NEF-AF Packet Flow Descriptor Exchange for Encrypted Traffic Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 5G telecommunications systems struggle to classify encrypted traffic due to limitations in Deep Packet Inspection (DPI) techniques, necessitating third-party solutions that require new interaction methods within the 3GPP framework.
Innovation Solution
The proposed method extends the NEF northbound API to allow the Application Function (AF) to initiate interactions with the Network Exposure Function (NEF) for Packet Flow Descriptor (PFD) management, enabling support for deterministic and machine learning-based traffic classification services, and allows operators to subscribe to external classification services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If Deep Packet Inspection (DPI) techniques are used for traffic classification, then traffic can be classified based on destination URLs, SNIs, and other clear text fields, but encrypted traffic cannot be classified accurately
Solution Approach 1:
The patent introduces a third-party traffic classification service as an intermediary between the operator's NEF and the application's traffic data. This intermediary service receives encrypted traffic data, applies sophisticated classification algorithms (including machine learning), and returns classification results to the operator without requiring the operator to directly handle or decrypt the encrypted traffic themselves
Solution Approach 2:
The patent replaces traditional mechanical DPI inspection methods with software-based machine learning classification services. Instead of using DPI engines to inspect packet contents, the system uses remote classification services that analyze traffic patterns and characteristics through software algorithms, enabling classification of encrypted traffic without direct packet inspection
2Measurement precision
If third-party traffic classification services are used to classify encrypted traffic, then classification accuracy improves, but new interaction methods and APIs are required within the 3GPP framework
Solution Approach 1:
The patent extends the existing NEF northbound API to serve multiple functions: it maintains compatibility with existing PFD management operations while adding new capabilities for third-party classification service interactions. The same API framework handles both traditional operator-initiated PFD requests and new subscription-based classifications from external services
Solution Approach 2:
The patent inverts the traditional initiation model where the operator (NEF) starts the interaction. Instead, the third-party classification service can initiate interactions by subscribing to traffic data and pushing classification results to the operator. This inversion allows the classification service to control the interaction flow and reduces the burden on the operator to manage complex request-response cycles
3Ease of operation
If the Application Function (AF) initiates PFD provision to the Network Exposure Function (NEF), then the procedure works for applications that provide PFDs, but operators cannot subscribe to external classification services
Solution Approach 1:
The patent makes the PFD management procedure dynamic by allowing multiple initiation modes. The system can operate in AF-initiated mode for applications that provide PFDs, or switch to NEF-initiated/subscription mode for operators wanting to use external classification services. The API framework adapts its behavior based on the service type and initiation mode required
Solution Approach 2:
The patent segments the PFD management functionality into distinct service types: one pathway for AF-provided PFDs (maintaining existing simple procedures) and another pathway for external classification services (enabling subscriptions and notifications). This segmentation allows each pathway to be optimized independently without compromising the other
Data Source
Figure 1
Figure 2~4
Figure 5~7
AI summary
A method of supporting Packet Flow Descriptor, PFD, management in a Service Based Architecture, SBA, based telecommunication network, wherein said telecommunication network comprises an Application Function, AF, that is arranged for implementing an Packet Flow Descriptor, PFD, management service allowing request and response message from and to a Network Exposure Function, NEF, comprised by said telecommunication network, said method comprises the steps of receiving, by said AF, from said NEF, a request message for requesting a PFD, wherein said request message comprises an application identification for identifying an application transmitting, by said AF, to said NEF, a response message comprising said application identification and said requested PFD. A complementary method and corresponding network functions and a computer program product are also presented herein.