Patent Description:
In the 3GPP standardization forum, a reference architecture for <NUM> wireless communications network is defined, for example in section <NUM>. <NUM> of <NPL>) <FIG> shows an example of a <NUM> network architecture <NUM>. The <NUM> network architecture <NUM> includes the following entities and interfaces.

Packet Flow Description Function (PFDF) <NUM>: in the <NUM> architecture <NUM>, this is included within a Network Exposure Function (NEF) <NUM>, for example to reduce the number of network functions in <NUM>. The PFDF <NUM> handles Packet Flow Descriptions (PFDs) associated with application identifier(s) and transfers them to the Session Management Function (SMF) <NUM> via a NG GW interface. The SMF <NUM> transfers these PFDs towards the User Plane Function (UPF) <NUM> through a N4 interface and PFD Management Procedure to enable the UPF <NUM> to perform accurate application detection when the PFDs are managed by a 3rd party service provider.

A Policy and Charging Rules Function (PCF) <NUM> is a functional element that performs policy control decision and flow-based charging control. The PCF provides network control regarding the service data flow detection.

The Session Management Function (SMF) <NUM> performs NAS handling for SM, User Equipment (UE) IP address allocation and management, sending Quality of Service (QoS) and policy NG2 information to the AN via an Access and Mobility Management Function (AMF) <NUM>, Idle/Active aware, Policy & Offline/Online Charging i/f termination, Policy enforcement control part, Lawful intercept (CP and interface to LI System), UP selection and termination of NG4 interface.

A User Plane Function (UPF) <NUM> (e.g. Policy Control Enforcement Function) encompasses service data flow detection, policy enforcement and flow-based charging functionalities. Anchor point for Intra-/Inter-RAT mobility (when applicable), External IP point of interconnect, Packet routing & forwarding, QoS handling for User plane, Packet inspection and PCC rule enforcement, Lawful intercept (UP collection), Roaming interface (UP), Traffic counting and reporting. Deep Packet Inspection (DPI) technology, embedded in the UPF <NUM>, supports packet inspection and service classification, which may classify IP packets according to a configured tree of rules so that they are assigned to a service session. DPI technology offers two types of analysis. Firstly, shallow packet inspection extracts basic protocol information such as IP addresses (source, destination) and other low-level connection states. This information typically resides in the packet header itself and consequently reveals the principal communication intent. Secondly, Deep Packet Inspection (DPI) provides application awareness. This is achieved by analyzing the content in both the packet header and the payload over a series of packet transactions. There are several possible methods of analysis used to identify and classify applications and protocols that are grouped into signatures. One of them is heuristic signatures which is related to the behavioral analysis of the user traffic. A heuristic traffic analyzer makes a best guess classification, but identification accuracy is not guaranteed to be <NUM>%. This limitation is inherent in the heuristic approach. This type of analysis that considers the behavioral analysis of the packets may consume considerable processing resources because more than one packet may be taken into account for the analysis.

In 3GPP TS <NUM> is defined an interface between the user plane and the control plane in a network. Once a session has been established between e.g. UPF <NUM> and SMF <NUM> they may exchange some information such as for example Packet Detection Rules (PDRs). According to this standard, on receipt of a user plane packet, the UPF shall perform a lookup of the provisioned PDRs and:.

In other words, at present in a Control and User Plane Separation (CUPS) architecture, the UPF classifies traffic according to the precedence parameter of the PDRs. It defines the relative precedence of a PDR among all the PDRs provisioned within an PFCP session, and matches a packet with the first matching PDR in order of preference of the PDRs.

DPI technology uses heuristic analyzers that detect and identify protocols used by UEs (e.g. applications within those UEs) based on for example binary signature patterns, metrics or connectivity patterns. The difficulty of correctly identifying this type of traffic means that the protocol identification accuracy cannot be guaranteed. The higher the percentage of encrypted packets, the lower the detection rate. Furthermore, the continuing increase in the number of connected applications and protocols in a typical UE device may increase the probability of incorrect protocol detection increases because of the new protocols and applications increment every year. For this reason, content providers (e.g. Over The Top, OTT, providers) have increased collaboration with operators for providing a good method for detecting their applications.

For example, a content provider can send to the operator, for example using a T8 interface, the rules (e.g. PDRs) for matching the traffic that corresponds to that content provider.

<NPL> discloses multimatch packet classification as a concatenated multistring matching problem, which can be solved by traversing a flat signature tree.

<CIT> discloses a system comprises logic to receive a data packet and identify, based on the data packet, a plurality of candidate rules. The logic is further to select a rule from among the plurality of candidate rules based on a priority associated with the rule and a determination that the rule matches the data packet.

The objectives of the present invention are achieved through the subject-matter of the independent claims, respectively claiming three methods of traffic monitoring, respectively in a first, second and third node (claims <NUM>, <NUM>, <NUM>), and corresponding apparatuses for traffic monitoring, respectively in a first, second and third node (claims <NUM>, <NUM>, <NUM>).

According to the standard, e.g. 3GPP TS <NUM>, PDRs must comply with the following rules:.

With these principles defined by the standards, there may be situations where a packet could potentially match several PDRs. Therefore, the packet is matched to the PDR with the highest preference among the potentially matching PDRs. In these cases, where there is a conflict between PDRs and the packet is matched to the PDR with the higher precedence, it is difficult for an operator to know if this is the correct behaviour, e.g. that the packet has been matched to the correct PDR (e.g. the most preferred PDR, regardless of precedence).

In some examples as describe herein, a packet may be matched in a first network node (e.g. UPF) to multiple PDRs, and this may be reported to a second network node (e.g. SMF). The SMF may take appropriate action, such as for example updating the PDRs in the UPF. This may be done in some examples by the SMF consulting a third network node (e.g. PCF).

<FIG> is a flow chart of an example of a method <NUM> of traffic monitoring in a first network node, such as for example a UPF, Packet Gateway (PGW) or Packet Gateway-User Plane (PGW-U). The first network node (and other nodes as described herein) may be a node in a <NUM> network, though the node may be in another network such as an LTE network or a network with a mixture of standard types. The method comprises, in step <NUM>, receiving a packet (e.g. an IP packet). In some examples, the packet may be received from the internet (e.g. downlink) or from a UE (e.g. uplink). Step <NUM> of the method <NUM> comprises determining that the packet matches a plurality of packet detection rules. That is, for example, once it is determined that the packet matches one PDR, the method <NUM> may continue to determine whether the packet matches any more PDRs. Determining that a packet matches a PDR may comprise for example determining that the packet matches respective Packet Detection Information (PDI) associated with the PDR. If the packet matches a plurality in PDRs, step <NUM> of the method <NUM> comprises sending an indication to a second network node (e.g. SMF or a Packet Gateway-Control Plane, PGW-C) that the packet matches a plurality of packet detection rules. Thus for example the first node may report to the second network node that there is a conflict in the PDRs configured in the first network node, as the packet matches multiple PDRs.

The indication sent to the second network node contains the plurality of packet detection rules, such that for example the second network node (or any other network node) may identify the PDRs that are conflicting. In some examples, the indication sent to the second network node may identify the PDRs (e.g. using a PDR ID).

The method <NUM> may in some examples comprise, in response to determining that the packet matches the plurality of packet detection rules, sending the packet to the second network node. Thus the second network node (or any other network node) may identify the packet that has resulted in or identified the conflict in the PDRs.

The method <NUM> comprises, after sending the indication to the second network node, receiving (e.g. from the second network node) a modification for one or more of the packet detection rules, and modifying the one or more of the packet detection rules according to the modification to produce modified packet detection rules. Therefore, for example, the PDRs may be modified such that the packet does not match all of the modified packet detection rules (although there may already have been other PDRs configured in the first network node that did not match the packet in step <NUM>). In some cases, the packet may match only one of the modified PDRs. In some examples, the method <NUM> may also include performing a respective action associated with each of the modified packet detection rules that the packet matches. The respective action may be one or more of a forwarding action rule, FAR, buffering action rule, BAR, quality enforcement rule, QER, usage reporting rule, URR, and/or policy control and charging, PCC, rule. Thus, the action may be undertaken regarding the packet after the PDRs have been modified. In other examples, the action may be taken before the modification - e.g. action associated with the highest precedence matching PDR, or the actions associated with all of the matching PDRs. The modification may comprise, for example, one or more of addition of one or more new PDRs, deletion of one or more existing PDRs, and/or changes to one or more parameters of one or more existing PDRs.

In some examples, sending the indication to the second network node comprises sending an indication that a threshold number of packets or bytes have matched a plurality of packet detection rules.

In some examples, each of the packet detection rules is associated with a respective further indication that indicates whether a packet matching that packet detection rule is permitted to match one or more other packet detection rules. Thus for example some PDRs may be allowed to match to a packet that also matches one or more other PDRs. Therefore, in some examples, sending the indication to the second network node comprises sending an indication that the packet matches at least one packet detection rule associated with a further indication that the packet is not permitted to match any other packet detection rule.

In these cases, for example, the indication is not sent to the second network node if all of the multiple matching PDRs are allowed to be multiple matching PDRs, i.e. the packet matches these multiple PDRs. In some examples, the the further indication (that the PDR(s) may be allowed to match a packet that also matches other PDR(s)) may be received from the second network node. The packet detection rules may be additionally or alternatively received from the second network node.

<FIG> is a flow chart of an example of a method <NUM> of traffic monitoring in a second network node, such as for example a Session Management Function, SMF, or a Packet Gateway-Control Plane, PGW-C. The method <NUM> comprises, in step <NUM>, sending a plurality of packet detection rules to a first network node, such as for example a User Plane Function, UPF, Packet Gateway, PGW, or Packet Gateway-User Plane, PGW-U. In some examples, the first network node may implement the method <NUM> described above. Step <NUM> of the method <NUM> comprises receiving an indication (e.g. from the first network node) that a packet received at the first network node matches the plurality of packet detection rules. Therefore, for example, the second network node may determine that there is a conflict in the PDRs configured in the first network node.

In some examples, the indication identifies or contains the plurality of packet detection rules.

Additionally or alternatively, the method <NUM> comprises receiving the packet from the first network node. Thus, for example, the second network node (or another network node, if this information is forwarded to another network node) may determine the PDRs that are conflicting.

The method <NUM> comprises sending the indication to a third network node, such as for example a PCF, receiving a modification for one or more of the packet detection rules (e.g. from the third network node), and sending the modification to the first network node. Thus for example the PDRs configured in the first network node may be modified such that the packet matches fewer (e.g. only one) of the modified PDRs.

In some examples, each of the packet detection rules is associated with a respective further indication that indicates whether a packet matching that packet detection rule is permitted to match one or more other packet detection rules. Thus, in some examples, receiving the indication comprises receiving an indication that the packet matches at least one packet detection rule associated with a further indication that the packet is not permitted to match any other packet detection rule. Thus the indication is only received if one or more of the conflicting PDRs are not permitted to be a multiple-matching PDR, that is, a PDR in a group that matches the packet.

In some examples, the second network node may send the packet detection rules to the first network node before receiving the indication.

<FIG> is a flow chart of an example of a method <NUM> of traffic monitoring. In some examples, the method <NUM> may be implemented in a PCF. The method <NUM> comprises, in step <NUM>, receiving an indication that a packet received at a first network node matches a plurality of packet detection rules. The indication is received from a second network node, e.g. a Session Management Function, SMF, or a Packet Gateway-Control Plane, PGW-C. Step <NUM> of the method <NUM> comprises sending a modification for at least one of the packet detection rules to the first network node. In some examples, the modification is sent via the second network node. The first network node may in some examples comprise a UPF, PGW or PGW-U. In some examples, the first network node may perform the method <NUM> described above, and/or the second network node may perform the method <NUM> described above.

<FIG> is a schematic of an example of apparatus <NUM> for traffic monitoring in a first network node. The apparatus <NUM> comprises processing circuitry <NUM> (e.g. one or more processors) and a memory <NUM> in communication with the processing circuitry <NUM>. The memory <NUM> contains instructions executable by the processing circuitry <NUM>. The apparatus <NUM> also comprises an interface <NUM> in communication with the processing circuitry <NUM>. Although the interface <NUM>, processing circuitry <NUM> and memory <NUM> are shown connected in series, these may alternatively be interconnected in any other way, for example via a bus.

In one embodiment, the memory <NUM> contains instructions executable by the processing circuitry <NUM> such that the apparatus <NUM> is operable to receive a packet, determine that the packet matches a plurality of packet detection rules, and send an indication to a second network node that the packet matches a plurality of packet detection rules. In some examples, the memory <NUM> contains instructions executable by the processing circuitry <NUM> such that the apparatus <NUM> is operable to carry out the method <NUM> described above.

<FIG> is a schematic of an example of apparatus <NUM> for traffic monitoring in a second network node. The apparatus <NUM> comprises processing circuitry <NUM> (e.g. one or more processors) and a memory <NUM> in communication with the processing circuitry <NUM>. The memory <NUM> contains instructions executable by the processing circuitry <NUM>. The apparatus <NUM> also comprises an interface <NUM> in communication with the processing circuitry <NUM>. Although the interface <NUM>, processing circuitry <NUM> and memory <NUM> are shown connected in series, these may alternatively be interconnected in any other way, for example via a bus.

In one embodiment, the memory <NUM> contains instructions executable by the processing circuitry <NUM> such that the apparatus <NUM> is operable to send a plurality of packet detection rules to a first network node, and receive an indication that a packet received at the first network node matches the plurality of packet detection rules. In some examples, the memory <NUM> contains instructions executable by the processing circuitry <NUM> such that the apparatus <NUM> is operable to carry out the method <NUM> described above.

<FIG> is a schematic of an example of apparatus <NUM> for traffic monitoring (e.g. in a third network node such as a PCF). The apparatus <NUM> comprises processing circuitry <NUM> (e.g. one or more processors) and a memory <NUM> in communication with the processing circuitry <NUM>. The memory <NUM> contains instructions executable by the processing circuitry <NUM>. The apparatus <NUM> also comprises an interface <NUM> in communication with the processing circuitry <NUM>. Although the interface <NUM>, processing circuitry <NUM> and memory <NUM> are shown connected in series, these may alternatively be interconnected in any other way, for example via a bus.

In one embodiment, the memory <NUM> contains instructions executable by the processing circuitry <NUM> such that the apparatus <NUM> is operable to receive an indication that a packet received at a first network node matches a plurality of packet detection rules, and send a modification for at least one of the packet detection rules to the first network node.

Additional specific example embodiments will now be described.

Embodiments of this disclosure may be based on a scenario composed by a UE properly connected to a mobile network, in which there will be a node (a UPF) with deep packet inspection and service classification functionality, and an SMF sending PDR rules to the UPF.

<FIG> shows an example of communications <NUM> between network entities, for example in embodiments where PCF does not support multi-classification in real time (i.e. the PCF does not support cases where a packet matches multiple PDRs), for example when establishing and/or performing traffic monitoring. The communications include the following (which may also be the steps of a method).

Claim 1:
A method (<NUM>) of traffic monitoring in a first network node, the method comprising:
receiving a plurality of packet detection rules from a second network node;
receiving (<NUM>) a packet;
determining (<NUM>) that the packet matches a plurality of packet detection rules;
sending (<NUM>) an indication to the second network node that the packet matches a plurality of packet detection rules; and
after sending the indication to the second network node, receiving from the second network node or from a third network node a modification for one or more of the packet detection rules, and modifying the one or more of the packet detection rules according to the modification to produce modified packet detection rules.