KR101286093B1 - Apparatus and method for inspecting deep packet using accounting message - Google Patents

Abstract

The present invention relates to a packet analysis apparatus and a method using a charging message, and in detail, a subscriber station checks a property of a billing message for each subscriber by analyzing a packet generated when using a packet service, and according to the property of the billing message for each subscriber. By mapping or releasing the terminal identifier and the IP address of the subscriber station, QoS of each subscriber or packet service can be applied based on the mapping result between the terminal identifier and the terminal address and subscriber information (eg, plan information, daily limit exceeded information, etc.). have.

Description

Packet analyzing apparatus using billing message and method thereof {APPARATUS AND METHOD FOR INSPECTING DEEP PACKET USING ACCOUNTING MESSAGE}

The present invention relates to a packet analysis apparatus and a method using a charging message, and in detail, a subscriber station checks a property of a billing message for each subscriber by analyzing a packet generated when using a packet service, and according to the property of the billing message for each subscriber. By mapping or releasing the terminal identifier and the IP address of the subscriber station, QoS of each subscriber or packet service can be applied based on the mapping result between the terminal identifier and the terminal address and subscriber information (eg, plan information, daily limit exceeded information, etc.). The present invention relates to a packet analysis apparatus using a charging message and a method thereof.

In Wide Code Division Multiple Access (WCDMA), a subscriber station is connected to a Serving GPRS Support Node (SGSN) and a Gateway GPRS Support Node (GGSN) through a base station and a Radio Network Controller (RNC) in a WCDMA network. Here, the RNC is a wired or wireless channel management, the protocol matching of the subscriber station, the protocol matching of the base station. SoftHandoff processing, protocol matching with Core Network, GPRS (General Packet Radio Service) access, fault management, system loading (Loading), etc. are responsible for. Here, GPRS is an asynchronous communication system that maximizes the efficiency of a transmission line by packet data transmission.

SGSN supports the mobility management of the subscriber station for the GPRS service, the call processing procedure, the session management for processing the transmission and reception of packet data, the authentication and the billing function, and the like. It also has a routing processing function of packet data.

GGSN is a packet switching device that provides Internet access to subscriber stations, and is capable of assigning IP addresses and QoS to subscribers. Specifically, the GGSN is a serving node of an IP (Internet Protocol) based packet network that provides a high speed packet data service for a packet data service of GPRS. GGSN assigns IP address to subscriber station for packet data service, manages session, performs routing function of packet data, and provides interface for connecting WCDMA network and Internet network. In addition, the GGSN determines a network providing a packet data service and an access network through an access point node (APN), and serves as a gateway to the Internet network. Here, the APN is a delimiter including an IP address assigned to the subscriber station by the GGSN, and may also be used as a delimiter for a specific service.

On the other hand, DPI (Deep Packet Inspection) refers to a technology for detecting various characteristics such as the protocol, service type for the packet by analyzing the Internet (IP) packet flowing in real time.

The DPI device may be installed and operated in a Gi interface, which is an interface from a GGSN to an external Internet network in a WCDMA network. The DPI device may analyze an IP packet to detect in real time which protocol is used and which service is used for each source / destination IP address. For example, the protocol type may include protocols such as Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP). In addition, the service type may include an internet service, a video service, an application market service, and the like.

IP allocation to the subscriber station is made by the GGSN. A different plan may be applied to each subscriber or an excess daily limit may be set for IP packets generated while the subscriber station uses the WCDMA network. For example, even though different subscribers use wireless data, they may be charged differently for the same amount of data because they subscribe to different plans. In addition, since the daily limit is set for each subscriber, QoS may be differently applied to subscribers exceeding the daily limit. That is, the maximum daily data traffic allowance per subscriber is limited, or the progressive excess charge may be applied in case of excessive use over a certain traffic.

To this end, the DPI device needs to calculate the packet usage based on the subscriber information rather than the IP address. However, the IP packet generated when the subscriber station uses the WCDMA network does not contain subscriber information. Accordingly, the DPI device may map or release an IP address and a terminal identifier assigned to a subscriber station to apply QoS for each subscriber or service.

The present invention has been made to solve the above problems, the subscriber station to check the properties of the billing message for each subscriber through the packet analysis occurred when using the packet service, and according to the properties of the billing message for each subscriber and the terminal identifier of the subscriber station; By mapping or releasing the IP address, the billing message can be applied to the subscriber or packet service based on the mapping result and the subscriber information (e.g., plan information, daily limit information, etc.) between the terminal identifier and the terminal address. An object of the present invention is to provide a packet analyzing apparatus and a method thereof.

To this end, the apparatus according to the first aspect of the present invention, the subscriber station analyzes the packet generated when using the packet service through the packet switching device, and confirms whether the subscriber-specific billing message is included in the packet received from the packet switching device A packet analyzer; An attribute confirmation unit for confirming an attribute of a billing message for each subscriber identified by the packet analyzer; And mapping the terminal identifier of the subscriber station included in the subscriber-specific charging message and the terminal address of the subscriber terminal according to the attribute of the subscriber-specific charging message or corresponding to the terminal identifier included in the subscriber-specific charging message and the terminal identifier. It characterized in that it comprises a mapping unit for releasing the mapping of the terminal address.

The apparatus may further include a service control unit for controlling the QoS application for the packet service used by the subscriber terminal based on the mapping of the terminal identifier and the terminal address and the subscriber information in association with the packet switching apparatus. do.

The service control unit may request the packet switching apparatus to apply QoS to the packet service used by the subscriber station according to the plan information or the utilization excess information included in the subscriber information.

The mapping unit may further include a mapping DB that stores mapping information of the terminal identifier and the terminal address.

The packet analyzer may determine the received message as the billing message for each subscriber when the message received from the packet exchange apparatus is a RADIUS message.

The attribute checking unit may determine whether an attribute of the charging message for each subscriber indicates charging start or charging end.

The mapping unit maps the terminal identifier and the terminal address when the attribute of the subscriber-specific charging message indicates charging start, and when the attribute of the subscriber-specific charging message indicates charging termination, the mapping of the terminal address corresponding to the terminal identifier. It is characterized in that the mapping is released.

On the other hand, the apparatus according to the second aspect of the present invention, the subscriber terminal packet analysis step of analyzing a packet generated when using the packet service; A message checking step of confirming whether a charging message for each subscriber is included in the packet; An attribute checking step of confirming an attribute of the identified subscriber-specific charging message; And mapping the terminal identifier of the subscriber station and the terminal address of the subscriber station included in the subscriber-specific billing message or the terminal identifier and the terminal identifier included in the subscriber-specific billing message according to the attributes of the subscriber-specific billing message. And a mapping step of releasing the mapping of the corresponding terminal address.

The method may further include a service control step of controlling QoS application for the packet service used by the subscriber station based on the mapping of the terminal identifier and the terminal address and the subscriber information.

The service control step may include requesting a packet switching device to apply QoS to the packet service used by the subscriber station according to the plan information or the utilization excess information included in the subscriber information.

In the message checking step, when the message received from the packet switching apparatus is a RADIUS message, the received message is determined as the billing message for each subscriber.

The attribute checking step may include checking whether an attribute of the subscriber-specific charging message indicates charging start or charging end.

The mapping step may include mapping the terminal identifier and the terminal address when the attribute of the subscriber-specific charging message indicates charging start, and the terminal address corresponding to the terminal identifier when the attribute of the subscriber-specific charging message indicates charging termination. It is characterized by de-mapping.

According to the present invention, a subscriber station identifies a property of a billing message for each subscriber through packet analysis generated when using a packet service, and maps or releases a terminal identifier and an IP address of the subscriber station according to the property of the billing message for each subscriber. QoS can be applied to each subscriber or packet service based on the mapping result and subscriber information (eg, plan information, daily limit exceeded information, etc.).

1 is a block diagram of an embodiment of a packet service network to which an apparatus for packet analysis according to the present invention is applied;
2 is a configuration diagram of an embodiment of the packet analysis apparatus of FIG. 1 according to the present invention;
3 is a flowchart illustrating a packet analysis method using a charging message according to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The configuration of the present invention and the operation and effect thereof will be clearly understood through the following detailed description. Prior to the detailed description of the present invention, the same components will be denoted by the same reference numerals even if they are displayed on different drawings, and the detailed description will be omitted when it is determined that the well-known configuration may obscure the gist of the present invention. do.

1 is a configuration diagram of a packet service network to which a packet analysis apparatus according to the present invention is applied.

As shown in FIG. 1, the packet service network includes a base station 110, a base station control device 120, a packet switching device 130, a packet analysis device 140, and a charging device 150.

The subscriber station 101 uses the Internet through a base station 110, a base station control device 120 for controlling the base station 110, and a packet switching device 130 that are wirelessly connected to the subscriber station 101, or a communication network. The packet service information provided by the connected service providing apparatus 10 is received. Here, the communication network may be a third party vendor network or an external packet network, and the service providing apparatus 10 may be connected to a third party vendor network or an external packet network.

The packet switching device 130 assigns an IP address to the subscriber station 101 and exchanges the packet according to the destination address of the packet generated when the subscriber station 101 assigned the IP address uses the packet service. If the packet switching device 130 is applied to the WCDMA network, the packet switching device 130 is a synchronous packet switching device PDSN (Packet Data Support Node), asynchronous packet switching device SGSN (Serving GPRS Support Node), GGSN (Gateway GPRS) Support Node) may be included. The packet switching device 130 generates a charging message for each subscriber for the packet. Here, the billing message for each subscriber includes subscriber identifier, telephone number, start time, stop time, uplink data amount, downlink data amount information, and the like. do.

The packet analyzing apparatus 140 copies and analyzes packets exchanged through the packet switching apparatus 130 with respect to the packets generated when the subscriber station 101 uses the packet service, and extracts packet data information. Here, the packet data information includes an identifier of the subscriber station 101, a source IP address, a destination IP address, a port number, and the like. At this time, the packet analysis device 140, when the subscriber-specific billing message is received from the packet-switching device 130, checks the attribute of the billing message for each subscriber. The packet analyzing apparatus 140 maps the terminal identifier of the subscriber station 101 and the IP address of the subscriber station 101 or releases the mapping of the IP address corresponding to the terminal identifier according to the attribute of the subscriber-specific charging message.

The billing device 150 generates billing data for each subscriber by using the billing message for each subscriber using the result analyzed by the packet analyzer 140 and the billing message for each subscriber generated by the packet switching device 130.

Meanwhile, the packet switching apparatus 130 may check the corresponding subscriber information based on the mapping information of the terminal identifier of the subscriber station 101 and the IP address of the subscriber station 11. The subscriber information includes a terminal identifier for identifying the subscriber terminal. For example, the terminal identifier may be a mobile station international ISDN number (MSISDN) or a terminal identifier capable of identifying a specific subscriber. The packet analyzing apparatus 140 interoperates with the packet switching apparatus 130 for a packet generated when using a packet service based on the mapping information and the subscriber information stored in the packet analyzing apparatus 140. Control can be performed.

2 is a block diagram of an embodiment of the packet analysis apparatus of FIG. 1 in accordance with the present invention.

As shown in FIG. 2, the packet analyzing apparatus 140 using the charging message according to the present invention includes a packet analyzing unit 210, an attribute checking unit 220, a mapping unit 230, a service control unit 240, and a mapping. DB 250 is included.

The packet analyzer 210 analyzes a packet generated when the subscriber station 101 uses a packet service through the packet exchange device 130. Here, the packet analyzer 210 may analyze the entire packet by mirroring or copying the packets exchanged through the packet exchange apparatus 130. The packet analyzer 210 checks whether the charging message for each subscriber is included in the packet received from the packet exchange apparatus 130. For example, the packet analyzer 210 may check whether the message generated by the packet switching device 130 is a RADIUS (Remote Authentication Dial-In User Services) message and check the charge message for each subscriber.

The attribute checking unit 220 checks the attribute of the subscriber-specific billing message confirmed by the packet analyzer 210. In detail, the attribute checking unit 220 checks whether the attribute of the subscriber-specific charging message indicates Accounting-Request Start or Accounting-Request Stop. Looking at the RADIUS message as an example of the attribute checking process, the attribute confirming unit 220 confirms that the charging start is indicated when the value of the Act-Status-Type attribute of the RADIUS message is '1'. In addition, the attribute checking unit 220 confirms that the charging is terminated when the charging status type (Acct-Status-Type) attribute value of the RADIUS message is '2'.

The mapping unit 230 maps the identifier of the subscriber station 101 and the IP address of the subscriber station 101 when the attribute of the charging message for each subscriber station 101 confirmed by the attribute checking unit 220 indicates the charging start. do. For example, the mapping unit 230 is a subscriber station that is a Calling Station ID (Calling-Station-Id) attribute value when the charging status type (Acct-Status-Type) attribute value is '1' in the attribute confirmation unit 220. The terminal identifier of 101 is mapped to the IP address of the subscriber station 101, which is an attribute value of the frame IP address. The mapping information is stored in the mapping DB 250. Here, the identifier of the subscriber station 101 may include a Mobile Station International ISDN Number (MSIDN).

On the other hand, the mapping unit 230 releases the address mapping of the packet corresponding to the identifier of the subscriber station 101 when the property of the billing message for each subscriber station 101 confirmed by the property checking unit 220 indicates the end of charging. do. For example, the mapping unit 230 is a subscriber station which is a Calling Station ID (Calling-Station-Id) attribute value when the charging status type (Acct-Status-Type) attribute value is '2' in the attribute confirming unit 220. The address mapping of the packet corresponding to the identifier of 101 is released. At this time, the mapping information stored in the mapping DB 250 is updated to be released.

The mapping DB 250 stores mapping information in which an identifier of the subscriber station 101 and an IP address of the subscriber station 101 are mapped.

Meanwhile, the service controller 240 controls the QoS application for the packet service used by the subscriber station 101 based on the mapping of the terminal identifier and the IP address and the subscriber information in association with the packet switching device 130. In detail, the service controller 240 may control the packet generated when the subscriber station 101 uses the packet service based on the plan information, the additional plan information, or the daily limit exceeding information included in the subscriber information. For example, the service controller 240 may limit the packet used by the subscriber station 101 in conjunction with the packet switching device 130 to the subscriber whose amount of generated packet data exceeds the daily limit, or use the packet in comparison with other subscriber stations. You can lower the priority.

3 is a flowchart illustrating a packet analysis method using a charging message according to the present invention.

The subscriber station 101 uses a packet service through a packet service network (S302).

The packet analyzer 210 of the packet analyzer 140 copies and analyzes a packet transmitted and received through the packet exchange apparatus 130 (S304).

As a result of the packet analysis, the packet analyzer 210 checks whether the charging message is for the packet service used in the subscriber station 101 (S306).

If the check result (S306), the charging message for the packet service, the attribute check unit 220 checks whether the attribute value of the charging state type in the charging message is '1' (S308). On the other hand, if the packet analysis result is not the charging message, the packet analysis device 140 performs a "S304" process which is a packet analysis process.

As a result of the check (S308), when the attribute value of the charging state type in the charging message is '1', the mapping unit 230 checks the attribute of the call terminal identifier and the IP address of the subscriber station 101 The terminal identifier of the subscriber station 101 and the IP address are mapped, and the mapped mapping information is stored in the mapping DB 250 (S310).

Thereafter, the service controller 240 controls the QoS application for the packet service used by the subscriber station 101 based on the mapping of the terminal identifier and the IP address and the subscriber information in association with the packet switching device 130 (S312). .

On the other hand, if the check result (S308), the attribute value of the charging state type in the charging message is not '1', the attribute checking unit 220 is whether or not the attribute value of the charging state type in the charging message is '2'. Check (S314).

When the attribute value of the charging state type in the charging message is '2', the mapping unit 230 checks the terminal identifier of the attribute of the calling terminal identifier and releases the mapping between the previously mapped corresponding terminal identifier and the IP address ( S316). Then, the mapping is updated as released from the mapping information stored in the mapping DB 250.

The foregoing description is merely illustrative of the present invention, and various modifications may be made by those skilled in the art without departing from the spirit of the present invention. Accordingly, the embodiments disclosed in the specification of the present invention are not intended to limit the present invention. The scope of the present invention should be construed according to the following claims, and all the techniques within the scope of equivalents should be construed as being included in the scope of the present invention.

According to the present invention, the subscriber station confirms the attributes of the billing message for each subscriber through packet analysis generated when using the packet service, and maps or releases the terminal identifier and the IP address of the subscriber station according to the attributes of the billing message for each subscriber. QoS based on a subscriber or packet service may be applied based on a mapping result between terminal addresses and subscriber information (eg, plan information, daily limit exceeded information, etc.). In this respect, the invention is a commercially available invention because the possibility of marketing or operating the applied device is not only sufficient for the use of the related technology, but also practically evident as it exceeds the limitation of the existing technology.

101: subscriber station 110: base station
120: base station control device 130: packet switching device
140: packet analysis device 150: charging device
210: packet analyzer 220: property check unit
230: mapping unit 240: service control unit
250: mapping DB

Claims (13)

A packet analyzer configured to analyze a packet generated when a subscriber station uses a packet service through a packet switching device, and to check whether a charging message for each subscriber is included in a packet received from the packet switching device;
An attribute confirmation unit for confirming an attribute of a billing message for each subscriber identified by the packet analyzer; And
The terminal identifier of the subscriber station included in the billing message for each subscriber and the terminal address of the subscriber station according to the attribute of the billing message for each subscriber, or the terminal corresponding to the terminal identifier and the terminal identifier included in the billing message for each subscriber Mapping section for unmapping addresses
Packet analysis apparatus using a charging message comprising a. The method of claim 1,
A service control unit for controlling QoS application for the packet service used by the subscriber station based on the mapping of the terminal identifier and the terminal address and the subscriber information in cooperation with the packet switching device.
Packet analysis apparatus using the charging message, characterized in that it further comprises. 3. The method of claim 2,
The service control unit,
And a request for application of QoS to the packet service used by the subscriber station according to the rate information or the utilization excess information included in the subscriber information. The method of claim 1,
The mapping unit,
Mapping DB for storing the mapping information of the terminal identifier and the terminal address
Packet analysis apparatus using the charging message, characterized in that it further comprises. The method of claim 1,
The packet analyzing unit,
And if the message received from the packet exchange apparatus is a RADIUS message, determine the received message as the charging message for each subscriber. The method of claim 1,
The attribute checking unit,
Packet analyzing apparatus using the charging message, characterized in that for checking whether the attribute of the billing message for each subscriber indicates the charge start or charge end. The method according to claim 6,
The mapping unit,
Mapping the terminal identifier and the terminal address when the attribute of the billing message for each subscriber indicates charging start; and unmapping the terminal address corresponding to the terminal identifier when the attribute of the billing message for each subscriber indicates termination of charging; Packet analysis apparatus using the charging message, characterized in that. A packet analyzing step of analyzing, by the subscriber station, a packet generated when using a packet service;
A message checking step of confirming whether a charging message for each subscriber is included in the packet;
An attribute checking step of confirming an attribute of the identified subscriber-specific charging message; And
The terminal identifier of the subscriber station included in the subscriber-specific billing message and the terminal address of the subscriber station are mapped according to the attributes of the subscriber-specific billing message or correspond to the terminal identifier and the terminal identifier included in the subscriber-specific billing message. Step of unmapping the mapped terminal address
Packet analysis method using a charging message comprising a. The method of claim 8,
A service control step of controlling the application of QoS to the packet service used by the subscriber station based on the mapping of the terminal identifier and the terminal address and the subscriber information
Packet analysis method using a charging message, characterized in that it further comprises. The method of claim 9,
The service control step,
The packet analysis method using the billing message, characterized in that the request for the application of the QoS to the packet service used by the subscriber terminal according to the plan information or the utilization exceeded information included in the subscriber information. The method of claim 8,
The message checking step,
And if the message received from the packet switching apparatus is a RADIUS message, determining the received message as the billing message for each subscriber. The method of claim 8,
The attribute checking step,
The packet analysis method using the charging message, characterized in that whether the attribute of the billing message for each subscriber indicates the charge start or charge end. 13. The method of claim 12,
Wherein the mapping step comprises:
Mapping the terminal identifier and the terminal address when the attribute of the billing message for each subscriber indicates charging start; and unmapping the terminal address corresponding to the terminal identifier when the attribute of the billing message for each subscriber indicates termination of charging; Packet analysis method using the charging message, characterized in that.

Images