A method, operational at a client device , comprising: establishing a set of one or more flows associated with one or more applications using control plane signaling; obtaining from a gateway device, at the client device during the control plane signaling, a first network token, wherein the first network token is: associated with a first flow of the set of one or more flows; associated with a first application of the one or more applications; provisioned to the client device via the control plane signaling; derived as an uplink network token and a downlink network token, different from the uplink network token, wherein: derivation of the uplink network token is based on a key known to the gateway device and on a parameter associated with the client device, and derivation of the downlink network token is based on the key known to the gateway device and on a parameter associated with an application server; and transporting the first network token from the client device to the gateway device in: a shim header in a shim layer between an Internet protocol, IP, layer and a medium access control, MAC, layer; a packet data convergence protocol, PDCP, header; and/or an IP extension header as defined in IP version 6, IPv6. establishing a set of one or more flows associated with one or more applications using control plane signaling; obtaining from a gateway device, at the client device during the control plane signaling, a first network token, wherein the first network token is: associated with a first flow of the set of one or more flows; associated with a first application of the one or more applications; provisioned to the client device via the control plane signaling; derived as an uplink network token and a downlink network token, different from the uplink network token, wherein: derivation of the uplink network token is based on a key known to the gateway device and on a parameter associated with the client device, and derivation of the downlink network token is based on the key known to the gateway device and on a parameter associated with an application server; and associated with a first flow of the set of one or more flows; associated with a first application of the one or more applications; provisioned to the client device via the control plane signaling; derived as an uplink network token and a downlink network token, different from the uplink network token, wherein: derivation of the uplink network token is based on a key known to the gateway device and on a parameter associated with the client device, and derivation of the downlink network token is based on the key known to the gateway device and on a parameter associated with an application server; and transporting the first network token from the client device to the gateway device in: a shim header in a shim layer between an Internet protocol, IP, layer and a medium access control, MAC, layer; a packet data convergence protocol, PDCP, header; and/or an IP extension header as defined in IP version 6, IPv6. a shim header in a shim layer between an Internet protocol, IP, layer and a medium access control, MAC, layer; a packet data convergence protocol, PDCP, header; and/or an IP extension header as defined in IP version 6, IPv6. <EOS>