A method for securely enabling in-network functionality over encrypted data sessions, the method comprising: - establishing an encrypted data session between two communication applications, a client communication application and a server communication application, over a communication network; - receiving and/or transmitting, by the client communication application, in said established encrypted data session, encrypted communication data from/to said server communication application through at least one computing network element; and - performing, by said at least one computing network element, different actions other than communication data forwarding from one communication application to the other on said encrypted communication data, wherein said encrypted communication data comprises a plurality of data portions, or contexts,, each one (CTX_X) being encrypted and authenticated via context keys, and said different actions being specific for said at least one computing network element and for one or more of said plurality of contexts (CTX_X) of the encrypted communication data, characterized in that the method further comprises: - negotiating, by the computing network element, with both of the two communication applications (100, 200), before performing the different actions on the one or more contexts (CTX_X), a symmetric key using a key exchange protocol; - generating, by both of the two communication applications (100, 200), for each one of the one or more contexts (CTX_X) of the encrypted communication data to which the computing network element has rights to, said context keys, wherein each of the two communication applications (100, 200) generates half of a shared secret for generating a pseudo random function, the pseudo random function being used for generating the context keys; - sending, by both of the two communication applications (100, 200), to the computing network element, the corresponding half of the shared secret in encrypted form using said symmetric key negotiated with the computing network element; and - computing, by the computing element, the context keys using the pseudo random function, the computed context keys being used to decrypt the encrypted communication data to perform the different actions. - establishing an encrypted data session between two communication applications, a client communication application and a server communication application, over a communication network; - receiving and/or transmitting, by the client communication application, in said established encrypted data session, encrypted communication data from/to said server communication application through at least one computing network element; and - performing, by said at least one computing network element, different actions other than communication data forwarding from one communication application to the other on said encrypted communication data, wherein said encrypted communication data comprises a plurality of data portions, or contexts,, each one (CTX_X) being encrypted and authenticated via context keys, and said different actions being specific for said at least one computing network element and for one or more of said plurality of contexts (CTX_X) of the encrypted communication data, characterized in that the method further comprises: - negotiating, by the computing network element, with both of the two communication applications (100, 200), before performing the different actions on the one or more contexts (CTX_X), a symmetric key using a key exchange protocol; - generating, by both of the two communication applications (100, 200), for each one of the one or more contexts (CTX_X) of the encrypted communication data to which the computing network element has rights to, said context keys, wherein each of the two communication applications (100, 200) generates half of a shared secret for generating a pseudo random function, the pseudo random function being used for generating the context keys; - sending, by both of the two communication applications (100, 200), to the computing network element, the corresponding half of the shared secret in encrypted form using said symmetric key negotiated with the computing network element; and - computing, by the computing element, the context keys using the pseudo random function, the computed context keys being used to decrypt the encrypted communication data to perform the different actions. - negotiating, by the computing network element, with both of the two communication applications (100, 200), before performing the different actions on the one or more contexts (CTX_X), a symmetric key using a key exchange protocol; - generating, by both of the two communication applications (100, 200), for each one of the one or more contexts (CTX_X) of the encrypted communication data to which the computing network element has rights to, said context keys, wherein each of the two communication applications (100, 200) generates half of a shared secret for generating a pseudo random function, the pseudo random function being used for generating the context keys; - sending, by both of the two communication applications (100, 200), to the computing network element, the corresponding half of the shared secret in encrypted form using said symmetric key negotiated with the computing network element; and - computing, by the computing element, the context keys using the pseudo random function, the computed context keys being used to decrypt the encrypted communication data to perform the different actions.