WO2021018420A1

WO2021018420A1 - Packet detection

Info

Publication number: WO2021018420A1
Application number: PCT/EP2020/058105
Authority: WO
Inventors: Miguel Angel PUENTE PESTAÑA; Carlos JIMENEZ CORDON; Juan-Mario Martin-Sanchez; Ruth PALLARES DEL EGIDO; Carlota VILLASANTE
Original assignee: Telefonaktiebolaget Lm Ericsson (Publ)
Priority date: 2019-07-26
Filing date: 2020-03-24
Publication date: 2021-02-04

Abstract

Methods and apparatus are provided. In an example aspect, a method in a wireless device of transmitting a frame to a receiver is provided. The method comprises determining that the frame is not successfully received by the receiver via a first wireless communication link between the wireless device and the receiver, and transmitting the frame to the receiver via a second wireless communication link between the wireless device and the receiver.

Description

PACKET DETECTION

Technical Field

Examples of the present disclosure relate to packet detection, for example relating to Packet Detection Rules (PDRs) and traffic monitoring.

Background

In 4G telecommunications (also referred to as Long Term Evolution, LTE), Control and User Plane Separation (CUPS) can enable a flexible placement of separated control plane (e.g. PGW-C) and user plane (e.g. PGW-U) functions, and may support diverse deployment scenarios (e.g. central or distributed user plane function). In 4G, the Sxb interface is the reference point between PGW-C and PGW-U, and is specified in 3GPP TS 29.244, which is incorporated herein by reference. The protocol for communications over the Sxb interface is the so-called Packet Forwarding Control Protocol (PFCP). Figure 1 shows an example of part of the 4G architecture 100 including the Sxb interface between PDN Gateway-C (PGW- C) and PDN Gateway-U (PGW-U).

The 5G architecture natively separates Session Management Function (SMF) and User Plane Function (UPF) network functions through the N4 reference point, which is also based on Packet Forwarding Control Protocol (PFCP). Figure 2 shows an example of part of the 5G architecture 200. In CUPS, the User Plane (UP) Function (UPF) reports to the control plane (CP) function (i.e. the SMF) the capabilities it supports. These are detailed for example in 3GPP TS 29 244, which is incorporated herein by reference, in Table 8.2.25-1 : UP Function Features. The SMF controls the packet processing in the UPF by establishing, modifying or deleting PFCP Sessions and by provisioning (i.e. adding, modifying or deleting) one or more Packet Detection Rules (PDRs), Forwarding Action Rules (FARs), Quality of Service Enforcement Rules (QERs), Usage reporting Rules (URRs) and/or Buffering Action Rules (BARs) per PFCP session, whereby an PFCP session may correspond to an individual Protocol Data Unit (PDU) session or a standalone PFCP session not tied to any PDU session.

Each PDR contains Packet Detection Information (PDI) specifying for example the traffic filters or signatures against which incoming packets are matched. Each PDR is associated to the following rules providing the set of instructions to apply to packets matching the PDI: • one FAR, which contains instructions related to the processing of a matching packet, specifically forward, duplicate, drop or buffer the packet, with or without notifying the CP function about the arrival of the packet ;

• zero, one or more QERs, which contain instructions related to Quality of Service (QoS) enforcement of the traffic;

• zero, one or more URRs, which contain instructions related to traffic measurement and reporting; and

• zero, one or more BARs, which contain buffering rules to apply to the matching

packet.

Some wireless communication devices such as for example User Equipments (UEs) may allow tethering of their wireless communication capability. Tethering is the sharing of a device's connection with other devices connected to it. For example, a device may share its cellular (e.g. 4G and/or 5G) connection with one or more other devices, referred to as tethered devices, and may communicate with the other devices using another (wired or wireless) communication technology such as for example Wi-Fi, Bluetooth or by physical connection using a cable, for example using Universal Serial Bus (USB). For IPv4 networks, tethering may operate using Network Address Translation (NAT) performed by the device sharing its connection, so from the network point of view, there is just one device with a single IPv4 network address. However, it may be technically possible to attempt to identify multiple devices. For example network operators may detect if a certain device (e.g. UE) is sharing its connection with other tethered devices using traffic inspection mechanisms (e.g. DPI and heuristic inspection). Traffic relating to the subscriber device (the device or UE sharing its connection) may be inspected to detect tethering devices connected to the UE by searching for differences in the protocol headers of packets in the traffic to set up a fingerprint for the tethered device(s). A fingerprint may comprise a certain set of parameters for identifying traffic relating to a tethered device (that is, traffic going to or coming from the tethered device).

Summary

One aspect of the present disclosure provides a method of traffic monitoring in a network node. The method comprises receiving a packet, determining, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule, and performing, for each matching packet detection rule, an action associated with the matching packet detection rule. Another aspect of the present disclosure provides a method in a first network node. The method comprises sending, to a second network node, an indication of a plurality of packet detection rules and an indication, for each of the packet detection rules, of an associated packet detection rule set of a plurality of packet detection rule sets such that each packet detection rule set is associated with at least one of the packet detection rules and at least one of the packet detection rule sets is associated with a plurality of the packet detection rules.

Another aspect of the present disclosure provides a method in a first network node. The method comprises sending, to a second network node, an indication of a plurality of Policy and Charging Control, PCC, rules and an indication, for each of the PCC rules, of an associated PCC rule set of a plurality of PCC rule sets such that each PCC rule set is associated with at least one of the PCC rules and at least one of the PCC rule sets is associated with a plurality of the PCC rules.

Another aspect of the present disclosure provides apparatus for traffic monitoring in a network node. The apparatus comprises a processor and a memory. The memory contains instructions executable by the processor such that the apparatus is operable to receive a packet, determine, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule, and perform, for each matching packet detection rule, an action associated with the matching packet detection rule.

Another aspect of the present disclosure provides apparatus in a first network node. The apparatus comprises a processor and a memory. The memory contains instructions executable by the processor such that the apparatus is operable to send, to a second network node, a plurality of packet detection rules and an indication of an associated packet detection rule set for each of the packet detection rules such that each packet detection rule set is associated with at least one of the packet detection rules and at least one of the packet detection rule sets is associated with a plurality of the packet detection rules.

Another aspect of the present disclosure provides apparatus in a first network node. The apparatus comprises a processor and a memory. The memory contains instructions executable by the processor such that the apparatus is operable to send, to a second network node, an indication of a plurality of Policy and Charging Control, PCC, rules and an indication, for each of the PCC rules, of an associated PCC rule set of a plurality of PCC rule sets such that each PCC rule set is associated with at least one of the PCC rules and at least one of the PCC rule sets is associated with a plurality of the PCC rules.

Another aspect of the present disclosure provides apparatus for traffic monitoring in a network node. The apparatus is configured to receive a packet, determine, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule, and perform, for each matching packet detection rule, an action associated with the matching packet detection rule.

Another aspect of the present disclosure provides Apparatus in in a first network node, the apparatus configured to send, to a second network node, a plurality of packet detection rules and an indication of an associated packet detection rule set for each of the packet detection rules such that each packet detection rule set is associated with at least one of the packet detection rules and at least one of the packet detection rule sets is associated with a plurality of the packet detection rules.

Another aspect of the present disclosure provides apparatus in a first network node, the apparatus configured to send, to a second network node, an indication of a plurality of Policy and Charging Control, PCC, rules and an indication, for each of the PCC rules, of an associated PCC rule set of a plurality of PCC rule sets such that each PCC rule set is associated with at least one of the PCC rules and at least one of the PCC rule sets is associated with a plurality of the PCC rules.

Brief Description of the Drawings

For a better understanding of examples of the present disclosure, and to show more clearly how the examples may be carried into effect, reference will now be made, by way of example only, to the following drawings in which:

Figure 1 shows an example of part of the 4G architecture;

Figure 2 shows an example of part of the 5G architecture;

Figure 3 is a flow chart of an example of a method 300 of traffic monitoring in a network node;

Figure 4 shows an example of packet detection rules arranged into sets; Figure 5 shows an example of packet detection rules arranged into sets where a packet detection rule associated with at least one of the sets is associated with a forwarding action;

Figure 6 illustrates an example of communication steps in a PFCP association request between a UPF and a SMF;

Figure 7 illustrates an example of communication steps during provisioning of PCC rules and PDRs at PDU session establishment;

Figure 8 illustrates another example of communication steps during provisioning of PCC rules and PDRs at PDU session establishment;

Figure 9 is a flow chart of an example of a method in a first network node;

Figure 10 is a flow chart of an example of a method in a first network node;

Figure 11 is a schematic of an example of apparatus for traffic monitoring in a network node;

Figure 12 is a schematic of an example of apparatus in a first network node; and

Figure 13 is a schematic of an example of apparatus in a first network node.

Detailed Description

The following sets forth specific details, such as particular embodiments or examples for purposes of explanation and not limitation. It will be appreciated by one skilled in the art that other examples may be employed apart from these specific details. In some instances, detailed descriptions of well-known methods, nodes, interfaces, circuits, and devices are omitted so as not obscure the description with unnecessary detail. Those skilled in the art will appreciate that the functions described may be implemented in one or more nodes using hardware circuitry (e.g., analog and/or discrete logic gates interconnected to perform a specialized function, ASICs, PLAs, etc.) and/or using software programs and data in conjunction with one or more digital microprocessors or general purpose computers. Nodes that communicate using the air interface also have suitable radio communications circuitry. Moreover, where appropriate the technology can additionally be considered to be embodied entirely within any form of computer-readable memory, such as solid-state memory, magnetic disk, or optical disk containing an appropriate set of computer instructions that would cause a processor to carry out the techniques described herein.

Hardware implementation may include or encompass, without limitation, digital signal processor (DSP) hardware, a reduced instruction set processor, hardware (e.g., digital or analogue) circuitry including but not limited to application specific integrated circuit(s) (ASIC) and/or field programmable gate array(s) (FPGA(s)), and (where appropriate) state machines capable of performing such functions.

Examples of this disclosure are described in terms of a particular architecture, such as for example the 5G architecture. However, these examples may be applied also to other architectures, such as for example the 4G architecture.

In an example of a CUPS implementation, PDRs may be provided by SMF to UPF on a per PFCP session (the PDRs are ordered by precedence). When a User Plane (UP) packet reaches the UPF, the UPF identifies the PFCP session the packet belongs to, and evaluates the PDRs provided for that PFCP session (e.g. determines whether the packet matches the PDRs) according to their precedence. When the packet matches the PDI of a PDR, the UPF executes the rule(s) (FAR, QER, etc.) associated with that PDR, and evaluation of the PDRs stops. That is, the remaining PDRs, which are lower in precedence than the“matched”

PDR, are not evaluated. In other words, each packet can only match one PDR.

In such examples, it is not possible for a packet to match multiple PDRs and trigger the execution of the rules associated to the multiple matching PDRs. This may be problematic for some use cases. For example, a network operator may wish to detect tethering by a device (used interchangeably herein with UE), for example for information gathering purposes or if tethering is not allowed for the device or by the operator. Additionally or alternatively, an operator may also want to detect and apply traffic rules to tethering traffic (i.e. traffic to/from a tethered device) and non-tethering traffic (i.e. traffic to/from a subscriber device) independently. In another example, an operator may wish to report traffic statistics on a per application granularity (e.g. statistics relating to a particular application or web site) for all traffic (tethering and non-tethering), but at the same time the operator may wish to block the tethering traffic. The operator may also in some examples wish to block specific applications executing in tethered devices. Another possibility is that the operator may wish to apply different QoS when more than a certain number of tethered devices tethered to a particular UE are detected. Current solutions do not support such use cases since they require actions that are associated with multiple matching PDRs. In another example use case, an operator may wish to detect and report the operating system (OS) that is executing user applications.

Certain embodiments of this disclosure may provide a solution to address one or more of the aforementioned problems. Particular examples may comprise

• A Session Management Function (SMF) to configure Packet Detection Rule (PDR) sets in a User Plane Function (UPF). Each PDR set may have its own configuration defining the precedence of the PDR set with respect to other PDR sets, how to evaluate the PDRs within the set, how to trigger and execute the rules associated to the matching PDRs, and/or other configuration information.

• A User Plane Function (UPF) to evaluate the PDR sets sequentially according to the configured PDR set precedence, which may allow execution of actions associated with multiple matching PDRs.

• UPF to execute the rules (Forwarding Action Rule, FAR, QoS Enforcement Rule, QER, etc.) associated with each matching PDR according to the received configuration.

Certain embodiments of this disclosure may also provide features for a PCF-SMF interface proposing to group Policy and Charging Control (PCC) rules in PCC rule sets. A SMF may produce PDR rules and associated sets based on the PCC rules and sets.

In some examples of this disclosure, the evaluation of PDRs and/or PDR sets in a User Plane Function (UPF) may enable use cases that require performing actions associated with more than one PDR for a certain packet. That is, for example, use cases can be enabled where a packet matches multiple PDRs. In some examples, the PDR structure as defined by the current standards can be considered as a PDR set (e.g. a default PDR set).

Therefore, embodiments of this disclosure may be implemented as an extension of current specifications/standards. Some examples may allow a high degree of flexibility for future use cases. For example, where PDRs are arranged into sets, one or more PDR sets can be configured to match a single PDR, while other PDR sets can be configured to evaluate all PDRs within the set regardless the number of matching PDRs.

Figure 3 is a flow chart of an example of a method 300 of traffic monitoring in a network node. The network node may comprise for example a User Plane Function (UPF) or Packet Gateway-User Plane (PGW-U). The method 300 comprises, in step 302, receiving a packet, such as for example an uplink packet from a wireless device or User Equipment (UE), or a downlink packet with a destination being a wireless device or UE (such a downlink packet may be received for example from the Internet). Step 304 of the method 300 comprises determining, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule (PDR), for example whether the packet matches packet detection information (PDI) associated with the PDR. This may result in the packet matching one or more PDRs. In particular embodiments, for example, if the packet matches a PDR, and there are one or more PDRs that have not been evaluated with respect to the packet, the method 300 may continue to evaluate at least some of these PDR(s). The packet may be evaluated in some examples by determining whether the packet matches each of the PDRs in turn, for example in order of precedence associated with the PDRs. In other examples, there may be other rules or arrangements for determining which PDRs are evaluated, and in what order.

Step 306 of the method 300 comprises performing, for each matching packet detection rule, an action associated with the matching packet detection rule. Thus, for example, if the packet matches multiple PDRs, the method 300 may comprise performing multiple actions associated with the PDRs. Each“action” associated with a PDR may comprise one or more actions to be performed if the packet matches the PDR. In some examples, the action associated with each PDR comprises one or more of a forwarding action rule (FAR), buffering action rule (BAR), Quality of Service (QoS) enforcement rule (QER), usage reporting rule (URR) and/or policy control and charging (PCC) rule.

In some examples, performing, for each matching packet detection rule, an action associated with the matching packet detection rule, comprises performing the action associated with the matching packet detection rule based on configuration information for the packet detection rules, said configuration information defining how said action is to be performed. The configuration information may be received from another network node, such as for example a Session Management Function (SMF), Policy Control Function (PCF) or Packet Gateway-Control Plane (PGW-C).

In some examples, performing, for each matching packet detection rule, an action associated with the matching packet detection rule comprises performing the actions associated with the matching packet detection rules in an order of precedence associated with the packet detection rules. Therefore, the actions are performed in order of preference. The PDRs themselves may be evaluated (i.e. it is determined if they match the packet) in order of preference in some examples, though in other examples the PDRs may be evaluated in any order with the actions themselves performed in order of preference.

The method 300 may in some examples comprise determining whether the packet matches at least one of the packet detection rules after determining that the packet matches at least one other of the packet detection rules. Thus for example the method 300 may continue evaluating PDRs even after the packet has already matched one of the PDRs.

In some examples, each of the packet detection rules is associated with a respective packet detection rule set. Each set may comprise one or more PDRs. Figure 4 shows an example of packet detection rules 400 arranged into sets. Three sets 402, 404 and 406 are shown, though in other examples there may be two or more sets. In the example shown in Figure 4, each set includes three PDRs, although in other examples each set may include one or more PDRs, and there may be different numbers of PDRs in different sets.

In such examples, determining, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule may for example comprise determining, for each packet detection rule set, whether the packet matches the packet detection rule associated with the packet detection rule set. In some examples, where the PDR set is associated with multiple PDRs, the method 300 may evaluate all of the PDRs in a set, whether or not the packet matches a PDR in the set, before evaluating PDRs in another set. Thus the packet may match one or more PDRs in a set and associated action(s) may be performed for the matching PDR(S). For example, the method 300 may comprise determining, for each packet detection rule set, that the packet matches one of the packet detection rules in the packet detection rule set, and determining whether the packet matches at least one other packet detection rule in the packet detection rule set. In alternative examples, an action may be performed for a maximum of one matching PDR in a set. Thus, for example, the method 300 may comprise determining, for each packet detection rule set, that the packet matches one of the packet detection rules in the packet detection rule set, and refraining from determining whether the packet matches any other packet detection rule in the packet detection rule set and/or refraining from performing an action associated with any other packet detection rule in the packet detection rule set. In some examples, whether to perform actions associated with only one PDR in a set or (potentially) multiple PDRs in a set may be determined for example by an indication received from Session Management Function (SMF) or a Packet Gateway-Control Plane (PGW-C). For example, the indication may be received in configuration information such as that referred to above. In some examples, each packet detection rule set is associated with a respective precedence. In such examples, determining, for each of the plurality of packet detection rules, whether the packet matches the packet detection rule may comprise evaluating the packet detection rules in order of precedence of the associated sets. Thus for example PDRs in a highest precedence set may be evaluated for a packet first, and so on. This is illustrated in Figure 4 by arrows between the sets. Thus, for example, PDR set 402 may be the highest precedence set, PDR set 404 may be the next highest precedence set, and PDR set 406 may be the lowest precedence set. In some examples, each PDR in a set is associated with a precedence within that set, which may define the order of evaluation of the PDRs (or the order actions performed for matching PDRs) within that set.

In some examples, where the PDRs are arranged in sets, the packet detection rule associated with at least one of the sets is associated with a forwarding action (e.g. a Forwarding Action Rule, FAR). Figure 5 shows an example of this arrangement, where packet detection rules 500 are arranged into sets and a packet detection rule associated with at least one of the sets is associated with a forwarding action. In this particular example, there are three PDR sets 502, 504 and 506, though in other examples there may be two or more sets. Each set includes at least one FAR that is associated with one of the PDRs, with the exception in this example of the last PDR set 506. As shown in the example in Figure 5, the PDR 508 in PDR set 1 502 is associated with FAR 506 that“points” to PDR set 2 504. That is, for example, if the packet matches the PDR 508, the FAR 506 will “forward” the packet to PDR set 2 504 for evaluating PDR(s) within that set. PDR set 2 504 also includes a FAR associated with a PDR that forwards the packet to the next set (in this example the last set 506), and so on. Thus, for example, performing, for each matching packet detection rule, the action associated with the matching packet detection rule comprises, for each of a subset of the sets, the associated forwarding action (e.g. FAR) to forward the packet to another set of the sets. As a result of including FARs in at least some of the sets, in some examples the order in which the sets are chosen for evaluation of their associated PDRs may be defined, though in some examples the order may be different for different packets depending on which PDRs are matched (and which associated forwarding actions are performed). In some examples, the first set to be chosen may be predefined (e.g. a highest precedence set or default set). In some examples, the“last” set (e.g. PDR set 3 506 in Figure 5) may include one or more FARs, but associated with PDR(s) that are not matched with the packet. In some examples, multiple PDRs in a set may be associated with respective FARs. In some examples, the PDRs (or an indication thereof) may be received from a network node such as a Session Management Function (SMF) or a Packet Gateway-Control Plane (PGW-C). In some examples, where the PDRs are arranged into sets, the packet detection rule sets (or an indication thereof) may be received from a network node such as a SMF or PGW-C.

In some examples of this disclosure, a network node such as a PCF may include one or more of the following fields in the Policy Control and Charging (PCC) rules sent to SMF:

• PCC-rule-set-ID - Identifier of a PCC rule set that each PCC rule belongs to (e.g. a PCC rule set for tethering traffic)

• PCC-rule-set-precedence - what precedence the PCC rule set has with respect to other PCC rule sets.

• PCC-rule-set-configuration - a specific configuration to apply to the PCC rules

belonging to this PCC rule set. For example, the configuration may specify whether and how to aggregate reports from reporting actions with reports from other actions associated with other PCC rules; whether and how to perform forwarding actions the traffic filtering is completed for all PCC rule sets; and/or other configuration related actions.

• Default-PCC-rule-set - if a PCF sends PCC rules not associated with any PCC-rule- set-ID, the PCC rules may be associated with a default rule set.

In some examples of this disclosure, a network node such as a SMF may include one or more of the following fields in a Packet Forwarding Control Protocol (PFCP) session establishment request from SMF to UPF, e.g. on a per PDR basis:

• PDR-set-ID - an identifier of the PDR set the PDR belongs to (e.g. a PDR set for tethering traffic)

• PDR-set-precedence - what precedence the PDR set has with respect to other PDR sets.

• PDR-set-configuration - specific configuration to apply to the PDR sets of the PFCP session. For example, the configuration may specify whether to evaluate all PDRs within the set and perform the associated actions, even if the packet matches multiple PDRs in the set, or to perform the action associated with the first matching PDR in the set; whether to aggregate reports (e.g. Usage Reporting Rules URR reports) from different matching PDRs; whether to execute FARs until evaluation ends; and/or other configuration related actions. Default-PDR-set - if the SMF sends to UPF PDRs not associated to any PDR-set-ID, the PDRs will be associated to this default set.

The following table shows an example the Information Elements in the PFCP session establishment request in accordance with some embodiments of this disclosure.

Certain fields in the PFCP protocol may be included in the Create PDR Information Element in some examples. Examples are shown in the following table, which may indicate some or all lEs that may be included within a Create PDR IE within a PFCP Session Establishment Request.

In some examples, least one FAR may be mandatory in the PDRs of a default PDR set. In such examples it may not be mandatory to include a FAR associated with at least one PDR in other set(s).

Figure 6 illustrates an example of communication steps 600 in a PFCP association request between a UPF and a SMF. The communication steps 600 include the following numbered steps:

1. UPF sends to SMF a PFCP association request indicating that the UPF supports PDF sets.

2. SMF responds to the UPF acknowledging the request.

Figure 7 illustrates an example of communication steps 700 during provisioning of PCC rules and PDRs at Protocol Data Unit (PDU) session establishment. In this example, the PDR sets may be associated with a precedence, for example as described above, which may indicate in which order to evaluate the sets. The communication steps 700 include the following numbered steps:

1. SMF receives a PDU session establishment request from Access and Mobility

Management Function (AMF) including the User-ID of a user (e.g. UE).

2. SMF sends a message to PCF requesting to get the PCC rules including the User-ID

3. PCF sends to SMF the PCC rules for the user, each PCC rule including one or more of:

a. App-ID - the application ID the PCC rule applies to. This is a generic field that can specify a user application (e.g. Facebook), a generic traffic type (e.g. video) or another type of traffic classification (e.g. tethering).

b. PCC-rule-set-ID - Identifier of the PCC rule set the PCC rule belongs to (e.g. a PCC rule set for tethering traffic)

c. PCC-rule-set-precedence - what precedence the PCC rule set has with

respect to other PCC rule sets.

d. PCC-rule-set-configuration - specific configuration to apply to the PCC rules belonging to this PCC rule set (e.g. whether all rules belonging to this PCC rule set are to be evaluated, or just the first matching rule according to the internal precedence within the PCC rule set; whether to aggregate reports; whether to perform forwarding actions when the traffic filtering is completed for all PCC rule sets; and/or any other configuration actions). e. Default-PCC-rule-set - if the PCF sends PCC rules not associated to any PCC-rule-set-ID, they will be associated with this default PCC rule set. The value of this field can be a specific ID, or a true/false value (i.e. whether or not the PCC rule set associated with this PCC rule is the default set).

4. SMF sends a message to Packet Flow Description Function (PFDF) to get the traffic filters or signatures for the App-ID

5. PFDF responds with the PFD (Packet Flow Descriptor) including the corresponding traffic filters or signatures for the App-ID

6. SMF sends to UPF a PFCP session establishment request including one or more of: a. PFCP-session-ID

b. The PDRs for the PFCP session, each PDR including one or more of:

i. App-ID

ii. PDI (Packet Detection Information) - includes the PFD information received from PFDF.

iii. PDR-set-ID - Identifier of the PDR set the PDR belongs to (e.g. a PDR set for tethering traffic)

iv. PDR-set-precedence - what precedence the PDR set has with

respect to other PDR sets.

v. PDR-set-configuration - specific configuration to apply to the PDR sets of the PFCP session (e.g. whether to evaluate all PDRs within the set and perform the actions associated with all matching PDRs within the set, or just perform the action associated with the first matching PDR in the set; whether to aggregate URR reports from different matching PDRs; whether to wait to perform FARs or other actions until after evaluation of all PDRs in the set; and/or any other configuration related action).

vi. Default-PDR-set - If the SMF sends to UPF PDRs not associated with any PDR-set-ID, they will be associated with the default PDR set. The value of this field can be a specific ID, or a true/false value.

7. The UPF acknowledges the PFCP session establishment.

8. The PDU session establishment procedure is completed.

Figure 8 illustrates another example of communication steps 800 during provisioning of PCC rules and PDRs at Protocol Data Unit (PDU) session establishment. In this example, at least one of the PDRs in at least one of the PDR sets may be associated with a Forwarding Action Rule, for example as described above. The communication steps 800 include the following numbered steps:

1. SMF receives a PDU session establishment request from AMF including the User-ID of a user (e.g. UE). 2. SMF sends a message to PCF to get the PCC rules including the User-ID

c. Linked-PCC-rule-set-ID - the PCC rule set that shall be evaluated sequentially after the App-ID is detected.

4. SMF sends a message to PFDF to get the traffic filters or signatures for the App-ID

b. The PDRs for the PFCP session, each PDR including one or more of:

i. App-ID

c. A FAR to route the packet towards the Linked PDR set, including:

i. Linked-PDR-set-ID - The PDR set that the FAR points to.

7. The UPF acknowledges the PFCP session establishment.

8. The PDU session establishment procedure is completed.

Figure 9 is a flow chart of an example of a method 900 in a first network node. The first network node may comprise for example a SMF or PGW-C. The method 900 comprises, in step 902, sending, to a second network node, an indication of a plurality of packet detection rules and an indication, for each of the packet detection rules, of an associated packet detection rule set of a plurality of packet detection rule sets such that each packet detection rule set is associated with at least one of the packet detection rules and at least one of the packet detection rule sets is associated with a plurality of the packet detection rules. The second node may comprise for example a PGW-U or UPF. Thus for example the first network node can provide PDRs and associated sets to the second network node. In some examples, one of the PDR sets may be a default PDR set. In some examples, the method 900 comprises receiving, before the sending, an indication that the second network node supports at least one packet detection rule set associated with a plurality of packet detection rules. Thus for example the first network node may provide the indication of associated packet detection rule sets for the PDRs only if the second network node indicates that it supports this feature.

The method 900 may in some examples comprise receiving Policy and Charging Control, PCC, rule sets from a Policy control Function, PCF, and determining the packet detection rules and the associated packet detection rule sets from the indication of the packet detection rule sets and the associated packet detection rules received from the PCF. The method 900 may also in some examples comprise receiving an indication of the respective precedence of each PCC rule set from a Policy control Function, PCF. Thus, for example, the first network node may translate the PCC rules into PDRs and associated sets, or otherwise generate PDRs and associated sets, based on the PCC rules (and, where appropriate, the respective precedence of the PDR sets or PCC rule sets).

In some examples, the method 900 may comprise sending, to the second network node, at least one indication of a forwarding action rule, FAR, associated with a first packet detection rule of a first packet detection rule set of the packet detection rule sets for forwarding a packet matching the first packet detection rule to a second packet detection rule set of the packet detection rule sets.

Where each packet detection rule set is associated with a respective precedence, the method 900 may comprise for example sending, to the second network node, an indication of whether to determine whether a packet matches one packet detection rule or a plurality of packet detection rules in each packet detection rule set. Thus for example the second network node may carry out an action associated with only one matching PDR in a set, or actions associated with multiple PDRs in a set, based on this indication.

Figure 10 is a flow chart of an example of a method 1000 in a first network node. In some examples, the first network node comprises a PCF. The method 1000 comprises, in step 1002, sending, to a second network node, an indication of a plurality of Policy and Charging Control, PCC, rules and an indication, for each of the PCC rules, of an associated PCC rule set of a plurality of PCC rule sets such that each PCC rule set is associated with at least one of the PCC rules and at least one of the PCC rule sets is associated with a plurality of the PCC rules. In some examples, the second network node comprises a SMF or PGW-C. One of the PCC rule sets may in some examples comprise a default PCC rule set. In some examples, the method 1000 comprises receiving, before the sending, an indication that the second network node supports at least one PCC rule set associated with a plurality of PCC rules. Thus, for example, the first network node may provide the indication of the associated PCC rule sets for the PDRs only if the second network node indicates that it supports this feature.

In some examples, each PCC rule set is associated with a respective precedence. Thus for example the method 1000 may comprise sending, to the second network node, an indication of the respective precedence of each PCC rule set from the second network node.

Figure 11 is a schematic of an example of apparatus 1100 for traffic monitoring in a network node. The apparatus 1100 comprises processing circuitry 1102 (e.g. one or more processors) and a memory 1104 in communication with the processing circuitry 1102. The memory 1104 contains instructions executable by the processing circuitry 1102. The apparatus 1100 also comprises an interface 1106 in communication with the processing circuitry 1102. Although the interface 1106, processing circuitry 1102 and memory 1104 are shown connected in series, these may alternatively be interconnected in any other way, for example via a bus.

In one embodiment, the memory 1104 contains instructions executable by the processing circuitry 1102 such that the apparatus 1100 is operable to receive a packet, determine, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule, and perform, for each matching packet detection rule, an action associated with the matching packet detection rule. In some examples, the apparatus 1100 is operable to carry out the method 300 described above with reference to Figure 3.

Figure 12 is a schematic of an example of apparatus 1200 in a first network node. The apparatus 1200 comprises processing circuitry 1202 (e.g. one or more processors) and a memory 1204 in communication with the processing circuitry 1202. The memory 1204 contains instructions executable by the processing circuitry 1202. The apparatus 1200 also comprises an interface 1206 in communication with the processing circuitry 1202. Although the interface 1206, processing circuitry 1202 and memory 1204 are shown connected in series, these may alternatively be interconnected in any other way, for example via a bus.

In one embodiment, the memory 1204 contains instructions executable by the processing circuitry 1202 such that the apparatus 1200 is operable to send, to a second network node, a plurality of packet detection rules and an indication of an associated packet detection rule set for each of the packet detection rules such that each packet detection rule set is associated with at least one of the packet detection rules and at least one of the packet detection rule sets is associated with a plurality of the packet detection rules. In some examples, the apparatus 1200 is operable to carry out the method 900 described above with reference to Figure 9.

Figure 13 is a schematic of an example of apparatus 1300 in a first network node. The apparatus 1300 comprises processing circuitry 1302 (e.g. one or more processors) and a memory 1304 in communication with the processing circuitry 1302. The memory 1304 contains instructions executable by the processing circuitry 1302. The apparatus 1300 also comprises an interface 1306 in communication with the processing circuitry 1302. Although the interface 1306, processing circuitry 1302 and memory 1304 are shown connected in series, these may alternatively be interconnected in any other way, for example via a bus.

In one embodiment, the memory 1304 contains instructions executable by the processing circuitry 1302 such that the apparatus 1300 is operable to send, to a second network node, an indication of a plurality of Policy and Charging Control, PCC, rules and an indication, for each of the PCC rules, of an associated PCC rule set of a plurality of PCC rule sets such that each PCC rule set is associated with at least one of the PCC rules and at least one of the PCC rule sets is associated with a plurality of the PCC rules. In some examples, the apparatus 1300 is operable to carry out the method 1000 described above with reference to Figure 10.

It should be noted that the above-mentioned examples illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative examples without departing from the scope of the appended statements. The word“comprising” does not exclude the presence of elements or steps other than those listed in a claim,“a” or“an” does not exclude a plurality, and a single processor or other unit may fulfil the functions of several units recited in the statements below. Where the terms,“first”,“second” etc. are used they are to be understood merely as labels for the convenient identification of a particular feature. In particular, they are not to be interpreted as describing the first or the second feature of a plurality of such features (i.e. the first or second of such features to occur in time or space) unless explicitly stated otherwise. Steps in the methods disclosed herein may be carried out in any order unless expressly otherwise stated. Any reference signs in the statements shall not be construed so as to limit their scope.

Claims

1. A method of traffic monitoring in a network node, the method comprising:

receiving a packet;

determining, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule; and

performing, for each matching packet detection rule, an action associated with the matching packet detection rule.

2. The method of claim 1 , wherein determining, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule comprises

determining that the packet matches a plurality of the packet detection rules.

3. The method of claim 1 or 2, wherein performing, for each matching packet detection rule, an action associated with the matching packet detection rule, comprises performing the action associated with the matching packet detection rule based on configuration information for the packet detection rules, said configuration information defining how said action is to be performed.

4. The method of any of claims 1 to 3, wherein performing, for each matching packet detection rule, an action associated with the matching packet detection rule comprises performing the actions associated with the matching packet detection rules in an order of precedence associated with the packet detection rules.

5. The method of any claims 1 to 4, comprising determining whether the packet matches at least one of the packet detection rules after determining that the packet matches at least one other of the packet detection rules.

6. The method of any of claims 1 to 5, wherein each of the packet detection rules is associated with a respective packet detection rule set.

7. The method of claim 6, wherein determining, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule comprises

determining, for each packet detection rule set, whether the packet matches the packet detection rule associated with the packet detection rule set.

8. The method of claim 6 or 7, wherein one or more of the packet detection rule sets is associated with at least one respective additional packet detection rule.

9. The method of claim 8, wherein each respective additional packet detection rule is associated with a respective additional action.

10. The method of any of claims 6 to 9, wherein each packet detection rule set is associated with a respective precedence, and determining, for each of the plurality of packet detection rules, whether the packet matches the packet detection rule comprises evaluating the packet detection rules in order of precedence of the associated sets.

11. The method of claim 10, comprising:

determining, for each packet detection rule set, that the packet matches one of the packet detection rules in the packet detection rule set, and determining whether the packet matches at least one other packet detection rule in the packet detection rule set; or

determining, for each packet detection rule set, that the packet matches one of the packet detection rules in the packet detection rule set, and refraining from determining whether the packet matches any other packet detection rule in the packet detection rule set and/or refraining from performing an action associated with any other packet detection rule in the packet detection rule set.

12. The method of claim 11 , comprising receiving an indication of whether to determine whether the packet matches at least one other packet detection rule in the packet detection rule set or to refrain from determining whether the packet matches any other packet detection rule in the packet detection rule set and/or refrain from performing an action associated with any other packet detection rule in the packet detection rule set, wherein the indication is received from a Session Management Function, SMF, or a Packet Gateway- Control Plane, PGW-C.

13. The method of any of claims 6 to 12, wherein the packet detection rule associated with at least one of the sets is associated with a forwarding action, and performing, for each matching packet detection rule, the action associated with the matching packet detection rule comprises, for each of a subset of the sets, the associated forwarding action to forward the packet to another set of the sets.

14. The method of any of claims 6 to 13, comprising receiving the packet detection rule sets from a Session Management Function, SMF, or a Packet Gateway- Control Plane, PGW-C.

15. The method of any of claims 1 to 14, comprising receiving the packet detection rules from a Session Management Function, SMF, or a Packet Gateway-Control Plane, PGW-C.

16. The method of any of the preceding claims, wherein the method is performed by a User Plane Function, UPF, or Packet Gateway-User Plane, PGW-U.

17. The method of any of the preceding claims, wherein determining, for each of the plurality of packet detection rules, whether the packet matches the packet detection rule comprises determining whether the packet matches packet detection information, PDI, associated with the packet detection rule.

18. The method of any of the preceding claims, wherein the action associated with each packet detection rule comprises one or more of a forwarding action rule, FAR, buffering action rule, BAR, quality enforcement rule, QER, usage reporting rule, URR, and/or policy control and charging, PCC, rule.

19. The method of any of the preceding claims, wherein the packet is received from a User Equipment, UE, or the Internet.

20. A method in a first network node, the method comprising:

sending, to a second network node, an indication of a plurality of packet detection rules and an indication, for each of the packet detection rules, of an associated packet detection rule set of a plurality of packet detection rule sets such that each packet detection rule set is associated with at least one of the packet detection rules and at least one of the packet detection rule sets is associated with a plurality of the packet detection rules.

21. The method of claim 20, wherein each packet detection rule set is associated with at least one of the packet detection rules.

22. The method of claim 20 or 21 , comprising receiving, before the sending, an indication that the second network node supports at least one packet detection rule set associated with a plurality of packet detection rules.

23. The method of any of claims 20 to 22, wherein the first network node comprises a Session Management Function, SMF, or a Packet Gateway-Control Plane, PGW-C.

24. The method of any of claims 20 to 23, wherein the second network node comprises a User Plane Function, UPF, or Packet Gateway-User Plane, PGW-U.

25. The method of any of claims 20 to 24, comprising receiving Policy and Charging Control, PCC, rule sets from a Policy control Function, PCF, and determining the packet detection rules and the associated packet detection rule sets from the indication of the packet detection rule sets and the associated packet detection rules received from the PCF.

26. The method of claim 26, comprising receiving an indication of the respective precedence of each packet detection rule set from a Policy control Function, PCF.

27. The method of any of claims 20 to 26, comprising sending, to the second network node, at least one indication of a forwarding action rule, FAR, associated with a first packet detection rule of a first packet detection rule set of the packet detection rule sets for forwarding a packet matching the first packet detection rule to a second packet detection rule set of the packet detection rule sets.

28. The method of any of claims 20 to 27, wherein each packet detection rule set is associated with a respective precedence.

29. The method of claim 27, comprising sending, to the second network node, an indication of whether to determine whether a packet matches one packet detection rule or a plurality of packet detection rules in each packet detection rule set.

30. The method of any of claims 20 to 29, wherein one of the packet detection rule sets comprises a default packet detection rule set.

31. A method in a first network node, the method comprising:

sending, to a second network node, an indication of a plurality of Policy and Charging Control, PCC, rules and an indication, for each of the PCC rules, of an associated PCC rule set of a plurality of PCC rule sets such that each PCC rule set is associated with at least one of the PCC rules and at least one of the PCC rule sets is associated with a plurality of the PCC rules.

32. The method of claim 31 , wherein each PCC rule set is associated with at least one of the PCC rules.

33. The method of claim 31 or 32, comprising receiving, before the sending, an indication that the second network node supports at least one PCC rule set associated with a plurality of PCC rules.

34. The method of any of claims 31 to 33, wherein the first network node comprises a Policy control Function, PCF.

35. The method of any of claims 31 to 34, wherein the second network node comprises a Session Management Function, SMF, or a Packet Gateway-Control Plane, PGW-C.

36. The method of any of claims 31 to 35, wherein each PCC rule set is associated with a respective precedence.

37. The method of claim 36, comprising sending, to the second network node, an indication of the respective precedence of each PCC rule set from the second network node.

38. The method of any of claims 31 to 37, wherein one of the PCC rule sets comprises a default PCC rule set.

39. A computer program comprising instructions which, when executed on at least one processor, cause the at least one processor to carry out a method according to any one of the preceding claims.

40. A subcarrier containing a computer program according to claim 39, wherein the subcarrier comprises one of an electronic signal, optical signal, radio signal or computer readable storage medium.

41. A computer program product comprising non transitory computer readable media having stored thereon a computer program according to claim 39.

42. Apparatus for traffic monitoring in a network node, the apparatus comprising a processor and a memory, the memory containing instructions executable by the processor such that the apparatus is operable to:

receive a packet; determine, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule; and

perform, for each matching packet detection rule, an action associated with the matching packet detection rule.

43. The apparatus of claim 42, wherein the memory contains instructions executable by the processor such that the apparatus is operable to carry out the method of any of claims 2 to 19.

44. Apparatus in a first network node, the apparatus comprising a processor and a memory, the memory containing instructions executable by the processor such that the apparatus is operable to:

send, to a second network node, a plurality of packet detection rules and an indication of an associated packet detection rule set for each of the packet detection rules such that each packet detection rule set is associated with at least one of the packet detection rules and at least one of the packet detection rule sets is associated with a plurality of the packet detection rules.

45. The apparatus of claim 44, wherein the memory contains instructions executable by the processor such that the apparatus is operable to carry out the method of any of claims 21 to 30.

46. Apparatus in a first network node, the apparatus comprising a processor and a memory, the memory containing instructions executable by the processor such that the apparatus is operable to:

send, to a second network node, an indication of a plurality of Policy and Charging Control, PCC, rules and an indication, for each of the PCC rules, of an associated PCC rule set of a plurality of PCC rule sets such that each PCC rule set is associated with at least one of the PCC rules and at least one of the PCC rule sets is associated with a plurality of the PCC rules.

47. The apparatus of claim 46, wherein the memory contains instructions executable by the processor such that the apparatus is operable to carry out the method of any of claims 21 to 30.

48. Apparatus for traffic monitoring in a network node, the apparatus configured to: receive a packet; determine, for each of a plurality of packet detection rules, whether the packet matches the packet detection rule; and

49. Apparatus in in a first network node, the apparatus configured to:

50. Apparatus in a first network node, the apparatus configured to: