Application steering and application blocking over a secure tunnel

A system, comprising:

• a first tunnel endpoint designed to associate at least a first Security Parameter Index (SPI) to a first application identifier to generate first mapping information;
• and
• a network entity coupled to the first tunnel endpoint over an encrypted tunnel,
• wherein the first tunnel endpoint is further designed to:
• communicate the first mapping information to the network entity.

A node designed to communicate with a network entity over an encrypted tunnel, the node comprising:

• a memory designed to store a unique Security Parameter Index (SPI) for each application identifier;
• a processor designed to associate at least a first Security Parameter Index (SPI) to a first application identifier and to generate first mapping information;
• and
• a transmitter designed to transmit the first mapping information to the network entity.

A network entity, comprising:

• a memory which stores first mapping information from a first tunnel endpoint, wherein the first mapping information comprises:
• at least a first Security Parameter Index (SPI) associated with a first application identifier;
• a receiver which receives a encrypted message from the first tunnel endpoint over an encrypted tunnel, wherein the encrypted message comprises an encrypted packet and an unencrypted header comprising the first SPI;
• and
• a processor designed to extract the first SPI from the unencrypted header, and to determine the first application identifier based on the first SPI and the first mapping information, and to identify a first application associated with the first application identifier.