Controlling services in a packet data network

[0001] 1. Field of the Invention

[0002] The invention relates to communication networks. In particular, the invention relates to controlling services in a packet data based communication network in a novel and improved way.

[0003] 2. Description of the Related Art

[0004] Nowadays service providers of packet data based communication networks, e.g. Internet Protocol (IP) based communication networks like Internet and various wireless communication networks such as General Packet Radio Service (GPRS) enabled mobile communication networks, Wireless LAN networks, and Code Division Multiple Access (CDMA) based mobile communication networks, need to provide value-added services in their networks in order to attract private and corporate subscribers to their network. Many such services require introducing intermediate nodes via which packets are routed before routing them towards the eventual destination IP address. The intermediate nodes perform a variety of tasks, which may be associated with different protocol layers. Such intermediate nodes are also called proxies.

[0005] The various value-added services provided may be categorized into subscriber services and network services. Examples of the subscriber services include packet data based voice, email, content downloading, browsing, streaming and rich calls. The network services are offered by packet data based mobile communication networks to support the usage of subscriber services. These network services include e.g. rerouting, barring, accounting, content proxy services, content blocking services, firewall services, virus scanning services, antispam services, performance enhancement proxy services, Virtual Private Network (VPN) services, various Quality of Service (QoS) related services and various charging related services both for online and offline charging. Unless otherwise stated, in the following the term ‘service’ is used to refer to both subscriber and network services.

[0006] In the case of Differentiated Services (DiffServ) it is sufficient to process packets at IP layer to perform packet metering, marking, shaping and dropping. Differentiated Services are more closely defined in, for example, the IETF RFC 2475. In the case of Transmission Control Protocol (TCP) connection routing, packets must be processed at TCP layer. The purpose of TCP connection routing is, for example, to allocate servers from a server resource pool for TCP connection requests. Typically, such TCP connection requests are associated with Hypertext Transfer Protocol (HTTP) content requests. The HTTP is defined in the IETF RFC 2616. In the context of mobile networks TCP proxies are also used to enhance performance over a slow and unreliable link layer connections. In the case of an application layer proxy, multiple packets constituting an application layer message must be intercepted in an intermediate node. An application layer proxy comprises also the lower layers, that is, the IP layer and the TCP or UDP layer. Application layer proxies are used in a variety of services which may be specific to the application protocol. Examples of application protocols in which proxies are used are Hypertext Transfer Protocol (HTTP, IETF RFC 2616), Session Initiation Protocol (SIP, IETF RFC 2543) and Simple Mail Transfer Protocol (SMTP, IETF RFC 2821). Application layer proxies are also used as application level gateways which perform protocol adaptation between different application layer protocols.

[0007] In the case of HTTP examples of services applied are rerouting, barring, accounting and charging services. In rerouting services an HTTP GET operation specifying a given Uniform Resource Locator (URL) is redirected to a different URL so that the URL is rewritten. The actual domain name part in the URL may already have been translated into an IP address at the source node, so a new destination IP address must be written to the HTTP GET operation. In barring services the proxy intercepts and bars HTTP GET operations targeted to given URLs. In accounting and charging services the volume of HTTP traffic to and from a given server address may be counted, for example. The volume of traffic may be measured in terms of data volume, that is, the number of bytes, or number of requests and responses. In accounting and charging applications it is also necessary to match HTTP requests (for example, GET operation) with HTTP responses (for example, 200 OK response). The purpose is, for example, to avoid charging for requests for which no response is received. Therefore, the HTTP proxy must also maintain the state of the HTTP messaging.

[0008] In addition to those mentioned above, value-added services to be provided in packet data networks may include content proxy services, content blocking services, firewall services, virus scanning services, antispam services, performance enhancement proxy services, Virtual Private Network (VPN) services, various Quality of Service (QoS) related services and various charging related services.

[0009] In some cases proxies such as those mentioned above are implemented as separate actual network elements. However, providing a whole gamut of services with separate network elements for each type of service eventually becomes difficult and expensive. Therefore, in some cases several proxy functionalities may be implemented in a single physical network element as service entities. A network element that implements several services may need to have a wide variety of service entities. By a service entity is meant herein an intermediate functionality configured between a packet source and a packet destination, which participates in the providing of a given service for the packets or higher layer protocol data units transmitted therein between the source and the destination. In more elaborate cases the service entities implemented by a given network element may belong to different networks, which may be administered by different administrative authorities. Further, some of the service entities may be located outside of the original network element in a remote network element, for example, in cases where the processing involved requires special hardware or it is otherwise meaningful to distribute the functionality. In such a case a packet is first transferred from the original network element to the remote network element in order to render it to the processing associated with the remote service entity. Thereupon, it is transferred back to the original network element.

[0010] Usually, when a packet arrives to a network element providing multiple service entities pertaining to one or many services, the network element must decide which service entities should be applied for the packet, that is, which service entities the packet should traverse. For each service entity a decision must be made whether the service entity should handle the packet, that is, whether the packet should be passed to the service entity. The packet needs to go through several decision points to determine which service entities need to process the packet. The service entities needed depend on the service that needs to be rendered to the packet. During the traversal of the packet through multiple service entities, the decision point between two service entities may become very complex and time consuming. Furthermore, the same decision may need to be made repetitively to determine whether a packet needs to be passed to a given service entity or not.

[0011] Reference is now made to FIG. 1, which illustrates a prior art process of determining which particular service entities need to handle a given packet received at a network element. In FIG. 1 there is a network node 100, which provides local and remote service entities by means of which at least one service may be rendered to the packet. Network node 100 is, for example, a GPRS support node. Network node 100 comprises Service Entity 1, Service Entity 2 and Service Entity 4. Packets are also relayed to and from a remote Service Entity 3 operating in a remote network node 102. A remote service entity is in other words an out-of-the-box service entity. Network node 100 further comprises Decision Point 1, Decision Point 3, Decision Point 3 and Decision Point 4. Decision points 1, 2 and 4 are associated with Service Entities 1, 2 and 4. Decision Point 3 is associated with the remote Service Entity 3. A packet passed to the remote Service Entity 3 is illustrated with arrow 119 and a packet returned or sent by the remote Service Entity 3 is illustrated with arrow 120.

[0012] An IP packet received by network node 100 is represented by arrow 110. The IP packet is passed to Decision Point 1. Decision Point 1 determines based on, for example, IP layer header information, higher protocol layer header information within payload or other payload information in the IP packet whether the IP packet must be subjected to processing performed by Service Entity 1. If processing performed by Service Entity 1 is required for the IP packet, Decision Point 1 passes the IP packet to Service Entity 1 as illustrated with arrow 114. Otherwise, Decision Point 1 passes the IP packet to a next Decision Point 2 as illustrated with arrow 111. When Service Entity 1 has performed processing on the IP packet, Service Entity 1 passes it to Decision Point 2 as illustrated with arrow 115. In the same manner each Decision Point 1-4 of FIG. 1 in turn inspects the IP packet and makes the decision whether the IP packet is to be passed to the Service Entity associated with the Decision Point. When each Service Entity has processed the IP packet, it is passed by them to the next Decision Point.

[0013] As a result of processing performed by Service Entity 2 the IP packet may once again have to be subjected to inspection at Decision Point 1. This is illustrated with arrow 118, which represents the loop back to Decision Point 1. The IP packet may have been modified by Service Entity 2 in such a way that it is necessary to inspect whether Service Entity 1 should process it again. When the last Service Entity 4 has processed the IP packet, it is subjected to routing decisions for determining the next network element to which it must be sent. Subsequent IP packets received at network node 100 are subjected to similar processing through the chain of Decision Points and Service Entities.

[0014] The disadvantage of a solution such as the one illustrated in FIG. 1 is that a decision point between two adjacent service entities may become extremely complex and expensive to implement and maintain. Furthermore, same decisions may need to be made repetitively to determine whether a packet needs to be passed to a service entity or not. For example, if same higher layer protocol headers must be detected and parsed in a similar manner in several decision points, the performance of network node 100 is reduced significantly. Let us assume, for example, that Service Entities 1 and 3 are configured to act as HTTP proxies for any packets carrying HTTP GET operations requesting a URL which belongs to a given set of URLs. In this case Decision Points 1 and 3 must both comprise same functionality of scanning packets containing TCP and HTTP headers, parsing HTTP headers to determine the URL and then checking whether the requested URL belongs to the given set of URLs.

[0015] Additionally, configuration of new services to a network node such as network node 100 is complicated. The software in network node 100 must be updated to reflect the new service entities and the associated decision points that need to be added to the existing chain of service entities.

[0016] The aim of the invention disclosed herein is to alleviate the problems discussed hereinbefore and to introduce flexibility in the creation, modification and execution of service entity chains. The processing performance of value-added services in network nodes is improved by avoiding double processing associated with service determination, i.e. determination of required service entities for a value-added service.

[0017] A first aspect of the present invention is a method of controlling services in a packet data based communication network comprising one or more terminal devices and one or more service entities for providing services to the terminal devices. As described above, the term ‘service entity’ refers to a logical entity providing one or more services. The term ‘service’ is used to refer to a value-added service. One or more service entities may be comprised in a server-type network element dedicated solely to providing services. Alternatively or additionally one or more service entities may be integrated with network elements that also have other functions besides providing services. For example, one or more service entities may be integrated with a gateway node of the present invention.

[0018] A change in the state of a connection between a terminal device and a gateway node of the communication network is detected. In response to the detected change, a service policy request for the terminal device is sent from the gateway node to a session control means of the communication network.

[0019] In response to the received request, one or more service policies are generated at the session control means. The one or more service policies comprise service information indicating which service entities and in which order are to be utilized for providing services to the terminal device.

[0020] The session control means may be comprised in a separate network element. Alternatively the session control means may be integrated with a network element that also has other functions besides those of the session control means. For example, the session control means may be integrated with the gateway node of the present invention.

[0021] One or more generated service policies are sent to the gateway node. At one or more service entities services are provided in the indicated order.

[0022] A second aspect of the present invention is a system of controlling services in a packet data based communication network. The system comprises one or more terminal devices. The system further comprises one or more service entities for providing services to the terminal devices. The system further comprises a gateway node comprising a detecting means for detecting a change in the state of a connection between a terminal device and the gateway node. The gateway node further comprises a service policy request means for sending, in response to the detected change, a service policy request for the terminal device.

[0023] The system further comprises a session control means for generating, in response to the service policy request received from the gateway node, one or more service policies, each comprising service information indicating which service entities and in which order are to be utilized for providing services to the terminal device. The session control means is configured to send one or more generated service policies to the gateway node. One or more service entities further comprise a rule means for providing services in the indicated order.

[0024] A third aspect of the present invention is a network node comprising a session control means for generating, in response to a service policy request received from a gateway node of a packet data based communication network, one or more service policies, each comprising service information indicating which service entities of the communication network and in which order are to be utilized for providing services to a terminal device of the communication network. The session control means is configured to send one or more generated service policies to the gateway node.

[0025] A fourth aspect of the present invention is a computer program comprising code adapted to perform the following steps when executed on a data-processing device. A change is detected in the state of a connection between a terminal device of a packet data based communication network and a gateway node of the communication network. In response to the detected change, a service policy request for the terminal device is sent from the gateway node to a session control means of the communication network. In response to the received service policy request, one or more service policies, each comprising service information indicating which service entities and in which order are to be utilized for providing services to said terminal device are generated at the session control means. One or more generated service policies are sent to the gateway node. At one or more service entities, services are provided in the indicated order.

[0026] In an embodiment of the invention, the generated one or more service policies further comprise one or more service entity specific service rules according to which the service entities are to provide their services. The one or more service rules received from session control means are forwarded from the gateway node to the indicated service entities, in the indicated order. The services are provided according to the service rules received from the gateway node.

[0027] In an embodiment of the invention, the gateway node comprises one or more service entity specific service rules according to which the service entities are to provide their services. The one or more service rules are forwarded from the gateway node to the indicated service entities, in the indicated order. The services are provided according to the service rules received from the gateway node.

[0028] In an embodiment of the invention, prior to generating the one or more service policies, a request for subscription data associated with a subscriber of the terminal device is sent from the session control means to a subscriber database of the communication network. In response to the received request, the requested subscription data is sent to the session control means, and the received subscription data is utilized in generating the one or more service policies. The subscriber database may be, for example, a Home Location Register in a General Packet Radio Service enabled mobile communication network.

[0029] In an embodiment of the invention the subscription data associated with the subscriber of the terminal device is updated at the subscriber database. A request for the updated subscription data is sent to the subscriber database. In response to the received request, the requested updated subscription data is sent to the session control means.

[0030] In an embodiment of the invention the packet data based communication network is an Internet Protocol based wireless communication network.

[0031] In an embodiment of the invention the detected change is a received request for access bearer establishment. Alternatively or additionally the detected change may be a received request for access bearer modification. In case of GPRS, the request for access bearer establishment may be e.g. a ‘Create PDP Context Request’, whereas the request for access bearer modification may be e.g. an ‘Update PDP Context Request’. The term ‘access bearer’ is used to refer to an information transmission path of a defined property, e.g. of a security tunnel, which access bearer is explicitly established across an access network between a terminal device and an access terminating gateway. One example of an access bearer is the PDP context in a GPRS system.

[0032] In an embodiment of the invention said detected change is a detected new service flow. The term ‘service flow’ is used to refer to a set of packet flows, defined by the L3-L7 and above lookup criteria. In the context of the present invention, a service flow is the lowest flow granulation to which a different set of service rules may be applied.

[0033] In an embodiment of the invention one or more received service rules are deleted at one or more service entities after an access bearer is released.

[0034] In an embodiment of the invention one or more received service rules are deleted at one or more service entities after the associated service flows are terminated.

[0035] In an embodiment of the invention one or more service policies received from the session control means are stored at the gateway node, e.g. for re-use.

[0036] In an embodiment of the invention one or more service rules received from the gateway node are stored at one or more service entities.

[0037] In an embodiment of the invention the Internet Protocol based wireless communication network comprises a Wireless Local Area Network (WLAN). A standard, IEEE 802.11, specifies the technologies for Wireless LANs. In a WLAN a mobile user can connect to a local area network through a wireless connection.

[0038] In an embodiment of the invention the Internet Protocol based wireless communication network comprises a General Packet Radio Service enabled mobile communication network.

[0039] In an embodiment of the invention the Internet Protocol based mobile communication network comprises a Code Division Multiple Access based network. In an embodiment of the invention, the gateway node is a Packet Data Serving Node (PDSN) of the Code Division Multiple Access based network.

[0040] In an embodiment of the invention prior to generating the one or more service policies, application session and media data is sent from an application function means to the session control means, and the received application session and media data is utilized in generating the one or more service policies.

[0041] The term ‘application function means’ refers to a network element which offers applications for IP based services. The application function means may, for example, be capable of communicating with a Policy Decision Function means in order to transfer dynamic QoS-related application information. The application function means may also be, for example, capable of communicating with a Charging Rules Function means in order to transfer dynamic charging-related application information.

[0042] In an embodiment of the invention the application session and media data is updated at the application function means, and the updated application session and media data is sent to the session control means.

[0043] In an embodiment of the invention the gateway node is a Packet Data Gateway of the Wireless LAN network.

[0044] In an embodiment of the invention the gateway node is a Gateway GPRS Support Node of the General Packet Radio Service enabled mobile communication network.

[0045] The invention allows improved flexibility in introducing new services in a communication network. Further, configuration of network nodes becomes easier. The processing performance of value-added services in network nodes is improved since double processing associated with service determination is eliminated.

[0050] Reference will now be made in detail to the embodiments of the invention, examples of which are illustrated in the accompanying drawings.

[0051] FIG. 2 illustrates an exemplary embodiment of the method of the present invention. At step 20 a change in the state of a connection Cn between a terminal device 201 of a communication network and a gateway node 202 of the communication network is detected. The change may be e.g. an access bearer establishment or an access bearer modification or detection of a new service flow. In response to the detected change, a service policy request for the terminal device 201 is sent from the gateway node 202 to a session control means 203 of the communication network, step 21.

[0052] In response to the received service policy request, at step 22, a request for subscription data associated with a subscriber of the terminal device 201 is sent from the session control means 203 to a subscriber database 204 of the communication network. In response to the received request, the requested subscription data is sent to the session control means 203, step 23.

[0053] At step 24, one or more service policies are generated at the session control means 203. The one or more service policies each comprise service information indicating which service entities and in which order are to be utilized for providing services to the terminal device 201. In the exemplary embodiment illustrated in FIG. 2 the one or more service policies further comprise service entity specific service rules according to which the service entities are to provide their services. The received subscription data is utilized in generating the one or more service policies. In addition, information pre-configured in the session control means 203 may also be utilized in generating the one or more service policies. A service policy may be generated for an access bearer or a service flow.

[0054] A service rule may, for example, comprise two parts: a trigger condition and at least one action. The trigger condition may define packets that must be subjected to the action. In other words, if a packet matches the trigger condition, then the at least one action defined in the rule is taken on the packet.

[0055] If a given service entity is a content proxy, at least one service rule to be forwarded to it may be a rule for charging.

[0056] If a given service entity is a content blocking entity, at least one service rule to be forwarded to it may contain one or more addresses to be blocked (e.g. in the form of Uniform Resource Locators, URLs) and/or a content blocking category of the subscriber. If the content blocking category is included, mapping from the content blocking category to address or addresses to be blocked is preferably performed in the content blocking entity.

[0057] If a given service entity is a firewall, at least one service rule to be forwarded to it may contain one or more service flows to be allowed and/or a firewall category of the subscriber. If the firewall category is included, mapping from the firewall category to service flow or service flows to be allowed/blocked is preferably performed in the firewall.

[0058] One or more generated service policies are sent to the gateway node 202, step 25. The received service rules are forwarded to the indicated service entities 205, 206, 207, in the indicated order, steps 26a, 27a and 28a. One or more service rules may be forwarded immediately, and one or more service rules may be forwarded when a service flow to which the service rule is to be applied is detected. At the service entities 205, 206, 207 services are provided according to the received service rules in the indicated order, steps 26b, 27b and 28b. The service entities 205, 206, 207 may report status information on providing their services to the gateway node 202.

[0059] For example, a generated service policy may indicate that a service by service entity A 205 is to be provided first, a service by service entity B 206 next, and finally a service by service entity C 207.

[0060] A first way to implement this is that the service rule(s) for service entity A 205 are first forwarded to the service entity A 205, step 26a. Next, the service entity A 205 provides its service(s) according to the rule(s) it received, step 26b. Next, the service rule(s) for service entity B 206 are forwarded to service entity B 206, step 27a. Then, the service entity B 206 provides its service(s) according to the rule(s) it received, step 27b. Finally, the service rule(s) for service entity C 207 are forwarded to the service entity C 207, step 28a. Then, the service entity C 207 provides its service(s) according to the rule(s) it received, step 28b.

[0061] A second way to implement this is that the service rule(s) for the service entity A 205 are first forwarded to the service entity A 205, step 26a. Next, the service rule(s) for the service entity B 206 are forwarded to the service entity B 206, step 27a. Then, the service rule(s) for the service entity C 207 are forwarded to the service entity C 207, step 28a. After all the service rules have been forwarded, the service entity A 205 provides its service(s) according to the rule(s) it received, step 26b. Next, the service entity B 206 provides its service(s) according to the rule(s) it received, step 27b. Finally, the service entity C 207 provides its service(s) according to the rule(s) it received, step 28b.

[0062] The actual service providing by the service entities 205, 206, 207 comprises the service entities 205, 206, 207 processing packets forwarded by the gateway node 202 according to their services. For example, the gateway node 202 forwards packets to service entity A 205 which sends the packets back to the gateway node 202 after processing them according to its services. When receiving the processed packets from service entity A 205, the gateway node 202 forwards the packets processed by the service entity A 205 to service entity B 206 which sends the packets back to the gateway node 202 after having processed them according to its services. When receiving the processed packets from service entity B 206, the gateway node 202 forwards the packets to service entity C 207 which again sends the packets back to the gateway node 202 after having processed them according to its services.

[0063] Alternatively, the gateway node 202 may e.g. forward packets to service entity A 205 which forwards the packets to service entity B 206 after having processed them according to its services. Service entity B 206 processes the packets and forwards the packets to service entity C 207. Service entity C 207 forwards the packets to the gateway node 202 after having processed them according to its services. In this alternative, service entities A, B and C 205, 206, 207 need to know where to forward the packets after providing their services. This information may be included in the service policy.

[0064] FIG. 3 illustrates an exemplary embodiment of the system of the present invention which embodiment relates to controlling services in a packet data based communication network. The packet data based communication network NW 300 may comprise e.g. a General Packet Radio Service enabled 3GPP mobile communication network. Alternatively the packet data based communication network NW 300 may comprise e.g. a WLAN network or a Code Division Multiple Access based network.

[0065] The exemplary system of FIG. 3 comprises mobile stations MS 301, one of which is illustrated in FIG. 3. The system further comprises service entities SE1, SE2 and SE3 306, 307, 308 for providing services to the mobile stations.

[0066] The exemplary system of FIG. 3 further comprises a gateway node GW 302. The gateway node GW 302 may be e.g. a Gateway GPRS Support Node. Alternatively the gateway node 302 may be e.g. a Packet Data Gateway of a WLAN network or a Packet Data Serving Node of a Code Division Multiple Access based network. The gateway node GW 302 comprises a detecting means DCT for detecting a change in the state of a connection Cn between a mobile station 301 and the gateway node GW 302. The gateway node GW 302 further comprises a service policy request means POL_REQ for sending, in response to the detected change, a service policy request for the mobile station MS 301. The detected change may be e.g. a request for establishing or modifying an access bearer for the mobile station MS 301, the request having been received at the gateway node GW 302. If the packet data based communication network NW 300 comprises a General Packet Radio Service enabled mobile communication network, the request for access bearer establishment or modification may be e.g. a ‘Create PDP Context Request’ message, or e.g. an ‘Update PDP Context Request’ message received from a Serving GPRS Support Node to a Gateway GPRS Support Node acting as the gateway node GW 302 of the present invention. Alternatively the detected change may be e.g. a detected new service flow for the mobile station MS 301.

[0067] The exemplary system of FIG. 3 further comprises a session control means SC 303 for generating one or more service policies in response to the service policy request received from the gateway node GW 302. The session control means SC 303 may comprise an authorization function, a function for control of charging, e.g. the Service Data Flow Based Charging Rules Function of 3GPP, a function for control of QoS, e.g. the Policy Decision Function of 3GPP, a credit control function, e.g. the Service Data Flow Based Credit Control of 3GPP, and/or a function for control of service entities. The one or more service policies each comprise service information indicating which service entities and in which order are to be utilized for providing services to the terminal device 301. In the exemplary embodiment illustrated in FIG. 3 the service policies further comprise service entity specific service rules according to which the service entities are to provide their services. The session control means SC 303 is configured to send one or more generated service policies to the gateway node GW 302. The gateway node GW 302 further comprises a forwarding means FWD for forwarding, in the indicated order, the received service rules to the indicated service entities. The service entities SE1 306, SE2 307, SE3 308 further comprise a rule means RL for providing services according to the received service rules in the indicated order. The gateway node GW 302 further comprises a first storage means STR1 for storing received service policies, e.g. for re-use. The service entities SE1 306, SE2 307, SE3 308 further comprise a second storage means STR2 for storing received service rules.

[0068] In the exemplary system of FIG. 3 the session control means SC 303 further comprises a subscription data request means SUB_REQ for sending a request for subscription data associated with a subscriber of the mobile station MS 301 to a subscriber database SUB_DB 304. The subscriber database 304 may be e.g. a Home Location Register. The subscriber database SUB_DB 304 comprises a sending means SND for sending, in response to the received request, the requested subscription data to the session control means SC 303 which session control means SC 303 is further configured to utilize the received subscription data in generating the one or more service policies. The session control means SC 303 may be further configured to utilize information pre-configured in itself in generating the one or more service policies.

[0069] In the exemplary system of FIG. 3 the subscriber database SUB_DB 304 further comprises a subscription data update means SUB_UPD for updating the subscription data associated with the subscriber of the terminal device MS 301. The session control means SC 303 further comprises a subscription data update request means SUB_UPD_REQ for sending a request for the updated subscription data to the subscriber database SUB_DB 304. The subscription data update means SUB_UPD is further configured to send, in response to the received request, the requested updated subscription data to the session control means SC 303.

[0070] In the exemplary system of FIG. 3 the session control means SC 303 further comprises an application and service data request means APP_REQ for sending a request for application session and media data to an application function means AF 305. The application function means AF 305 is configured to send the requested application session and media data to the session control means SC 303 which session control means SC 303 is further configured to utilize the received application session and media data in generating the one or more service policies. Further, the application function means AF 305 comprises application session and media data update means APP_UPD for updating the application session and media data, and for sending the updated application session and media data to the session control means SC 303.

[0071] In the exemplary system of FIG. 3 the service entities SE1 306, SE2 307 and SE3 308 further comprise a first deleting means DELL for deleting one or more received service rules after an established access bearer is released. One or more service entities may further comprise a second deleting means DEL2 for deleting one or more received service rules after the associated service flows are terminated.

[0072] The following describes operation of the exemplary embodiment of FIG. 3 in more detail when the packet data based communication network 300 is a General Packet Radio Service enabled mobile communication network and when the application function means AF 305 is not involved, in other words when no application session and media data is sent by the application function means AF 305 to the session control means SC 303. The session control means SC 303 uses subscription data, information from the gateway node GW 302 and pre-configured information for decision making.

[0073] First, the gateway node GW 302 receives a request for access bearer establishment or modification, such as a Create PDP Context Request or Update PDP Context Request, comprising e.g. a user identification, an Access Point Name (APN), and an access network type. As is known by those skilled in the art, the Access Point Name is a reference to the gateway node to be used for e.g. GPRS access. The gateway node GW 302 determines whether control by the session control means SC 303 is required.

[0074] Next, if control by the session control means SC 303 is required, the gateway node GW 302 resolves the address of the session control means SC 303 e.g. by using pre-configured address information of the session control means SC 303. The gateway node GW 302 sends a service policy request comprising the user identification, the APN, and the access network type to the session control means SC 303. The gateway node GW 302 may receive the access network type in the request for access bearer establishment or modification. Alternatively the gateway node GW 302 may derive the access network type e.g. from the address of a Serving GPRS Support Node. The address of the session control means SC 303 may be pre-configured in the gateway node GW 302 per APN.

[0075] Next, if subscription data is not available in the session control means SC 303, the session control means SC 303 may send a request for subscription data comprising the user identification and the APN to the subscriber database SUB_DB 304 to retrieve the subscription data.

[0076] Next, the subscriber database SUB_DB 304 replies by sending the subscription data to the session control means SC 303. The subscription data comprises e.g. a unique subscription identity, a list of services provisioned for the subscription and personal attributes for rule creation. The session control means SC 303 stores the subscription data.

[0077] Next, the session control means SC 303 generates one or more service policies and sends one or more generated service policies to the gateway node GW 302. In this exemplary embodiment, when generating a service policy, the session control means SC 303 take into account information sent by the gateway node GW 302, subscription data and information pre-configured in the session control means SC 303 (e.g. service—service flow mapping, subscription data attribute—service rule mapping). In addition to the service information and the service rules comprised in the generated one or more service policies, the session control means SC 303 may send to the gateway node GW 302 a list of services allowed on the access bearer, indication of maximum values for the QoS class and indication of maximum bit rates for the access bearer, indication of maximum values for the QoS class and indication of maximum bit rates for each service flow.

[0078] The gateway node GW 302 enforces the received service policies. The gateway node GW 302 determines which service rules have to be indicated to the service entities and sends such rules to them. The gateway node GW 302 may also store the service rules for later distribution to the service entities, for example until a corresponding service flow is detected at the gateway node GW 302. Finally, the gateway node GW 302 acknowledges the access bearer establishment or modification.

[0079] The following describes operation of the exemplary embodiment of FIG. 3 in more detail when the packet data based communication network 300 is a General Packet Radio Service enabled mobile communication network and when the application function means AF 305 is involved. Involvement of the application function means AF 305 may be relevant e.g. when establishing or modifying secondary access bearers. Application session and media data is sent by the application function means AF 305 to the session control means SC 303. The session control means SC 303 uses the application session and media data from the application function means AF 305, the subscription data, information from the gateway node GW 302 and pre-configured information for decision making.

[0080] Multiple application sessions may be ongoing in parallel. These application sessions may be supported by multiple application function means (not illustrated in FIG. 3). The address of the session control means SC 303 may be pre-configured to the multiple application function means so that the multiple application function means can send information on the application session(s) to the same the session control means SC 303. The trusted multiple application function means may be pre-configured to the session control means SC 303. In decision making, the session control means SC 303 then takes into account information received from the trusted multiple application function means.

[0081] First, the application function means AF 305 sends a session authorization message comprising e.g. application session and media data and an authorization token request to the session control means SC 303. The application session and media data may include for each media component an application identification, packet classifier information, direction information, QoS information and application specific information. The authorization token request is included if the application function means AF 305 wants the session control means SC 303 to allocate an authorization token.

[0082] The application function means AF 305 may send information on multiple application sessions to the session control means SC 303. Further, multiple application function means may send information on the application sessions to the session control means SC 303.

[0083] Next, the session control means SC 303 allocates an authorization token, if requested by the application function means AF 305, and replies by sending a session authorization acknowledgement message comprising the authorization token to the application function means AF 305. The authorization token may be sent from the application function means AF 305 to the terminal device MS 301.

[0084] Next, the gateway node GW 302 receives a request for access bearer establishment or modification, such as a Create PDP Context Request or an Update PDP Context Request, comprising a user identification, an APN, an access network type, the authorization token and service flow identifications. The authorization token and service flow identifications are available, if sent by the mobile station MS 301. Multiple sets of authorization tokens and service flow identifications may also be available.

[0085] Next, the gateway node GW 302 resolves the session control means SC 303 address by using the authorization token. The gateway node GW 302 sends a service policy request comprising e.g. user identification, the APN, the access network type, the authorization token and the service flow identifications to the session control means SC 303. The gateway node GW 302 may receive the access network type in the request for access bearer establishment or modification. Alternatively the gateway node GW 302 may derive the access network type e.g. from the address of a Serving GPRS Support Node. The authorization token and the service flow identifications are included if received in the request for access bearer establishment or modification. Multiple sets of authorization tokens and service flow identifications may also be included.

[0086] Next, the authorization token and service flow identifications are used to access the information sent by the application function means AF 305. The subscription data or information pre-configured to the session control means SC 303 may be used e.g. to perform limitations for the information sent by the application function means AF 305 or to search additional information for generating service policies.

[0087] The session control means SC 303 generates one or more service policies and sends one or more generated service policies to the gateway node GW 302. In this exemplary embodiment, when generating a service policy, the session control means SC 303 take into account information sent by the gateway node GW 302, information sent by the application function means AF 305, subscription data and information pre-configured in the session control means SC 303 (e.g. service—service flow mapping, subscription data attribute—service rule mapping). In addition to the service information and the service rules comprised in the generated one or more service policies, the session control means SC 303 may send to the gateway node GW 302 a list of services allowed on the access bearer, indication of maximum values for the QoS class and indication of maximum bit rates for the access bearer, indication of maximum values for the QoS class and indication of maximum bit rates for each service flow.

[0088] The gateway node GW 302 enforces the received service policies. The gateway node GW 302 determines which service rules have to be indicated to the service entities and sends such rules to them. The gateway node GW 302 may also store the service rules for later distribution to the service entities, for example until a corresponding service flow is detected at the gateway node GW 302. Finally, the gateway node GW 302 acknowledges the access bearer establishment or modification.

[0089] The following describes operation of the exemplary embodiment of FIG. 3 in more detail when the packet data based communication network 300 is a General Packet Radio Service enabled mobile communication network and when subscription data in the subscriber database SUB_DB 304 is modified so that the modifications have to be reflected to the session control means SC 303 and the gateway node GW 302.

[0090] First, the subscriber database SUB_DB 304 notifies the session control means SC 303 that modifications in subscription data have taken place by sending an update notification message.

[0091] Next, the session control means SC 303 requests the modified subscription data either when receiving the update notification, when receiving the next request related to the user identification and APN from the gateway node GW 302, or periodically. The session control means SC 303 sends a request for the updated subscription data comprising the user identification and the APN to the subscriber database SUB_DB 304.

[0092] Next, the subscriber database SUB_DB 304 replies by sending the updated subscription data to the session control means SC 303. The updated subscription data comprises e.g. a unique subscription identity, a list of services provisioned for the subscription and personal attributes for rule creation. The session control means SC 303 stores the updated subscription data.

[0093] Next, the session control means SC 303 determines which access bearers and service flows are affected by the subscription data modification. The session control means SC 303 generates one or more service policies and sends one or more generated service policies to the gateway node GW 302. In addition to the service information indicating which services in which order shall be applied for the access bearer or for each service flow, and the service rules for each of the services controlled by the session control means SC 303, the session control means SC 303 may send to the gateway node GW 302 a list of services allowed on the access bearer, indication of maximum values for the QoS class and indication of maximum bit rates for the access bearer, indication of maximum values for the QoS class and indication of maximum bit rates for each service flow. The attributes requiring modifications are included.

[0094] Finally, the gateway node GW 302 enforces the service policies. The gateway node GW 302 determines which service rules have to be indicated to the service entities and sends such service rules to them.

[0095] The following describes operation of the exemplary embodiment of FIG. 3 in more detail when the packet data based communication network 300 is a General Packet Radio Service enabled mobile communication network and when application session and media data is updated. Update of application session and media data may happen e.g. when an application session is modified. During an ongoing application session, updates which have to be reflected to the session control means SC 303 may take place. The application function means AF 305 informs the session control means SC 303 about the new application session and media data. The session control means SC 303 may push generated service policies to the gateway node GW 302.

[0096] First, the application function means AF 305 decides to inform the session control means SC 303 about updated application session and media data. The application function means AF 305 sends a session information message comprising the application session and media data to the session control means SC 303. The application session and media data may include for each modified media component an application identification, packet classifier information, direction information, QoS information and application specific information.

[0097] Next, the session control means SC 303 replies by sending a session information acknowledgement message to the application function means AF 305.

[0098] Next, the subscription data or information pre-configured to the session control means SC 303 may be used e.g. to perform limitations for the information sent by the application function means AF 305 or to search additional information for generating service policies.

[0099] Then, the session control means SC 303 determines which access bearers and service flows are affected by the updated application session and media data. The session control means SC 303 generates one or more service policies and sends one or more generated service policies to the gateway node GW 302. In addition to the service information indicating which services in which order shall be applied for the access bearer or for each service flow, and the service rules for each of the services controlled by the session control means SC 303, the session control means SC 303 may send to the gateway node GW 302 a list of services allowed on the access bearer, indication of maximum values for the QoS class and indication of maximum bit rates for the access bearer, indication of maximum values for the QoS class and indication of maximum bit rates for each service flow. The attributes requiring modifications are included. The gateway node GW 302 enforces the service policies. The gateway node GW 302 determines which service rules have to be indicated to the service entities and sends such service rules to them.

[0100] The following describes operation of the exemplary embodiment of FIG. 3 in more detail when the packet data based communication network 300 is a General Packet Radio Service enabled mobile communication network and when pre-configured information in the session control means SC 303 is modified. If the pre-configured information in the session control means SC 303 is modified, the modifications may have to be reflected to the gateway node GW 302.

[0101] First, the pre-configured information in the session control means SC 303 is modified. The session control means SC 303 determines which access bearers and service flows are affected by the modification. For each such access bearer, the session control means SC 303 generates one or more service policies to the gateway node GW 302. In addition to the service information indicating which services in which order shall be applied for the access bearer or for each service flow, and the service rules for each of the services controlled by the session control means SC 303, the session control means SC 303 may send to the gateway node GW 302 a list of services allowed on the access bearer, indication of maximum values for the QoS class and indication of maximum bit rates for the access bearer, indication of maximum values for the QoS class and indication of maximum bit rates for each service flow. The attributes requiring modifications are included.

[0102] Then, the gateway node GW 302 enforces the service policies. The gateway node GW 302 determines which service rules have to be indicated to the service entities and sends such service rules to them.

[0103] The following describes operation of the exemplary embodiment of FIG. 3 in more detail when the packet data based communication network 300 is a General Packet Radio Service enabled mobile communication network, and when an access bearer is to be terminated without involvement of the application function means AF 305.

[0104] First, the gateway node GW 302 receives a request to terminate the access bearer or decides to terminate the access bearer itself.

[0105] Next, the gateway node GW 302 determines which service entities have to be informed about the access bearer termination and informs them to remove the relevant service rules. The service entities may remove the service rules immediately or after a timer expiry. The gateway node GW 302 informs the session control means SC 303 about the access bearer termination by sending a message to the session control means SC 303. The session control means SC 303 may remove the relevant subscription data immediately or after a timer expiry.

[0106] The following describes operation of the exemplary embodiment of FIG. 3 in more detail when the packet data based communication network 300 is a General Packet Radio Service enabled mobile communication network, and when an access bearer is to be terminated with involvement of the application function means AF 305.

[0107] First, the gateway node GW 302 receives a request to terminate an access bearer or decides to terminate the access bearer itself.

[0108] Next, the gateway node GW 302 determines which service entities have to be informed about the access bearer termination and informs them to remove the relevant service rules. The service entities may remove the service rules immediately or after a timer expiry. The gateway node GW 302 informs the session control means SC 303 about the access bearer termination by sending a message to the session control means SC 303. The session control means SC 303 may remove the relevant subscription data immediately or after a timer expiry.

[0109] Next, the session control means SC 303 informs the application function means AF 305 about the access bearer termination by sending a message. Finally, the application function means AF 305 replies by sending an acknowledgement message.

[0110] The following describes operation of the exemplary embodiment of FIG. 3 in more detail when the packet data based communication network 300 is a General Packet Radio Service enabled mobile communication network, and when an application session is to be terminated.

[0111] First, an application session is terminated.

[0112] Next, the application function means AF 305 informs the session control means SC 303 about the application session termination by sending a message. Then, the session control means SC 303 replies by sending an acknowledgement message to the application function means AF 305.

[0113] Next, the session control means SC 303 informs the gateway node GW 302 about the session termination by sending a service policy.

[0114] Next, the gateway node GW 302 determines which service entities have to be informed about the access bearer termination and informs them to remove the relevant service rules. The service entities may remove the service rules immediately or after a timer expiry. The gateway node GW 302 sends a message to the session control means SC 303. The session control means SC 303 may remove the relevant subscription data immediately or after a timer expiry.

[0115] The following describes operation of the exemplary embodiment of FIG. 3 in more detail when the packet data based communication network 300 is a General Packet Radio Service enabled mobile communication network, and when the detected change in the state of the connection Cn is a detected new service flow.

[0116] When the gateway node GW 302 detects a new service flow, it sends a service policy request to the session control means SC 303 and gets a service policy for the detected new service flow as a reply.

[0117] Later, when the detected new service flow is terminated, the gateway node GW 302 informs the respective service entities to remove the service rules. In an alternative embodiment, the service entities detect service flow termination themselves and remove the service rules. ‘Detecting service flow termination’ may be performed e.g. by detecting that no more packets belonging to a service flow has been received in a given time period. To facilitate this, a timer may be used.

[0118] It is obvious to a person skilled in the art that with the advancement of technology, the basic idea of the invention may be implemented in various ways. The invention and its embodiments are thus not limited to the examples described above, instead they may vary within the scope of the claims.