Efficient policy enforcement using network tokens for services—user-plane approach
One aspect relates to initiating, by a device, a connection with an application server associated with one or more application services. A gateway derives an uplink network token and/or a downlink network token. The tokens are provisioned to the device and/or an application server over the user-plane. The tokens are included with uplink and/or downlink packets, respectively. Another aspect relates to receiving a data packet at a gateway. The gateway determines a requirement for a network token from the packet. The gateway derives the network token based on a device subscription profile maintained by a network. The network token may be sent with the packet to a destination address associated with the packet. A packet including a network token may be received at a gateway. The gateway may verify the network token and send the data packet to an application server or a device if the verifying is successful.
1. A method, operational at a device, comprising:
initiating, by the device, a connection with an application server associated with one or more application services;
obtaining, in response to initiating the connection, a network token from the application server, wherein the network token is:
derived, by a gateway separate from the device and the application server, with a function having a set of input parameters including a secret key that is unknown to the device and unknown to the application server,
associated with a first user-plane data flow of a set of one or more user-plane data flows,
associated with a first application service of the one or more application services, and
provisioned to the device from the application server via one or more user-plane messages; and
sending the network token with one or more uplink (UL) packets from the device to the application server in the user-plane.
2. The method of claim 1 , wherein the network token is based on a device subscription profile of the device and/or a policy of the first application service.
3. The method of claim 1 , wherein the network token reflects a policy enforced by a core network with respect to the device.
4. The method of claim 1 , wherein initiating the connection includes sending a connection request and the connection request includes an explicit request for the network token.
5. The method of claim 1 , wherein initiating the connection includes sending a packet representative of an implicit request for the network token.
6. The method of claim 5 , wherein the implicit request is represented by sending a first packet to the application server.
7. The method of claim 1 , wherein initiating the connection includes sending a packet that requires an acknowledgement from the application server, wherein the acknowledgement transports the network token to the device.
8. The method of claim 1 , wherein the network token is transported from the device to a packet data network (PDN) gateway (P-GW) in a user-plane shim header.
9. The method of claim 8 , wherein the user-plane shim header is located above an Internet Protocol (IP) layer.
10. The method of claim 1 , wherein the network token is transported from the device to a packet data network (PDN) gateway (P-GW) in an Internet Protocol (IP) extension header as defined in IP version 6 (IPv6).
11. The method of claim 1 , wherein the network token is transported from the device to an access node in a packet data convergence protocol (PDCP) layer, copied to a general packet radio service (GPRS) tunneling protocol (GTP) layer for a user-plane (GTP-U) layer in the access node, and transported from the access node to a packet data network (PDN) gateway (P-GW) in the GTP-U layer.
12. A device, comprising:
a network communication interface configured to communicate over a wireless network; and
a processing circuit coupled to the network communication interface, the processing circuit configured to:
initiate a connection with an application server associated with one or more application services;
obtain, in response to initiating the connection, a network token from the application server, wherein the network token is:
derived, by a gateway separate from the device and the application server, with a function having a set of input parameters including a secret key that is unknown to the device and unknown to the application server,
associated with a first user-plane data flow of a set of one or more user-plane data flows,
associated with a first application service of the one or more application services, and
provisioned to the device from the application server via one or more user-plane messages; and
send the network token with one or more uplink (UL) packets from the device to the application server in the user-plane.