Disabling user plane encryption and / or integrity protection for mpquic traffic

Abstract

In accordance with example embodiments of the invention there is at least a method and apparatus to perform establishing via an access network associated with a user equipment in a communication network, a packet data unit session for data transmission over the access network comprising the apparatus is caused to: based on information from a policy and charging control rule function to a session management function, the session management function creates rules comprising rules to identify the traffic transmitted over the packet data unit session indicating that the transmitted traffic is at least one of encrypted or integrity protected; wherein the information from a policy and charging control rule indicates that traffic encryption on the user plane can be omitted for the packet data unit session, and wherein the traffic is identified by an application ID or IP 5-tuple; based on the identifying, communicating between the session management function and the access network to cause disabling of at least one of user plane encryption or integrity protection for the traffic transmitted via the packet data unit session.

Description

DISABLING USER PLANE ENCRYPTION AND / OR INTEGRITY PROTECTIONFOR MPQUIC TRAFFICTECHNICAL FIELD:

[0001] The teachings in accordance with the exemplary embodiments of this invention relate generally to addressing double encryption by disabling the encryption at the UP layer for that PDU session or disable encryption at the UP layer and, more specifically, relate to addressing double encryption by disabling the encryption at the UP layer for that PDU session or disable encryption at the UP layer between UE and N3IWF in case of untrusted non-3GPP access that is relevant for the MPQUIC connection.BACKGROUND:

[0002] This section is intended to provide a background or context to the invention that is recited in the claims. The description herein may include concepts that could be pursued, but are not necessarily ones that have been previously conceived or pursued. Therefore, unless otherwise indicated herein, what is described in this section is not prior art to the description and claims in this application and is not admitted to be prior art by inclusion in this section.

[0003] Certain abbreviations that may be found in the description and / or in the Figures are herewith defined as follows:3GPP 3rdGeneration Partnership ProgramAMF Access and Mobility Management FunctionATSSS Access Traffic Steering, Switching and SplittingATSSS-LL ATSSS Lower LayerCP Control PlaneDRB Data Radio Bearer gNB gNodeBIETF Internet Engineering Task ForceIP Internet ProtocolIPSec IP SecurityMA PDU Multi-Access Packet Data UnitMPQUIC Multipath QUICMPTCP Multipath TCPN3IWF Non-3GPP Interworking FunctionNDS Network Domain SecurityNR New RadioPDU Packet Data UnitPSA PDU Session AnchorQUIC Protocol name, not an abbreviationRAN Radio Access NetworkRRC Radio Resource ControlSMF Session Management FunctionTCP Transmission Control ProtocolUDP User Datagram ProtocolUE User EquipmentUP User PlaneUPF User Plane Function

[0004] SA2 has defined the use of Multipath QUIC between the UE and the UPF as a new ATSSS steering function. In this definition, the ATSSS uses one 3GPP access over NR and one non-3GPP access over untrusted or trusted non-3GPP access to steer the traffic.

[0005] Example embodiments of this invention proposes improved operations for Multipath QUIC.SUMMARY:

[0006] This section contains examples of possible implementations and is not meant to be limiting.

[0007] In another example aspect of the invention, there is an apparatus, such as a user equipment side apparatus, comprising: at least one processor; and at least one non-transitorymemory storing instructions, that when executed by the at least one processor, cause the apparatus at least to: establish via an access network associated with a user equipment in a communication network, a packet data unit session for data transmission over the access network comprising the apparatus is caused to: based on information from a policy and charging control rule function to a session management function, the session management function creates rules comprising rules to identify the traffic transmitted over the packet data unit session indicating that the transmitted traffic is at least one of encrypted and / or integrity protected; wherein the information from a policy and charging control rule indicates that traffic encryption on the user plane can be omitted for the packet data unit session, and wherein the traffic is identified by an application ID or IP 5-tuple; and based on the identifying, communicate between the session management function and the access network to cause disabling of at least one of user plane encryption and / or integrity protection for the traffic transmitted via the packet data unit session.

[0008] In still another example aspect of the invention, there is a method, comprising: establishing via an access network associated with a user equipment in a communication network, a packet data unit session for data transmission over the access network comprising: based on information from a policy and charging control rule function to a session management function, the session management function creates rules comprising rules to identify the traffic transmitted over the packet data unit session indicating that the transmitted traffic is at least one of encrypted and / or integrity protected; wherein the information from a policy and charging control rule indicates that traffic encryption on the user plane can be omitted for the packet data unit session, and wherein the traffic is identified by an application ID or IP 5-tuple; and based on the identifying, communicating between the session management function and the access network to cause disabling of at least one of user plane encryption or integrity protection for the traffic transmitted via the packet data unit session.

[0009] A further example embodiment is an apparatus and a method comprising the apparatus and the method of the previous paragraphs, wherein the access traffic steering, switching, and splitting rules and N4 rules are indicating that multipath QUIC without user plane encryption is preferred steering function for certain service data flows identified by an application ID, IP 5-tuple or by other means, wherein the access traffic steering, switching, and splitting rules and N4 rules are indicating that multipath QUIC is used as traffic steering function for uplink and download traffic, wherein there is sending towards the user equipmentan indication to disable at least one of user plane encryption or integrity protection for the connection used to transmit the identified traffic, wherein there is creating at least one separate tunnel between the user equipment and a core network without encryption or integrity protection, wherein the session management function requests from a non-3GPP interworking function to disable encryption and integrity protection for at least one separate tunnel between the non-3GPP interworking function and the user equipment, wherein there is reusing a tunnel without encryption or integrity protection to transmit traffic that is identified to be encrypted, use a backhaul to inform a radio access network and user plane function to disable at least one of encryption and / or integrity protection for the IPsec tunnel between radio access network and a core network, or alternatively to offload traffic to a non-protected IP connection, wherein there is using a backhaul network between a radio access network and a core network, where traffic is transmitted via tunnels; and instructing the radio access network and the core network to disable the encryption and integrity protection for the tunnels, or offload the traffic to a nonprotected IP connection, wherein the packet data unit session is established via a 3GPP or non- 3GPP access network, wherein the packet data unit session can be a multi-access packet data unit session, wherein the rules are part of multi-access rules and access traffic steering, switching, and splitting rules, wherein the identified traffic is encrypted using transport layer security, wherein the identified traffic is transmitted over the QUIC transport layer, and / or wherein the identified traffic is transmitted over multiple accesses using multipath QUIC transport layer.

[0010] A non-transitory computer-readable medium storing program code, the program code executed by at least one processor to perform at least the method as described in the paragraphs above.

[0011] In yet another example aspect of the invention, there is an apparatus comprising: means for establishing via an access network associated with a user equipment in a communication network, a packet data unit session for data transmission over the access network comprising: based on information from a policy and charging control rule function to a session management function, the session management function creates rules comprising means for rules to identify the traffic transmitted over the packet data unit session indicating that the transmitted traffic is at least one of encrypted or integrity protected; wherein the information from a policy and charging control rule indicates that traffic encryption on the userplane can be omitted for the packet data unit session, and wherein the traffic is identified by an application ID or IP 5-tuple; and means based on the identifying, for communicating between the session management function and the access network to cause disabling of at least one of user plane encryption and / or integrity protection for the traffic transmitted via the packet data unit session.

[0012] In accordance with the example embodiments as described in the paragraph above, at least the means for establishing, creating, identifying, and communicating comprises a network interface, and computer program code stored on a computer-readable medium and executed by at least one processor.

[0013] A communication system comprising a network side apparatus and a user equipment side apparatus embodying the apparatus above performing operations as described above.BRIEF DESCRIPTION OF THE DRAWINGS:

[0014] The above and other aspects, features, and benefits of various embodiments of the present disclosure will become more fully apparent from the following detailed description with reference to the accompanying drawings, in which like reference signs are used to designate like or equivalent elements. The drawings are illustrated for facilitating better understanding of the embodiments of the disclosure and are not necessarily drawn to scale, in which:

[0015] FIG. 1 shows aspects of user plane security between a control plane and a user plane;

[0016] FIG. 2 shows communication between a UE and a gNB or ng-eNB of a security policy for a PDU session;

[0017] FIG. 3 shows a signalling approach for creation of a multipath QUIC connection identifying operations performed in accordance with example embodiments of the invention;

[0018] FIG. 4 shows a high level block diagram of various devices used in carrying out various aspects of the invention; and

[0019] FIG. 5 shows a method in accordance with example embodiments of the invention which may be performed by an apparatus.DETAILED DESCRIPTION:

[0020] In example embodiments of this invention there is proposed at least a method and apparatus for addressing double encryption by disabling the encryption at the UP layer for that PDU session or disable encryption at the UP layer between UE and N3IWF in case of untrusted non-3GPP access that is relevant for the MPQUIC connection.

[0021] SA2 has defined the use of Multipath QUIC between the UE and the UPF as a new ATSSS steering function in standards at the time of this application. Up to these standards ATSSS uses one 3GPP access over NR and one non-3GPP access over untrusted or trusted non-3GPP access to steer the traffic.

[0022] A main concept of ATSSS is the notion of Multi Access (MA) PDU Sessions, which are PDU Sessions for which data traffic can be sent over the two concurrent accesses. MP-QUIC extends QUIC to enable the simultaneous use of multiple paths for a single connection. QUIC requires according to standards the mandatory usage of TLS 1.3 with encryption.

[0023] This mandatory requirement is reasonable for the intended use of QUIC in the normal client - application server environment in the Internet. In the SA2 discussion, the double encryption on QUIC layer and on the access layer was seen as putting unnecessary computational burden in the UPF and there was a desire to have an optional encryption / integrity protection / authentication on QUIC layer in case access layer security is used.

[0024] Standards at the time of this application captured that security optimizations that can improve the user-plane performance are studied to identify whether the encryption in the QUIC layer can be omitted.

[0025] This above mentioned SA3 SID intends to study if encryption / integrity protection / authentication of QUIC between UE and UPF can be omitted, and to study the mechanisms to do so for MPQUIC for ATSSS.

[0026] The outcome should be applicable also for applications other than QUIC and incorporate feedback from IETF.

[0027] However, disabling encryption at the QUIC layer is currently not feasible without a major modification of the protocol, thus it would require a solution defined and accepted in IETF. Another approach to solve this issue of double encryption could be to disable the encryption at the UP layer for that MA PDU session that uses the MPQUIC connection. In the same way it should be possible to disable encryption at the UP layer between UE and N3IWF in case of untrusted non-3GPP access.

[0028] However, to disable UP layer security as per the creation of the MPQUIC connection is complicated as it will require changes in the signaling. It is noted that example embodiments of the invention address this requirement.

[0029] FIG. 1 shows aspects of user plane security between a control plane and a user plane;

[0030] It is noted that during the operations as shown in FIG. 1 :• an SMF shall provide UP security policy for a PDU session to the RAN during the PDU session establishment procedure, as specified in standards at the time of this application;• the UP security policy shall indicate whether UP confidentiality and / orUP;• integrity protection shall be activated or not for all DRBs allocated to that PDU session. The UP security policy shall be used to activate UP confidentiality and / or UP integrity for all DRBs belonging to the PDU session;• if the RAN cannot activate UP confidentiality and / or UP integrity protection when the received UP security policy is "Required", the RAN shall reject establishment of UP resources for the PDU Session and indicate rejectcause to the SMF; and• if the received UP security policy is "Not needed ", then the establishment of the PDU Session shall proceed as described in standards at the time of this application. Only if the UE indicates that it supports use of integrity protection, RAN can activate UP integrity protection.

[0031] FIG. 2 shows communication between a UE and a gNB or ng-eNB of a security policy for a PDU session;

[0032] As shown in step la of FIG.2 the gNB or ng-eNB determines a precondition: RRC security is activated, i.e., RRC ciphering and RRC integrity protection are activated; then as shown in step lb of FIG. 2 there is communicated between the gNB or ng-eNB and the UE RRC Connection Reconfiguration (UP integrity indication, UP ciphering indication for each DRB); then as shown in step 1c of FIG. 2 the gNB or ng-eNB determines for each DRB, if UP integrity is activated, starts uplink UP integrity verification and downlink UP integrity protection, and for each DRB, if UP ciphering is activated. Start uplink UP deciphering and downlink UP ciphering. Then as shown in step 2a of FIG. 2 the UE is verifying RRC Connection Reconfiguration integrity, and if successful, for each DRB, if UP integrity is activated, start uplink UP integrity protection and downlink UP integrity verification; for each DRB, if UP ciphering is activated, start uplink UP ciphering and downlink UP deciphering, and send RRC Connection Configuration Complete. Then as shown in step 2b of FIG. 2 there is communicating between the UE and the gNB or ng-eNB an RRC Connection Reconfiguration Complete message.

[0033] As defined in standards at the time of this application, there is a requirement to avoid (if feasible) the double encryption created by the 3GPP defined UP confidentiality protection and QUIC as transport protocol for the PDU session between the UE and the UPF acting as PSA (PDU session anchor).

[0034] However, Disabling encryption at the QUIC layer does not seem a feasible approach, since it would require an IETF defined solution, with a significant impact in the design of the protocol.

[0035] Another approach is to solve this double encryption by disabling the encryption at the UP layer for that PDU session that is relevant for the MPQUIC connection. In the same way it should be possible to disable encryption at the UP layer between UE and N3IWF in case of untrusted non-3GPP access. A problem is that this approach will require changes in the signaling. Example embodiments of the invention solve at least this problem.

[0036] Before describing the example embodiment of the invention as disclosed herein in detail, reference is made to FIG. 4 for illustrating a simplified block diagram of various electronic devices that are suitable for use in practicing the example embodiments of this invention.

[0037] FIG. 4 shows a block diagram of one possible and non-limiting exemplary system in which the example embodiment of the invention may be practiced. In FIG. 4, a user equipment (UE) 10 is in wireless communication with a wireless network 1 or network, 1 as in FIG. 4. The wireless network 1 or network 1 as in FIG. 4 can comprise a communication network such as a mobile network e.g., the mobile network 1 or first mobile network as disclosed herein. Any reference herein to a wireless network 1 as in FIG. 4 can be seen as a reference to any wireless network as disclosed herein. Further, the wireless network 1 as in FIG. 4 can also comprises hardwired features as may be required by a communication network. A UE is a wireless, typically mobile device that can access a wireless network. The UE, for example, may be a mobile phone (or called a "cellular" phone) and / or a computer with a mobile terminal function. For example, the UE or mobile terminal may also be a portable, pocket, handheld, computer-embedded or vehicle-mounted mobile device and performs a language signaling and / or data exchange with the RAN.

[0038] The UE 10 includes one or more processors DP 10A, one or more memories MEM 10B, and one or more transceivers TRANS 10D interconnected through one or more buses. Each of the one or more transceivers TRANS 10D includes a receiver and a transmitter. The one or more buses may be address, data, or control buses, and may include any interconnection mechanism, such as a series of lines on a motherboard or integrated circuit, fiber optics or other optical communication equipment, and the like. The one or more transceivers TRANS 10D which can be optionally connected to one or more antennas for communication to NN 12 and NN 13, respectively. The one or more memories MEM 10B include computer program code PROG 10C. The UE 10 communicates with NN 12 and / or NN 13 via a wireless link 11 or 16.

[0039] The NN 12 (NR / 5G Node B, an evolved NB, or LTE device) is a network node such as a master or secondary node base station (e.g., for NR or LTE long term evolution) that communicates with devices such as NN 13 and UE 10 of FIG. 4. The NN 12 provides access to wireless devices such as the UE 10 to the wireless network 1. The NN 12 includes one or more processors DP 12A, one or more memories MEM 12B, and one or more transceivers TRANS 12D interconnected through one or more buses. In accordance with the example embodiment of the invention these TRANS 12D can include X2 and / or Xn interfaces for use to perform the example embodiments. Each of the one or more transceivers TRANS 12D includes a receiver and a transmitter. The one or more transceivers TRANS 12D can be optionally connected to one or more antennas for communication over at least link 11 with the UE 10. The one or more memories MEM 12B and the computer program code PROG 12C are configured to cause, with the one or more processors DP 12 A, the NN 12 to perform one or more of the operations as described herein. The NN 12 may communicate with another gNB or eNB, or a device such as the NN 13 such as via link 16. Further, the link 11, link 16 and / or any other link may be wired or wireless or both and may implement, e.g., an X2 or Xn interface. Further the link 11 and / or link 16 may be through other network devices such as, but not limited to an NCE / MME / SGW / UDM / PCF / AMF / SMF / LMF 14 device as in FIG. 4. The NN 12 may perform functionalities of an MME (Mobility Management Entity) or SGW (Serving Gateway), such as a User Plane Functionality, and / or an Access Management functionality for LTE and similar functionality for 5G.

[0040] The NN 13 can be for WiFi or Bluetooth or other wireless device associated with a mobility function device such as an AMF or SMF, further the NN 13 may comprise a NR / 5G Node B or possibly an evolved NB a base station such as a master or secondary node base station (e.g., for NR or LTE long term evolution) that communicates with devices such as the NN 12 and / or UE 10 and / or the wireless network 1. The NN 13 includes one or more processors DP 13 A, one or more memories MEM 13B, one or more network interfaces, and one or more transceivers TRANS 13D interconnected through one or more buses. In accordance with the example embodiment of the invention these network interfaces of NN 13 can include X2 and / or Xn interfaces for use to perform the example embodiments. Each of the one or more transceivers TRANS 13D includes a receiver and a transmitter that can optionally be connected to one or more antennas. The one or more memories MEM 13B include computer program code PROG 13C. For instance, the one or more memories MEM 13B and the computer program code PROG 13C are configured to cause, with the one or more processors DP 13 A, the NN 13 to perform one or more of the operations as described herein. The NN 13 may communicate with another mobility function device and / or eNB such as the NN 12 and the UE 10 or any other device using, e.g., link 11 or link 16 or another link. The Link 16 as shown in FIG. 4 can be used for communication with the NN 12. These links maybe wired or wireless or both and may implement, e.g., an X2 or Xn interface. Further, as stated above the link 11 and / or link 16 may be through other network devices such as, but not limited to an NCE / MME / SGW device such as the NCE / MME / SGW / UDM / PCF / AMF / SMF / LMF 14 of FIG. 4.

[0041] The one or more buses of the device of FIG. 4 may be address, data, or control buses, and may include any interconnection mechanism, such as a series of lines on a motherboard or integrated circuit, fiber optics or other optical communication equipment, wireless channels, and the like. For example, the one or more transceivers TRANS 12D, TRANS 13D and / or TRANS 10D may be implemented as a remote radio head (RRH), with the other elements of the NN 12 being physically in a different location from the RRH, and these devices can include one or more buses that could be implemented in part as fiber optic cable to connect the other elements of the NN 12 to a RRH.

[0042] It is noted that although FIG. 4 shows a network nodes such as NN 12 and NN 13, any of these nodes may incorporate or be incorporated into an eNodeB or eNB or gNB such as for LTE and NR, and would still be configurable to perform example embodiments.

[0043] Also it is noted that description herein indicates that “cells” perform functions, but it should be clear that the gNB that forms the cell and / or a user equipment and / or mobility management function device that will perform the functions. In addition, the cell makes up part of a gNB, and there can be multiple cells per gNB.

[0044] The wireless network 1 or any network it can represent may or may not include a NCE / MME / SGW / UDM / PCF / AMF / SMF / LMF 14 that may include (NCE) network control element functionality, MME (Mobility Management Entity) / SGW (Serving Gateway) functionality, and / or serving gateway (SGW), and / or MME (Mobility Management Entity) and / or SGW (Serving Gateway) functionality, and / or user data management functionality (UDM), and / or PCF (Policy Control) functionality, and / or Access and Mobility Management Function (AMF) functionality, and / or Session Management (SMF) functionality, and / or Location Management Function (LMF), and / or Authentication Server (AUSF) functionality and which provides connectivity with a further network, such as a telephone network and / or a data communications network (e.g., the Internet), and which is configured to perform any 5G and / or NR operations in addition to or instead of other standard operations at the time of this application. The NCE / MME / SGW / UDM / PCF / AMF / SMF / LMF 14 is configurable to perform operations in accordance with example embodiments in any of an LTE, NR, 5G and / or any standards based communication technologies being performed or discussed at the time of this application. In addition, it is noted that the operations in accordance with example embodiments, as performed by the NN 12 and / or NN 13, may also be performed at the NCE / MME / SGW / UDM / PCF / AMF / SMF / LMF 14.

[0045] The NCE / MME / SGW / UDM / PCF / AMF / SMF / LMF 14 includes one or more processors DP 14A, one or more memories MEM 14B, and one or more network interfaces (N / W I / F(s)), interconnected through one or more buses coupled with the link 13 and / or link 16. In accordance with the example embodiments these network interfaces can include X2 and / or Xn interfaces for use to perform the example embodiments. The one or more memories MEM 14B include computer program code PROG 14C. The one or more memories MEM14Band the computer program code PROG 14C are configured to, with the one or more processors DP 14A, cause the NCE / MME / SGW / UDM / PCF / AMF / SMF / LMF 14 to perform one or more operations which may be needed to support the operations in accordance with the example embodiments.

[0046] It is noted that that the NN 12 and / or NN 13 and / or UE 10 can be configured (e.g. based on standards implementations etc.) to perform functionality of a Location Management Function (LMF). The LMF functionality may be embodied in any of these network devices or other devices associated with these devices. In addition, an LMF such as the LMF of the MME / SGW / UDM / PCF / AMF / SMF / LMF 14 of FIG. 4, as at least described below, can be co-located with UE 10 such as to be separate from the NN 12 and / or NN 13 of FIG. 4 for performing operations in accordance with example embodiment of the invention as disclosed herein.

[0047] The wireless Network 1 may implement network virtualization, which is the process of combining hardware and software network resources and network functionality into a single, software-based administrative entity, a virtual network. Network virtualization involves platform virtualization, often combined with resource virtualization. Network virtualization is categorized as either external, combining many networks, or parts of networks, into a virtual unit, or internal, providing network-like functionality to software containers on a single system. Note that the virtualized entities that result from the network virtualization are still implemented, at some level, using hardware such as processors DP 10, DP12A, DP 13 A, and / or DP14A and memories MEM 10B, MEM 12B, MEM 13B, and / or MEM 14B, and also such virtualized entities create technical effects.

[0048] The computer readable memories MEM 12B, MEM 13B, and MEM 14B may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor based memory devices, flash memory, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory. The computer readable memories MEM 12B, MEM 13B, and MEM 14B may be means for performing storage functions. The processors DP10, DP12A, DP13A, and DP14A may be of any type suitable to the local technical environment, and may include one or more of general purpose computers, special purpose computers, microprocessors, digitalsignal processors (DSPs) and processors based on a multi-core processor architecture, as nonlimiting examples. The processors DP10, DP12A, DP13A, and DP14A may be means for performing functions, such as controlling the UE 10, NN 12, NN 13, and other functions as described herein.

[0049] In general, various embodiments of any of these devices can include, but are not limited to, cellular telephones such as smart phones, tablets, personal digital assistants (PDAs) having wireless communication capabilities, portable computers having wireless communication capabilities, image capture devices such as digital cameras having wireless communication capabilities, gaming devices having wireless communication capabilities, music storage and playback appliances having wireless communication capabilities, Internet appliances permitting wireless Internet access and browsing, tablets with wireless communication capabilities, as well as portable units or terminals that incorporate combinations of such functions.

[0050] Further, the various embodiments of any of these devices can be used with a UE vehicle, a High Altitude Platform Station, or any other such type node associated with a terrestrial network or any drone type radio or a radio in aircraft or other airborne vehicle or a vessel that travels on water such as a boat.

[0051] As similarly stated above, to solve double encryption by disabling the encryption at the UP layer for that PDU session or disable encryption at the UP layer between UE and N3IWF in case of untrusted non-3GPP access that is relevant for the MPQUIC connection, but will require changes in the signaling. Example embodiments of the invention solve at least this problem.

[0052] Some main principles in accordance with example embodiments of the invention are underlined in the steps below:1. If double encryption on the UP layer for MA PDU sessions using MPQUIC as steering function shall be avoided, ATSSS rules (send to UE) and N4 rules (send to UPF) and NGAP N2 rules (send to gNB via AMF) for this MA PDU session can be created in a way that only MPQUIC steering function is used for all service data flows in UL andDL. This is to avoid that for some flows MPQUIC but for others MPTCP or ATSSS- LL are used which do not provide in-built encryption;2. If the UE indicates that it supports MPQUIC for any steering mode, the network (SMF) creates ATSSS and N4 rules for this MA PDU session only containing MPQUIC as steering function. This can be based on input from PCF. PCF provides PCC rules to SMF indicating that MPQUIC without UP encryption is preferred steering function for certain service data flows identified by application ID or IP 5-tuple. Based on traffic descriptor (s') containing e.g., application ID or IP 5-tuple it must be ensured that MPQUIC steering function can be applied to all the traffic carried over the MA PDU session. For example, in standards at the time of this application MPQUIC supports only UDP traffic, thus MA PDU session shall only be used for UDP traffic and MPQUIC as steering function;3. If the MA PDU session uses MPQUIC as the only steering function, core network can set UP security policy to “Not Needed”, thus indicating to RAN that UP integrity protection shall not apply for this MA PDU Session. RAN will then require the UE to disable UP encryption and / or integrity protection on the air interface. Network (SMF) can also add an indication to the MA PDU session establishment response that for this MA PDU session no UP encryption is applied;4. If untrusted non-3GPP access is used as second access path, SMF can instruct N3IWF and UE to disable encryption for the MA PDU session. However, this will disable the encryption on a UE level, so it can be used only if the UE uses only a MA PDU Session with MPQUIC but e.g., not in cases where the UE uses a MA PDU session and a normal PDU session that can carry any kind of traffic;5. Additionally, in the backhaul, the network also may ask RAN and UPF to disable the encryption / inte rity protection for the IPsec tunnel between RAN and core network, or alternatively to (simply) offload the traffic to a non-protected IP connection.

[0053] It must be noted that the proposed solution does also apply for any PDU session that carries only traffic using QUIC as transport protocol.

[0054] FIG. 3 shows a signalling approach for creation of a multipath QUIC connection identifying steps performed in accordance with example embodiments of the invention.

[0055] It is noted that in FIG. 3 the novel steps in accordance with example embodiments of the invention can be found in steps 2, 3, 4, 5, 6, 7, 8, 9, 10, and 11 of FIG. 3, as identified by an asterisk.

[0056] FIG. 3 shows communication of operations between a UE, gNB, UPF, AMF, and SMF.

[0057] It is noted that these UE, gNB, UPF, AMF, and SMF devices can comprise elements as shown in FIG. 4.

[0058] As shown in FIG. 3, between the UPF, AMF, and SMF is an N4 (NDS / IP). Also as shown in FIG. 3 there is between the gNB and the UPF an N3 (NDS / IP) IPSec. Then as shown in step 1 of FIG. 3 there is between the UE, the gNB, UPF, AMF, and / or SMF communication of MAPDU Session with MPQUIC is established in TS 23502 figure (4.3.2.2.1-1) and delta available in 4.22.2: step 1 to 10. Then in novel step 2 of FIG. 3 as identified with an asterisks there is at the SMF based on policy and PCC rules, creating TSSS and N4 rules for this multi-access packet data unit session only containing multipath QUIC as a steering function. In novel step 3 of FIG. 3, during Namf_CommunicationNlN2MessageTransfer communicated between the AMF and the gNB is indicated user plane encryption is not required, rest is similar to step 11 of 3GPP TS 23.502 figure (4.3.2.2.1-1). In novel step 4 of FIG. 3 during N2 message PDU session request communicated between the SMF and the AMF there is an indication that user plane encryption is not required, rest is similar to step 12 of TS 23.502 figure (4.3.2.2.1-1).. As shown in novel step 5 of FIG. 3 there is during an AN_specific Resource setup an indication that user plane encryption is not required, rest is similar to step 13 of TS 23.502 figure (4.3.2.2.1-1). As shown in FIG. 3 a PDU session is established between a UE, gNB, UPF, AMF, and SMF as shown in FIG. 3. Further, as shown in FIG. 3 there is between the UE and the gNB Disable encryption at PDCP layer. Thereafter, as shown in step 5.5 of FIG. 3 there is indicated by the gNB to the UE Opt2 5b RRC Connection Reconfig (UE encryption disable), and responding by the UE to the gNB of Opt2: 5c RRCCon Reconf Complete. As shown in novel step 6 of FIG. 3 there iscommunicated from the SMF with the UPF an N4 session modify request or other N4 request to offload traffic on non IPSec connection or IPSec tunnel without encryption (PDU session ID). In novel step 7 of FIG. 3 there is communicating between the SMF and the AMF an indication to disable gNB to UPF security. As shown in novel step 8 of FIG. 3 there is communicated between the AMF and the gNB an NGAP N2 message to disable gNB to UPF security for UE for the non-encrypted DRB. As shown in novel steps 9, 10, and 11 of FIG. 3 there is shown between the UPF and the gNB different options. As shown in novel step 9 of FIG. 3 there is shown option 1 to create separate IPSec tunnel without encryption or integrity protection and offload the traffic conveyed in MPQUIC. As shown in novel step 10 of FIG. 3 there is option 2 of reusing IPSec tunnel and deactivating encryption and / or integrity protection to offload the traffic conveyed in MPQUIC. Then as shown in novel step 11 of FIG. 3 there an option 3 to create a new IP connection that is not protected to offload the traffic conveyed in the MPQUIC.

[0059] To help understand example embodiments of the invention novel aspects herein are underlined.

[0060] In these examples it can be assumed that between gNB and UPF there is N3 (UP) connection and between UPF and SMF there are N4 (CP) connections. These connections are protected by NDS / IP (IPSec).

[0061] The following steps relate to operations as disclosed in FIG. 3 and includes underlined main principles in accordance with example embodiments of the invention:

[0062] Step 1 : UE triggers creation of MA PDU session using MPQUIC as steering function as defined in standards at the time of this application, step 1 to 10 (MA PDU Session aspect is defined in standards at the time of this application);

[0063] Step 2: If double encryption on the UP layer for MA PDU sessions using MPQUIC as steering function shall be avoided, ATSSS rules (send to UE) and N4 rules (send to UPF) for this MA PDU session can be created in a way that only MPQUIC steering function is used for all service data flows in UL and DL;

[0064] This is to avoid that for some flows MPQUIC but for others MPTCP or ATSSS- LL are used which do not provide in-built encryption.

[0065] Step 3: SMF sends Namf_CommunicationNlN2MessageTransfer message to AMF with indication that UP Encryption is not required and / or UP integrity protection is not required. Then gNB sends AN Specific Resource setup message with indication of UP encryption not required and / or UP integrity protection not required.

[0066] Steps 4, 5: AMF will send N2 message PDU Session req with flag UP encryption not required and / or UP integrity protection not required. Rest of the parameters are similar to standards at the time of this application.

[0067] Alternatively, network can use RRC connection reconnect request to disable the encryption or integrity protection of the PDU session.

[0068] Now, PDCP layer encryption and integrity protection will be disabled.

[0069] Disabling gNB and UPF encryption and integrity protection.

[0070] Step 6: SMF sends N4 message to UPF to offload traffic on non IPSecConnection, or IPSec tunnel without encryption for a specific PDU Session Id.

[0071] Step 7, 8: SMF also sends a message to AMF to inform RAN to disable the encryption and / or integrity protection on the gNB -UPF interface. AMF sends NGAP message to RAN.

[0072] Step 9: Qptl: Create separate IPSec tunnel without encryption or integrity protection, and offload the traffic conveyed in MPQUIC.

[0073] Step 10 Qpt2: reuse IPSec tunnel and deactivate encryption / integrity protection to offload the traffic conveyed in MPQUIC.

[0074] Step 11 Qpt3: Create a new IP connection (not protected) to offload the traffic conveyed in MPQUIC.

[0075] Further, it is noted that example embodiments of the invention can impact:UE: disable UP encryption and / or integrity protection triggered by RAN,RAN (gNB): disable UP encryption or integrity protection triggered by SMF,N3IWF : disable UP encryption or integrity protection triggered by SMF,SMF: trigger RAN to disable UP encryption or integrity protection, create ATSSS / N4 rules based on PCF input allowing only MPQUIC / QUIC traffic, andPCF : provide PCC rules to SMF indicating that MPQUIC without UP encryption or integrity protection is preferred steering function.

[0076] FIG. 5 shows a method in accordance with example embodiments of the invention which may be performed by an apparatus.

[0077] FIG. 5 illustrates operations which may be performed by a device such as, but not limited to, a device such as a network device (e.g., the NN 12 and / or NN 13 as in FIG. 4). As shown in block 510 of FIG. 5 there is establishing via an access network associated with a user equipment in a communication network, a packet data unit session for data transmission over the access network. As shown in block 520 of FIG. 5 there is based on information from a policy and charging control rule function to a session management function, the session management function creates rules comprising rules to identify the traffic transmitted over the packet data unit session indicating that the transmitted traffic is at least one of encrypted or integrity protected. As shown in block 530 of FIG. 5 wherein the information from a policy and charging control rule indicates that traffic encryption on the user plane can be omitted for the packet data unit session. As shown in block 540 of FIG. 5 wherein the traffic is identified by an application ID or IP 5-tuple. As shown in block 550 of FIG. 5 there is, based on the identifying, communicate between the session management function and the access network tocause disabling of at least one of user plane encryption or integrity protection for the traffic transmitted via the packet data unit session.

[0078] In accordance with the example embodiments as described in the paragraph above, wherein the access traffic steering, switching, and splitting rules and N4 rules are indicating that multipath QUIC without user plane encryption is preferred steering function for certain service data flows identified by an application ID, IP 5-tuple or by other means.

[0079] In accordance with the example embodiments as described in the paragraphs above, wherein the access traffic steering, switching, and splitting rules and N4 rules are indicating that multipath QUIC is used as traffic steering function for uplink and download traffic.

[0080] In accordance with the example embodiments as described in the paragraphs above, wherein there is sending towards the user equipment an indication to disable at least one of user plane encryption or integrity protection for the connection used to transmit the identified traffic.

[0081] In accordance with the example embodiments as described in the paragraphs above, wherein there is creating at least one separate tunnel between the user equipment and a core network without encryption or integrity protection.

[0082] In accordance with the example embodiments as described in the paragraphs above, wherein the session management function requests from a non-3GPP interworking function to disable encryption and integrity protection for at least one separate tunnel between the non-3GPP interworking function and the user equipment.

[0083] In accordance with the example embodiments as described in the paragraphs above, wherein there is reusing a tunnel without encryption or integrity protection to transmit traffic that is identified to be encrypted

[0084] In accordance with the example embodiments as described in the paragraphs above, wherein there is using a backhaul to inform a radio access network and user plane function to disable at least one of encryption and / or integrity protection for the IPsec tunnelbetween radio access network and a core network, or alternatively to offload traffic to a nonprotected Internet Protocol connection.

[0085] In accordance with the example embodiments as described in the paragraphs above, wherein there is using a backhaul network between a radio access network and a core network, where traffic is transmitted via tunnels; and instructing the radio access network and the core network to disable the encryption and integrity protection for the tunnels, or offload the traffic to a non-protected IP connection.

[0086] In accordance with the example embodiments as described in the paragraphs above, wherein the packet data unit session is established via a 3GPP or non-3GPP access network.

[0087] In accordance with the example embodiments as described in the paragraphs above, wherein the packet data unit session can be a multi-access packet data unit session.

[0088] In accordance with the example embodiments as described in the paragraphs above, wherein the rules are part of multi-access rules and access traffic steering, switching, and splitting rules, wherein the identified traffic is encrypted using transport layer security.

[0089] In accordance with the example embodiments as described in the paragraphs above, wherein the identified traffic is transmitted over the QUIC transport layer, and / or wherein the identified traffic is transmitted over multiple accesses using multipath QUIC transport layer.

[0090] A non-transitory computer-readable medium (MEM 12B and / or MEM 13B as in FIG. 4) storing program code (PROG 12C and / or PROG 13C as in FIG. 4), the program code executed by at least one processor (DP 12A and / or DP 13A as in FIG. 4) to perform the operations as at least described in the paragraphs above.

[0091] In accordance with an example embodiment of the invention as described above there is an apparatus comprising: means for establishing (TRANS 12D and / or TRANS 13D; MEM 12B and / or MEM 13B, PROG 12C and / or PROG 13C, and DP 12A and / or DP 13A as in FIG. 4) via an access network associated with a user equipment in a communication network, a packet data unit session for data transmission over the access network comprising: based oninformation from a policy and charging control rule function to a session management function, the session management function creates rules comprising means for rules (TRANS 12D and / or TRANS 13D; MEM 12B and / or MEM 13B, PROG 12C and / or PROG 13C, and DP 12A and / or DP 13A as in FIG. 4) to identify the traffic transmitted over the packet data unit session indicating that the transmitted traffic is at least one of encrypted or integrity protected; wherein the information from a policy and charging control rule function indicates that traffic encryption on the user plane can be omitted for the packet data unit session, and wherein the traffic is identified by an application ID or IP 5-tuple; and means, based on the identifying, for communicating (TRANS 12D and / or TRANS 13D; MEM 12B and / or MEM 13B, PROG 12C and / or PROG 13C, and DP 12A and / or DP 13A as in FIG. 4) between the session management function and the access network to cause disabling of at least one of user plane encryption and / or integrity protection for the traffic transmitted via the packet data unit session

[0092] In the example aspect of the invention according to the paragraph above, wherein at least the means for establishing, creating, identifying, and communicating comprises non-transitory computer-readable medium (MEM 12B and / or MEM 13B as in FIG. 4) storing program code (PROG 12C and / or PROG 13C as in FIG. 4), the program code executed by at least one processor (DP 12A and / or DP 13A as in FIG. 4).

[0093] Further, in accordance with example embodiments of the invention there is circuitry for performing operations in accordance with example embodiments of the invention as disclosed herein. This circuitry can include any type of circuitry including content coding circuitry, content decoding circuitry, processing circuitry, image generation circuitry, data analysis circuitry, etc.). Further, this circuitry can include discrete circuitry, applicationspecific integrated circuitry (ASIC), and / or field-programmable gate array circuitry (FPGA), etc. as well as a processor specifically configured by software to perform the respective function, or dual-core processors with software and corresponding digital signal processors, etc.). Additionally, there are provided necessary inputs to and outputs from the circuitry, the function performed by the circuitry and the interconnection (perhaps via the inputs and outputs) of the circuitry with other components that may include other circuitry in order to perform example embodiments of the invention as described herein.

[0094] In accordance with example embodiments of the invention as disclosed in this application this application, the “circuitry” provided can include at least one or more or all of the following:(a) hardware-only circuit implementations (such as implementations in only analog and / or digital circuitry);(b) combinations of hardware circuits and software, such as (as applicable):(i) a combination of analog and / or digital hardware circuit(s) with software / firmware; and(ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions, such as functions or operations in accordance with example embodiments of the invention as disclosed herein); and(c) hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation.”

[0095] In accordance with example embodiments of the invention, there is adequate circuitry for performing at least novel operations in accordance with example embodiments of the invention as disclosed in this application, this 'circuitry' as may be used herein refers to at least the following:(a) hardware-only circuit implementations (such as implementations in only analog and / or digital circuitry); and(b) to combinations of circuits and software (and / or firmware), such as (as applicable): (i) to a combination of processor(s) or (ii) to portions of processor(s) / software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions); and(c) to circuits, such as a microprocessor(s) or a portion of a microprocessor(s), that require software or firmware for operation, even if the software or firmware is not physically present.

[0096] This definition of 'circuitry' applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term "circuitry" would also cover an implementation of merely a processor (or multiple processors) or portion of a processor and its (or their) accompanying software and / or firmware. The term "circuitry" would also cover, for example and if applicable to the particular claim element, a baseband integrated circuit or applications processor integrated circuit for a mobile phone or a similar integrated circuit in a server, a cellular network device, or other network device.

[0097] In general, the various embodiments may be implemented in hardware or special purpose circuits, software, logic or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software which may be executed by a controller, microprocessor or other computing device, although the invention is not limited thereto. While various aspects of the invention may be illustrated and described as block diagrams, flow charts, or using some other pictorial representation, it is well understood that these blocks, apparatus, systems, techniques or methods described herein may be implemented in, as non-limiting examples, hardware, software, firmware, special purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof.

[0098] Embodiments of the inventions may be practiced in various components such as integrated circuit modules. The design of integrated circuits is by and large a highly automated process. Complex and powerful software tools are available for converting a logic level design into a semiconductor circuit design ready to be etched and formed on a semiconductor substrate.

[0099] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments. All of the embodiments described in this Detailed Description are exemplary embodiments provided to enable personsskilled in the art to make or use the invention and not to limit the scope of the invention which is defined by the claims.

[0100] The foregoing description has provided by way of exemplary and non-limiting examples a full and informative description of the best method and apparatus presently contemplated by the inventors for carrying out the invention. However, various modifications and adaptations may become apparent to those skilled in the relevant arts in view of the foregoing description, when read in conjunction with the accompanying drawings and the appended claims. However, all such and similar modifications of the teachings of example embodiments of this invention will still fall within the scope of this invention.

[0101] It should be noted that the terms "connected," "coupled," or any variant thereof, mean any connection or coupling, either direct or indirect, between two or more elements, and may encompass the presence of one or more intermediate elements between two elements that are "connected" or "coupled" together. The coupling or connection between the elements can be physical, logical, or a combination thereof. As employed herein two elements may be considered to be "connected" or "coupled" together by the use of one or more wires, cables and / or printed electrical connections, as well as by the use of electromagnetic energy, such as electromagnetic energy having wavelengths in the radio frequency region, the microwave region and the optical (both visible and invisible) region, as several non-limiting and non- exhaustive examples.

[0102] Furthermore, some of the features of the preferred embodiments of this invention could be used to advantage without the corresponding use of other features. As such, the foregoing description should be considered as merely illustrative of the principles of the invention, and not in limitation thereof.

Claims

Claims:

1. An apparatus, comprising: at least one processor; and at least one memory storing instructions, that when executed by the at least one processor, cause the apparatus at least to: establish via an access network associated with a user equipment in a communication network, a packet data unit session for data transmission over the access network; based on information from a policy and charging control rule function to a session management function, the session management function creates rules to identify the traffic transmitted over the packet data unit session indicating that the transmitted traffic is at least one of encrypted or integrity protected; wherein the information from a policy and charging control rule function indicates that traffic encryption and / or integrity protection on the user plane can be omitted for the packet data unit session, and wherein the traffic is identified by an application ID or IP 5 -tuple; and based on the identifying, communicate between the session management function and the access network to cause disabling of at least one of user plane encryption or integrity protection for the traffic transmitted via the packet data unit session.

2. The apparatus of claim 1, further caused to: send towards the user equipment an indication to disable at least one of user plane encryption or integrity protection for the connection used to transmit the identified traffic.

3. The apparatus of claim 1, further caused to: create at least one separate tunnel between the user equipment and a core network without encryption or integrity protection.

4. The apparatus of claim 1 , wherein the session management function requests from a non-3GPP interworking function to disable encryption and integrity protection for at least one separate tunnel between the non-3GPP interworking function and the user equipment.

5. The apparatus of claim 1, further caused to: reuse a tunnel without encryption or integrity protection to transmit traffic that is identified to be encrypted.

6. The apparatus of claim 1, further caused to: use a backhaul network between a radio access network and a core network, where traffic is transmitted via tunnels; instruct the radio access network and the core network to disable the encryption and integrity protection for the tunnels, or offload the traffic to a non-protected IP connection.

7. The apparatus of claim 1, wherein the rules are part of multi-access rules and access traffic steering, switching, and splitting rules.

8. The apparatus of claim 1, wherein the identified traffic is encrypted using transport layer security.

9. The apparatus of claim 1, wherein the identified traffic is transmitted over theQUIC transport layer.

10. The apparatus of claim 1, wherein the identified traffic is transmitted overmultiple accesses using multipath QUIC transport layer.

11. A method, comprising: establishing via an access network associated with a user equipment in a communication network, a packet data unit session for data transmission over the access network; based on information from a policy and charging control rule function to a session management function, the session management function creates rules to identify the traffic transmitted over the packet data unit session indicating that the transmitted traffic is at least one of encrypted or integrity protected; wherein the information from a policy and charging control rule function indicates that traffic encryption on the user plane can be omitted for the packet data unit session, and wherein the traffic is identified by an application ID or IP 5 -tuple; based on the identifying, communicating between the session management function and the access network to cause disabling of at least one of user plane encryption or integrity protection for the traffic transmitted via the packet data unit session.

12. The method of claim 11, further comprising: sending towards the user equipment an indication to disable at least one of user plane encryption or integrity protection for the connection used to transmit the identified traffic.

13. The method of claim 11, further comprising: creating at least one separate tunnel between the user equipment and a core network without encryption or integrity protection.

14. The method of claim 11, wherein the session management function requests from a non-3GPP interworking function to disable encryption and integrity protection for at least one separate tunnel between the non-3GPP interworking function and the user equipment.

15. The method of claim 11, further comprising: using a backhaul network between a radio access network and a core network, where traffic is transmitted via tunnels; and instructing the radio access network and the core network to disable the encryption and integrity protection for the tunnels, or offload the traffic to a non-protected IP connection.

16. The method of claim 11, wherein the rules are part of multi-access rules and access traffic steering, switching, and splitting rules.

17. The method of claim 11, wherein the identified traffic is encrypted using transport layer security.

18. The method of claim 11, wherein the identified traffic is transmitted over the QUIC transport layer.

19. The method of claim 11, wherein the identified traffic is transmitted over multiple accesses using multipath QUIC transport layer.

Images