Policy enforcer in a network that has a network address translator

A computer program product that comprises a non-transitory computer readable medium that stores instructions for:

• receiving, by a policy enforcer and by from a probe, a first signature and first control metadata;
• wherein the first control metadata is indicative of at least one control plane message that was exchanged between a radio access network (RAN) and a core network and was intercepted by the probe;
• wherein the at least one control plane message relates to a first entity that either belongs to the RAN or is coupled to the RAN;
• wherein the first signature has a predetermined lifespan and wherein the wherein the non-transitory computer readable medium stores instructions for ignoring the first signature after a duration of the lifespan expired;
• processing, by the policy enforcer, information packets received by the policy enforcer to provide information packet signatures, wherein the information packets have undergone an address translation process before being received by the policy enforcer;
• and
• enforcing by the policy enforcer and with an assistance of the probe, a policy associated with the first entity, wherein the enforcing affects an information packet that is associated with an information packet signature that equals the first signature;
• wherein the address translation process when working correctly does not corrupt the first signature;
• wherein the assistance of the probe in the enforcing of the policy associated with the first entity is executed in addition to sending by the probe and to the policy enforcer the first signature and the first control metadata.

A method for enforcing a policy on data plane traffic, the method comprising:

• receiving, by a policy enforcer and from a probe, a first signature and first control metadata;
• wherein the first control metadata is indicative of at least one control plane message that was exchanged between a radio access network (RAN) and a core network and was intercepted by the probe;
• wherein the at least one control plane message relates to a first entity that either belongs to the RAN or is coupled to the RAN;
• wherein the first signature has a predetermined lifespan and wherein the method comprises ignoring the first signature after a duration of the lifespan expired;
• processing, by the probe and by the policy enforcer, information packets received by the policy enforcer to provide information packet signatures, wherein the information packets have undergone an address translation process before being received by the policy enforcer;
• and
• enforcing, by the policy enforcer, a policy associated with the first entity, wherein the enforcing affects an information packet of the information packets that is associated with an information packet signature that equals the first signature;
• wherein the address translation process when working correctly does not corrupt the first signature.