Systems and methods for protocol data unit set identification

Abstract

Systems and methods for Protocol Data Unit (PDU) Set identification for end-to-end encrypted traffic, such as QUIC traffic between a User Equipment (UE) and Application Server (AS). Mechanisms can include one or more of: (i) additional path identification with corresponding Connection IDs (CIDs), such as for even and odd sets; (ii) sharing of key information for access to set sequence numbering; (iii) coalescing PDU set identification information in capsules with encrypted packet data for PDUs over encrypted channels; and / or (iv) elimination of capsule information for a PDU set in subsequent transmissions following initial transmissions in order to reduce signaling overhead.

Description

SYSTEMS AND METHODS FOR PROTOCOL DATA UNIT SET IDENTIFICATIONTECHNICAL FIELD

[0001] Disclosed are embodiments related to encrypted communications, and in particular, mechanisms for Protocol Data Unit (PDU) set identification of encrypted information, such as end-to-end (e2e) encrypted extended Reality and Media (XRM) over QUIC transported on a 5G network, utilizing Multiplexed Application Substrate over QUIC Encryption (MASQUE) protocols.BACKGROUND

[0002] 5G is the fifth generation of mobile communications, addressing a wide range of use cases. FIG. 1 illustrates a 5G reference architecture as defined by the 3rd Generation Partnership Project (3GPP), for instance, providing a policy and charging control framework. The system 100 of FIG. 1 includes an Application Function (AF), Network Exposure Function (NEF), Policy Control Function (PCF), Session Management Function (SMF), and User Plane Function (UPF). The AF can interact with the 3GPP Core Network, and in certain aspects, allow external parties to use the Exposure APIs offered by the network operator The NEF can support different functionalities, and in particular, support different Exposure APIs in some cases. The PCF supports a unified policy framework to govern the network behavior. Specifically, the PCF provides PCC (Policy and Charging Control) rules to the PCEF (Policy and Charging Enforcement Function), that is, the SMF / UPF that enforces policy and charging decisions according to provisioned PCC rules. In this example, the SMF supports different functionalities, for instance, the SMF receives PCC rules from the PCF and configures the UPF accordingly. The UPF supports handling of user plane traffic, including packet inspection, packet routing and forwarding, traffic usage reporting, QoS handling, etc.

[0003] QUIC is a User Datagram Protocol (UDP) based stream-multiplexed and secure transport protocol with integrity protected header and encrypted payload. Most of the QUIC header is further encrypted using a separate header protection mechanism, with a separately derived encryption key. Unlike the traditional transport protocol stack with Transmission Control Protocol (TCP), which typically resides in the operating system kernel, QUIC can be implemented in the user space, such as in the application layer. Therefore, this improves flexibility in terms of transport protocol evolution with implementation of new features, congestion control, deploy ability, and adoption. QUIC is standardized by the Internet Engineering Task Force (IETF), and is likely to become the main transport protocol in the Internet’s user plane. It is expected that most applications running today over HTTP / HTTPS will migrate to QUIC, driven by latency improvements and stronger security. Notably, compared to HTTPS, encryption in QUIC covers both the transport protocol headers as well as the payload, as opposed to Transport Layer Security (TLS) over TCP. As an example, HTTPS protects only the payload. Additionally, the IETF is specifying an extension to the QUIC protocol that enables the concurrent use of multiple parallel network paths (UDP 4-tuples) in a single QUIC connection. A multipath-enabled QUIC connection can use multiple connection IDs (CIDs), one or more per path, with each path having its own 5-tuple address and port values In certain aspects, the schedulingof data transmission on the paths need not be normatively defined, and can be adapted to an application’s needs and the paths' properties to meet transport goals.

[0004] Proxies can be used as intermediate entities, such as a node or device. For instance, one type of proxy can be an intermediary program acting as both server and client, creating or simply relaying requests on behalf of other entities. In this case, requests are serviced internally or by passing them on, with possible translation, to other servers. There are several types of proxies. A "transparent proxy” can refer to a proxy that does not modify the request or response beyond what is required for proxy authentication and identification. A “non-transparent proxy” can refer to a proxy that modifies the request or response to provide some added service to the user agent, such as group annotation services, media type transformation, protocol reduction, or anonymity filtering. A “reverse proxy” can refer to a proxy that, in effect, pretends to be the actual server (as far as any client or client proxy is concerned), but it passes on the request to the actual server that is usually sitting behind another layer of firewalls. A “Performance Enhancement Proxy” (PEP) can refer to a proxy that is used to improve the performance of protocols on network paths, for example, where native performance suffers due to characteristics of a link or subnetwork on the path.

[0005] Presently, IETF has a Working Group regarding Multiplexed Application Substrate over QUIC Encryption or “MASQUE,” aimed at developing mechanisms that allow configuring and concurrently running multiple proxied stream- and datagram-based flows inside an HTTPS connection. These mechanism(s) are collectively called MASQUE. The group has specified HTTP and / or HTTP / 3 extensions that enable this functionality. It is expected that through MASQUE: (i) applications can create a secure connection to an on-path network proxy; (ii) one can establish secure e2e connection to one or more servers via a proxy; (iii) application data is secured e2e and protected from unauthorized used in the network; and (iv) content providers and / or Mobile Network Operators will have a secure channel to exchange information about applications and policy in real-time.

[0006] There remains a need for systems and devices that can support PDU Set information identification for end- to-end encrypted communications, including with QUIC.SUMMARY

[0007] According to some embodiments, systems and methods are provided that enable MASQUE-based PDU Set identification for end-to-end encrypted traffic, such as QUIC traffic between a User Equipment (UE) and Application Server (AS). In some embodiments, the mechanisms can be optimized through one or more of: (i) PDU Set identification based on additional paths with corresponding CIDs, such as for even and odd sets; (ii) sharing of key information for access to set sequence numbering; (iii) coalescing PDU set identification information (e g., in capsules) with encrypted packet data for PDUs over encrypted channels; and / or (iv) elimination of capsule information for a PDU set in subsequent transmissions following initial transmissions in order to reduce signaling overhead and processing.

[0008] According to some embodiments, a method is provided that comprises establishing a secure tunnel for sending PDU set information; and sending encrypted first PDU set information via the secure tunnel. An apparatus may be configured to perform the method.

[0009] According to some embodiments a method is provided that comprises identifying packets received from a U E, where the packets are part of a QUIC connection establishment request with a target AS; sending a request to tunnel the UE’s connection to the target AS, where the request indicates communication of encrypted PDU set information on a secure tunnel; and receiving PDU set information from the target AS over the secure tunnel, where the PDU set information corresponds to encrypted PDUs received from the AS. An apparatus may be configured to perform the method

[0010] According to some embodiments, methods are provided that comprise establishing or configuring a secure tunnel connection; and sending or receiving first PDU set information coalesced with one or more initial PDUs via the secure tunnel connection. Subsequent PDUs may or may not include the PDU set information. An apparatus may be configured to perform the methods.

[0011] According to embodiments, a system is provided that can perform any of the steps of the methods, and that may comprise one or more of the apparatuses described above.

[0012] According to some embodiments, a computer program product may comprise a non-transitory computer readable medium storing instructions which when performed by processing circuitry of a device causes the device to perform any of the methods described herein.BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate various embodiments.

[0014] FIG. 1 illustrates a 5G system architecture.

[0015] FIG. 2 illustrates a system using a proxy

[0016] FIGs. 3A and FIG. 3B are signal flow diagrams illustrating processes according to embodiments.

[0017] FIGs. 4, 5, 6A, and 6B are flow charts illustrating processes according to embodiments.

[0018] FIGs. 7-12 illustrate networks, systems, and devices according to one or more embodiments.DESCRIPTION

[0019] There currently exist certain challenges.

[0020] For example, 3GPP TR 23.700-70 includes a “Study on architecture enhancement for Extended Reality and Media service (XRM); Phase 2," which identifies certain challenges that exist with respect to supporting advanced media services, such as High Data Rate Low Latency (HDRLL) services and Augmented Reality (AR) / Virtual Reality (VR) I Extended Reality (XR) services. Specifically, Key Issue #2 notes the need to “Support PDU Set information identification for end-to-end encrypted XRM traffic." This could include, for instance, the usage of end-to-end encryption that is broadly deployed in current networks to provide security, with the same expected for XRM applications. According to some embodiments, mechanisms described herein can address if and how the 5GS performs PDU Set information identification in an end-to-end encryption scenario, including with respect to AR / VR / XR / XRM applications.

[0021] The existing solution for PDU Set identification in 3GPP is based on the following: (a) for XRM applications there is provided Real-time Transport Protocol (RTP) or Secure RTP (SRTP) extension headers with PDU Set identification information; and (b) a PSA-UPF identifies PDU Sets based on analysis of the RTP payload with the help of a Protocol Description provided by the AF. With this framework, identification of PDU Sets for end-to-end encrypted media traffic is currently possible by using the SRTP protocol together with RTP extension headers. However, the PDU Set identification information is sent in cleartext, and thus, is unprotected. Therefore, a man-in- the-middle attack is possible by modifying the SRTP extension headers and / or impersonating the content provider, which would affect the correct functioning of the Next Generation Radio Access Network (NG-RAN). Moreover, the currently defined solution can only work with RTP transport protocol, it does not support evolved transports such as Media over QUIC Transport, so it is limited in terms of evolution, applicability, and adoption.

[0022] Certain aspects of this disclosure and their embodiments may provide solutions to these or other challenges according to one or more of the following.

[0023] In some embodiments, end-to-end encryption is realized by the use of the QUIC protocol. An in-band signaling channel is established between the UPF and the content provider's Application Server (AS) using MASQUE, where the MASQUE proxy is collocated with the AS. The “AS" may also refer to the corresponding AF, which is a Network Function in 5G that provides application-related information to other Network Functions.

[0024] In embodiments, the AS communicates with the 5G network through the AF with signaling requesting AF session establishment with Quality of Service (QoS). Later on, the AS receives and sends user plane payload packets over the internet (N6 interface) + the MASQUE in-band signaling. In certain aspects, for every downlink packet, the AS uses capsules to provide the UPF with their PDU Set information for each packet, such as PDU Set Sequence Number, Size, Importance, PDU Sequence Number within the PDU Set, and indication of end of PDU Set. To avoid encapsulation and encryption of payload packets between the AS and the UPF, capsules are sent coalesced with the QUIC payload packets in the same UDP packet, and the QUIC payload packets are forwarded using QUIC-Aware Proxying Using HTTP processes.

[0025] In certain aspects, solutions can be optimized to minimize UDP packet overhead by sending capsules only with initial payload packets and last packet. Also, PDU Set identification can be achieved by using multipath QUIC and alternating connection IDs for odd and even PDU Sets. In this case, the PDU Set Sequence Number is counted by the UPF. It can also be made more robust, for example against burst loses, by adding more Connection IDs. Additionally, PDU Set level information (e g. size and importance) can be sent only on initial packets per PDU Set, since their value is the same for all PDUs in the PDU Set. In embodiments, this information is repeated for a number of PDUs to compensate for potential packet loss. As another example, the End of PDU Set indication can be sent in a capsule together with the last PDU in the PDU Set only. Also, a PDU Set Sequence Number per PDU can be obtained without capsule sending using the headers in the QUIC packets of the end-to-end connection. For this purpose, in embodiments, the AS sends the header protection key to the UPF in a MASQUE capsule right after the end-to-end QUIC connection establishment. In embodiments, an SN is sent with the initial packets together with the PDU Set size and importance, in order to map the end-to-end QUIC packet sequence number to the PDU sequence number in the PDU Set.

[0026] In some embodiments, a mechanism is provided to exchange PDU Set metadata between the AS and UPF by means of the MASQUE capsule protocol, together with the following optimizations: (i) packet processing optimization by coalescing MASQUE capsules with QUIC payload PDUs on the same UDP packet; and / or (ii) UDP packet overhead optimization using multipath QUIC, with initial sending of capsules with metadata and sharing of QUIC header protection key for PDU sequence number derivation

[0027] Additionally, certain embodiments may provide one or more of the following technical advantages:• the end-to-end XRM traffic can be RTP over QUIC, media over QUIC, or any other XRM application protocol carried over QUIC;• the solution is transparent to application clients at the UE;• packet processing is optimized at UPF and AS by avoiding encapsulation and double encryption;• UDP packet overhead between UPF and AS is minimized; and / or• the solution works in spite of packet loss and reordering.

[0028] According to some embodiments, improvements and advantages described herein can be realized through updates to one or more standards. For instance, 3GPP TS 29.501 can be updated to add the handling of Connect- UDP for PDU Set Identification and marking to the PDU Set Handling procedure. As another example, 3GPP TS 29.503 can be updated to add an indication to use Connect-UDP for PDU Set Detection together with the FQDN for the AS to the PCC Rules. As another example, with respect to 3GPP TS 29.522, an extension of the Nnef AFSessionwithQoS API can be updated with an indication to use Connect-UDP for PDU Set Detection together with the FQDN for the AS. As another example, 3GPP TS 29.244 can be updated to add an indication to use Connect-UDP for PDU Set Detection together with the FQDN for the AS to the N4 rules.

[0029] FIG. 2 illustrates aspects of client / server and proxy interactions. In FIG. 2, communications between a client 202 and server 204 use a proxy 206. This can include connections 210a, 210b, 212a, and 212b. In some embodiments, the application client explicitly opens a QUIC tunnel connection to the proxy and requests forwarding, and uses an HTTP CONNECT-like protocol and a custom protocol to request or negotiate forwarding, authentication, and configuration. In certain aspects, a QUIC proxy 206 provides secure forwarding and performance enhancement services, such as congestion control support (mobile / satellite), access policy enforcement, load balancing / mobility, multi-hop chaining / onion routing, etc. The QUIC proxy may optionally also open a tunnel to the server 204 (if supported by server). By using these mechanisms, the client 202 and / or server 204 (usually the client) explicitly contacts a proxy 206, such as a QUIC Proxy, in order to expose information between a Content Provider (Application Client and / or Server) and the Mobile Network Operator (e.g. QUIC Proxy at UPF). With reference to FIG. 2, an inner connection 212a, 2102b is used that carries (encrypted) application traffic between client and server (not visible to the proxy), while the outer connections 210a, 210b can be used to expose information between the Content Provider (Application Client and / or Server) and the Mobile Network Operator (e.g QUIC Proxy at UPF). In some embodiments, a server, such as an Application Sever (AS), can have an integrated proxy for handling certain communications, such as a MASQUE proxy. Forexample, a UE or other client can be connected to the UPF via an access network; and a UPF (e.g., as a MASQUE Client) can be connected to an AS via the Internet, which itself can include a MASQUE proxy in tight integration with an XRM sender Part of the AS in some embodiments.

[0030] Some of the embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. Embodiments are provided by way of example to convey the scope of the subject matter to those skilled in the art.

[0031] Referring now to FIGs. 3A and 3B, a process 300 is provided according to some embodiments. The process 300 may be implemented, for example, using one or more of a UE, NG-RAN, PSA-UPF, SMF, PCF / NEF, and / or AF / AS. In embodiments, these may be one or more of the functions, nodes, devices, or other entities described in connection with FIG. 1, FIG. 2, and FIGs. 7-12. And in some embodiments, the aspects of process 300 shown in FIG. 3B may follow those described in connection with FIG. 3A. One or more steps may be omitted, and the order of steps may be adjusted, according to some embodiments.

[0032] The process may begin, for instance, with step 301 and PDU session establishment. In embodiments, a PDU Session Establishment procedure is performed as defined in clause 4.3.2.2.1 of TS 23.502. This can include one or more steps by the UE, NG-RAN, PSA-UPF and SMF. In step 302, the AF sends a request for session establishment to the PCF / NEF, such as a Nnef_AFsessionWithQoS_Create request as defined in clause 4.15.6.6 of TS 23.502. This can provide PDU Set-based QoS requirement and assistant information for traffic detection. In embodiments, it also provides an indication to use Connect-UDP for PDU Set Identification and the Address of the AS for the Connect-UDP request. In embodiments, the PCF generates PCC Rules based on the information provided by the AF and / or local policies, for instance, as defined in clause 6.1.3.27.4 of TS 23.503. This can include a request to identify and mark the PDU Set information on the end-to-end encrypted media traffic. In step 303, the PCF forwards the PCC Rules for end-to-end encrypted XRM traffic within SM Policy Association Establishment / Modification. While XRM traffic is used in examples, other types of traffic may be applicable according to embodiments, such as other media services or other ARA / R / XR services. In step 304a, the SMF configures the UPF. For instance, the SMF binds the PCC rules to a new QoS flow, determines the applicable QoS Profile, and determines N4 rules including a QoS Enforcement Rule with PDU Set marking indication, a Packet Detection Rule including the Packet Detection Information, and an indication to use Connect-UDP for PDU Set Detection together with the FQDN for the AS. According to embodiments, the SMF sends the N4 rules - including QER, FAR and PDR with Packet Detection Information and Connect-UDP information - to the PSA-UPF. In certain aspects, as part of step 304a, the UPF is configured with PDR with application detection information, MASQUE Protocol Description, and a FAR with an indication to set up the MASQUE tunnel together with the FQDN for the AS. In step 304b the SMF provides the QoS profiles to the NG-RAN (e.g., via AMF), and in step 304c the SMF provisions the QoS rules to the UE, for instance, in a NAS message to the UE via AMF and NG-RAN.

[0033] In step 305, the UE initiates encrypted communications, such as an end-to-end QUIC connection towards the AS to enable the e2e encryption of XRM traffic (or other traffic).

[0034] In step 306, the UPF performs target selection and / or matching, for instance, based on rules. In embodiments, the UPF matches the PDR for the end-to-end encrypted XRM using the Packet DetectionInformation and determines that PDU Set identification and marking is to be applied based on the linked Quality Enforcement Rule. The UPF may select a target AS FQDN based on the information in the linked Forwarding Action Rule, FAR In step 307, for instance if there is not an existing QUIC connection between the UPF and the AS, a new QUIC connection to use for a tunnel connection is established. This may be, for instance, a MASQUE tunnel. In some embodiments, this connection needs to be multipath capable. This QUIC connection on its initial path can be identified by an indicator, such as CID=MI . In certain aspects, based on the associated Connect-UDP information, the UPF decides to establish a QUIC connection to the AS (if not already established) and send a Connect-UDP to the target AS. According to some embodiments, for instance if one or more optimizations are implemented, it also indicates its support for multi-path QUIC. In step 308, the UPF forwards the initial QUIC packet sent by the UE in step 305 towards the AS. According to embodiments, it is sent using the MASQUE connection. In step 309, the AS and UE complete the QUIC connection establishment. This can include packets forwarded through the MASQUE connection. According to embodiments, step 309 can establish the CID for the end-to-end QUIC connection from the AS to the UE.

[0035] Referring now to FIG. 3B, in step 310 and according to some embodiments, if one or more optimizations are implemented, the UPF establishes additional new (e.g., two or more) new paths towards the AS. This can be, for instance, in order to distinguish PDUs belonging to odd and even PDU Sets that are sent through them, without the need for additional metadata. Moreover, the additional paths may only be necessary if there is not already sufficient paths for the MASQUE QUIC connection. In embodiments, the different paths can be identified by new CIDs (e.g., M1 , M2, etc.) for the AS-to-UPF direction. Based on Multi-path QUIC, for instance, the UPF and AS can establish corresponding virtual Connection IDs for each path for the Connect-UDP tunneling context established in step 307 for the end-to-end QUIC connection. These virtual CIDs (e.g., vM 1 , vM2, etc.) are for the AS-to-UPF direction. In certain aspects, these paths do not mean different physical paths to the AS, but rather, are distinguished by their 4-tuples and Connection IDs. The process may be made more robust, for instance against burst losses, by adding more Connection IDs to the mechanism so that a burst packet loss does not mask a switch of CIDs back to the one used prior to the loss, thus fooling the UPF that no change has occurred when it actually has occurred.

[0036] In step 311 , if the optimizations are implemented, the AS derives the 1-RTT keys to use with the UE and sends the header protection key to the UPF in a capsule, so that the UPF can extract the sequence number of QUIC packets in the end-to-end traffic and include it as PDU SN in the packets forwarded to the NG-RAN. According to embodiments, the end-to-end SN is not included as the PDU SN for the PDU Set, and the end-to-end SN is incremented for every packet through the lifetime of the e2e QUIC connection. For instance, the PDU SN within a PDU Set can be reset to 1 for every new PDU Set. In certain aspects, this is a reason for the PDU SN to be signaled together with the initial packets of each PDU Set, so that a mapping can be done for the subsequent packets.

[0037] According to embodiments, for example where one or more optimizations described herein are used, steps 312-314 are performed.

[0038] Referring now to step 312a, when the AS sends the first packet in a PDU set it will perform one or more of the following operations according to some embodiments. First, a virtual CID is selected for use, which is associated with the end-to-end QUIC connection. This could include, for example, picking one of the paths between the AS and UPF that exist, such as vM1 (representing ODD here). In this example, the end-to-end QUIC packet is per the QUIC-Aware proxying using HTTP, with its CID=E2 replaced by CID=vM1 The PDU set information for this packet (PDU) is sent in a capsule The capsule may be provided as an extension as defined by the Capsule Protocol of IETF RFC 9297, though other capsule techniques may be used. In embodiments, this capsule is sent in the MASQUE QUIC connection as a datagram; that is, it will become encapsulated in a QUIC packet with CID=M1. These two QUIC packets, with CIDs vMI and M1 , respectively can be coalesced in the same UDP payload, where both share the UDP packet's payload space. The PDU set information capsule may contain information such as PDU Set size, importance, PDU set sequence number, and PDU sequence number within a PDU set, and if this PDU is the last in the PDU set an End PDU indication. According to embodiments, if one or more of the optimizations implemented herein are used, the AS performs this step for a number (N) of the first N packet in the PDU set with their corresponding PDU set Information coalesced. The value of N can be chosen to a number that is appropriate to combat any likely level of packet loss in a given implementation.

[0039] Additionally, in step 312a, the AS initial payload packets are sent over one of the established MASQUE connections, such as the one for odd (or even) PDU Sets. These packets are not encapsulated but forwarded using QUIC-Aware Proxying Using HTTP. In addition, the AS sends capsules including the PDU Set size and importance, and in embodiments the PDUS sequence number within the PDU set, coalesced with the payload QUIC packets in the same UDP packet. Other information can be included and coalesced. The capsule with the PDU Set metadata is repeated with an appropriate number of initial packets to compensate for potential packet loss.

[0040] In steps 312b and 312c, upon reception of the first payload packet on the odd (or even) QUIC connection for instance, the UPF sets the PDU Set Sequence Number to an initial value (e.g. “1") and forwards the packets received on that QUIC connection to the NG-RAN, and gets the determined PDU Set SN and received PDU Set Size and Importance from the coalesced capsule. It also derives the PDU Sequence Number based on the payload QUIC packet by using the stored header protection key and sends all PDU Set metadata as GTP-U extension header together with the payload The UPF stores the PDU Set sequence number, PDU Set size and Importance for further use on the same virtual Connection ID. According to embodiments, the NG-RAN sends the first PDU set in steps 312c, 313c, and 314c. According to embodiments, processing / extraction of PDU information is enabled based on the receipt of a key as described with respect to step 311 .

[0041] In steps 313a and 313b, the AS sends subsequent QUIC packets without encapsulation over the same virtual Connection ID (vM1) and the UPF forwards them to the NG-RAN with the metadata obtained from the initial packets. The UPF extracts the sequence numbers of the end-to-end QUIC packets using the header protection key and then maps them to the PDU sequence number within the PDU Set by comparing them with the PDU and end-to-end packet sequence numbers received in step 312a. The PDU Sequence numbers within the PDU Set are also forwarded to the NG-RAN in the GTP-U header extension. If the N first packets of each PDU set weresent with PDU set information, this embodiment can detect PDU changes for up to N consecutive packet losses, and recover the PDU set information for N-1 consecutive packet losses. In steps 314a and 314b, the AS sends the last packet of the PDU Set coalesced with a capsule indicating End of PDU Set. The UPF forwards it to the NG-RAN adding that indication in the GTP-U header extension.

[0042] In steps 315a-c, 316a-c, and 317a-c, the AS sends packets for the next PDU Set on another virtual Connection ID, such as the one for even PDU Sets (vM2). The UPF increments the PDU Set SN and forwards the packets with the added metadata as in steps 312b-314b. Additionally, the AS sends subsequent PDU Sets on the even and odd virtual Connection IDs and UPF determines the PDU Set SN and other PDU Set metadata as described above. To make the detection of PDU set changes detectable and even more reliable, several paths and virtual CIDs can be used between the AS and the UPF. Thus, PDU set changes will be detected even if PDU burst losses causes whole PDU sets to be lost.

[0043] According to some embodiments, if the optimizations are not implemented, one or more of steps 310 and 311 are not performed and steps 312a-317a may be simplified in process 300 as follows. First, multiple virtual connection IDs are not necessarily used between the UPF and AS. Second, all payload packets are sent coalesced with MASQUE capsules with PDU Set information, including PDU Set Sequence Number, PDU Set Size, Importance, PDU Sequence Number within the PDU Set and End of PDU Set indication for the last PDU or each PDU Set where the reduced overhead optimization is not implemented. Third, the UPF gets all PDU Set Information from the MASQUE capsules and forwards it to the NG-RAN as GTP-U header extension.

[0044] One or more embodiments described with respect to FIGs. 3A and3B can enable the support of PDU Set related handling for end-to-end encrypted traffic using QUID as transport protocol and MASQUE as in-band communication between 5GS and the content-provider AS, and optionally between the UE and the 5GS. For instance, end-to-end XRM traffic can be RTP over QUI , media over QUIC or any other XRM application protocol carried over QUIC. In embodiments, the XRM packets (or other media) are encapsulated within QUIC packets via QUIC streams and datagrams to transport real-time data within a QUIC connection for a specific IP flow (represented by IP 5-tuple) and are encrypted through embedded QUIC security.

[0045] Referring now to FIG. 4, in some embodiments, the process 400 may begin with step 410, in which a request for session establishment for communicating PDU set identification information is sent. For instance, it may be sent to a network to enable the network to identify packets received from a UE that are part of a QUIC connection establishment request In some embodiments, establishing a secure tunnel comprises receiving a request for a secured tunnel protocol with an indication to provide PDU set information. However, in other embodiments, this is configured in the PCF as a local policy; it could also be implemented where the trigger to establish the Connect- UDP and the FQDN of the AS are configured in the SMF and / or UPF. In step 420, a secure tunnel for sending PDU set information is established. According to embodiments, the tunnel protocol is MASQUE, and PDUs and / or PDU set information are sent over a MASQUE connection. In step 430, a request for an end-to-end QUIC connection is received from a client over the secure tunnel. In step 440, a message is received to establish additional paths. In this case, for example, a set of PDUs is sent over a first path identified by a first CID and a next set of PDUs is sent over a second path identified by a second CID. Step 450, which may be optional in someembodiments, includes sending a QUIC header protection key for PDU identification information in a capsule. In step 460, encrypted first PDU set information is sent via the secure tunnel In step 470, encrypted second PDU set information is sent via the secure tunnel. According to embodiments, process 400 can include sending one or more encrypted first PDUs of a first PDU set to a client, where the first PDU set information corresponds to the first PDUs. Additionally, one or more encrypted second PDUs of a second PDU set are sent, and in some embodiments, the PDUs of the second PDU set are sent with a different CID than PDUs of the first PDU set. PDU set information can be sent in a capsule with the PDUs. In some embodiments, two QUIC PDUs are coalesced into a single UDP payload. For example, a payload QUIC packet can be coalesced with a signaling capsule in the same UFP packet, thus avoiding encapsulation of the payload packet into the capsule and the associated double encryption of the payload packets. Examples of set information are PDU set size, importance, PDU set sequence number, PDU sequence number within the first PDU set, and an end PDU indication. According to some embodiments, process 400 is performed by an AF / AS as described with respect to FIGs. 3A and 3B. In embodiments, process 400 may include one or more of the steps 301-317.

[0046] Referring now to FIG. 5, process 500 may begin with step 510, in which packets received from a UE are identified. According to embodiments, the packets are part of a QUIC connection establishment request with a target AS. In step 520, the target AS is selected, for instance, by rule matching and / or based on received information or a configuration. In step 530, a request to tunnel the UE’s connection to the target AS is sent. In certain aspects, the request indicates communication of encrypted PDU set information on a secure tunnel. The request may comprise sending a Connect-UDP to the target AS. Step 540 includes receiving PDU set information from the target AS over the secure tunnel, where the PDU set information corresponds to encrypted PDUs received from the AS. In embodiments, the secure tunnel for communicating PDU set information is a MASQUE tunnel. In step 550, at least one QUIC packet is forwarded from the UE towards the target AS using the secure tunnel connection. In step 560, one or more paths with the target AS are established. In embodiments, a first path is for a first set of PDUs and is identified by a first CID, and a second path is for a second set of PDUs and is identified by a second CID (e.g., for even and odd sets). In step 570, which may be optional in some embodiments, the process includes receiving a header protection key in a capsule and extracting a sequence number of a QUIC packet using the key. In embodiments, a PDU Sequence Number within a PDU set can be derived from the sequence number of QUIC packets by applying a difference between the sequence number of the QUIC packets and the PDU Sequence Number within the PDU Set received in the capsule of received PDUs. In step 580, packets received from the target AS are forwarded on a tunnel connection to an NG-RAN. According to embodiments, set identification information comprises one or more of PDU set size, importance, PDU set sequence number, PDU sequence number within the PDU set, and an end of PDU Set indication. According to some embodiments, process 500 is performed by a PSA-UPF as described with respect to FIGs. 3A and 3B. In embodiments, process 500 may include one or more of the steps 301-317.

[0047] In some embodiments, the information and messages received as part of process 400 are those sent in process 500. Likewise, the information and messages received as part of process 500 can be those sent in process 400. That is, processes 400 and 500 are performed together according to embodiments. For instance, process400 may be performed by an AS or AF, for example with an integrated MASQUE proxy, that is connected to a PSA-UPF or other client performing process 500. According to embodiments, a system may include one or mor devices or nodes performing processes 400 and / or 500.

[0048] Referring now to FIGs. 6A and 6B, processes 600 and 650 relating to the use of capsules are provided. Process 600 may be performed, for instance, in an Application Server (AS) other Application Function (AF), while process 650 may be performed in a User Plane Function (UPF), such as a the PSA-UPF. In embodiments, processes 600 and 650 may include one or more of the steps 301-317.

[0049] Referring now to FIG. 6A, process 600 may begin with step 601, where a secure tunnel connection is established. In step 602, PDU set information coalesced with one or more initial PDUs is sent via the secure tunnel connection. In some embodiments, the tunnel connection is a MASQUE connection and the PDU set information and PDU are coalesced in a capsule. The method may also optionally include one or more of: sending (603) one or more subsequent PDUs of the first PDU set via the tunnel connection and without the coalesced PDU set information; sending (604) a last PDU of the first PDU set coalesced with a PDU set end indication via the tunnel connection; sending (605) second PDU set information coalesced with one or more initial PDUs via the secure tunnel connection; sending (606) one or more subsequent PDUs of the second PDU set via the tunnel connection and without the coalesced PDU set information; and sending (607) a last PDU of the second PDU set coalesced with a PDU set end indication via the tunnel connection. The PDUs of the first set can be sent with a first CID, and the PDUs of the second set sent with a second, different CID (e.g., for even and odd sets).

[0050] Referring now to FIG. 6B, process 650 may begin with step 651, where a secure tunnel connection is configured. In step 652, PDU set information coalesced with one or more initial PDUs is received via the secure tunnel connection. In some embodiments, the tunnel connection is a MASQUE connection and the PDU set information and PDU are coalesced in a capsule. The method may also optionally include one or more of: receiving (653) one or more subsequent PDUs of the first PDU set via the tunnel connection and without the coalesced PDU set information; receiving (654) a last PDU of the first PDU set coalesced with a PDU set end indication via the tunnel connection; receiving (655) second PDU set information coalesced with one or more initial PDUs via the secure tunnel connection; receiving (656) one or more subsequent PDUs of the second PDU set via the tunnel connection and without the coalesced PDU set information; and receiving (657) a last PDU of the second PDU set coalesced with a PDU set end indication via the tunnel connection. The PDUs of the first set can be received on a path with a first CID, and the PDUs of the second set on a path with a second, different CID (e g., for even and odd sets).

[0051] The processes 400, 500, 600, and 650 may be implemented, for example, using one or more of a UE, NG- RAN, PSA-UPF, SMF, PCF / NEF, and / or AF / AS. In embodiments, these may be one or more of the functions, nodes, devices, or other entities described in connection with FIG. 1 , FIG. 2, FIGs. 3A-3B, and FIGs. 7-12. Additionally, one or more steps may be omitted, and the order of steps may be adjusted, according to some embodiments.

[0052] According to some embodiments, to get PDU Set information from the AS in a secure way, the UPF sets up a MASQUE connection to an HTTP proxy integrated in the AS, indicating the capability to receive PDU Setinformation in capsules, according to a Capsule Protocol. In certain aspects, capsules can be defined to contain PDU Set information such as PDU Set Size and Importance and End of Data Burst indication. A capsule with the PDU Set size and importance and no payload may be sent at the beginning of each PDU Set and repeated an appropriate number of times to compensate for potential packet loss To ensure that PDU Set information is available to all PDU Set payload packets, the capsule may be coalesced with the initial QUIC packets with XRM Payload of the PDU set. Additionally, to avoid re-encapsulation and re-encryption, in embodiments all XRM (or other media traffic) payload packets are forwarded using QUIC-Aware Proxying Using HTTP. In some embodiments, to indicate each PDU Set, a mechanism is defined where every time a new PDU Set is to be sent, the QUIC entity at the AS selects a different QUIC CID, up to a maximum number or CIDs, after which the already established connections are re-used. This allows indicating the PDU Set of the packets while forwarding them directly, without encapsulating them in MASQUE Datagrams. Using two Connection IDs for this purpose is often sufficient. In some embodiments, the End PDU Set indication is sent as a capsule in a QUIC packet that is coalesced in the same UDP payload as the last packet in a data burst. PDU Set Sequence Number can be obtained from the QUIC packets of the end-to-end connection by having the AS sending the header protection key to the UPF in a Masque capsule. Alternatively, the header protection key may be sent by the UE if another MASQUE connection is established between the UE and the UPF to support traffic identification of the encrypted payload as such (apart from PDU Sets). In some embodiments, non-PDU Set traffic can be forwarded in a separate Connection ID.

[0053] In some embodiments, the AF sends an AF request message including Quality of Service (QoS) requirement and assistance information for the media traffic to the NEF / PCF. This can include: a QoS requirement that contains the PDU Set based QoS parameters; traffic descriptions such as the the matching condition (IP filter or application ID) together with the target FQDN; and / or a Protocol Description that indicates QUIC-Aware Proxying Using HTTP with XRM capsule specification.

[0054] Identification of end-to-end encrypted traffic can present a challenge when the payload is encrypted end- to-end. Currently a limited identification is possible based on the use of IP filters and SNI, but such distinction may not be sufficient in many cases. One or more embodiments can enable the identification of XRM traffic subject to PDU Set marking with the assistance of both the UE and AF for that traffic. In certain aspects, the XRM application may communicate to the 5GS an identifier of the XRM service as traffic detection assistance In certain aspects, the PCF may generate PCC Rules using that XRM service identifier and pass them to the SMF and then the UPF for traffic detection. In certain aspects, before end-to-end connection establishment, the UE sends a Connect- UDP to the UPF to establish an uplink MASQUE connection, indicating the target XRM service. In certain aspects, the UPF, based on the indicated XRM service identifier, can match the appropriate PDR and enforce the corresponding policies, in addition to the PDU Set identification and marking. In certain aspects, disclosed mechanisms allow the UPF to identify traffic with a finer granularity than with IP filters and SNIs.

[0055] FIG. 7 shows an example of a communication system 700 in accordance with some embodiments.

[0056] In the example, the communication system 700 includes a telecommunication network 702 that includes an access network 704, such as a radio access network (RAN), and a core network 706, which includes one or morecore network nodes 708. The access network 704 includes one or more access network nodes, such as network nodes 710a and 710b (one or more of which may be generally referred to as network nodes 710), or any other similar 3rdGeneration Partnership Project (3GPP) access nodes or non-3GPP access points. Moreover, as will be appreciated by those of skill in the art, a network node is not necessarily limited to an implementation in which a radio portion and a baseband portion are supplied and integrated by a single vendor. Thus, it will be understood that network nodes include disaggregated implementations or portions thereof. For example, in some embodiments, the telecommunication network 702 includes one or more Open-RAN (ORAN) network nodes. An ORAN network node is a node in the telecommunication network 702 that supports an ORAN specification (e.g., a specification published by the O-RAN Alliance, or any similar organization) and may operate alone or together with other nodes to implement one or more functionalities of any node in the telecommunication network 702, including one or more network nodes 710 and / or core network nodes 708.

[0057] Examples of an ORAN network node include an open radio unit (O-RU), an open distributed unit (O-DU), an open central unit (O-CU), including an O-CU control plane (O-CU-CP) or an O-CU user plane (O-CU-UP), a RAN intelligent controller (near-real time or non-real time) hosting software or software plug-ins, such as a near- real time control application (e.g., xApp) or a non-real time control application (e.g., rApp), or any combination thereof (the adjective “open" designating support of an ORAN specification). The network node may support a specification by, for example, supporting an interface defined by the ORAN specification, such as an A1, F1 , W1, E1 , E2, X2, Xn interface, an open fronthaul user plane interface, or an open fronthaul management plane interface. Moreover, an ORAN access node may be a logical node in a physical node. Furthermore, an ORAN network node may be implemented in a virtualization environment (described further below) in which one or more network functions are virtualized. For example, the virtualization environment may include an O-Cloud computing platform orchestrated by a Service Management and Orchestration Framework via an O-2 interface defined by the O-RAN Alliance or comparable technologies. The network nodes 710 facilitate direct or indirect connection of user equipment (UE), such as by connecting UEs 712a, 712b, 712c, and 712d (one or more of which may be generally referred to as UEs 712) to the core network 706 over one or more wireless connections.

[0058] Example wireless communications over a wireless connection include transmitting and / or receiving wireless signals using electromagnetic waves, radio waves, infrared waves, and / or other types of signals suitable for conveying information without the use of wires, cables, or other material conductors. Moreover, in different embodiments, the communication system 700 may include any number of wired or wireless networks, network nodes, UEs, and / or any other components or systems that may facilitate or participate in the communication of data and / or signals whether via wired or wireless connections. The communication system 700 may include and / or interface with any type of communication, telecommunication, data, cellular, radio network, and / or other similar type of system.

[0059] The UEs 712 may be any of a wide variety of communication devices, including wireless devices arranged, configured, and / or operable to communicate wirelessly with the network nodes 710 and other communication devices. Similarly, the network nodes 710 are arranged, capable, configured, and / or operable to communicate directly or indirectly with the UEs 712 and / or with other network nodes or equipment in the telecommunicationnetwork 702 to enable and / or provide network access, such as wireless network access, and / or to perform other functions, such as administration in the telecommunication network 702.

[0060] In the depicted example, the core network 706 connects the network nodes 710 to one or more hosts, such as host 716. These connections may be direct or indirect via one or more intermediary networks or devices. In other examples, network nodes may be directly coupled to hosts. The core network 706 includes one more core network nodes (e.g., core network node 708) that are structured with hardware and software components. Features of these components may be substantially similar to those described with respect to the UEs, network nodes, and / or hosts, such that the descriptions thereof are generally applicable to the corresponding components of the core network node 708. Example core network nodes include functions of one or more of a Mobile Switching Center (MSC), Mobility Management Entity (MME), Home Subscriber Server (HSS), Access and Mobility Management Function (AMF), Session Management Function (SMF), Authentication Server Function (AUSF), Subscription Identifier De-concealing function (SIDF), Unified Data Management (UDM), Security Edge Protection Proxy (SEPP), Network Exposure Function (NEF), and / or a User Plane Function (UPF).

[0061] The host 716 may be under the ownership or control of a service provider other than an operator or provider of the access network 704 and / or the telecommunication network 702, and may be operated by the service provider or on behalf of the service provider. The host 716 may host a variety of applications to provide one or more service. Examples of such applications include live and pre-recorded audio / video content, data collection services such as retrieving and compiling data on various ambient conditions detected by a plurality of UEs, analytics functionality, social media, functions for controlling or otherwise interacting with remote devices, functions for an alarm and surveillance center, or any other such function performed by a server.

[0062] As a whole, the communication system 700 of FIG. 7 enables connectivity between the UEs, network nodes, and hosts. In that sense, the communication system may be configured to operate according to predefined rules or procedures, such as specific standards that include, but are not limited to: Global System for Mobile Communications (GSM); Universal Mobile Telecommunications System (UMTS); Long Term Evolution (LTE), and / or other suitable 2G, 3G, 4G, 5G standards, or any applicable future generation standard (e.g., 6G); wireless local area network (WLAN) standards, such as the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards (WiFi); and / or any other appropriate wireless communication standard, such as the Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, Near Field Communication (NFC) ZigBee, LiFi, and / or any low-power wide-area network (LPWAN) standards such as LoRa and Sigfox.

[0063] In some examples, the telecommunication network 702 is a cellular network that implements 3GPP standardized features. Accordingly, the telecommunications network 702 may support network slicing to provide different logical networks to different devices that are connected to the telecommunication network 702. For example, the telecommunications network 702 may provide Ultra Reliable Low Latency Communication (URLLC) services to some UEs, while providing Enhanced Mobile Broadband (eMBB) services to other UEs, and / or Massive Machine Type Communication (mMTC)ZMassive loT services to yet further UEs.

[0064] In some examples, the UEs 712 are configured to transmit and / or receive information without direct human interaction. For instance, a UE may be designed to transmit information to the access network 704 on apredetermined schedule, when triggered by an internal or external event, or in response to requests from the access network 704. Additionally, a UE may be configured for operating in single- or multi-RAT or multi-standard mode. For example, a UE may operate with any one or combination of Wi-Fi, NR (New Radio) and LTE, i.e. being configured for multi-radio dual connectivity (MR-DC), such as E-UTRAN (Evolved-UMTS Terrestrial Radio Access Network) New Radio - Dual Connectivity (EN-DC).

[0065] In the example, the hub 714 communicates with the access network 704 to facilitate indirect communication between one or more UEs (e.g., UE 712c and / or 712d) and network nodes (e.g., network node 710b). In some examples, the hub 714 may be a controller, router, content source and analytics, or any of the other communication devices described herein regarding UEs. For example, the hub 714 may be a broadband router enabling access to the core network 706 for the UEs. As another example, the hub 714 may be a controller that sends commands or instructions to one or more actuators in the UEs. Commands or instructions may be received from the UEs, network nodes 710, or by executable code, script, process, or other instructions in the hub 714. As another example, the hub 714 may be a data collector that acts as temporary storage for UE data and, in some embodiments, may perform analysis or other processing of the data. As another example, the hub 714 may be a content source. For example, for a UE that is a VR headset, display, loudspeaker or other media delivery device, the hub 714 may retrieve VR assets, video, audio, or other media or data related to sensory information via a network node, which the hub 714 then provides to the UE either directly, after performing local processing, and / or after adding additional local content. In still another example, the hub 714 acts as a proxy server or orchestrator for the UEs, in particular if one or more of the UEs are low energy loT devices.

[0066] The hub 714 may have a constant / persistent or intermittent connection to the network node 710b. The hub 714 may also allow for a different communication scheme and / or schedule between the hub 714 and UEs (e.g., UE 712c and / or 712d), and between the hub 714 and the core network 706. In other examples, the hub 714 is connected to the core network 706 and / or one or more UEs via a wired connection. Moreover, the hub 714 may be configured to connect to an M2M service provider over the access network 704 and / or to another UE over a direct connection. In some scenarios, UEs may establish a wireless connection with the network nodes 710 while still connected via the hub 714 via a wired or wireless connection. In some embodiments, the hub 714 may be a dedicated hub - that is, a hub whose primary function is to route communications to / from the UEs from / to the network node 710b. In other embodiments, the hub 714 may be a non-dedicated hub - that is, a device which is capable of operating to route communications between the UEs and network node 710b, but which is additionally capable of operating as a communication start and / or end point for certain data channels.

[0067] FIG. 8 shows a UE 800 in accordance with some embodiments. As used herein, a UE refers to a device capable, configured, arranged and / or operable to communicate wirelessly with network nodes and / or other UEs. Examples of a UE include, but are not limited to, a smart phone, mobile phone, cell phone, voice over IP (VoIP) phone, wireless local loop phone, desktop computer, personal digital assistant (PDA), wireless cameras, gaming console or device, music storage device, playback appliance, wearable terminal device, wireless endpoint, mobile station, tablet, laptop, laptop-embedded equipment (LEE), laptop-mounted equipment (LME), smart device, wireless customer-premise equipment (CPE), vehicle, vehicle-mounted or vehicle embedded / integrated wirelessdevice, etc. Other examples include any UE identified by the 3rd Generation Partnership Project (3GPP), including a narrow band internet of things (NB-loT) UE, a machine type communication (MTC) UE, and / or an enhanced MTC (eMTC) UE.

[0068] A UE may support device-to-device (D2D) communication, for example by implementing a 3GPP standard for sidelink communication, Dedicated Short-Range Communication (DSRC), vehicle-to-vehicle (V2V), vehicle-to- infrastructure (V2I), or vehicle-to-everything (V2X). In other examples, a UE may not necessarily have a user in the sense of a human user who owns and / or operates the relevant device. Instead, a UE may represent a device that is intended for sale to, or operation by, a human user but which may not, or which may not initially, be associated with a specific human user (e.g., a smart sprinkler controller). Alternatively, a UE may represent a device that is not intended for sale to, or operation by, an end user but which may be associated with or operated for the benefit of a user (e.g., a smart power meter).

[0069] The UE 800 includes processing circuitry 802 that is operatively coupled via a bus 804 to an input / output interface 806, a power source 808, a memory 810, a communication interface 812, and / or any other component, or any combination thereof. Certain UEs may utilize all or a subset of the components shown in FIG. 8. The level of integration between the components may vary from one UE to another UE. Further, certain UEs may contain multiple instances of a component, such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0070] The processing circuitry 802 is configured to process instructions and data and may be configured to implement any sequential state machine operative to execute instructions stored as machine-readable computer programs in the memory 810. The processing circuitry 802 may be implemented as one or more hardware- implemented state machines (e.g., in discrete logic, field-programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), etc.); programmable logic together with appropriate firmware; one or more stored computer programs, general-purpose processors, such as a microprocessor or digital signal processor (DSP), together with appropriate software; or any combination of the above. For example, the processing circuitry 802 may include multiple central processing units (CPUs).

[0071] In the example, the input / output interface 806 may be configured to provide an interface or interfaces to an input device, output device, or one or more input and / or output devices. Examples of an output device include a speaker, a sound card, a video card, a display, a monitor, a printer, an actuator, an emitter, a smartcard, another output device, or any combination thereof. An input device may allow a user to capture information into the UE 800. Examples of an input device include a touch-sensitive or presence-sensitive display, a camera (e.g., a digital camera, a digital video camera, a web camera, etc.), a microphone, a sensor, a mouse, a trackball, a directional pad, a trackpad, a scroll wheel, a smartcard, and the like. The presence-sensitive display may include a capacitive or resistive touch sensor to sense input from a user. A sensor may be, for instance, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetometer, an optical sensor, a proximity sensor, a biometric sensor, etc., or any combination thereof. An output device may use the same type of interface port as an input device. For example, a Universal Serial Bus (USB) port may be used to provide an input device and an output device.

[0072] In some embodiments, the power source 808 is structured as a battery or battery pack. Other types of power sources, such as an external power source (e.g., an electricity outlet), photovoltaic device, or power cell, may be used The power source 808 may further include power circuitry for delivering power from the power source 808 itself, and / or an external power source, to the various parts of the UE 800 via input circuitry or an interface such as an electrical power cable. Delivering power may be, for example, for charging of the power source 808. Power circuitry may perform any formatting, converting, or other modification to the power from the power source 808 to make the power suitable for the respective components of the UE 800 to which power is supplied.

[0073] The memory 810 may be or be configured to include memory such as random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disks, optical disks, hard disks, removable cartridges, flash drives, and so forth. In one example, the memory 810 includes one or more application programs 814, such as an operating system, web browser application, a widget, gadget engine, or other application, and corresponding data 816. The memory 810 may store, for use by the UE 800, any of a variety of various operating systems or combinations of operating systems.

[0074] The memory 810 may be configured to include a number of physical drive units, such as redundant array of independent disks (RAID), flash memory, USB flash drive, external hard disk drive, thumb drive, pen drive, key drive, high-density digital versatile disc (HD-DVD) optical disc drive, internal hard disk drive, Blu-Ray optical disc drive, holographic digital data storage (HDDS) optical disc drive, external mini-dual in-line memory module (DIMM), synchronous dynamic random access memory (SDRAM), external micro-DIMM SDRAM, smartcard memory such as tamper resistant module in the form of a universal integrated circuit card (UICC) including one or more subscriber identity modules (SIMs), such as a USIM and / or ISIM, other memory, or any combination thereof. The UICC may for example be an embedded UICC (eUlCC), integrated UICC (iUICC) or a removable UICC commonly known as 'SIM card.’ The memory 810 may allow the UE 800 to access instructions, application programs and the like, stored on transitory or non-transitory memory media, to off-load data, or to upload data. An article of manufacture, such as one utilizing a communication system may be tangibly embodied as or in the memory 810, which may be or comprise a device-readable storage medium

[0075] The processing circuitry 802 may be configured to communicate with an access network or other network using the communication interface 812 The communication interface 812 may comprise one or more communication subsystems and may include or be communicatively coupled to an antenna 822 The communication interface 812 may include one or more transceivers used to communicate, such as by communicating with one or more remote transceivers of another device capable of wireless communication (e.g., another UE or a network node in an access network). Each transceiver may include a transmitter 818 and / or a receiver 820 appropriate to provide network communications (e.g., optical, electrical, frequency allocations, and so forth). Moreover, the transmitter 818 and receiver 820 may be coupled to one or more antennas (e.g., antenna 822) and may share circuit components, software or firmware, or alternatively be implemented separately.

[0076] In the illustrated embodiment, communication functions of the communication interface 812 may include cellular communication, Wi-Fi communication, LPWAN communication, data communication, voicecommunication, multimedia communication, short-range communications such as Bluetooth, near-field communication, location-based communication such as the use of the global positioning system (GPS) to determine a location, another like communication function, or any combination thereof Communications may be implemented in according to one or more communication protocols and / or standards, such as IEEE 802.11, Code Division Multiplexing Access (CDMA), Wideband Code Division Multiple Access (WCDMA), GSM, LTE, New Radio (NR), UMTS, WiMax, Ethernet, transmission control protocol / internet protocol (TCP / IP), synchronous optical networking (SONET), Asynchronous Transfer Mode (ATM), QUIC, Hypertext Transfer Protocol (HTTP), and so forth.

[0077] Regardless of the type of sensor, a UE may provide an output of data captured by its sensors, through its communication interface 812, via a wireless connection to a network node. Data captured by sensors of a UE can be communicated through a wireless connection to a network node via another UE. The output may be periodic (e.g., once every 15 minutes if it reports the sensed temperature), random (e.g., to even out the load from reporting from several sensors), in response to a triggering event (e.g., when moisture is detected an alert is sent), in response to a request (e.g., a user initiated request), or a continuous stream (e.g., a live video feed of a patient).

[0078] As another example, a UE comprises an actuator, a motor, or a switch, related to a communication interface configured to receive wireless input from a network node via a wireless connection. In response to the received wireless input the states of the actuator, the motor, or the switch may change. For example, the UE may comprise a motor that adjusts the control surfaces or rotors of a drone in flight according to the received input or to a robotic arm performing a medical procedure according to the received input.

[0079] A UE, when in the form of an Internet of Things (loT) device, may be a device for use in one or more application domains, these domains comprising, but not limited to, city wearable technology, extended industrial application and healthcare. Non-limiting examples of such an loT device are a device which is or which is embedded in: a connected refrigerator or freezer, a TV, a connected lighting device, an electricity meter, a robot vacuum cleaner, a voice controlled smart speaker, a home security camera, a motion detector, a thermostat, a smoke detector, a door / window sensor, a flood / moisture sensor, an electrical door lock, a connected doorbell, an air conditioning system like a heat pump, an autonomous vehicle, a surveillance system, a weather monitoring device, a vehicle parking monitoring device, an electric vehicle charging station, a smart watch, a fitness tracker, a head-mounted display for Augmented Reality (AR) or Virtual Reality (VR), a wearable for tactile augmentation or sensory enhancement, a water sprinkler, an animal- or item-tracking device, a sensor for monitoring a plant or animal, an industrial robot, an Unmanned Aerial Vehicle (UAV), and any kind of medical device, like a heart rate monitor or a remote controlled surgical robot. A UE in the form of an loT device comprises circuitry and / or software in dependence of the intended application of the loT device in addition to other components as described in relation to the UE 800 shown in FIG. 8.

[0080] As yet another specific example, in an loT scenario, a UE may represent a machine or other device that performs monitoring and / or measurements, and transmits the results of such monitoring and / or measurements to another UE and / or a network node. The UE may in this case be an M2M device, which may in a 3GPP context be referred to as an MTC device. As one particular example, the UE may implement the 3GPP NB-loT standard. Inother scenarios, a UE may represent a vehicle, such as a car, a bus, a truck, a ship and an airplane, or other equipment that is capable of monitoring and / or reporting on its operational status or other functions associated with its operation.

[0081] In practice, any number of UEs may be used together with respect to a single use case. For example, a first UE might be or be integrated in a drone and provide the drone's speed information (obtained through a speed sensor) to a second UE that is a remote controller operating the drone. When the user makes changes from the remote controller, the first UE may adjust the throttle on the drone (e.g. by controlling an actuator) to increase or decrease the drone's speed. The first and / or the second UE can also include more than one of the functionalities described above. For example, a UE might comprise the sensor and the actuator, and handle communication of data for both the speed sensor and the actuators.

[0082] FIG. 9 shows a network node 900 in accordance with some embodiments. As used herein, network node refers to equipment capable, configured, arranged and / or operable to communicate directly or indirectly with a UE and / or with other network nodes or equipment, in a telecommunication network. Examples of network nodes include, but are not limited to, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs) and NR NodeBs (gNBs)), O-RAN nodes or components of an O-RAN node (e.g., O-RU, O-DU, O-CU).

[0083] Base stations may be categorized based on the amount of coverage they provide (or, stated differently, their transmit power level) and so, depending on the provided amount of coverage, may be referred to as femto base stations, pico base stations, micro base stations, or macro base stations. A base station may be a relay node or a relay donor node controlling a relay. A network node may also include one or more (or all) parts of a distributed radio base station such as centralized digital units, distributed units (e.g., in an O-RAN access node) and / or remote radio units (RRUs), sometimes referred to as Remote Radio Heads (RRHs). Such remote radio units may or may not be integrated with an antenna as an antenna integrated radio. Parts of a distributed radio base station may also be referred to as nodes in a distributed antenna system (DAS).

[0084] Other examples of network nodes include multiple transmission point (multi-TRP) 5G access nodes, multistandard radio (MSR) equipment such as MSR BSs, network controllers such as radio network controllers (RNCs) or base station controllers (BSCs), base transceiver stations (BTSs), transmission points, transmission nodes, multi-cell / multicast coordination entities (MCEs), Operation and Maintenance (O&M) nodes, Operations Support System (OSS) nodes, Self-Organizing Network (SON) nodes, positioning nodes (e.g , Evolved Serving Mobile Location Centers (E-SMLCs)), and / or Minimization of Drive Tests (MDTs).

[0085] The network node 900 includes a processing circuitry 902, a memory 904, a communication interface 906, and a power source 908. The network node 900 may be composed of multiple physically separate components (e.g., a NodeB component and a RNC component, or a BTS component and a BSC component, etc.), which may each have their own respective components. In certain scenarios in which the network node 900 comprises multiple separate components (e.g., BTS and BSC components), one or more of the separate components may be shared among several network nodes. For example, a single RNC may control multiple NodeBs. In such a scenario, each unique NodeB and RNC pair, may in some instances be considered a single separate network node. In someembodiments, the network node 900 may be configured to support multiple radio access technologies (RATs). In such embodiments, some components may be duplicated (e.g., separate memory 904 for different RATs) and some components may be reused (e.g., a same antenna 910 may be shared by different RATs). The network node 900 may also include multiple sets of the various illustrated components for different wireless technologies integrated into network node 900, for example GSM, WCDMA, LTE, NR, WiFi, Zigbee, Z-wave, LoRaWAN, Radio Frequency Identification (RFID) or Bluetooth wireless technologies. These wireless technologies may be integrated into the same or different chip or set of chips and other components within network node 900.

[0086] The processing circuitry 902 may comprise a combination of one or more of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application-specific integrated circuit, field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software and / or encoded logic operable to provide, either alone or in conjunction with other network node 900 components, such as the memory 904, to provide network node 900 functionality.

[0087] In some embodiments, the processing circuitry 902 includes a system on a chip (SOO). In some embodiments, the processing circuitry 902 includes one or more of radio frequency (RF) transceiver circuitry 912 and baseband processing circuitry 914. In some embodiments, the radio frequency (RF) transceiver circuitry 912 and the baseband processing circuitry 914 may be on separate chips (or sets of chips), boards, or units, such as radio units and digital units. In alternative embodiments, part or all of RF transceiver circuitry 912 and baseband processing circuitry 914 may be on the same chip or set of chips, boards, or units.

[0088] The memory 904 may comprise any form of volatile or non-volatile computer-readable memory including, without limitation, persistent storage, solid-state memory, remotely mounted memory, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), mass storage media (for example, a hard disk), removable storage media (for example, a flash drive, a Compact Disk (CD) or a Digital Video Disk (DVD)), and / or any other volatile or non-volatile, non-transitory device-readable and / or computer-executable memory devices that store information, data, and / or instructions that may be used by the processing circuitry 902. The memory 904 may store any suitable instructions, data, or information, including a computer program, software, an application including one or more of logic, rules, code, tables, and / or other instructions capable of being executed by the processing circuitry 902 and utilized by the network node 900. The memory 904 may be used to store any calculations made by the processing circuitry 902 and / or any data received via the communication interface 906. In some embodiments, the processing circuitry 902 and memory 904 is integrated.

[0089] The communication interface 906 is used in wired or wireless communication of signaling and / or data between a network node, access network, and / or UE. As illustrated, the communication interface 906 comprises port(s) / terminal(s) 916 to send and receive data, for example to and from a network over a wired connection. The communication interface 906 also includes radio front-end circuitry 918 that may be coupled to, or in certain embodiments a part of, the antenna 910. Radio front-end circuitry 918 comprises filters 920 and amplifiers 922. The radio front-end circuitry 918 may be connected to an antenna 910 and processing circuitry 902. The radio front-end circuitry may be configured to condition signals communicated between antenna 910 and processing circuitry 902. The radio front-end circuitry 918 may receive digital data that is to be sent out to other network nodesor UEs via a wireless connection. The radio front-end circuitry 918 may convert the digital data into a radio signal having the appropriate channel and bandwidth parameters using a combination of filters 920 and / or amplifiers 922. The radio signal may then be transmitted via the antenna 910. Similarly, when receiving data, the antenna 910 may collect radio signals which are then converted into digital data by the radio front-end circuitry 918. The digital data may be passed to the processing circuitry 902. In other embodiments, the communication interface may comprise different components and / or different combinations of components.

[0090] In certain alternative embodiments, the network node 900 does not include separate radio front-end circuitry 918, instead, the processing circuitry 902 includes radio front-end circuitry and is connected to the antenna 910. Similarly, in some embodiments, all or some of the RF transceiver circuitry 912 is part of the communication interface 906. In still other embodiments, the communication interface 906 includes one or more ports or terminals 916, the radio front-end circuitry 918, and the RF transceiver circuitry 912, as part of a radio unit (not shown), and the communication interface 906 communicates with the baseband processing circuitry 914, which is part of a digital unit (not shown).

[0091] The antenna 910 may include one or more antennas, or antenna arrays, configured to send and / or receive wireless signals. The antenna 910 may be coupled to the radio front-end circuitry 918 and may be any type of antenna capable of transmitting and receiving data and / or signals wirelessly. In certain embodiments, the antenna 910 is separate from the network node 900 and connectable to the network node 900 through an interface or port.

[0092] The antenna 910, communication interface 906, and / or the processing circuitry 902 may be configured to perform any receiving operations and / or certain obtaining operations described herein as being performed by the network node. Any information, data and / or signals may be received from a UE, another network node and / or any other network equipment. Similarly, the antenna 910, the communication interface 906, and / or the processing circuitry 902 may be configured to perform any transmitting operations described herein as being performed by the network node. Any information, data and / or signals may be transmitted to a UE, another network node and / or any other network equipment.

[0093] The power source 908 provides power to the various components of network node 900 in a form suitable for the respective components (e.g., at a voltage and current level needed for each respective component). The power source 908 may further comprise, or be coupled to, power management circuitry to supply the components of the network node 900 with power for performing the functionality described herein. For example, the network node 900 may be connectable to an external power source (e.g., the power grid, an electricity outlet) via an input circuitry or interface such as an electrical cable, whereby the external power source supplies power to power circuitry of the power source 908. As a further example, the power source 908 may comprise a source of power in the form of a battery or battery pack which is connected to, or integrated in, power circuitry. The battery may provide backup power should the external power source fail.

[0094] Embodiments of the network node 900 may include additional components beyond those shown in FIG. 9 for providing certain aspects of the network node's functionality, including any of the functionality described herein and / or any functionality necessary to support the subject matter described herein. For example, the network node 900 may include user interface equipment to allow input of information into the network node 900 and to allowoutput of information from the network node 900. This may allow a user to perform diagnostic, maintenance, repair, and other administrative functions for the network node 900.

[0095] FIG. 10 is a block diagram of a host 1000, which may be an embodiment of the host 716 of FIG. 7, in accordance with various aspects described herein. As used herein, the host 1000 may be or comprise various combinations hardware and / or software, including a standalone server, a blade server, a cloud-implemented server, a distributed server, a virtual machine, container, or processing resources in a server farm. The host 1000 may provide one or more services to one or more UEs.

[0096] The host 1000 includes processing circuitry 1002 that is operatively coupled via a bus 1004 to an input / output interface 1006, a network interface 1008, a power source 1010, and a memory 1012. Other components may be included in other embodiments. Features of these components may be substantially similar to those described with respect to the devices of previous figures, such as FIGs. 8 and 9, such that the descriptions thereof are generally applicable to the corresponding components of host 1000.

[0097] The memory 1012 may include one or more computer programs including one or more host application programs 1014 and data 1016, which may include user data, e.g., data generated by a UE for the host 1000 or data generated by the host 1000 for a UE. Embodiments of the host 1000 may utilize only a subset or all of the components shown. The host application programs 1014 may be implemented in a container-based architecture and may provide support for video codecs (e.g., Versatile Video Coding (WC), High Efficiency Video Coding (HEVC), Advanced Video Coding (AVC), MPEG, VP9) and audio codecs (e.g., FLAG, Advanced Audio Coding (AAC), MPEG, G.711), including transcoding for multiple different classes, types, or implementations of UEs (e.g., handsets, desktop computers, wearable display systems, heads-up display systems). The host application programs 1014 may also provide for user authentication and licensing checks and may periodically report health, routes, and content availability to a central node, such as a device in or on the edge of a core network. Accordingly, the host 1000 may select and / or indicate a different host for over-the-top services for a UE. The host application programs 1014 may support various protocols, such as the HTTP Live Streaming (HLS) protocol, Real-Time Messaging Protocol (RTMP), Real-Time Streaming Protocol (RTSP), Dynamic Adaptive Streaming over HTTP (MPEG-DASH), etc.

[0098] FIG. 11 is a block diagram illustrating a virtualization environment 1100 in which functions implemented by some embodiments may be virtualized In the present context, virtualizing means creating virtual versions of apparatuses or devices which may include virtualizing hardware platforms, storage devices and networking resources. As used herein, virtualization can be applied to any device described herein, or components thereof, and relates to an implementation in which at least a portion of the functionality is implemented as one or more virtual components. Some or all of the functions described herein may be implemented as virtual components executed by one or more virtual machines (VMs) implemented in one or more virtual environments 1100 hosted by one or more of hardware nodes, such as a hardware computing device that operates as a network node, UE, core network node, or host. Further, in embodiments in which the virtual node does not require radio connectivity (e.g., a core network node or host), then the node may be entirely virtualized. In some embodiments, thevirtualization environment 1100 includes components defined by the O-RAN Alliance, such as an O-Cloud environment orchestrated by a Service Management and Orchestration Framework via an 0-2 interface

[0099] Applications 1102 (which may alternatively be called software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) are run in the virtualization environment Q400 to implement some of the features, functions, and / or benefits of some of the embodiments disclosed herein.

[0100] Hardware 1104 includes processing circuitry, memory that stores software and / or instructions executable by hardware processing circuitry, and / or other hardware devices as described herein, such as a network interface, input / output interface, and so forth. Software may be executed by the processing circuitry to instantiate one or more virtualization layers 1106 (also referred to as hypervisors or virtual machine monitors (VMMs)), provide VMs 1108a and 1108b (one or more of which may be generally referred to as VMs 1108), and / or perform any of the functions, features and / or benefits described in relation with some embodiments described herein. The virtualization layer 1106 may present a virtual operating platform that appears like networking hardware to the VMs 1108.

[0101] The VMs 1108 comprise virtual processing, virtual memory, virtual networking or interface and virtual storage, and may be run by a corresponding virtualization layer 1106. Different embodiments of the instance of a virtual appliance 1102 may be implemented on one or more of VMs 1108, and the implementations may be made in different ways. Virtualization of the hardware is in some contexts referred to as network function virtualization (NFV). NFV may be used to consolidate many network equipment types onto industry standard high volume server hardware, physical switches, and physical storage, which can be located in data centers, and customer premise equipment.

[0102] In the context of NFV, a VM 1108 may be a software implementation of a physical machine that runs programs as if they were executing on a physical, non-virtualized machine. Each of the VMs 1108, and that part of hardware 1104 that executes that VM, be it hardware dedicated to that VM and / or hardware shared by that VM with others of the VMs, forms separate virtual network elements. Still in the context of NFV, a virtual network function is responsible for handling specific network functions that run in one or more VMs 1108 on top of the hardware 1104 and corresponds to the application 1102.

[0103] Hardware 1104 may be implemented in a standalone network node with generic or specific components. Hardware 1104 may implement some functions via virtualization. Alternatively, hardware 1104 may be part of a larger cluster of hardware (e.g. such as in a data center or CPE) where many hardware nodes work together and are managed via management and orchestration 1110, which, among others, oversees lifecycle management of applications 1102. In some embodiments, hardware 1104 is coupled to one or more radio units that each include one or more transmitters and one or more receivers that may be coupled to one or more antennas. Radio units may communicate directly with other hardware nodes via one or more appropriate network interfaces and may be used in combination with the virtual components to provide a virtual node with radio capabilities, such as a radio access node or a base station. In some embodiments, some signaling can be provided with the use of a control system 1112 which may alternatively be used for communication between hardware nodes and radio units.

[0104] FIG. 12 shows a communication diagram of a host 1202 communicating via a network node 1204 with a UE 1206 over a partially wireless connection in accordance with some embodiments. Example implementations, in accordance with various embodiments, of the UE (such as a UE 712a of FIG 7 and / or UE 800 of FIG 8), network node (such as network node 710a of FIG. 7 and / or network node 900 of FIG. 9), and host (such as host 716 of FIG. 7 and / or host 1000 of FIG. 10) discussed in the preceding paragraphs will now be described with reference to FIG. 12.

[0105] Like host 1000, embodiments of host 1202 include hardware, such as a communication interface, processing circuitry, and memory. The host 1202 also includes software, which is stored in or accessible by the host 1202 and executable by the processing circuitry. The software includes a host application that may be operable to provide a service to a remote user, such as the UE 1206 connecting via an over-the-top (OTT) connection 1250 extending between the UE 1206 and host 1202. In providing the service to the remote user, a host application may provide user data which is transmitted using the OTT connection 1250.

[0106] The network node 1204 includes hardware enabling it to communicate with the host 1202 and UE 1206. The connection 1260 may be direct or pass through a core network (like core network 706 of FIG. 7) and / or one or more other intermediate networks, such as one or more public, private, or hosted networks. For example, an intermediate network may be a backbone network or the Internet.

[0107] The UE 1206 includes hardware and software, which is stored in or accessible by UE 1206 and executable by the UE’s processing circuitry. The software includes a client application, such as a web browser or operatorspecific “app” that may be operable to provide a service to a human or non-human user via UE 1206 with the support of the host 1202. In the host 1202, an executing host application may communicate with the executing client application via the OTT connection 1250 terminating at the UE 1206 and host 1202. In providing the service to the user, the UE's client application may receive request data from the host's host application and provide user data in response to the request data. The OTT connection 1250 may transfer both the request data and the user data. The UE's client application may interact with the user to generate the user data that it provides to the host application through the OTT connection 1250.

[0108] The OTT connection 1250 may extend via a connection 1260 between the host 1202 and the network node 1204 and via a wireless connection 1270 between the network node 1204 and the UE 1206 to provide the connection between the host 1202 and the UE 1206. The connection 1260 and wireless connection 1270, over which the OTT connection 1250 may be provided, have been drawn abstractly to illustrate the communication between the host 1202 and the UE 1206 via the network node 1204, without explicit reference to any intermediary devices and the precise routing of messages via these devices.

[0109] As an example of transmitting data via the OTT connection 1250, in step 1208, the host 1202 provides user data, which may be performed by executing a host application. In some embodiments, the user data is associated with a particular human user interacting with the UE 1206. In other embodiments, the user data is associated with a UE 1206 that shares data with the host 1202 without explicit human interaction. In step 1210, the host 1202 initiates a transmission carrying the user data towards the UE 1206. The host 1202 may initiate the transmission responsive to a request transmitted by the UE 1206. The request may be caused by human interaction with theUE 1206 or by operation of the client application executing on the UE 1206. The transmission may pass via the network node 1204, in accordance with the teachings of the embodiments described throughout this disclosure. Accordingly, in step 1212, the network node 1204 transmits to the UE 1206 the user data that was carried in the transmission that the host 1202 initiated, in accordance with the teachings of the embodiments described throughout this disclosure. In step 1214, the UE 1206 receives the user data carried in the transmission, which may be performed by a client application executed on the UE 1206 associated with the host application executed by the host 1202.

[0110] In some examples, the UE 1206 executes a client application which provides user data to the host 1202. The user data may be provided in reaction or response to the data received from the host 1202. Accordingly, in step 1216, the UE 1206 may provide user data, which may be performed by executing the client application. In providing the user data, the client application may further consider user input received from the user via an input / output interface of the UE 1206. Regardless of the specific manner in which the user data was provided, the UE 1206 initiates, in step 1218, transmission of the user data towards the host 1202 via the network node 1204. In step 1220, in accordance with the teachings of the embodiments described throughout this disclosure, the network node 1204 receives user data from the UE 1206 and initiates transmission of the received user data towards the host 1202. In step 1222, the host 1202 receives the user data carried in the transmission initiated by the UE 1206.

[0111] One or more of the various embodiments improve the performance of OTT services provided to the UE 1206 using the OTT connection 1250, in which the wireless connection 1270 forms the last segment.

[0112] In an example scenario, factory status information may be collected and analyzed by the host 1202. As another example, the host 1202 may process audio and video data which may have been retrieved from a UE for use in creating maps. As another example, the host 1202 may collect and analyze real-time data to assist in controlling vehicle congestion (e.g., controlling traffic lights). As another example, the host 1202 may store surveillance video uploaded by a UE. As another example, the host 1202 may store or control access to media content such as video, audio, VR or AR which it can broadcast, multicast or unicast to UEs. As other examples, the host 1202 may be used for energy pricing, remote control of non-time critical electrical load to balance power generation needs, location services, presentation services (such as compiling diagrams etc. from data collected from remote devices), or any other function of collecting, retrieving, storing, analyzing and / or transmitting data

[0113] In some examples, a measurement procedure may be provided for the purpose of monitoring data rate, latency and other factors on which the one or more embodiments improve. There may further be an optional network functionality for reconfiguring the OTT connection 1250 between the host 1202 and UE 1206, in response to variations in the measurement results. The measurement procedure and / or the network functionality for reconfiguring the OTT connection may be implemented in software and hardware of the host 1202 and / or UE 1206. In some embodiments, sensors (not shown) may be deployed in or in association with other devices through which the OTT connection 1250 passes; the sensors may participate in the measurement procedure by supplying values of the monitored quantities exemplified above, or supplying values of other physical quantities from which software may compute or estimate the monitored quantities. The reconfiguring of the OTT connection 1250 may includemessage format, retransmission settings, preferred routing etc.; the reconfiguring need not directly alter the operation of the network node 1204. Such procedures and functionalities may be known and practiced in the art. In certain embodiments, measurements may involve proprietary UE signaling that facilitates measurements of throughput, propagation times, latency and the like, by the host 1202. The measurements may be implemented in that software causes messages to be transmitted, in particular empty or 'dummy' messages, using the OTT connection 1250 while monitoring propagation times, errors, etc.

[0114] Although the computing devices described herein (e.g., UEs, network nodes, hosts) may include the illustrated combination of hardware components, other embodiments may comprise computing devices with different combinations of components. It is to be understood that these computing devices may comprise any suitable combination of hardware and / or software needed to perform the tasks, features, functions and methods disclosed herein. Determining, calculating, obtaining or similar operations described herein may be performed by processing circuitry, which may process information by, for example, converting the obtained information into other information, comparing the obtained information or converted information to information stored in the network node, and / or performing one or more operations based on the obtained information or converted information, and as a result of said processing making a determination. Moreover, while components are depicted as single boxes located within a larger box, or nested within multiple boxes, in practice, computing devices may comprise multiple different physical components that make up a single illustrated component, and functionality may be partitioned between separate components. For example, a communication interface may be configured to include any of the components described herein, and / or the functionality of the components may be partitioned between the processing circuitry and the communication interface. In another example, non-computationally intensive functions of any of such components may be implemented in software or firmware and computationally intensive functions may be implemented in hardware.

[0115] In certain embodiments, some or all of the functionality described herein may be provided by processing circuitry executing instructions stored on in memory, which in certain embodiments may be a computer program product in the form of a non-transitory computer-readable storage medium. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry without executing instructions stored on a separate or discrete device-readable storage medium, such as in a hard-wired manner. In any of those particular embodiments, whether executing instructions stored on a non-transitory computer-readable storage medium or not, the processing circuitry can be configured to perform the described functionality. The benefits provided by such functionality are not limited to the processing circuitry alone or to other components of the computing device, but are enjoyed by the computing device as a whole, and / or by end users and a wireless network generally.

[0116] While various embodiments are described herein, it should be understood that they have been presented by way of example only, and not limitation. Thus, the breadth and scope of this disclosure should not be limited by any of the above-described exemplary embodiments. Moreover, any combination of the above-described elements in all possible variations thereof is encompassed by the disclosure unless otherwise indicated herein or otherwise clearly contradicted by context.

[0117] Additionally, while the processes described above and illustrated in the drawings are shown as a sequence of steps, this was done solely for the sake of illustration. Accordingly, it is contemplated that some steps may be added, some steps may be omitted, the order of the steps may be re-arranged, and some steps may be performed in parallel.CITATIONS LIST

[0118] 3GPP TR 23.700-70 vO.3.0 (Feb 2024): Study on architecture enhancement for Extended Reality and Media service (XRM); Phase 2

[0119] IETF RFC 9297: HTTP Datagrams and the Capsule Protocol

[0120] IETF RFC 9298: Proxying UDP in HTTP

[0121] IETF RFC 9484: Proxying IP in HTTP

[0122] Multipath Extensions for QUIC (available at https: / / datatracker.ietf.org / doc / draft-ietf-quic-multipath / )

[0123] QUIC-Aware Proxying Using HTTP (available at https: / / datatracker.ietf.org / doc / draft-pauly-masque-quic- proxy /

[0124] The invention can also be defined by the following clauses:1. A method (400) comprising: establishing (420) a secure tunnel for sending Protocol Data unit, PDU, set information; and sending (460) encrypted first PDU set information via the secure tunnel.2. The method of clause 1 , wherein establishing the secure tunnel comprises receiving a request for a secured tunnel protocol with an indication to provide PDU set information.3. The method of clause 1 or 2, further comprising: receiving (430) a request for an end-to-end QUIC connection from a client over a secure tunnel.4. The method of any of clauses 1-3, further comprising: sending one or more encrypted first PDUs of a first PDU set to a client, wherein the first PDU set information corresponds to the first PDUs.5. The method of clause 4, wherein the first PDUs are sent together with the PDU Set information for every PDU in the set.6. The method of any of clauses 1-5, further comprising: sending (410) a request for application session establishment for communicating PDU set identification information to a network to enable the network to identify packets received from a User Equipment, UE, that arepart of a QUIC connection.7. The method of clause 6, wherein the request for application session establishment comprises one or more of Multiplexed Application Substrate over QUIC Encryption, MASQUE, protocol description information; an indication to use Connect-UDP for PDU set identification; a Fully Qualified Domain Name, FQDN, of an Application Server, AS; and / or an address of an AS for the Connect-UDP request.8. The method of any of clauses 1-7, wherein the tunnel protocol is MASQUE, and wherein the PDUs and PDU set information are sent over a MASQUE connection.9. The method of clause 8, wherein the PDU set information is sent in a capsule with the PDUs.10. The method of any of clauses 8, wherein the capsule and a QUIC PDU are coalesced into a single User Datagram Protocol, UDP, payload.11. The method of any of clauses 1-10, wherein the PDU set information comprises one or more of PDU set size, importance, PDU set sequence number, PDU sequence number within the first PDU set, and an end PDU indication.12. The method of clause 11 , wherein the PDU sequence number within the first PDU set is sent with one or more initial PDUs but not all PDUs in the set.13. The method of any of clauses 11 or 12, wherein the PDU sequence number within the first PDU set is sent with every PDU in the set.14. The method of any of clauses 1-13, wherein sending PDU set information comprises selecting a Connection ID, CID, for signaling packets belonging to different PDU Sets.15. The method of any of clauses 1-14, wherein one or more PDUs are sent to a User Equipment, UE, according to an encrypted end-to-end QUIC protocol.16. The method of any of clauses 1-15, further comprising: sending at least one additional encrypted PDU of the first PDU set without a set identification information capsule.17. The method of any of clauses 1-16, further comprising: sending (450) a QUIC header protection key for PDU identification information in a capsule.18. The method of any of clauses 1-17, further comprising: receiving (440) a message to establish additional paths, wherein a first set of PDUs is sent over a first path identified by a first CID and a second set of PDUs is sent over a second path identified by a second CID.19. The method of clause 18, wherein a plurality of subsequent sets of PDUs are alternately sent over the first and second paths20. The method of clause 18 or 19, wherein the first path is for odd PDU sets and the second path is for even PDU sets.21. The method of any of clauses 3-20, wherein the received QUIC connection establishment message indicates support for multi-path QUIC.22. The method of any of clauses 1-21, further comprising: sending (470) encrypted second PDU set information via the secure tunnel and one or more encrypted second PDUs of the second PDU set, wherein the PDUs of the second PDU set are sent with a different CID than PDUs of the first PDU set.23. The method of any of clauses 1-22, wherein the PDUs comprise extended Reality and Media, XRM, packets.24. The method of any of clauses 1-23, wherein establishing the secure tunnel comprises receiving a connection establishment message for PDU set identification information according to the tunnel protocol.25. The method of any of clauses 1-23, wherein establishing the secure tunnel comprises receiving a Connect- UDP from a PSA-UPF26. An apparatus (204, 708, 900, 1100) configured to: establish a secure tunnel for sending Protocol Data Unit, PDU, set information; and send encrypted first PDU set information via the secure tunnel.27. The apparatus of clause 26, further configured to perform any of the steps of clauses 2-24.28. The apparatus of clause 26 or 27, wherein the apparatus is an Application Server, AS.29. The apparatus of any of clauses 26-28, wherein the apparatus comprises an integrated MultiplexedApplication Substrate over QUIC Encryption, MASQUE, proxy for communication of PDU set information.30. A method (500) comprising: identifying (510) packets received from a User Equipment, UE, wherein the packets are part of a QUIC connection with a target Application Server, AS; sending (530) a request to tunnel the UE's connection to the target AS, wherein the request indicates communication of encrypted Protocol Data Unit, PDU, set information on a secure tunnel; and receiving (540) PDU set information from the target AS over the secure tunnel, wherein the PDU set information corresponds to encrypted PDUs received from the AS.31. The method of clause 30, wherein sending the request to tunnel the UE's connection to the target AS comprises sending a Connect-UDP to the target AS.32. The method of clause 30 or 31 , wherein an identification of received packets of a QUIC connection for which PDU set information will be received is based on received or configured information.33. The method of clause 32, wherein the received information comprises N4 rules or information regarding a Multiplexed Application Substrate over QUIC Encryption, MASQUE, for the tunnel connection to the target AS.34. The method of clause 33, wherein the N4 rules comprise one or more of a Quality Enforcement Rule, QER; a Forwarding Action Rule, FAR; a Packet Detection Rule, PDR; a Fully Qualified Domain Name, FQDN, of the target AS; and / or a Connect-UDP information.35. The method of any of clauses 30-34, wherein the secure tunnel for communicating PDU set information is a MASQUE tunnel.36. The method of any of clauses 30-35, further comprising: selecting (520) the target AS.37. The method of clause 36, wherein the selecting is based on matching at least one rule to received information regarding encrypted traffic identification and associated PDU set identification.38. The method of any of clauses 30-37, further comprising: forwarding (550) at least one QUIC packet from the UE towards the target AS using the secure tunnel connection.39. The method of any of clauses 20-37, wherein at least one received encrypted PDU is not encapsulated andsent using QUIC-aware forwarding translating a QUIC header destination connection identifier of the AS to a UE QUIC packet.40. The method of any of clauses 30-39, wherein the encrypted PDUs are received together with a capsule containing the corresponding PDU set identification information.41. The method of clause 40, wherein the encrypted PDU and the PDU set information are each one of them encapsulated in a QUIC packet and coalesced into a single User Datagram Protocol, UDP, payload.42. The method of any of clauses 30-41, wherein the set identification information comprises one or more of PDU set size, importance, PDU set sequence number, PDU sequence number within the PDU set, and an end of PDU Set indication.43. The method of any of clauses 30-42, further comprising: receiving at least one additional encrypted PDU of the corresponding PDU set without a set identification information capsule.44. The method of any of clauses 30-43 further comprising: forwarding (580) packets received from the target AS on a tunnel connection to an NG-RAN.45. The method of clause 44, wherein the forwarding further comprises setting a PDU set sequence number for the packets for the first PDU set.46. The method of any of clauses 30-45, further comprising: establishing (560) one or more paths with the target AS, wherein a first path is for a first set of PDUs and is identified by a first Connection ID, CID, and a second path is for a second set of PDUs and is identified by a second CID.47. The method of clause 46, wherein the first path is for odd PDU sets and the second path is for even PDU sets.48. The methods of any of clauses 30-47, wherein the PDU set sequence number is received in a capsule with PDU Set information coalesced with every PDUs in the set.49. The method of any of clauses 30-48, further comprising: receiving (570) a header protection key in a capsule and extracting a sequence number of a QUIC packet using the key.50. The method of any clauses 30-49, further comprising deriving a PDU Sequence Number within a PDU set from the sequence number of QUIC packets by applying a difference between the sequence number of the QUIC packets and the PDU Sequence Number within the PDU Set received in the capsule of received PDUs.51. An apparatus (202, 708, 900, 1100) configured to identify packets received from a User Equipment, UE, wherein the packets are part of a QUIC connection with a target Application Server, AS; send a request to tunnel the UE's connection to the target AS, wherein the request indicates communication of encrypted Protocol Data Unit, PDU, set information on a secure tunnel; and receive PDU set information from the target AS over the secure tunnel, wherein the PDU set information corresponds to encrypted PDUs received from the AS.52. The apparatus of clause 51 , further configured to perform any of the steps of clauses 30-50.53. The apparatus of clause 51 or 52, wherein the apparatus is a PSA-UPF.54. A method (600) comprising: establishing (601) a secure tunnel connection; and sending (602) first PDU set information coalesced with one or more initial PDUs via the secure tunnel connection.55. The method of clause 54, wherein the tunnel connection is a Multiplexed Application Substrate over QUIC Encryption, MASQUE, connection, and wherein the PDU set information and PDU are coalesced in a capsule.56. The method of clause 54 or 55, further comprising: sending (603) one or more subsequent PDUs of the first PDU set via the tunnel connection and without the coalesced PDU set information.57. The method of any of clauses 54-56, further comprising: sending (604) a last PDU of the first PDU set coalesced with a PDU set end indication via the tunnel connection.58. The method of any of clauses 54-57 further comprising: sending (605) second PDU set information coalesced with one or more initial PDUs via the secure tunnel connection; sending (606) one or more subsequent PDUs of the second PDU set via the tunnel connection and without thecoalesced PDU set information; and sending (607) a last PDU of the second PDU set coalesced with a PDU set end indication via the tunnel connection.59. The method of clause 58, wherein the PDUs of the first set are sent with a first Connection ID, CID, and the PDUs of the second set are sent with a second, different CID.60. The method of clause 59, wherein the first CID is for odd PDU sets and the second CID is for even PDU sets.61. The method of any of clauses 54-60, further comprising any of the steps of clauses 1-25.62. A method (650) comprising: configuring (651) a secure tunnel connection; and receiving (652) first PDU set information coalesced with one or more initial PDUs via the secure tunnel connection.63. The method of clause 62, wherein the tunnel connection is a Multiplexed Application Substrate over QUIC Encryption, MASQUE, connection, and wherein the PDU set information and PDU are coalesced in a capsule.64. The method of 62 or 63, further comprising: receiving (653) one or more subsequent PDUs of the first PDU set via the tunnel connection and without the coalesced PDU set information.65. The method of any of clauses 62-64, further comprising: receiving (654) a last PDU of the first PDU set coalesced with a PDU set end indication via the tunnel connection.66. The method of any of clauses 62-65, further comprising: receiving (655) second PDU set information coalesced with one or more initial PDUs via the secure tunnel connection; receiving (656) one or more subsequent PDUs of the second PDU set via the tunnel connection and without the coalesced PDU set information; and receiving (657) a last PDU of the second PDU set coalesced with a PDU set end indication via the tunnel connection.67. The method of clause 66, wherein the PDUs of the first set are received on a path with a first Connection ID,CID, and the PDUs of the second set are received on path with a second, different CID.68. The method of clause 67, wherein the first CID is for odd PDU sets and the second CID is for even PDU sets.69. The method of any of clauses 62-68, further comprising any of the steps of clauses 27-45.70. An apparatus configured to perform any of clauses 54-69. 71. A computer program product comprising a non-transitory computer readable medium storing instructions which when performed by processing circuitry of a device causes the device to perform any of 1-25, 30-50, and 54-69.

Claims

CLAIMS:

1. A method (400) comprising: establishing (420) a secure tunnel for sending Protocol Data unit, PDU, set information; and sending (460) encrypted first PDU set information via the secure tunnel.

2. The method of claim 1 , wherein establishing the secure tunnel comprises receiving a request for a secured tunnel protocol with an indication to provide PDU set information.

3. The method of claim 1 or 2, further comprising: receiving (430) a request for an end-to-end QUIC connection from a client over a secure tunnel.

4. The method of any of claims 1-3, further comprising: sending one or more encrypted first PDUs of a first PDU set to a client, wherein the first PDU set information corresponds to the first PDUs.

5. The method of claim 4, wherein the first PDUs are sent together with the PDU Set information for every PDU in the set.

6. The method of any of claims 1-5, further comprising: sending (410) a request for application session establishment for communicating PDU set identification information to a network to enable the network to identify packets received from a User Equipment, UE, that are part of a QUIC connection.

7. The method of claim 6, wherein the request for application session establishment comprises one or more of Multiplexed Application Substrate over QUIC Encryption, MASQUE, protocol description information; an indication to use Connect-UDP for PDU set identification; a Fully Qualified Domain Name, FQDN, of an Application Server, AS; and / or an address of an AS for the Connect-UDP request.

8. The method of any of claims 1-7, wherein the tunnel protocol is MASQUE, and wherein the PDUs and PDU set information are sent over a MASQUE connection.

9. The method of claim 8, wherein the PDU set information is sent in a capsule with the PDUs.

10. The method of claims 9, wherein the capsule and a QUIC PDU are coalesced into a single User Datagram Protocol, UDP, payload.

11. The method of any of claims 1-10, wherein the PDU set information comprises one or more of PDU set size, importance, PDU set sequence number, PDU sequence number within the first PDU set, and an end PDU indication.

12. The method of claim 11 , wherein the PDU sequence number within the first PDU set is sent with one or more initial PDUs but not all PDUs in the set.

13. The method of any of claims 11 or 12, wherein the PDU sequence number within the first PDU set is sent with every PDU in the set.

14. The method of any of claims 1-13, wherein sending PDU set information comprises selecting a Connection ID, CID, for signaling packets belonging to different PDU Sets.

15. The method of any of claims 1-14, wherein one or more PDUs are sent to a User Equipment, UE, according to an encrypted end-to-end QUIC protocol.

16. The method of any of claims 1-15, further comprising: sending at least one additional encrypted PDU of the first PDU set without a set identification information capsule.

17. The method of any of claims 1-16, further comprising: sending (450) a QUIC header protection key for PDU identification information in a capsule.

18. The method of any of claims 1-17, further comprising: receiving (440) a message to establish additional paths, wherein a first set of PDUs is sent over a first path identified by a first CID and a second set of PDUs is sent over a second path identified by a second CID.

19. The method of any of claims 1-18, wherein establishing the secure tunnel comprises receiving a connection establishment message for PDU set identification information according to the tunnel protocol.

20. The method of any of claims 1-18, wherein establishing the secure tunnel comprises receiving a Connect- UDP from a PSA-UPF.

21. An apparatus (204, 708, 900, 1100) configured to: establish a secure tunnel for sending Protocol Data Unit, PDU, set information; and send encrypted first PDU set information via the secure tunnel.

22. The apparatus of claim 21, further configured to perform any of the steps of claims 2-20.

23. The apparatus of claim 21 or 22, wherein the apparatus is an Application Server, AS.

24. A method (500) comprising: identifying (510) packets received from a User Equipment, UE, wherein the packets are part of a QUIC connection with a target Application Server, AS; sending (530) a request to tunnel the UE's connection to the target AS, wherein the request indicates communication of encrypted Protocol Data Unit, PDU, set information on a secure tunnel; and receiving (540) PDU set information from the target AS over the secure tunnel, wherein the PDU set information corresponds to encrypted PDUs received from the AS.

25. The method of claim 24, wherein sending the request to tunnel the UE's connection to the target AS comprises sending a Connect-UDP to the target AS.

26. The method of claim 24 or 25, wherein an identification of received packets of a QUIC connection for which PDU set information will be received is based on received or configured information.

27. The method of claim 26, wherein the received information comprises N4 rules or information regarding a Multiplexed Application Substrate over QUIC Encryption, MASQUE, for the tunnel connection to the target AS.

28. The method of claim 27, wherein the N4 rules comprise one or more of a Quality Enforcement Rule, QER; a Forwarding Action Rule, FAR; a Packet Detection Rule, PDR; a Fully Qualified Domain Name, FQDN, of the target AS; and / or a Connect-UDP information.

29. The method of any of claims 24-28, wherein the secure tunnel for communicating PDU set information is a MASQUE tunnel.

30. The method of any of claims 24-29, further comprising: selecting (520) the target AS.

31. The method of claim 30, wherein the selecting is based on matching at least one rule to received information regarding encrypted traffic identification and associated PDU set identification.

32. The method of any of claims 24-31, further comprising: forwarding (550) at least one QUIC packet from the UE towards the target AS using the secure tunnel connection.

33. The method of any of claims 24-31 , wherein at least one received encrypted PDU is not encapsulated and sent using QUIC-aware forwarding translating a QUIC header destination connection identifier of the AS to a UE QUIC packet.

34. The method of any of claims 24-33, wherein the encrypted PDUs are received together with a capsule containing the corresponding PDU set identification information.

35. The method of claim 34, wherein the encrypted PDU and the PDU set information are each one of them encapsulated in a QUIC packet and coalesced into a single User Datagram Protocol, UDP, payload.

36. The method of any of claims 24-35, wherein the set identification information comprises one or more of PDU set size, importance, PDU set sequence number, PDU sequence number within the PDU set, and an end of PDU Set indication.

37. The method of any of claims 24-36, further comprising: receiving at least one additional encrypted PDU of the corresponding PDU set without a set identification information capsule.

38. The method of any of claims 24-37 further comprising: forwarding (580) packets received from the target AS on a tunnel connection to an NG-RAN.

39. The method of claim 38, wherein the forwarding further comprises setting a PDU set sequence number for the packets for the first PDU set.

40. An apparatus (202, 708, 900, 1100) configured to identify packets received from a User Equipment, UE, wherein the packets are part of a QUIC connection with a target Application Server, AS; send a request to tunnel the UE's connection to the target AS, wherein the request indicates communication of encrypted Protocol Data Unit, PDU, set information on a secure tunnel; and receive PDU set information from the target AS over the secure tunnel, wherein the PDU set information corresponds to encrypted PDUs received from the AS.

41. The apparatus of claim 40, further configured to perform any of the steps of claims 25-39.

42. The apparatus of claim 40 or 41 , wherein the apparatus is a PSA-UPF.

43. A computer program product comprising a non-transitory computer readable medium storing instructions which when performed by processing circuitry of a device causes the device to perform any of 1-20 and 24-39.

Images