# US 11,910,191 B2 · Efficient policy enforcement using network tokens for services—user-plane approach > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,910,191 B2 - Document ID: US11910191B2 - Status: Granted - Kind: B2 - Application number: 17/992,842 - Filed: 2022-11-22 - Published: 2023-03-23 - Granted: 2024-02-20 - Earliest claimed: 2015-02-24 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: Soo Bum Lee; Gavin Bernard Horn; John Wallace Nasielski; Stefano Faccin - Web page: https://patentgrep.com/patent/US11910191B2 ## CPC - H04W 12/069: using certificates or pre-shared keys - H04L 47/20: Traffic policing - H04L 47/22: Traffic shaping - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol - H04W 12/088: using filters or firewalls - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract One aspect relates to initiating, by a device, a connection with an application server associated with one or more application services. A gateway derives an uplink network token and/or a downlink network token. The tokens are provisioned to the device and/or an application server over the user-plane. The tokens are included with uplink and/or downlink packets, respectively. Another aspect relates to receiving a data packet at a gateway. The gateway determines a requirement for a network token from the packet. The gateway derives the network token based on a device subscription profile maintained by a network. The network token may be sent with the packet to a destination address associated with the packet. A packet including a network token may be received at a gateway. The gateway may verify the network token and send the data packet to an application server or a device if the verifying is successful. ## Claims ### Claim 1 A method, operational at an application server, comprising: sending, by the application server, a request to initiate a first application service with a device; obtaining, in response to sending the request to initiate the first application service, a network token, wherein the network token is: associated with a first data flow of a set of one or more data flows, associated with the first application service, and sent to the device via one or more user-plane messages; and sending the network token with one or more downlink packets sent from the application server to the device in the user-plane, wherein the network token is derived by a gateway device of a core network. ### Claim 2 (depends on 1) The method of claim 1, wherein the network token is based on a device subscription profile of the device and/or a policy of the first application service. ### Claim 3 (depends on 1) The method of claim 1, wherein the network token reflects a policy enforced by a core network with respect to the device. ### Claim 4 (depends on 1) The method of claim 1, wherein the request to initiate the first application service includes an explicit request for the network token. ### Claim 5 (depends on 1) The method of claim 1, wherein sending the request to initiate the first application service includes sending a packet representative of an implicit request for the network token. ### Claim 6 (depends on 1) The method of claim 1, wherein the application server is associated with one or more application services. ### Claim 7 (depends on 1) The method of claim 1, wherein sending the network token with the one or more downlink packets comprises including the network token in every downlink packet sent from the application server to the device in the user-plane. ### Claim 8 An application server, comprising: means for sending, by the application server, a request to initiate a first application service with a device; means for obtaining, in response to sending the request to initiate the first application service, a network token, wherein the network token is: associated with a first data flow of a set of one or more data flows, associated with the first application service, and sent to the device via one or more user-plane messages; and means for sending the network token with one or more downlink packets sent from the application server to the device in the user-plane, wherein the network token is derived by a gateway device of a core network. ### Claim 9 (depends on 8) The application server of claim 8, wherein the network token is based on a device subscription profile of the device and/or a policy of the first application service. ### Claim 10 (depends on 8) The application server of claim 8, wherein the network token reflects a policy enforced by a core network with respect to the device. ### Claim 11 (depends on 8) The application server of claim 8, wherein the request to initiate the first application service includes an explicit request for the network token. ### Claim 12 (depends on 8) The application server of claim 8, wherein sending the request to initiate the first application service includes sending a packet representative of an implicit request for the network token. ### Claim 13 An application server, comprising: a memory; and a processor, wherein the memory and the processor are configured to: send, by the application server, a request to initiate a first application service with a device; obtain, in response to sending the request to initiate the first application service, a network token, wherein the network token is: associated with a first data flow of a set of one or more data flows, associated with the first application service, and sent to the device via one or more user-plane messages; and send the network token with one or more downlink packets sent from the application server to the device in the user-plane, wherein the network token is derived by a gateway device of a core network. ### Claim 14 (depends on 13) The application server of claim 13, wherein the network token is based on a device subscription profile of the device and/or a policy of the first application service. ### Claim 15 (depends on 13) The application server of claim 13, wherein the network token reflects a policy enforced by a core network with respect to the device. ### Claim 16 (depends on 13) The application server of claim 13, wherein the request to initiate the first application service includes an explicit request for the network token. ### Claim 17 (depends on 13) The application server of claim 13, wherein sending the request to initiate the first application service includes sending a packet representative of an implicit request for the network token.