Quality of service (qos) differentiation for internet protocol (ip) access in a wireless communication system

A method for communicating datagrams of a protocol data unit (PDU) session between a user equipment (UE) and a fifth-generation core network (5GC) via a non-third generation partnership project (non-3GPP) access network, the method comprising:

• transmitting a first datagram of data related to the PDU session via an IPsec tunnel over the non-3GPP access network according to a first quality of service (QOS) based on a first DSCP value in a first outer Internet Protocol (IP) header of the first datagram, the first datagram including the first outer IP header and a first IPsec header that encapsulates a first encrypted payload, the first encrypted payload including:
• a first inner IP header, a first generic routing encapsulation (GRE) header, and a first encrypted PDU;
• and
• upon receiving a request to transmit data related to the PDU session according to a second QoS different from the first QoS and determining at least one criterion is met:
• transmitting a second datagram of data via the IPsec tunnel according to the second QoS by inserting a second DSCP value in a second outer IP header of the second datagram, the second datagram including the second outer IP header and a second IPsec header that encapsulates a second encrypted payload, the second encrypted payload including:
• a second inner IP header, a second GRE header, and a second encrypted PDU.

An apparatus comprising:

• a modem;
• and
• a processor configured to control the modem to:
• establish an Internet Protocol security (IPsec) tunnel over a non-third generation partnership project (non-3GPP) access network;
• generate a first datagram to convey a first encrypted protocol data unit (PDU), the first datagram including a first outer Internet Protocol (IP) header and an IPsec header that encapsulates an encrypted payload, the encrypted payload including:
• a first inner IP header, a generic routing encapsulation (GRE) header, and the first encrypted PDU;
• set a first differentiated services code point (DSCP) value of the first outer IP header to match a second DSCP value of the first encrypted PDU;
• and
• transmit the first datagram via the IPsec tunnel in the non-3GPP access network.