g., HTTP / 2 node does not support 3gpp_Sbi_Lci custom header) experienced by the HTTP / 2 node before sending the MAX_CONCURRENT_STREAMS_UPDATE.

[0142] However, if the HTTP / 2 node supports 3gpp_Sbi_Lci custom header and the HTTP / 2 peer did not receive this header at the time it needs or desires to send the MAX_CONCURRENT_STREAMS_UPDATE frame, the HTTP / 2 peer can initiate a NF discovery procedure by requiring from the NRF the list of NF instances that can fulfill its needs. The NRF responds with a list of available NF instances of the required type with their LCI. The obtained list can include or not the HTTP / 2 node it is already connected to. Based on the obtained list, the HTTP / 2 peer may choose to establish new HTTP / 2 connections with new HTTP / 2 nodes or may decide to request an increase of the value of SETTINGS_MAX_CONCURRENT_STREAMS setting on its connection with the current HTTP / 2 node serving it. Initiating a NF discovery procedure before sending a MAX_CONCURRENT_STREAMS_UPDATE to the HTTP / 2 node allows the HTTP / 2 peer:• To better assess its service options for better QoS;• Reduce the network overhead. In fact, the HTTP / 2 peer may opt for sending a MAX_CONCURRENT_STREAMS_UPDATE to the HTTP / 2 node before initiating a NF service discovery. However, we assume that it is likely that the HTTP / 2 node refuses the increase of the SETTINGS_MAX_CONCURRENT_STREAMS setting, as it did not advertise to the HTTP / 2 peer its load through a 3gpp_Sbi_Lci custom header. This indicates that the HTTP / 2 node is not available to allocate additional resources to this HTTP / 2 peer. In such a scenario, the HTTP / 2 peer will have to initiate NF discovery procedure to respond to its needs and thus, its exchange of the additional SETTINGS and MAX_CONCURRENT_STREAMS_UPDATE frames (4 frames (Figure 10)) were useless and created an unneeded overhead.

[0143] While LCI inquiry through 3gpp_Sbi_Lci custom header and NF service discovery are 5G specific, the proposed approach can be applied in any other network in which the HTTP / 2 peer can inquire the LCI of the HTTP / 2 node and other nodes that can serve it.

[0144] Figure 11 is a flow chart that illustrates the operation of the HTTP / 2 node and HTTP / 2 peer to perform the 5G specific SETTINGS_MAX_CONCURRENT_STREAMS update procedure in the case of increasing its value, in accordance with one embodiment of the present disclosure. The steps of the procedure are as follows:

[0145] Step 1100: The HTTP / 2 peer determines that it requires or desires an increase in the value of the SETTINGS_MAX_CONCURRENT_STREAMS setting.

[0146] Step 1102: The HTTP / 2 peer determines whether it can inquire (e.g., request or otherwise obtain) LCI of the HTTP2 / node. If so, the process proceeds to step 1104. If not, the process proceeds to step 1116.

[0147] Step 1104: The HTTP / 2 peer determines whether it has received LCI of the HTTP / 2 node. If so, the process proceeds to step 1112. If not, the process proceeds to step 1106.

[0148] Step 1106, 1108, and 1110: If the HTTP / 2 peer is an NFc, an SCP, or an SEPP (step 1106, YES), the HTTP / 2 peer initiates a NF discovery procedure with the NRF to inquire about the possible NF instances that can serve the HTTP / 2 peer. The NF service discovery procedure can include or not include ECI (using or not using 3gpp_Sbi_Lci custom header) of the different NF instances comprising or not comprising the HTTP / 2 node to which the HTTP / 2 peer is connected (step 1108) and the process then proceeds to step 1112. If the HTTP / 2 peer is not an NFc, SCP, or SEPP (step 1106, NO), the HTTP / 2 peer inquires or obtains the LCI of the HTTP / 2 node using, e.g., any configured method (e.g., monitoring tool) (step 1110), and then the process proceeds to step 1112.

[0149] Step 1112: The HTTP / 2 peer determines whether it desires to request increasing the value of the SETTINGS_MAX_CONCURRENT_STREAMS setting based on the received LCI. If not, the process proceeds to step 1114. If so, the process proceeds to step 1116. For example, if the LCI the HTTP / 2 peer received from the HTTP / 2 node depicts for example a load of 60%, and the HTTP / 2 peer judges its request to be time sensitive and discovered some other nodes that can serve it which have 20% of load, the HTTP / 2 peer can decide to establish a new connection with the discovered node which has 20% as load rather than requesting an increase of the maximum number of streams. Alternatively, if the HTTP / 2 peer can handle waiting to be served and does not want to establish a new TCP connection with another node, it can request an increase of the number of streams from its currently connected HTTP / 2 node (the one having 60% load). Again, this is just an example. Further, the decision on whether to request an increase or not based on LCI can be configuration / implementation specific to the operator.

[0150] Step 1114: The HTTP / 2 peer initiates an HTTP / 2 connection with another HTTP / 2 node(s) that can handle its requests.

[0151] Step 1116: The HTTP / 2 peer sends, to the HTTP / 2 node, a MAX_CONCURRENT_STREAMS_UPDATE frame with a new requested value for the SETTINGS J AX_CONCURRENT_STREAMS parameter.

[0152] Step 1118: The HTTP / 2 node responds to the MAX_CONCURRENT_STREAMS_UPDATE frame received from the HTTP / 2 in step 1116 with a MAX_CONCURRENT_STREAMS_UPDATE frame having the ACK flag set to 1 and an empty payload to acknowledge the receipt of the MAX_CONCURRENT_STREAMS_UPDATE frame of step 1116.

[0153] Step 1120: The HTTP / 2 node sends, to the HTTP / 2 peer, a SETTINGS frame with a new value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter. The new value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter may or may not be equal to the requested new value.

[0154] Step 1122: The HTTP / 2 peer responds to the HTTP / 2 node with a SETTINGS frame having an ACK flag set to 1 and an empty payload to acknowledge the receipt and application of the new value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter received in step 1120. Note that steps 1118, 1120, and 1122 are performed if the HTTP / 2 node accepts the request. However, the HTTP / 2 node can also reject the request. In this case, the alternative to 1118 will be that the HTTP / 2 node responds to the MAX_CONCURRENT_STREAMS_UPDATE frame received from the HTTP / 2 in step 1116 with a MAX_CONCURRENT_STREAMS_UPDATE frame having the REJECT flag set to 1 and an empty payload to reject the increase request", which can lead the HTTP / 2 peer to perform step 1114.D. Security implications and discussion of the proposedSETTINGS_MAX_CONCURRENT_STREAMS value increase procedure

[0155] Enabling the HTTP / 2 peer to request increasing the value of the SETTINGS_MAX_CONCURRENT_STREAMS setting increases the attack surface of the HTTP / 2 node and that of the network to which it belongs. A malicious HTTP / 2 peer can create multiple HTTP / 2 connections with an HTTP / 2 node and request an increase of the value of SETTINGS_MAX_CONCURRENT_STREAMS setting to a high one on all of them, by mean of the proposed SETTINGS_MAX_CONCURRENT_STREAMS value increase general procedure (Section 2.2(B) of the Detailed Description). If the HTTP / 2 node granted the requested increase to the HTTP / 2 peer to the same requested value or a different one, it will be extending its attack surface. The malicious HTTP / 2 peer can now further exploit the HTTP / 2 stream multiplexing feature to launch a scaled stream multiplexing attack (Section 1.3 of the Detailed Description) on the HTTP / 2 node. Further, allowing an HTTP / 2 peer to request an increase of the value of the SETTINGS_MAX_CONCURRENT_STREAMS setting and granting that increase can lead to a resource starvation for other HTTP / 2 peers sharing the HTTP / 2 node resources.

[0156] To prevent a scaled stream multiplexing attack and avoid starving of HTTP / 2 peers, the use of the MAX_CONCURRENT_STREAMS_UPDATE frame is, in one embodiment, enabled for use with one or more of the following security and resources management features:• Enforce a certain limit on the maximum resources that an HTTP / 2 node can allocate to an HTTP / 2 peer;• Implement a fairness model at the HTTP / 2 node to avoid resource starvation of the HTTP / 2 peers;• Augment the HTTP / 2 node with capabilities to inquire about the HTTP / 2 behavior before increasing the value of its SETTINGS_MAX_CONCURRENT_STREAMS setting. This can include inquiring: o LCI of the HTTP / 2 peer from management entities (e.g., NRF in 5G network, NFV MANO) in order to assess the accuracy of its need for the requested increase; and / or o About the security state of the HTTP / 2 peer through monitoring and anomaly detection tools to verify that the HTTP / 2 peer is a benign node.• Augment the HTTP / 2 node with SETTINGS J AX_CONCURRENT_STREAMS optimization mechanism such as the one proposed in Section 3 of the Detailed Description to ensure fair and optimized HTTP / 2 node resources allocation to its peers.3 HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS - Optimization Mechanism

[0157] HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS setting is determined per HTTP / 2 connection and per direction by an HTTP / 2 node towards an HTTP / 2 peer. The value of this parameter has, however, a great impact on the resources allocated by the HTTP / 2 node to its HTTP / 2 peer. In fact, each HTTP / 2 stream is allocated a thread by the HTTP / 2 node processing it. Increasing the number of open or half-open concurrent streams on an HTTP / 2 connection increases the number of running threads on the HTTP / 2 node and hence its consumed resources. As the number of HTTP / 2 node resources and threads are limited and are shared across multiple HTTP / 2 peers, an HTTP / 2 node that grants high values of SETTINGS_MAX_CONCURRENT_STREAMS setting on its connections with an HTTP / 2 peer allows the latter to deplete its resources, starve other HTTP / 2 peers, and violate their QoS. It also increases its attack surface and becomes more vulnerable to HTTP / 2 streams multiplexing attacks launched from its HTTP / 2 peer. Thus, it is intrinsic to augment an HTTP / 2 node with a SETTINGS_MAX_CONCURRENT_STREAMS optimization mechanism to ensure:• Optimized resource allocation across HTTP / 2 peers.• Fairness between HTTP / 2 peers.• Prevention and mitigation of HTTP / 2 stream multiplexing attacks on the HTTP / 2 node.

[0158] Towards this end, in one embodiment, an HTTP / 2SETTINGS J AX_CONCURRENT_STREAMS optimization mechanism is disclosed. The proposed HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS optimization mechanism includes any one or more of the following aspects:• A real-time optimization approach designed to optimize the value of SETTINGS_MAX_CONCURRENT_STREAMS parameter across currently connected HTTP / 2 peers (i.e., current HTTP / 2 connections) based on current available HTTP / 2 node resources and / or HTTP / 2 peers’ priorities. Such optimization can account for allowing the update of the value of SETTINGS JVIAX_CONCURRENT_STREAMS setting for existing connections or it can simply be used to determine the value of this parameter for a newly established connection while keeping existing connections parameters intact. More precisely, the value of SETTINGS_MAX_CONCURRENT_STREAMS setting is be optimized based on, e.g.: o HTTP / 2 node available resources that account for determining the value of SETTINGS_MAX_CONCURRENT_STREAMS setting for an HTTP / 2 connection based on the current available HTTP / 2 node Central Processing Unit (CPU) and memory resources along with the current available threads that are not initiated (i.e., are not processing current HTTP / 2 peers’ streams), and finally the estimated resources (e.g., memory, CPU, threads, etc.) that are likely to be consumed by existing HTTP / 2 peers. Such estimation depends on the remaining uninitiated streams that count towards their current SETTINGS_MAX_CONCURRENT_STREAMS value. In the case where the modification of the value of SETTINGS_MAX_CONCURRENT_STREAMS setting for existing HTTP / 2 connections is allowed, the optimization mechanism should account for minimizing the number of HTTP / 2 connections that need to be altered (i.e., HTTP / 2 connections for which the value of SETTINGS_MAX_CONCURRENT_STREAMS needs to be modified) to accommodate for the streams needed for the HTTP / 2 connection we are optimizing for. o HTTP / 2 node’s peer priorities that account for determining the value of SETTINGS_MAX_CONCURRENT_STREAMS parameter for an HTTP / 2 connection proportionally to the priority of the HTTP / 2 peer we are optimizing forin comparison to the priorities of other currently connected HTTP / 2 peers. Higher priority HTTP / 2 peers are assigned a higher value for SETTINGS_MAX_CONCURRENT_STREAMS setting than those of lower priorities. HTTP / 2 peers priorities can be determined by the network operators based on the role they play in the network and the services they assist in delivering.In a 5G network for example, HTTP / 2 nodes and HTTP / 2 peers depict the 5G SBA NFs (e.g., AMF, SMF, etc.). 3GPP standardized the services (i.e., APIs) provided by each of these NFs, the 5G procedures (e.g., NF service discovery, registration procedure, etc.) in which they are involved, and their NFcs (e.g., HTTP / 2 peers). This allows MNOs to assess the importance of a 5G SBA NF in comparison to others. For instance, an AMF is the first core NF contacted for UE authentication and registration procedures. These procedures require the AMF (i.e., HTTP / 2 peer) to request SMF (i.e., HTTP / 2 node) services. Thus, if the AMF was not served by the SMF in time, it can cause a QoS degradation for the UE or even a DoS. Hence, the SMF should prioritize the AMF in comparison to a UPF (i.e., HTTP / 2 peer), for example; which allows a UE to access the data network. Delays in accessing the data network are less critical than delays in the UE authentication and registration which are mandatory to allow the UE to get any mobile service (e.g., call, Short Message Service (SMS), etc.). Global System for Mobile Communications Association (GSMA) presents a risk assessment of the 5G path / operation, type / operation id and information elements document. The GSMA document highlights the risk associated with exploiting 5G signaling messages to perform attacks on 5G network. The risk is estimated through an overall score calculated based on the possible impact, the attack vector and the pre-conditions required for the exploitation of the related vulnerability used to perform the attack. We believe that this document can serve MNO in determining the priorities to be allocated to 5G NFs and which can serve in optimizing the SETTINGS_MAX_CONCURRENT_STREAMS setting associated with their HTTP / 2 connections. For example, an MNO may average the risks assigned to the different operations performed by an NF and use it to estimate the latter priority. Another approach MNO can follow is to assign priorities to the different 5G procedures and use those priorities to estimate the priority of an NF peer (the priority of the NF can be calculated as the average priorities of the 5G procedures this NF is involved in when requesting services of the HTTP / 2 node) with respect to other HTTP / 2 peers requesting the services of the same HTTP / 2 node.• A proactive optimization approach designed to optimize the value of SETTINGS_MAX_CONCURRENT_STREAMS setting across forecasted HTTP / 2 peers (i.e., current HTTP / 2 connections) that are predicted to be connected in a future timestep. The optimization approach accounts for forecasted HTTP / 2 node resources and / or HTTP / 2 peers’ priorities that will be available in a future timestep. The forecasted peer(s) can include new HTTP / 2 connections that will be established in the forecasted timestep and / or existing HTTP / 2 connections that will continue to exist in the forecasted timestep. In the latter case, the HTTP / 2 node can choose to update SETTINGS_MAX_CONCURRENT_STREAMS setting of existing connections at the optimization time in order to free its resources in time to accommodate for new HTTP / 2 connections that are predicted at the future timestep. Similarly, to the real-time optimization approach, the value of SETTINGS_MAX_CONCURRENT_STREAMS setting is optimized based on, e.g.:• HTTP / 2 node available resources that account for determining the value of SETTINGS J AX_CONCURRENT_STREAMS setting for an HTTP / 2 connection based on the HTTP / 2 node CPU and memory resources along with the threads that are forecasted to be available in the predicted timestep. Machine learning techniques such as Long Short-Term Memory (LSTM) model can be used to predict the availability of HTTP / 2 node resources. o HTTP / 2 node’s peers priorities that account for determining the value of SETTINGS_MAX_CONCURRENT_STREAMS setting for an HTTP / 2 connection proportionally to the priority of the HTTP / 2 peer we are optimizing for in comparison to the priorities of other HTTP / 2 peers forecasted to be connected to the HTTP / 2 node in the next timestep. Machine learning techniques such as LSTM can be used to forecast HTTP / 2 peer types, estimated load and hence priorities that will be connected to the HTTP / 2 node in a future timestep. Higher priority HTTP / 2 peers are assigned a higher value for SETTINGS_MAX_CONCURRENT_STREAMS setting that those of lower priorities. HTTP / 2 peers priorities can be determined by the network operators based on the role they play in the network and the services they assist in delivering. In 5G networks, MNOs can assign priorities to HTTP / 2 peers in the same way that was discussed above for HTTP / 2 peer priorities under the real-time optimization approach.

[0159] In case where optimization of SETTINGS_MAX_CONCURRENT_STREAMS setting accounted for both HTTP / 2 node available resources and peers priorities, be it in real-time optimization approach or proactive optimization approach, a conservative optimization strategy is preferred, in some embodiments, to limit the possible exploitability of the stream multiplexing feature for malicious activities. In such a conservative strategy, in one embodiment, the SETTINGS_MAX_CONCURRENT_STREAMS setting is assigned the minimum value between those determined by the HTTP / 2 node available resources and peers priorities methods as shown in the example procedure of Figure 12, which is described in detail below.

[0160] Note that if HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS optimization mechanism is not enabled at the HTTP / 2 node, the latter assigns the default configured SETTINGS JVIAX_CONCURRENT_STREAMS value for its HTTP / 2 peer.

[0161] Figure 12 is a flow chart that illustrates one example embodiment of an HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS optimization mechanism. The steps of the procedure of Figure 12 are as follows.

[0162] Step 1200: An HTTP / 2 connection (i.e., a TCP connection) is established between an HTTP / 2 node and an HTTP / 2 peer.

[0163] Step 1202: If the stream multiplexing optimization procedure is not enabled, the process proceeds to step 1204. Otherwise, if the stream multiplexing optimization feature is enabled, the process proceeds to step 1206 (for Option A - real-time optimization) or step 1224 (for Option B - proactive optimization).

[0164] Step 1204: If the stream optimization feature is not enabled, the HTTP / 2 node sends, to the HTTP / 2 peer, a SETTINGS frame with the value of the SETTINGS_MAX_CURRENT_STREAMS parameter set to a default value, and the process ends.

[0165] Step 1206: If the stream multiplexing optimization feature is enabled, the HTTP / 2 node determines whether real-time optimization is enabled. If not, the process proceeds to step 1222. If so, the process proceeds to step 1208 (Option Al - real-time resources optimization) and / or step 1212 (Option A2 - priority-based optimization).

[0166] Step 1208: The HTTP / 2 node determines whether real-time resources optimization is enabled. If so, the process proceeds to step 1210.

[0167] Steps 1210: If real-time resources optimization is enabled, the HTTP / 2 node determines a value for the SETTINGS_MAX_CURRENT_STREAMS parameter (referred to as “max_stream_valueAl”) based on: current available CPU resources at the HTTP / 2 node, current available memory resources at the HTTP / 2 node, current available threads at the HTTP / 2 node,and / or estimated amount of resources (e.g., CPU resources, memory resources, and / or threads) that will be consumed by existing HTTP / 2 peer(s) depending on their remaining un-initiated streams.

[0168] Step 1212: The HTTP / 2 node also determines whether HTTP / 2 peer(s) priority-based optimization is enabled. If so, the process proceeds to step 1214.

[0169] Step 1214: The HTTP / 2 node determines a value (referred to as max_stream_valueA2) for the SETTINGS_MAX_CURRENT_STREAMS parameter proportionally to the existing HTTP / 2 peers priorities.

[0170] Step 1216: If real-time resources optimization is enabled but priority-based optimization is not enabled, the HTTP / 2 node sets a new value (referred to as “new_max_streams”) to max_stream_valueAl.

[0171] Step 1218: If real-time resources optimization is enabled and priority-based optimization is also enabled, the HTPP / 2 node sets new_max_streams to the minimum of max_streams_valueAl and max_streams_valueA2.

[0172] Step 1220: If real-time resources optimization is not enabled and priority-based optimization is enabled, the HTTP / 2 node sets new_max_streams to max_streams_valueA2.

[0173] Step 1222: The HTTP / 2 node sends, to the HTTP / 2 peer, a SETTINGS frame with the for the SETTINGS_MAX_CURRENT_STREAMS parameter set to the new_max_streams value.

[0174] Step 1224: For Option B, the HTTP / 2 node determines whether proactive optimization is enabled. If not, the process proceeds to step 1222.

[0175] Step 1226: The HTTP / 2 node determines whether proactive resource optimization is enabled.

[0176] Step 1228: If proactive resource optimization is enabled, the HTTP / 2 node determines a new value (referred to here as max_stream_valueBl) for the SETTINGS_MAX_CURRENT_STREAMS parameter based on predicted future resource availability at the HTTP / 2 node based on forecasted HTTP / s peer(s) in the next timestep(s).

[0177] Step 1230: The HTTP / 2 node determines whether proactive HTTP / 2 peer(s) prioritybased optimization is enabled. If so, the process proceeds to step 1232.

[0178] Step 1232: The HTTP / 2 node predicts future number and / or types and priorities of future HTTP / 2 peer(s) and then determines a new value (referred to here as max_stream_valueB2) proportionally to the predicted future number and / or types and priorities of future HTTP / 2 peer(s).

[0179] Step 1234: If proactive resources optimization is enabled but proactive HTTP / 2 peer(s) priority-based optimization is not enabled, the HTTP / 2 node sets new_max_streams equal to max_stream_valueBl.

[0180] Step 1236: If proactive resources optimization is enabled and proactive HTTP / 2 peer(s) priority-based optimization is also enabled, the HTTP / 2 node sets new_max_streams equal to the minimum of max_stream_valueB 1 and max_stream_valueB2.

[0181] Step 1238: If proactive resources optimization is not enabled but proactive HTTP / 2 peer(s) priority-based optimization is enabled, the HTTP / 2 node sets new_max_streams equal to max_stream_valueB2.

[0182] The HTTP / 2 node sends, to the HTTP / 2 peer, a SETTINGS frame with the SETTINGS_MAX_CURRENT_STREAMS parameter set to the new_max_streams value.4 HTTP / 2 SETTINGS JMAX_CONCURRENT_STREAMS - OptimizationTriggering Events

[0183] HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS value optimization can be triggered responsive to, e.g., any of the following non-limiting list of events:• Upon the establishment of a new HTTP / 2 connection;• Upon closing one or many existing HTTP / 2 connections;• Periodically, based on the network operator configuration of the HTTP / 2 node;• Throughout a network / HTTP / 2 node self-healing procedure;• Following a management request (Figure 13). The SETTINGS_MAX_CONCURRENT_STREAMS value optimization management request can be initiated by, e.g.: o The NFV MANO framework managing the HTTP / 2 node. For example, an NFV Orchestrator (NFVO) may decide to reoptimize the network resources including the HTTP / 2 node resources based on the identification of an overload or underutilization of existing network resources, among others. o The network administrator. o A security agent upon the detection / mitigation of a network node fault, an attack, etc. For example, a security agent may detect a Distributed Denial-of-Service (DDoS) attack on HTTP / 2 nodel which crashed. As a mitigation procedure the security agent can redirect the load to HTTP / 2 node2 of the same type of HTTP / 2 nodel. In such a situation, the security agent can trigger SETTINGS_MAX_CONCURRENT_STREAMS value optimization procedure on HTTP / 2 node2 to allow better load balancing and QoS for its existingconnections and the new established ones which resulted from the redirected load of the failed HTTP / 2 nodel.5 HTTP / 2 SETTINGS JMAX_CONCURRENT_STREAMS - OptimizationMechanism Application

[0184] The network operator may choose to trigger the SETTINGS_MAX_CONCURRENT_STREAMS value optimization mechanism (Section 3 of the Detailed Description) based on but not limited to one or many of the aforementioned triggering events (Section 4 of the Detailed Description). However, the network operator decision should be based on careful assessment of the communication overhead and possible disruption of existing HTTP / 2 connections (i.e., in case of modification of theSETTINGS J AX_CONCURRENT_STREAMS value for existing HTTP / 2 connections is allowed). In one embodiment, optimizing the value of SETTINGS_MAX_CONCURRENT_STREAMS setting is performed at the establishment of a new HTTP / 2 connection is highly beneficial for load balancing at the HTTP / 2 node and for prevention from HTTP / 2 stream multiplexing attacks. In one embodiment, any one or more of the following may be performed:• Applying the real-time optimization approach upon the establishment of a new HTTP / 2 connection without allowing changing the SETTINGS_MAX_CONCURRENT_STREAMS value for existing HTTP / 2 connections in order to prevent any service disruption.• Applying the real-time optimization approach upon the request of a modification of SETTINGS_MAX_CONCURRENT_STREAMS value for an existing HTTP / 2 connection without allowing changing the SETTINGS_MAX_CONCURRENT_STREAMS value for other existing HTTP / 2 connections in order to prevent any service disruption.• Applying the real-time optimization approach while allowing change of the SETTINGS_MAX_CONCURRENT_STREAMS value for existing HTTP / 2 connections following any management and security request or based on node periodic configuration or self-healing mechanism. We believe allowing re-optimization of the resources assigned to existing HTTP / 2 connections following any of the aforementioned events is crucial for network optimization. Note that it is very likely that the mentioned events are already based on network disruption, thus we believe that re-optimizing SETTINGS_MAX_CONCURRENT_STREAMS value for existing HTTP / 2 connections will not add any disruption to the network.• Applying the proactive optimization approach following but not limited to the detection of an attack, an increase in the load or a prediction of a potential flash crowd event. The proactive optimization approach can serve to estimate the benefits of re-optimizing the network resources and to assess the need to do so especially when applied for multiple HTTP / 2 nodes and connections.• Applying the proactive optimization approach upon the request of a modification of SETTINGS_MAX_CONCURRENT_STREAMS value for an existing HTTP / 2 connection without allowing changing the SETTINGS_MAX_CONCURRENT_STREAMS value for other existing HTTP / 2 connections in order to prevent any service disruption. The obtained value from the proactive optimization approach can serve to detect potential attacks incoming from existing HTTP / 2 connections requesting an increase of the value of SETTINGS J AX_CONCURRENT_STREAMS parameter (Section 2.2(D) of the Detailed Description. The HTTP / 2 node receiving such request can compare the requested value of SETTINGS_MAX_CONCURRENT_STREAMS parameter with that predicted one. If the difference between both values was less than a specified threshold, the HTTP / 2 node can grant the request by setting the new value of SETTINGS_MAX_CONCURRENT_STREAMS parameter to the predicted one. However, if the difference between both values was greater than the specified threshold, the HTTP / 2 node can refuse the request and may require a security assessment of the HTTP / 2 peer from existing security controls / agents.6 HTTP / 2 SETTINGS_MAX_CONCURRENT_STREAMS - Optimization Mechanism Application

[0185] Figure 14 illustrates one example of a cellular communications system 1400 in which embodiments of the present disclosure may be implemented. In the embodiments described herein, the cellular communications system 1400 is a 5G system (5GS) including a Next Generation RAN (NG-RAN) and a 5G Core (5GC); however, embodiments of the present disclosure are not limited thereto and can be applied to future systems such as, e.g., Sixth Generation (6G) systems. In this example, the RAN includes base stations 1402-1 and 1402-2, which in the 5GS include gNBs and optionally next generation eNBs (ng-eNBs) (e.g., Long Term Evolution (LTE) RAN nodes connected to the 5GC), controlling corresponding (macro) cells 1404-1 and 1404-2. The base stations 1402-1 and 1402-2 are generally referred to herein collectively as base stations 1402 and individually as base station 1402. Likewise, the (macro) cells 1404-1 and 1404-2 are generally referred to herein collectively as (macro) cells 1404 andindividually as (macro) cell 1404. The RAN may also include a number of low power nodes 1406-1 through 1406-4 controlling corresponding small cells 1408-1 through 1408-4. The low power nodes 1406-1 through 1406-4 can be small base stations (such as pico or femto base stations) or Remote Radio Heads (RRHs), or the like. Notably, while not illustrated, one or more of the small cells 1408-1 through 1408-4 may alternatively be provided by the base stations 1402. The low power nodes 1406-1 through 1406-4 are generally referred to herein collectively as low power nodes 1406 and individually as low power node 1406. Likewise, the small cells 1408-1 through 1408-4 are generally referred to herein collectively as small cells 1408 and individually as small cell 1408. The cellular communications system 1400 also includes a core network 1410, which in the 5GS is referred to as the 5GC. The base stations 1402 (and optionally the low power nodes 1406) are connected to the core network 1410.

[0186] The base stations 1402 and the low power nodes 1406 provide service to wireless communication devices 1412-1 through 1412-5 in the corresponding cells 1404 and 1408. The wireless communication devices 1412-1 through 1412-5 are generally referred to herein collectively as wireless communication devices 1412 and individually as wireless communication device 1412. In the following description, the wireless communication devices 1412 are oftentimes UEs, but the present disclosure is not limited thereto.

[0187] Figure 15 illustrates a wireless communication system represented as a 5G network architecture composed of core NFs, where interaction between any two NFs is represented by a point-to-point reference point / interface. Figure 15 can be viewed as one particular implementation of the system 1400 of Figure 14.

[0188] Seen from the access side the 5G network architecture shown in Figure 15 comprises a plurality of UEs 1412 connected to either a RAN 1402 or an Access Network (AN) as well as an AMF 1500. Typically, the R(AN) 1402 comprises base stations, e.g. such as eNBs or gNBs or similar. Seen from the core network side, the 5GC NFs shown in Figure 15 include a NSSF 1502, an AUSF 1504, a UDM 1506, the AMF 1500, a SMF 1508, a PCF 1510, and an Application Function (AF) 1512.

[0189] Reference point representations of the 5G network architecture are used to develop detailed call flows in the normative standardization. The N 1 reference point is defined to carry signaling between the UE 1412 and AMF 1500. The reference points for connecting between the AN 1402 and AMF 1500 and between the AN 1402 and UPF 1514 are defined as N2 and N3, respectively. There is a reference point, Ni l, between the AMF 1500 and SMF 1508, which implies that the SMF 1508 is at least partly controlled by the AMF 1500. N4 is used by the SMF 1508 and UPF 1514 so that the UPF 1514 can be set using the control signal generated by theSMF 1508, and the UPF 1514 can report its state to the SMF 1508. N9 is the reference point for the connection between different UPFs 1514, and N14 is the reference point connecting between different AMFs 1500, respectively. N15 and N7 are defined since the PCF 1510 applies policy to the AMF 1500 and SMF 1508, respectively. N12 is required for the AMF 1500 to perform authentication of the UE 1412. N8 and N10 are defined because the subscription data of the UE 1412 is required for the AMF 1500 and SMF 1508.

[0190] The 5GC network aims at separating User Plane (UP) and Control plane (CP). The UP carries user traffic while the CP carries signaling in the network. In Figure 15, the UPF 1514 is in the UP and all other NFs, i.e., the AMF 1500, SMF 1508, PCF 1510, AF 1512, NSSF 1502, AUSF 1504, and UDM 1506, are in the CP. Separating the UP and CP guarantees each plane resource to be scaled independently. It also allows UPFs to be deployed separately from CP functions in a distributed fashion. In this architecture, UPFs may be deployed very close to UEs to shorten the Round Trip Time (RTT) between UEs and data network for some applications requiring low latency.

[0191] The core 5G network architecture is composed of modularized functions. For example, the AMF 1500 and SMF 1508 are independent functions in the CP. Separated AMF 1500 and SMF 1508 allow independent evolution and scaling. Other CP functions like the PCF 1510 and AUSF 1504 can be separated as shown in Figure 15. Modularized function design enables the 5GC network to support various services flexibly.

[0192] Each NF interacts with another NF directly. It is possible to use intermediate functions to route messages from one NF to another NF. In the CP, a set of interactions between two NFs is defined as service so that its reuse is possible. This service enables support for modularity. The UP supports interactions such as forwarding operations between different UPFs.

[0193] Figure 16 illustrates a 5G network architecture using service-based interfaces between the NFs in the CP, instead of the point-to-point reference points / interfaces used in the 5G network architecture of Figure 15. However, the NFs described above with reference to Figure 15 correspond to the NFs shown in Figure 16. The service(s) etc. that a NF provides to other authorized NFs can be exposed to the authorized NFs through the service-based interface. In Figure 16 the service based interfaces are indicated by the letter “N” followed by the name of the NF, e.g. Namf for the service based interface of the AMF 1500 and Nsmf for the service based interface of the SMF 1508, etc. The NEF 1600 and the NRF 1602 in Figure 16 are not shown in Figure 15 discussed above. However, it should be clarified that all NFs depicted in Figure 15 can interact with the NEF 1600 and the NRF 1602 of Figure 16 as necessary, though not explicitly indicated in Figure 15.

[0194] Some properties of the NFs shown in Figures 15 and 16 may be described in the following manner. The AMF 1500 provides UE-based authentication, authorization, mobility management, etc. A UE 1412 even using multiple access technologies is basically connected to a single AMF 1500 because the AMF 1500 is independent of the access technologies. The SMF 1508 is responsible for session management and allocates Internet Protocol (IP) addresses to UEs. It also selects and controls the UPF 1514 for data transfer. If a UE 1412 has multiple sessions, different SMFs 1508 may be allocated to each session to manage them individually and possibly provide different functionalities per session. The AF 1512 provides information on the packet flow to the PCF 1510 responsible for policy control in order to support QoS. Based on the information, the PCF 1510 determines policies about mobility and session management to make the AMF 1500 and SMF 1508 operate properly. The AUSF 1504 supports authentication function for UEs or similar and thus stores data for authentication of UEs or similar while the UDM 1506 stores subscription data of the UE 1412. The Data Network (DN), not part of the 5GC network, provides Internet access or operator services and similar.

[0195] An NF may be implemented either as a network element on a dedicated hardware, as a software instance running on a dedicated hardware, or as a virtualized function instantiated on an appropriate platform, e.g., a cloud infrastructure.

[0001] Figure 17 is a schematic block diagram of a network node 1700 according to some embodiments of the present disclosure. Optional features are represented by dashed boxes. The network node 1700 may be, for example, a base station 1402 or a network node that implements all or part of the functionality of an NF in the core network 1410. As illustrated, the network node 1700 includes a control system 1702 that includes one or more processors 1704 (e.g., CPUs, Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs), and / or the like), memory 1706, and a network interface 1708. The one or more processors 1704 are also referred to herein as processing circuitry. In addition, if the network node 1700 is a radio access node (e.g., a base station 1402, gNB, or network node that implements at least some of the functionality of the base station 1402 or gNB), the network node 1700 may include one or more radio units 1710 that each includes one or more transmitters 1712 and one or more receivers 1714 coupled to one or more antennas 1716. The radio units 1710 may be referred to or be part of radio interface circuitry. In some embodiments, the radio unit(s) 1710 is external to the control system 1702 and connected to the control system 1702 via, e.g., a wired connection (e.g., an optical cable). However, in some other embodiments, the radio unit(s) 1710 and potentially the antenna(s) 1716 are integrated together with the control system 1702. The one or more processors 1704 operate to provide one or more functions of the network node 1700 as describedherein (e.g., one or more functions of a HTTP / 2 node or HTTP / peer described herein). In some embodiments, the function(s) are implemented in software that is stored, e.g., in the memory 1706 and executed by the one or more processors 1704.

[0002] Figure 18 is a schematic block diagram that illustrates a virtualized embodiment of the network node 1700 according to some embodiments of the present disclosure. Again, optional features are represented by dashed boxes. As used herein, a “virtualized” network node is an implementation of the network node 1700 in which at least a portion of the functionality of the network node 1700 is implemented as a virtual component(s) (e.g., via a virtual machine(s) executing on a physical processing node(s) in a network(s)). As illustrated, in this example, if the network node 1700 is a radio access node, the network node 1700 may include the control system 1702 and / or the one or more radio units 1710, as described above. The control system 1702 may be connected to the radio unit(s) 1710 via, for example, an optical cable or the like. The network node 1700 includes one or more processing nodes 1800 coupled to or included as part of a network(s) 1802. If present, the control system 1702 or the radio unit(s) are connected to the processing node(s) 1800 via the network 1802. Each processing node 1800 includes one or more processors 1804 (e.g., CPUs, ASICs, FPGAs, and / or the like), memory 1806, and a network interface 1808.

[0003] In this example, functions 1810 of the network node 1700 described herein (e.g., one or more functions of a HTTP / 2 node or HTTP / 2 peer described herein) are implemented at the one or more processing nodes 1800 or distributed across the one or more processing nodes 1800 and the control system 1702 and / or the radio unit(s) 1710 in any desired manner. In some particular embodiments, some or all of the functions 1810 of the network node 1700 described herein are implemented as virtual components executed by one or more virtual machines implemented in a virtual environment(s) hosted by the processing node(s) 1800. As will be appreciated by one of ordinary skill in the art, additional signaling or communication between the processing node(s) 1800 and the control system 1702 is used in order to carry out at least some of the desired functions 1810. Notably, in some embodiments, the control system 1702 may not be included, in which case the radio unit(s) 1710 communicate directly with the processing node(s) 1800 via an appropriate network interface(s).

[0004] In some embodiments, a computer program including instructions which, when executed by at least one processor, causes the at least one processor to carry out the functionality of the network node 1700 or a node (e.g., a processing node 1800) implementing one or more of the functions 1810 of the network node 1700 in a virtual environment according to any of the embodiments described herein is provided. In some embodiments, a carrier comprising theaforementioned computer program product is provided. The carrier is one of an electronic signal, an optical signal, a radio signal, or a computer readable storage medium (e.g., a non-transitory computer readable medium such as memory).

[0005] Figure 19 is a schematic block diagram of the network node 1700 according to some other embodiments of the present disclosure. The network node 1700 includes one or more modules 1900, each of which is implemented in software. The module(s) 1900 provide the functionality of the network node 1700 described herein. This discussion is equally applicable to the processing node 1800 of Figure 18 where the modules 1900 may be implemented at one of the processing nodes 1800 or distributed across multiple processing nodes 1800 and / or distributed across the processing node(s) 1800 and the control system 1702.

[0196] Any appropriate steps, methods, features, functions, or benefits disclosed herein may be performed through one or more functional units or modules of one or more virtual apparatuses. Each virtual apparatus may comprise a number of these functional units. These functional units may be implemented via processing circuitry, which may include one or more microprocessor or microcontrollers, as well as other digital hardware, which may include Digital Signal Processors (DSPs), special-purpose digital logic, and the like. The processing circuitry may be configured to execute program code stored in memory, which may include one or several types of memory such as Read Only Memory (ROM), Random Access Memory (RAM), cache memory, flash memory devices, optical storage devices, etc. Program code stored in memory includes program instructions for executing one or more telecommunications and / or data communications protocols as well as instructions for carrying out one or more of the techniques described herein. In some implementations, the processing circuitry may be used to cause the respective functional unit to perform corresponding functions according to one or more embodiments of the present disclosure.

[0197] While processes in the figures may show a particular order of operations performed by certain embodiments of the present disclosure, it should be understood that such order is exemplary (e.g., alternative embodiments may perform the operations in a different order, combine certain operations, overlap certain operations, etc.).

[0198] Those skilled in the art will recognize improvements and modifications to the embodiments of the present disclosure. All such improvements and modifications are considered within the scope of the concepts disclosed herein.

Claims

Claims1. A method performed by a first Hyper-Text Transfer Protocol Version 2, HTTP / 2, node (1000), the method comprising: establishing (1004) a Transport Control Protocol, TCP, connection with a second HTTP / 2 node (1002); receiving (1008), from the second HTTP / 2 node (1002), a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a first value; transmitting (1014) data to the second HTTP / 2 node (1002) over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter; and while the TCP connection is established, sending (1016), to the second HTTP / 2 node (1002), an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a second value that is different than the first value.

2. The method of claim 1, further comprising, while the TCP connection is established: receiving (1020), from the second HTTP / 2 node (1002), a second settings frame responsive to the update frame, wherein the second settings frame sets the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to the second value.

3. The method of claim 1, further comprising, while the TCP connection is established: receiving (1020), from the second HTTP / 2 node (1002), a second settings frame responsive to the update frame, wherein the second settings frame sets the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a third value that is different than both the first value and the second value.

4. The method of claim 2 or 3, further comprising, after sending (1016) the update frame but prior to receiving (1020) the second settings frame, receiving (1018) a second update frame from the second HTTP / 2 node (1002) that acknowledges the update frame.

5. The method of claim 4, wherein the third value is in a range of values between the first value and the second value.

6. The method of claim 4 or 5, wherein the second update frame accepts the request to change the value of the SETTINGS J AX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection.

7. The method of claim 1, further comprising receiving (1018) a second update frame from the second HTTP / 2 node (1002) that rejects the request to change the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection.

8. The method of any of claims 1 to 7, wherein the second value is greater than the first value.

9. The method of any of claims 1 to 7, wherein the second value is less than the first value.

10. The method of any of claims 1 to 9, wherein the first HTTP / 2 node (1000) is a first network node in a core network of a cellular communications system, and the second HTTP / 2 node (1002) is a second network node in the core network of the cellular communications system.

11. The method of claim 10, further comprising: receiving (1015) load control information from the second network node; and deciding (1015), based on the load control information received from the second network node, to request an increase in the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection;wherein sending (1016) the update frame comprises sending (1016) the update frame to the second network node responsive to deciding (1015) to request an increase in the value of the SETTINGS J AX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection.

12. A first Hyper-Text Transfer Protocol Version 2, HTTP / 2, node (1000) adapted to: establish (1004) a Transport Control Protocol, TCP, connection with a second HTTP / 2 node (1002); receive (1008), from the second HTTP / 2 node (1002), a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a first value; transmit (1014) data to the second HTTP / 2 node (1002) over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS J AX_CONCURRENT_STREAMS parameter; and while the TCP connection is established, send (1016), to the second HTTP / 2 node (1002), an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a second value that is different than the first value.

13. The first HTTP / 2 node (1000) of claim 12 further adapted to perform the method of any of claims 2 to 11.

14. A first Hyper-Text Transfer Protocol Version 2, HTTP / 2, node (1000; 1700) comprising: a network interface (1708); and processing circuitry (1704) associated with the network interface (1708), the processing circuitry (1704) configured to cause the first HTTP / 2 node (1000; 1700) to: establish (1004) a Transport Control Protocol, TCP, connection with a secondHTTP / 2 node (1002); receive (1008), from the second HTTP / 2 node (1002), a settings frame that sets a value of a SETTINGS JVIAX_CONCURRENT_STREAMS parameter that defines amaximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a first value; transmit (1014) data to the second HTTP / 2 node (1002) over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter; and while the TCP connection is established, send (1016), to the second HTTP / 2 node (1002), an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a second value that is different than the first value.

15. The first HTTP / 2 node (1000) of claim 14 wherein the processing circuitry (1704) is further configured to cause the first HTTP / 2 node (1000; 1700) to perform the method of any of claims 2 to 11.

16. A computer program comprising instructions which, when executed on at least one processor, cause the at least one processor to carry out the method according to any of claims 1 to 11.

17. A carrier containing the computer program of claim 16, wherein the carrier is one of an electronic signal, an optical signal, a radio signal, or a computer readable storage medium.

18. A non-transitory computer readable medium storing instructions executable by processing circuitry of a first Hyper-Text Transfer Protocol Version 2, HTTP / 2, node (1000) whereby the first HTTP / 2 node (1000) is operable to: establish (1004) a Transport Control Protocol, TCP, connection with a second HTTP / 2 node (1002); receive (1008), from the second HTTP / 2 node (1002), a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a first value;transmit (1014) data to the second HTTP / 2 node (1002) over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter; and while the TCP connection is established, send (1016), to the second HTTP / 2 node (1002), an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a second value that is different than the first value.

19. A method performed by a second Hyper-Text Transfer Protocol Version 2, HTTP / 2, node (1002), the method comprising: establishing (1004) a Transport Control Protocol, TCP, connection with a first HTTP / 2 node (1000); sending (1008), to the first HTTP / 2 node (1000), a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a first value; receiving (1014) data from the first HTTP / 2 node (1000) over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS J AX_CONCURRENT_STREAMS parameter; and while the TCP connection is established, receiving (1016), from the first HTTP / 2 node (1000), an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a second value that is different than the first value.

20. The method of claim 19, further comprising, while the TCP connection is established: sending (1020), to the first HTTP / 2 node (1000), a second settings frame responsive to the update frame, wherein the second settings frame sets the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to the second value.

21. The method of claim 19, further comprising, while the TCP connection is established:sending (1020), to the first HTTP / 2 node (1000), a second settings frame responsive to the update frame, wherein the second settings frame sets the value of the SETTINGS J AX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a third value that is different than both the first value and the second value.

22. The method of claim 20 or 21, further comprising, after receiving (1016) the update frame but prior to sending (1020) the second settings frame, sending (1018) a second update frame from the second HTTP / 2 node (1002) that acknowledges the update frame.

23. The method of claim 22, wherein the third value is in a range of values between the first value and the second value.

24. The method of claim 22 or 23, wherein the second update frame accepts the request to change the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection.

25. The method of claim 19, further comprising sending (1018) a second update frame to the first HTTP / 2 node (1000) that rejects the request to change the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection.

26. The method of any of claims 19 to 25, wherein the second value is greater than the first value.

27. The method of any of claims 19 to 25, wherein the second value is less than the first value.

28. The method of any of claims 19 to 27, wherein the first HTTP / 2 node (1000) is a first network node in a core network of a cellular communications system, and the second HTTP / 2node (1002) is a second network node in the core network of the cellular communications system.

29. The method of claim 28, further comprising sending (1015) load control information to the first network node.

30. A second Hyper-Text Transfer Protocol Version 2, HTTP / 2, node (1002) adapted to: establish (1004) a Transport Control Protocol, TCP, connection with a first HTTP / 2 node(1000); send (1008), to the first HTTP / 2 node (1000), a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a first value; receive (1014) data from the first HTTP / 2 node (1000) over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter; and while the TCP connection is established, receive (1016), from the first HTTP / 2 node (1000), an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a second value that is different than the first value.

31. The second HTTP / 2 node (1002) of claim 30 further adapted to perform the method of any of claims 20 to 29.

32. A second Hyper-Text Transfer Protocol Version 2, HTTP / 2, node (1002; 1700) comprising: a network interface (1708); and processing circuitry (1704) associated with the network interface (1708), the processing circuitry (1704) configured to cause the second HTTP / 2 node (1002; 1700) to: establish (1004) a Transport Control Protocol, TCP, connection with a first HTTP / 2 node (1000); send (1008), to the first HTTP / 2 node (1000), a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximumnumber of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a first value; receive (1014) data from the first HTTP / 2 node (1000) over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter; and while the TCP connection is established, receive (1016), from the first HTTP / 2 node (1000), an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a second value that is different than the first value.

33. The second HTTP / 2 node (1002) of claim 32 further adapted to perform the method of any of claims 20 to 29.

34. A computer program comprising instructions which, when executed on at least one processor, cause the at least one processor to carry out the method according to any of claims 19 to 29.

35. A carrier containing the computer program of claim 34, wherein the carrier is one of an electronic signal, an optical signal, a radio signal, or a computer readable storage medium.

36. A non-transitory computer readable medium storing instructions executable by processing circuitry of a second Hyper-Text Transfer Protocol Version 2, HTTP / 2, node (1002) whereby the second HTTP / 2 node (1002) is operable to: establish (1004) a Transport Control Protocol, TCP, connection with a first HTTP / 2 node (1000); send (1008), to the first HTTP / 2 node (1000), a settings frame that sets a value of a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a first value; receive (1014) data from the first HTTP / 2 node (1000) over the TCP connection using a number, N, of streams, wherein N is less than or equal to the first value for the SETTINGS JVIAX_CONCURRENT_STREAMS parameter; andwhile the TCP connection is established, receive (1016), from the first HTTP / 2 node (1000), an update frame that requests a change of the value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the first HTTP / 2 node (1000) to the second HTTP / 2 node (1002) on the TCP connection to a second value that is different than the first value.

37. A method performed by a Hyper-Text Transfer Protocol Version 2, HTTP / 2, node, the method comprising: establishing (1200) a Transport Control Protocol, TCP, connection with a peer HTTP / 2 node; and while the TCP connection is established: determining (1206-1220; 1224-1238) a new value for aSETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection, based on any one or more of the following: current available resources at the HTTP / 2 node, predicted future available resources at the HTTP / 2 node, current priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node, and predicted priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node; and sending (1222), to the peer HTTP / 2 node, a settings frame that sets a value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection to the new value.

38. The method of claim 37, wherein the current available resources at the HTTP / 2 node comprise any one or more of the following: a current amount of available processing resources, a current amount of available memory resources, a current number of available processing threads, and an amount of resources currently estimated to be consumed by one or more peer HTTP / 2 nodes.

39. The method of claim 37 or 38, further comprising detecting a triggering condition for determining (1206-1220; 1224-1238) the new value for the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection and sending (1222) the settings frame that sets the value of theSETTINGS J AX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection to the new value.

40. The method of claim 39, wherein the triggering condition comprises: establishment of a new HTTP / 2 connection; closing one or more existing HTTP / 2 connections; a periodic triggering condition based on a configuration of the HTTP / 2 node; a triggering condition associated to a network or HTTP / 2 node self-healing procedure; or a management request.

41. A Hyper-Text Transfer Protocol Version 2, HTTP / 2, node adapted to: establish (1200) a Transport Control Protocol, TCP, connection with a peer HTTP / 2 node; and while the TCP connection is established: determine (1206-1220; 1224-1238) a new value for aSETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection, based on any one or more of the following: current available resources at the HTTP / 2 node, predicted future available resources at the HTTP / 2 node, current priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node, and predicted priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node; and send (1222), to the peer HTTP / 2 node, a settings frame that sets a value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection to the new value.

42. The HTTP / 2 node of claim 41 further adapted to perform the method of any of claims 38 to 40.

43. A Hyper-Text Transfer Protocol Version 2, HTTP / 2, node (1700) adapted to: a network interface (1708); and processing circuitry (1704) associated with the network interface (1708), the processing circuitry (1704) configured to cause the HTTP / 2 node (1700) to:establish (1200) a Transport Control Protocol, TCP, connection with a peer HTTP / 2 node; and while the TCP connection is established: determine (1206-1220; 1224-1238) a new value for a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection, based on any one or more of the following: current available resources at the HTTP / 2 node, predicted future available resources at the HTTP / 2 node, current priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node, and predicted priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node; and send (1222), to the peer HTTP / 2 node, a settings frame that sets a value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection to the new value.

44. The HTTP / 2 node of claim 43 further adapted to perform the method of any of claims 38 to 40.

45. A computer program comprising instructions which, when executed on at least one processor, cause the at least one processor to carry out the method according to any of claims 37 to 40.

46. A carrier containing the computer program of claim 45, wherein the carrier is one of an electronic signal, an optical signal, a radio signal, or a computer readable storage medium.

47. A non-transitory computer readable medium storing instructions executable by processing circuitry of a Hyper-Text Transfer Protocol Version 2, HTTP / 2, node, whereby the HTTP / 2 node is operable to: establish (1200) a Transport Control Protocol, TCP, connection with a peer HTTP / 2 node; and while the TCP connection is established: determine (1206-1220; 1224-1238) a new value for a SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines a maximumnumber of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection, based on any one or more of the following: current available resources at the HTTP / 2 node, predicted future available resources at the HTTP / 2 node, current priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node, and predicted priorities of one or more peer HTTP / 2 nodes of the HTTP / 2 node; and send (1222), to the peer HTTP / 2 node, a settings frame that sets a value of the SETTINGS_MAX_CONCURRENT_STREAMS parameter that defines the maximum number of streams that can be transmitted from the peer HTTP / 2 node to the HTTP / 2 node on the TCP connection to the new value.

Images