CA2301383A1 - Monitoring the transmission quality in a digital communications network - Google Patents

Monitoring the transmission quality in a digital communications network Download PDF

Info

Publication number
CA2301383A1
CA2301383A1 CA 2301383 CA2301383A CA2301383A1 CA 2301383 A1 CA2301383 A1 CA 2301383A1 CA 2301383 CA2301383 CA 2301383 CA 2301383 A CA2301383 A CA 2301383A CA 2301383 A1 CA2301383 A1 CA 2301383A1
Authority
CA
Canada
Prior art keywords
monitoring data
performance monitoring
network
network element
communications network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
CA 2301383
Other languages
French (fr)
Inventor
Bernd Weis
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alcatel Lucent SAS
Original Assignee
Alcatel SA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alcatel SA filed Critical Alcatel SA
Publication of CA2301383A1 publication Critical patent/CA2301383A1/en
Abandoned legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L1/00Arrangements for detecting or preventing errors in the information received
    • H04L1/24Testing correct operation
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04JMULTIPLEX COMMUNICATION
    • H04J2203/00Aspects of optical multiplex systems other than those covered by H04J14/05 and H04J14/07
    • H04J2203/0001Provisions for broadband connections in integrated services digital network using frames of the Optical Transport Network [OTN] or using synchronous transfer mode [STM], e.g. SONET, SDH
    • H04J2203/0057Operations, administration and maintenance [OAM]

Abstract

In a digital communications network, performance monitoring data (19, 20) are determined for each connection (38) in a network element (27) that switches or terminates the connection. The performance monitoring data (19, 20) are stored as managed objects in a database (22) of the respective network element (27). On request, these performance monitoring data (19, 20) are transmitted to a network management facility. In prior-art networks, the performance monitoring data (19, 20) cannot be used to furnish proof that a service was actually provided, because they are manipulable.
In the method according to the invention, the performance monitoring data (19, 20) are encrypted (5) and provided with an electronic signature prior to transmission (7). For this, each network element (27) is equipped with an encryption device (21).

Description

Monitoring the Transmission Quality in a Digital Communications Network This invention relates to a method of monitoring the transmission quality in a digital communications network and to a network element for a digital communications network.
Digital communications networks are structured according to a multilayer model, such as the 7-layer OSI model. To monitor the transmission quality ("performance monitoring") in digital communications networks and particularly in synchronous digital communications networks, such as SDH or SONET
networks, it is common practice to determine performance monitoring data in each layer, store these data, and transmit them on request to a central control unit, the network management system. To that end, various parameters that characterize the transmission quality are determined and counted over predetermined periods of time, typically 15 min and 24 h. Typical parameters are: background block errors, errored seconds, and severely errored seconds.
Performance monitoring takes place in network elements of the communications network in which connections are switched or terminated. The performance monitoring CA 02301383 2000-03-20 .
data are stored as managed objects in a management information base (MIB) of the respective network element.
Frorn an article by T. Apostolopoulos et al, "On the Implementation of a Prototype for Performance Management Services", Proceedings IEEE Symposium on Computers and Communications, June 27-29, 1995, a performance-monitoring method for a TCP/IP network is known which involves storing performance monitoring data as managed objects in an MIB database and transmitting them to a management facility. The method is designed and suited for a single, homogeneous network consisting of subnetworks which is under the control of a single network operator and is managed by a single central network management system.
In digital communications networks, the situation described is becoming increasingly complex because of the increasing number of network operators and service providers, which are generally not identical. This situation is shown by way of example in Fig. 3. A
customer 37 requests from a service provider 34 a connection 38 from a location A, 35, to a location B, 36. The~'service provider 34 cooperates with several network'operators 31, 32, 33, which each provide subconn~ctions. The service provider 34 books the subconnections at the network operators and interconnects the subconnections at interfaces IF to establish the connection 38 desired by the customer.
The service provider 34 makes the requested connection 38 available to the customer 37 and guarantees a predetermined transmission quality. The network operators 31, 32, 33 guarantee the service provider 34 a predetermined transmission quality for each of the subconnections switched by them. Charges are made by the service provider 34 to the customer 37 and by the network operators 31 to the service provider 34 for the services provided.
Each network operator has its own network management system in which performance monitoring data can be collected and retrieved. These data give information about the actual transmission quality, and thus about the quality of the service provided. So far neither the service provider nor the customer has access to the performance monitoring data of the individual network operators, so that it has been impossible for them to determine and monitor the actual transmission quality.
For the service provider it is desirable to be able to determine the actual transmission quality and, in case of a dispute, prove to the customer and the network operators that the service was actually provided. Such proof cannot be furnished with the performance monitoring data used so far, because such data are manipulable. It is therefore an object of the invention to provide a secure method of monitoring the transmission quality. Another object of the invention is to provide a network element for a digital communications network which permits secure monitoring of the transmission quality of a switched connection.
These objects are attained by the features of claim 1 and claim 6, respectively. Further advantageous aspects of the invention are apparent from the dependent claims.
One advantage of the invention is that the encryption of the performance monitoring data precludes any manipulation of the performance monitoring data, so that the performance monitoring data can be used to furnish proof that the service was actually provided.
The invention will become more apparent by reference to the following description of an embodiment of the invention taken in conjunction with the accompanying drawings, in which:
Fig. 1 is a block diagram with the functions of the monitoring device and the subsequent encoding in accordance with the invention;
Fig. 2 is a block diagram of a network element in accordance with the invention;
Fig. 3 shows the logical establishment of a connection in a digital communications network;
and Fig. 4 is a flowchart of the method in accordance with the invention.
A fundamental idea of the invention is to ensure the integrity of performance monitoring data through the use of an encryption process, e.g., through an electronic signature.
The determination of the performance monitoring data at a network element of the digital communications network is shown by way of example in Fig. 1. First, however, the architecture of the network element will be explained with the aid of Fig. 2. The network element 27 has a number of input/output ports I/O, 25, which are interconnected via a switching matrix 24.
Connected to the switching matrix 24 is a monitoring device CPU, 23, which performs the functions shown in Fig. 1 for each switched connection. The switching matrix 24 may, for instance, be a processor with associated memory, with the functions being implemented as parts of a control program. The performance monitoring data determined by the monitoring device CPU, 23, are fed to !an encryption device ENCRYPT, 21, and subsequently shored as managed objects in a memory 22 structured as a database. On request, the encrypted data can be transmitted via an interface Q-IF, 26. The interface may, for instance, be the Q interface commonly used for network management. The encryption device 21 may preferably be combined with the processor serving as the monitoring device 23 on a single chip. The network element 27 may be a digital crossconnect or an add/drop multiplexer of an SDH or SONET network, for example.
The monitoring device performs the functions shown in Fig. 1. At one of the input/output ports 25 of the network element 27, a message signal 11 is received which is organized into frames. Each frame consists of a payload block and a header. In the header, a checksum BIP is transmitted. From each payload block, a new checksum BIPc l2 is computed, which is compared, 13, with the checksum BIP contained in the header. If a disagreement is detected, an erroneous block was received. Both the received blocks 14 and the erroneous blocks 15 are counted. From the counts 14, 15, the above-mentioned known parameters, i.e., background block errors (BBE) 16, errored seconds (ES) 17, and severely errored seconds (SES) 18, are determined. An errored second is present if in a one-second interval, errors are present, but less than 30~
of the blocks are erroneous. A severely errored second is present if in a one-second interval, more than 30~
of the received blocks are erroneous. The parameters are added over 15 min, 20, and over 24 h, 19. These values 19, 20 represent the performance monitoring data and are available as ASCII text.
The network element 27 generates such a record of performance monitoring data 19, 20 for each connection that is switched or terminated by it. Advantageously, each data record 19, 20 is treated and stored as a managed object.
According to the invention, the performance monitoring data 19, 20 are encrypted with the encryption device 21 following the monitoring device 23. The encryption device 21 converts the performance monitoring data 19, so that their authenticity and integrity can be checked later. To that end, the encryption device 21 adds an electronic signature to each performance monitoring data record 19, 20.
An algorithm using a private key and a public key, such as the well-known RSA algorithm, is particularly 20 suited for the encryption. The encryption device 21 will then load the required key via the communications network. Each key is preferably generated and made available by an independent, trustworthy organization, such as the Deutsches Bundesamt fur Telekommunikation (German Federal Office for Telecommunications). The generally acknowledged integrity of this independent organization additionally guarantees the integrity of the encrypted data.
Through the electronic signature, the performance monitoring data can be read, but not modified, by any authorized person who has the key.
Each encrypted data record is stored as a managed object in a management information base (MIB) 22 of the network element 27, and can be transmitted on request via the interface Q-IF, 26, to a network management system. The encrypted performance monitoring data for a particular connection can now also be made available to service providers and customers who are to be charged for the connection.
Fig. 3 shows the above-described logical establishment of a connection 38 in a digital communications network. A customer 37 requests a connection 38 from a service provider 34. The service provider 34 has rented subconnections, e.g., in the form of leased lines, from three different network operators 31, 32, 33. The service provider interconnects the subconnections at interfaces IF to establish the requested connection 38, and makes the latter available to its customer 37. To be able to guarantee its customer 37 the required quality of the connection 37, the service provider receives from each network operator 31, 32, 33 the encrypted performance monitoring data of each subconnection. The service provider can use these performance monitoring data to prove to its customers and to the network operators that the service was provided. If the required transmission quality is not reached, this can be offset, for example, by a reduction of the charges to be paid by the customer and by giving a discount on the rental charges for the leased lines.
In a particularly advantageous application of the invention, a service provider that requests a connection from a network operator specifies to the latter a key for this connection. The key is only valid for a requested connection. The service provider can retrieve the performance monitoring data encrypted with this key from the network elements or the network management system of the network operator. In this way, the service provider can control the actual connection quality and has guarantee that the performance monitoring data actually correlate with the requested connection.
The sequence of steps in the method according to the invention is shown in Fig. 3:
Step 1: A service provider or a customer requests a connection from a network operator.
Step 2: The network operator establishes the requested connection in its communications network and makes it available to the service provider or customer.
Step 3: A key is transmitted to each network element by which the connection is switched or terminated.
Step 4: In each network element, performance monitoring data are determined.
Step S: In each network element, the performance monitoring data are encrypted with the transmitted key and provided with an electronic signature.
Step 6: The encrypted performance monitoring data are stored as managed objects in a database of each network element.
Step 7: On request, the encrypted performance monitoring data are transmitted to the service provider or customer.

Claims (8)

Claims
1. A network element (27) for a digital communications network, comprising:
- a switching matrix (24) for switching connections (38) between input ports (25) and output ports (25) of the network element (27);
- a monitoring device (23) for determining performance monitoring data (19, 20) for each switched connection (38);
- a memory (22) for storing the performance monitoring data (19, 20); and - an interface (26) for transmitting the stored performance monitoring data (19, 20), characterized by an encryption device (21) for encrypting the performance monitoring data (19, 20).
2. A network element (27) as claimed in claim 1 wherein the performance monitoring data (19, 20) are provided with an electronic signature.
3. A network element (27) as claimed in claim 1 wherein the performance monitoring data (19, 20) are stored in the form of managed objects, and wherein the memory (22) is structured as a database.
4. A network element (27) as claimed in claim 1 wherein the encryption device (21) uses a private key and a public key.
5. A network element (27) as claimed in claim 1 wherein a key required for the encryption is loaded over the communications network into the network element (27).
6. A method of monitoring the transmission quality in a digital communications network, comprising the steps of:
- switching (2) connections between endpoints (35, 36) in the communications network using network elements (27);
- determining (4) performance monitoring data (19, 20) for each switched connection (38) in the network elements (27);
- storing (6) the performance monitoring data (19, 20) in the network elements (27); and - transmitting (7) the stored performance monitoring data (19, 20) from the network elements (27) to a management facility;
characterized in that prior to transmission (7), the performance monitoring data (19, 20) are encrypted (5).
7. A method as claimed in claim 6 wherein an encrypting algorithm with a private key and a public key is used for the encryption (5).
8. A method as claimed in claim 6 wherein a key used for encryption (5) is only valid for a single connection (38).
CA 2301383 1999-04-13 2000-03-20 Monitoring the transmission quality in a digital communications network Abandoned CA2301383A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE1999116490 DE19916490A1 (en) 1999-04-13 1999-04-13 Monitoring the transmission quality in a digital communication network
DE19916490.8 1999-04-13

Publications (1)

Publication Number Publication Date
CA2301383A1 true CA2301383A1 (en) 2000-10-13

Family

ID=7904298

Family Applications (1)

Application Number Title Priority Date Filing Date
CA 2301383 Abandoned CA2301383A1 (en) 1999-04-13 2000-03-20 Monitoring the transmission quality in a digital communications network

Country Status (3)

Country Link
EP (1) EP1045539A3 (en)
CA (1) CA2301383A1 (en)
DE (1) DE19916490A1 (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102004005016B4 (en) 2004-01-30 2008-02-14 Lucent Technologies Network Systems Gmbh Method for controlling the transport capacity for data transmission over a network and network

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5515376A (en) * 1993-07-19 1996-05-07 Alantec, Inc. Communication apparatus and methods
IL113259A (en) * 1995-04-05 2001-03-19 Diversinet Corp Apparatus and method for safe communication handshake and data transfer
DE19521485A1 (en) * 1995-06-13 1996-12-19 Deutsche Telekom Ag Method and device for the transmission of confidential connection establishment and service information between subscriber end devices and one or more digital switching centers
DE69626486T2 (en) * 1996-01-29 2004-04-01 International Business Machines Corp. Method and system for synchronizing encryption / decryption keys in a data communication network using marking packets
CA2218218A1 (en) * 1996-11-08 1998-05-08 At&T Corp. Promiscuous network monitoring utilizing multicasting within a switch
US6631402B1 (en) * 1997-09-26 2003-10-07 Worldcom, Inc. Integrated proxy interface for web based report requester tool set

Also Published As

Publication number Publication date
EP1045539A2 (en) 2000-10-18
DE19916490A1 (en) 2000-10-26
EP1045539A3 (en) 2003-06-25

Similar Documents

Publication Publication Date Title
EP0200704B1 (en) Bootstrap channel security arrangement for communication network
US5440633A (en) Communication network access method and system
CN1496063B (en) Network, IPsec set server equipment, IPsec processing equipment and relevant methods
FI76469C (en) KOMMUNIKATIONSSYSTEM FOER KABELTELEVISIONSNAET.
US5825750A (en) Method and apparatus for maintaining security in a packetized data communications network
EP1484892B1 (en) Method and system for lawful interception of packet switched network services
US6574730B1 (en) User authentication in a communications network
US5216715A (en) Key distribution in public communication networks taking account of security gradations
EP1048181B1 (en) Procedure and system for the processing of messages in a telecommunication system
JPH03210847A (en) Communication circuit netz
CA2067411C (en) Communication network intended for secure transmission
FI109254B (en) Method, system and device for verification
JP2006528445A (en) Procedures for monitoring usage of broadcast content
CN212413188U (en) Vehicle-mounted security gateway
CN116647326A (en) Block chain-based embedded gateway system
CA2301383A1 (en) Monitoring the transmission quality in a digital communications network
US6158009A (en) Communication monitoring and controlling apparatus
EP0849713A1 (en) A method and a system for the encryption of codes
Treytl et al. Security architecture for power-line metering system
US20240056824A1 (en) Method in a telecommunication network, and computer system
Tanaka et al. A confidentiality system for ISDN inter-PC high-speed file transfer
KR100679801B1 (en) Interworking device for database servers in intelligent network
KR100261282B1 (en) A method for supporting security services through the expansion of incm
Kou Security Architecture Standard
Herrigel A security architecture for the core part of CS-2

Legal Events

Date Code Title Description
FZDE Dead