Methods, communication device and nodes for enabling handling of data packets in a wireless communication system

A core network node for enabling handling of data packets in a wireless communication system, the core network node being comprised in a core network of the wireless communication system, the core network node being configured to:

• identify a potentially malicious service data flow associated with a communication device served by an access network of the wireless communication system;
• assign, to the potentially malicious service data flow, an identifier value that indicates that data packets associated with the potentially malicious service data flow is to be handled according to a packet handling rule for potentially malicious data packets;
• and to
• provide the identifier value towards the communication device, towards at least one of:
• an access node that serves the communication device in the access network, and
• a second core network node that processes data packets to and from the communication device,
• wherein the identifier value indicates at least one of:
• that data packets associated with the potentially malicious service data flow is to be dropped by at least one of the communication device and the access node;
• that data packets associated with the potentially malicious service data flow is to be monitored within the access network;
• that the communication device associated with the potentially malicious service data flow is to be deprioritized by the access node;
• that network resources for the communication device associated with the potentially malicious service data flow is to be restricted by the access node;
• and
• wherein the identifier value implicitly indicates that data packets belonging to the potentially malicious service data flow is to be dropped or monitored.

A method performed by an access node for enabling handling of data packets in a wireless communication system, the access node being comprised in an access network of the wireless communication system, the method comprising:

• obtaining, from a core network node, an identifier comprising an identifier value that indicates that data packets associated with a potentially malicious service data flow is to be handled according to a packet handling rule for potentially malicious data packets;
• obtaining a data packet that is marked with the identifier comprising the identifier value;
• and
• handling the data packet according to the packet handling rule for potentially malicious data packets,
• wherein the identifier value indicates at least one of:
• that data packets associated with the potentially malicious service data flow is to be dropped by at least one of the communication device and the access node;
• that data packets associated with the potentially malicious service data flow is to be monitored within the access network;
• that the communication device associated with the potentially malicious service data flow is to be deprioritized by the access node;
• that network resources for the communication device associated with the potentially malicious service data flow is to be restricted by the access node;
• and
• wherein the identifier value implicitly indicates that data packets belonging to the potentially malicious service data flow is to be dropped or monitored.

An access node for enabling handling of data packets in a wireless communication system, the access node being comprised in an access network of the wireless communication system, the access node being configured to:

• obtain, from a core network node, an identifier value that indicates that data packets associated with a potentially malicious service data flow is to be handled according to a packet handling rule for potentially malicious data packets;
• obtain a data packet that is marked with the identifier value;
• and to
• handle the data packet according to the packet handling rule, wherein the identifier value indicates at least one of:
• that data packets associated with the potentially malicious service data flow is to be dropped by at least one of the communication device and the access node;
• that data packets associated with the potentially malicious service data flow is to be monitored within the access network;
• that the communication device associated with the potentially malicious service data flow is to be deprioritized by the access node;
• that network resources for the communication device associated with the potentially malicious service data flow is to be restricted by the access node;
• and
• wherein the identifier value implicitly indicates that data packets belonging to the potentially malicious service data flow is to be dropped or monitored.

A method performed by a communication device for enabling handling of data packets in a wireless communication system, the communication device being comprised in the wireless communication system and being served by a radio access network of the wireless communication system, the method comprising:

• obtaining an identifier comprising an identifier value that indicates that data packets associated with a potentially malicious service data flow is to be handled according to a packet handling rule for potentially malicious data packets;
• obtaining a data packet for uplink transmission;
• determining that the data packet belongs to the potentially malicious service data flow;
• and
• handling the data packet according to the packet handling rule for potentially malicious data packets,
• wherein the identifier value indicates at least one of:
• that data packets associated with the potentially malicious service data flow is to be dropped by at least one of the communication device and the access node;
• that data packets associated with the potentially malicious service data flow is to be monitored within the access network;
• that the communication device associated with the potentially malicious service data flow is to be deprioritized by the access node;
• that network resources for the communication device associated with the potentially malicious service data flow is to be restricted by the access node;
• and
• wherein the identifier value implicitly indicates that data packets belonging to the potentially malicious service data flow is to be dropped or monitored.

A communication device for enabling handling of data packets in a wireless communication system, the communication device being comprised in the wireless communication system, the communication device being configured to:

• obtain an identifier comprising an identifier value that indicates that data packets associated with a potentially malicious service data flow is to be handled according to a packet handling rule for potentially malicious data packets;
• obtain a data packet for uplink transmission;
• determine that the data packet belongs to the potentially malicious service data flow;
• and to
• handle the data packet according to the packet handling rule for potentially malicious data packets,
• wherein the identifier value indicates at least one of:
• that data packets associated with the potentially malicious service data flow is to be dropped by at least one of the communication device and the access node;
• that data packets associated with the potentially malicious service data flow is to be monitored within the access network;
• that the communication device associated with the potentially malicious service data flow is to be deprioritized by the access node;
• that network resources for the communication device associated with the potentially malicious service data flow is to be restricted by the access node;
• and
• wherein the identifier value implicitly indicates that data packets belonging to the potentially malicious service data flow is to be dropped or monitored.

A computer program product comprising a non-transitory computer readable medium storing instructions which, when executed on at least one processor, cause the at least one processor to:

• identify a potentially malicious service data flow associated with a communication device served by an access network of the wireless communication system;
• assign, to the potentially malicious service data flow, an identifier value to an identifier, wherein the identifier value indicates that data packets associated with the potentially malicious service data flow is to be handled according to a packet handling rule for potentially malicious data packets;
• and
• provide an identifier comprising the identifier value towards the communication device towards at least one of:
• an access node that serves the communication device in the access network, and
• a second core network node that processes data packets to and from the communication device,
• wherein the identifier value indicates at least one of:
• that data packets associated with the potentially malicious service data flow is to be dropped by at least one of the communication device and the access node;
• that data packets associated with the potentially malicious service data flow is to be monitored within the access network;
• that the communication device associated with the potentially malicious service data flow is to be deprioritized by the access node;
• that network resources for the communication device associated with the potentially malicious service data flow is to be restricted by the access node;
• and
• wherein the identifier value implicitly indicates that data packets belonging to the potentially malicious service data flow is to be dropped or monitored.