EFFICIENT POLICY ENFORCEMENT USING NETWORK TOKENS FOR SERVICES C-PLANE APPROACH

摘要

A device establishes flows associated with one or more applications using control plane signaling. A gateway device obtains a request for a network token during the control plane signaling. The gateway device derives the network token and sends it to the device and/or an access node during the control plane signaling. The device and/or access node obtain the network token, where the network token is associated with a first flow of the one or more flows, a first application of the one or more applications, and provisioned to the device or access node via the control plane signaling. The network token may be included in a packet sent in the user plane from the device. The network token may be verified at the access node and/or the gateway device using a cryptographic function and sent to its destination based on the results of the verification.

主权项

1. A method, operational at a device, comprising:
establishing a set of one or more flows associated with one or more applications using control plane signaling; obtaining, at the device during the control plane signaling, a first network token, wherein the first network token is:
associated with a first flow of the set of one or more flows;associated with a first application of the one or more applications; andprovisioned to the device via the control plane signaling.