A method, operational in a system, wherein the system comprises a device (502, 602, 702, 802, 902), an application server (516, 616, 716, 908), and a gateway device, P-GW, (510, 610), wherein the method comprises the steps of: initiating, by the device (502, 602, 702, 802, 902), a connection with the application server (516, 616, 716, 908) associated with one or more application services, wherein initiating the connection includes sending a connection request and the connection request includes an explicit request for a network token, and wherein the connection request includes an application identifier (App ID); and deriving (522, 622) the network token, by the gateway device, P-GW, (510, 610), wherein the network token is derived using a hash function having a set of input parameters including a secret key (K P-GW) known to the gateway device (510, 610), a device Internet Protocol, IP, address (IPc), a device port number (Pc), an application server IP address (IPs), an application server port number (P s), protocol identifier (Proto), and the application identifier (App ID); obtaining, by the device (502, 602, 702, 802, 902), in response to initiating the connection, the network token from one of the application server (516, 616, 716, 908) and/or the gateway device (510, 610, 710, 810, 906), wherein the network token is provisioned to the device (502, 602, 702, 802, 902) via one or more user-plane messages; sending the network token with one or more uplink, UL, packets from the device (502, 602, 702, 802, 902) to the application server (516, 616, 716, 908) in the user-plane, receiving, by the P-GW 510, the one or more uplink, UL, packets; and verifying, by the gateway device, P-GW, (510, 610), the network token included with the one or more uplink, UL, packets. initiating, by the device (502, 602, 702, 802, 902), a connection with the application server (516, 616, 716, 908) associated with one or more application services, wherein initiating the connection includes sending a connection request and the connection request includes an explicit request for a network token, and wherein the connection request includes an application identifier (App ID); and deriving (522, 622) the network token, by the gateway device, P-GW, (510, 610), wherein the network token is derived using a hash function having a set of input parameters including a secret key (K P-GW) known to the gateway device (510, 610), a device Internet Protocol, IP, address (IPc), a device port number (Pc), an application server IP address (IPs), an application server port number (P s), protocol identifier (Proto), and the application identifier (App ID); obtaining, by the device (502, 602, 702, 802, 902), in response to initiating the connection, the network token from one of the application server (516, 616, 716, 908) and/or the gateway device (510, 610, 710, 810, 906), wherein the network token is provisioned to the device (502, 602, 702, 802, 902) via one or more user-plane messages; sending the network token with one or more uplink, UL, packets from the device (502, 602, 702, 802, 902) to the application server (516, 616, 716, 908) in the user-plane, receiving, by the P-GW 510, the one or more uplink, UL, packets; and verifying, by the gateway device, P-GW, (510, 610), the network token included with the one or more uplink, UL, packets.