Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
  • H04L41/02—Standardisation; Integration
  • H04L41/0213—Standardised network management protocols, e.g. simple network management protocol [SNMP]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
  • H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
  • H04L41/5003—Managing SLA; Interaction between SLA and QoS

Definitions

• the invention relates to telecommunications networks which utilize Internet Protocol (IP). More particularly, the invention relates to methods and apparatus for controlling the transfer of IP packets over a network.
• IP Internet Protocol
• An Active IP Network integrates two very different network programming models, an IP packet based model, and an Active Network capsule based model. This report shows how to integrate these two models into a single node, called an Active IP node, and how to integrate an Active IP node into an IP network. It also presents some preliminary ideas on the constraints network architects will face when building Active protocols for a heterogeneous network of Active and non- Active IP nodes. By using a model of constant and variable processing, integrating the Active and IP architectures has lead to a clean and simple node design and implementation. Furthermore, mechanisms presented in this report, such as protected buffers, provide various safety constraints which aid in the integration. Finally, this report presents some preliminary performance results which, when combined with the above characteristics, suggest that the Active IP platform will be appealing to researchers who wish to study application specific protocols for the Internet.”
• Active networks permit applications to inject programs into the nodes of local and, more importantly, wide area networks. This supports faster service innovation by making it easier to deploy new network services.
• This document defines an architecture for implementing scalable service differentiation in the Internet.
• This architecture achieves scalability by aggregating traffic classification state which is conveyed by means of IP-layer packet marking using the DS field [DSFIELD]. Packets are classified and marked to receive a particular per-hop forwarding behavior on nodes along their path. Sophisticated classification, marking, policing, and shaping operations need only be implemented at network boundaries or hosts. Network resources are allocated to traffic streams by service provisioning policies which govern how traffic is marked and conditioned upon entry to a differentiated services-capable network, and how that traffic is forwarded within that network. A wide variety of services can be implemented on top of these building blocks.
• the differentiated services architecture specified in this document can be contrasted with other existing models of service differentiation. We classify these alternative models into the following categories: relative priority marking, service marking, label switching, Integrated Services RSVP, and static per-hop classification.
• relative priority marking model include IPv4 Precedence marking as defined in [RFC791 ⁇ http://www.faqs.org/rf ' cs/rfc791.html>l. 802.5 Token Ring priority [TR], and the default interpretation of 802. lp traffic classes [802. lp].
• the application, host, or proxy node selects a relative priority or "precedence" for a packet (e.g., delay or discard priority), and the network nodes along the transit path apply the appropriate priority forwarding behavior corresponding to the priority value within the packet's header.
• a relative priority or "precedence” for a packet e.g., delay or discard priority
• the network nodes along the transit path apply the appropriate priority forwarding behavior corresponding to the priority value within the packet's header.
• Our architecture can be considered as a refinement to this model, since we more clearly specify the role and importance of boundary nodes and traffic conditioners, and since our per-hop behavior model permits more general forwarding behaviors than relative delay or discard priority.
• IPv4 TOS As defined in [RFC 1349 ⁇ http://www.faqs.org/rfcs/rfcl349.html>!.
• each packet is marked with a request for a "type of service", which may include "minimize delay”, “maximize throughput”, “maximize reliability”, or “minimize cost”.
• Network nodes may select routing paths or forwarding behaviors which are suitably engineered to satisfy the service request. This model is subtly different from our architecture. Note that we do not describe the use of the DS field as an input to route selection.
• Examples of the label switching (or virtual circuit) model include Frame Relay, ATM, and MPLS [FRELAY, ATM].
• path forwarding state and traffic management or QOS state is established for traffic streams on each hop along a network path. Traffic aggregates of varying granularity are associated with a label switched path at an ingress node, and packets/cells within each label switched path are marked with a forwarding label that is used to lookup the next-hop node, the per-hop forwarding behavior, and the replacement label at each hop.
• This model permits finer granularity resource allocation to traffic streams, since label values are not globally significant but are only significant on a single link; therefore resources can be reserved for the aggregate of packets/cells received on a link with a particular label, and the label switching semantics govern the next-hop selection, allowing a traffic stream to follow a specially engineered path through the network.
• This improved granularity comes at the cost of additional management and configuration requirements to establish and maintain the label switched paths.
• the amount of forwarding state maintained at each node scales in proportion to the number of edge nodes of the network in the best case (assuming multipoint- to-point label switched paths), and it scales in proportion with the square of the number of edge nodes in the worst case, when edge-edge label switched paths with provisioned resources are employed.
• the Integrated Services/RSVP model relies upon traditional datagram forwarding in the default case, but allows sources and receivers to exchange signaling messages which establish additional packet classification and forwarding state on each node along the path between them [RFC1633 ⁇ http://www.faqs.org/rfcs/rfcl633.html>. RSVP].
• RSVP Packet Control Protocol
• the amount of state on each node scales in proportion to the number of concurrent reservations, which can be potentially large on high- speed links.
• This model also requires application support for the RSVP signaling protocol. Differentiated services mechanisms can be utilized to aggregate Integrated Services RSVP state in the core of the network [Bernet].
• a variant of the Integrated Services/RSVP model ehminates the requirement for hop- by-hop signaling by utilizing only "static" classification and forwarding policies which are implemented in each node along a network path. These policies are updated on administrative timescales and not in response to the instantaneous mix of microflows active in the network.
• the state requirements for this variant are potentially worse than those encountered when RSVP is used, especially in backbone nodes, since the number of static policies that might be applicable at a node over time may be larger than the number of active sender-receiver sessions that might have installed reservation state on a node.
• the support of large numbers of classifier rules and forwarding policies may be computationally feasible, the management burden associated with installing and maintaining these rules on each node within a backbone network which might be traversed by a traffic stream is substantial.
• links and nodes employing these techniques may be utilized to extend differentiated services behaviors and semantics across a layer-2 switched infrastructure (e.g., 802. lp LANs, Frame Relay/ATM backbones) interconnecting DS nodes, and in the case of MPLS may be used as an alternative intra-domain implementation technology.
• layer-2 switched infrastructure e.g., 802. lp LANs, Frame Relay/ATM backbones
• MPLS may be used as an alternative intra-domain implementation technology.
• the constraints imposed by the use of a specific link-layer technology in particular regions of a DS domain (or in a network providing access to DS domains) may imply the differentiation of traffic on a coarser grain basis.
• all or a subset of the PHBs in use may be supportable (or may be indistinguishable).
• a particular router will typically consider two packets to be in the same FEC if there is some address prefix X in that router's routing tables such that X is the "longest match" for each packet's destination address.
• each hop in turn reexamines the packet and assigns it to a FEC.
• MPLS the assignment of a particular packet to a particular FEC is done just once, as the packet enters the network.
• the FEC to which the packet is assigned is encoded as a short fixed length value known as a "label”.
• the label is sent along with it; that is, the packets are "labeled" before they are forwarded.
• the label is used as an index into a table which specifies the next hop, and a new label.
• the old label is replaced with the new label, and the packet is forwarded to its next hop.
• CIP Classical IP Over ATM
• LIS Logical IP Subnets
• LANE operates at the MAC layer and can be used with any layer 3 protocol.
• Classical IP over ATM only works with IP.
• MPOA Multi-protocol over ATM
• MPOA provides for a distributed, virtual router.
• the edge devices that connect the ATM subnets to legacy LAN segments are somewhat like interface cards for the virtual router.
• the entire ATM network connecting the edge devices is the virtual router forwarding backplane.
• the packet forwarding function is separated from the route calculation function, which is performed by the route server.
• each router is also a switch.
• Packets that have been assigned to a shortcut carry fixed length labels, in addition to the usual layer 3 header.
• MPLS allows shortcuts to be set up based on a number of criteria such as destination IP addresses, classes of service and service policies, allowing for a very flexible network engineering.
• MPLS is not tied to ATM; instead, it aims to operate over any link layer technology that can support fixed length labels to identify shortcuts.
• the fractured intelligence of today's packet networks present fundamental limitations to the deployment of large-scale carrier networks that provision next generation services demanding high bandwidth and/or real-time transmission.
• the lack of overall coordination across overlaying networks and among services remains a central shortcoming.
• the fundamental problems include:
• Intranet architectures can offer either guaranteed Quality of Service (QOS), Internet Protocol (IP) service management or flexibility in adapting new applications. Nevertheless, current procedures fail to deliver all three of these goals in an integrated solution. Providing the highest Quality of Service requires the emulation of circuit- switched networking whereby resource reservation occurs before transmission of request. However, technologies such as Asynchronous Transfer Mode (ATM) fail to deliver IP's range of service as it cannot natively route or match IP's addressing structure to its own. Furthermore, active networks enable the dynamic reconfiguration of network elements, adapting the network to the goals of specific applications. Nevertheless, though active networks offer advantages on a packet-by-packet basis, it cannot determine the overall network resource demands on the Intranet.
• QOS Quality of Service
• IP Internet Protocol
• ATM Asynchronous Transfer Mode
• COPS Common Open Policy Service
• IP Internet Protocol
• DiffServ Differentiated Services
• each router a packet traverses assigns a packet to a Forward Equivalency Class.
• MPLS Multiprotocol Label Switching
• FEC FEC
• the FEC is then encoded as a short fixed-length value termed a label, and that label is sent along with the packet at each hop.
• the label is used as an index to a lookup table at the node, which then provides a new label. The old label is switched for the new one, and the packet is forwarded.
• MPLS Through the mapping of MPLS labels to ATM VPI/VCIs, MPLS integrates a core functionality of IP routing with ATM switching. However, MPLS lacks the same capabiUties as the IntServ/DiffServ architecture. Hosts transmit on a best effort basis with policy decisions occurring with processing at the Label Edge Router (LER). SUMMARY OF THE INVENTION
• An object-oriented database can be developed to store fundamental network information. Objects can be matched to many variables including Management Information Bases (MTBs), host requests, IP multicasting addresses, IP and ATM addresses or service particular information.
• the database can utilize hierarchical addressing and routing tables to efficiently and time-effectively make optimal decisions.
• a service-policy program utilizing the information stored in these databases can make decisions concerning the optimal utiUzation of the network given host demands and network availabiUty.
• Each host can be suppUed with a software proxy that allows it to interact with the service node, allowing the hosts to inform the service node of the parameters of any transmission it requests.
• Communication between hosts, service nodes and network elements wiU be provided by a service/poUcy signaUng protocol that wiU enable integrated signaUng intelUgence across a packet-network.
• This architecture allows for the placement of increased intelUgence at the host and service interface the decisions of the service-poUcy program with those above-mentioned protocols. Moreover, this architecture enables the seamless and effective large-scale monitoring of services provisioned. Tracking of time and types of services used can be implemented, aUowing for inteUigent selection and distribution of future services.
• a customer requests a web page.
• the software proxy installed in the host's computer uses the signaling protocol to send a message to the service node notifying the server of the relevant information to access the web page.
• the program in the service node reads the database and executes a decision on the availabiUty of resources to access such a web page.
• the service node can decide that resources are unavailable, that resources can be made available through manipulating network elements or that resources are available. If it decides that resources are strictly unavailable, it can send the equivalent of a busy signal.
• the service node can proactively respond to potential problems in the network through the decision-making capabilities of the service-poUcy program.
• the decisions of the program can manipulate host transmission and network activities. For instance, the program can decide that hosts must back off transmission of certain classes of service to relieve congestion in the network. The software proxy in the host would execute such requests.
• the service-poUcy program can decide that network elements must drop, back off or execute different traffic engineering poUcies. Traffic engineering can be intelUgently and centraUy determined in service nodes and executed as needed throughout the appropriate places in the network.
• This architecture wiU carry requesting information from hosts, store it in centraUzed databases and aUow the service-poUcy program to execute decisions pertinent to transportation, records and bilting. It will be able to track IGMP joins and leaves, enabling efficient and comprehensive service and poUcy management. This allows providers to decide intelUgently whether transmission of videos is more effective point-to-point or as a multicast based on the situation of the entire network.. Moreover, as host requests for these services are tracked constantly, the popularity of programming including content and advertising is available for comprehensive review. This enables a provider to optimize both the resources in their network and the programming offered to their customers.
• Figure 1 is a simpUfied flow chart showing host-local node interaction according to the invention
• Figure 2 is a simpUfied flow chart showing local node-master node interaction according to the invention.
• FIG. 3 is a simplified flow chart showing local node-networking equipment interaction according to the invention.
• Figure 4 is a simpUfied flow chart showing pubUc internet web server architecture according to the invention.
• Figure 5 is a simpUfied diagram iUustrating the relationships among host, local node, master node, and networking equipment according to the invention.
• the Network Active IntelUgence Control System provides a hierarchical management structure for Intranets encompassing the utilization of a software proxy in hosts and two levels of active nodes coordinating the execution of poUcy and management services.
• a signaling protocol, ATPv6, developed for the interaction of active nodes, provides communication among the hosts and the active nodes.
• ATPv6 is a simple query and response protocol that can be used to exchange poUcy and service information between an active node and its cUents.
• ATPv6 uses options, which were designed to support pre-defined optional processing, to support dynamicaUy defined optional processing.
• the dual layer structure of active nodes serves two roles.
• utiUzing AIPv6 to query and respond between the hosts, local nodes and master nodes, poUcy and service decisions can be distributed throughout the network.
• this structure enables the distribution of network utiUzation statistics, coUected as a basis for service and poUcy decisions.
• the architecture segments this role into local active nodes and master active nodes.
• Local active nodes collect SNMP polUng information in a defined area whereas Master active nodes aggregate the polUng information of the local active nodes in its areas. Master active nodes forward critical information to the local nodes and reply to the requests of local nodes for additional information, as necessary.
• Local nodes execute policy decisions through the transmission of SNMP 'gets' that reconfigure networking devices.
• the NAICS architecture enables host themselves to signal Local Active Nodes with AIPv6 queries.
• Local Active Node responses provide a definitive answer to the queries of Hosts, securing the service and transmission parameters relative to service level agreements and network utiUzation.
• Service and transmission parameters, mediated by the active nodes, are secured throughout the entire Intranet.
• DSL Digital Subscriber Line
• WAN Wide Area Network
• CPE Digital Subscriber Line
• WAN Wide Area Network
• This structure connects end-user's computers to a Wide Area Network interconnecting end-users and providing access to the Pubtic Internet.
• service and poUcy management responsibiUties lack centraUzed control as they are executed in diverse devices. End-users forward traffic to their connected CPE modem/routers that transmit packets across the copper local loop to a DSL Access Multiplexer. Provision of network resources cannot be accompUshed dynamically.
• the requests of end-users cannot immediately reconfigure the network devices in Une with said request.
• Transmissions must adhere to the pre-defined parameters. Transmission that do not do conform are penaUzed with potential drop or delay of the delivery. Notification of end-users occurs only with the reUance of transport layer protocols such as Transmission Control Protocol. End-users lack a comprehensive mechanism to determine service or transmission status.
• Remote Access Dial In User Service (RADIUS) servers provide Authentication, Authorization and Accounting (AAA) services critical to the deployment of DSL services as they track user, technical and business management capabiUties.
• DNS Domain Name Servers
• DNS services are critical to simple and effective Internet access.
• Dynamic Host Configuration Protocol (DHCP) enables a server to dynamically assign IP addresses to end- users. DNS and DHCP are commonly integrated into one networking device.
• Service Connection Management mechanisms provision connections to DSL end-users, relate subscribers to DSL services, view SNMP traps and access the fault, configuration, accounting, performance, security (FCAPS) functionatity.
• FCAPS performance, security
• COPS Common Open Policy Service
• COPS provide a cUent/server structure between a poUcy manager and network elements. From the edge of a network, best-effort poUcies can be enacted based on a centraUzed poUcy server.
• this architecture provides signaUng between edge routers and a poUcy server. No signaling exists between the hosts of a DSL network and centraUzed servers. The multiple devices that provide service management cannot be integrated into this policy management structure.
• aU of the techniques in current practices for DSL services cannot dynamically adapt to the demands of new and diverse appUcations.
• a service provider seeks to authenticate and allocate resources for particular appUcations on demand to its DSL/WAN subscribers.
• the networking devices allow subscribers to signal a service management server that authorizes and accounts the provision of a value-added service.
• a subscriber would utiUze a GUI to request such a service, query and respond with the service management server, and receive authorization for that service.
• the server could signal the deUvery of certain appUcation.
• the server could not estabUsh the policy requirements with the requesting host. In the current practice, such decisions occur at the edge of a network.
• NAICS Network Active Intelligence Control System
• hosts transmit on a best effort basis and receive AAA through servers distinct from poUcy and transmission functionaUties.
• NAICS utilizes software proxies in host computers. These software proxies contain databases that map appUcation types to transmission and service parameters. Requested appUcations match code representing transmission and service parameters. These parameters can signal the control system to the service and poUcy needs of that specific host.
• Hosts transmit an Advanced Internet Protocol Version 6 packet (ATPv6) to a Local active node.
• ATPv6 Advanced Internet Protocol Version 6 packet
• the Local Active Node responds to the Host with a variable, stored in the local node's soft-cache, that maps to the sender's IP address.
• the Host responds to that transmission of the Local Active Node with the variable assigned by the node and the code representing the transmission and service parameters needed for the application.
• the Local Active Node stores the variable, source and destination IP address in a table.
• An interpreter executes a decision based on the contents of the table.
• the database in the Local Active Node stores critical information to the execution of service and poUcy decisions including SNMP network utiUzation, IP routing table, Private Network-Network Interface (PNNI) routing table, Internet Group Management Protocol (IGMP), Value- Added AppUcations, AAA, DNS and DHCP.
• PNNI Private Network-Network Interface
• IGMP Internet Group Management Protocol
• the Local Active Node relays the decision to the Host through transmitting code contained in an AJPv6 packet to the Host. Based on the decision executed, the Local Active Node utilizes SNMP 'gets' to reconfigure networking devices. The transmission of SNMP 'gets' faciUtates the provision of requests for specific transmission and service parameters for the host.
• the query and response mechanism of AIPv6 between hosts and Local Active Nodes simpUfies the current practice of interaction between the hosts and various service management devices and rectifies the lack of interaction between hosts and poUcy management devices.
• ALPv6 query and response enables Local Active Nodes and Master Active Nodes to synchronize network utiUzation information in a scalable manner.
• Local Active Nodes poU network devices to determine current network utiUzation. Given a limited amount of devices and hosts, one Local Active Node is sufficient for polUng of network utiUzation information and to respond to requests from end-users. In a large-scale network, such as a DSL/WAN, multiple Local Active Nodes are necessary to execute this responsibiUty and a higher-level device is needed to synchronize the activities of the Local Active Nodes.
• the Master Active Node responds to queries of the Local Active Nodes to ensure such synchronization.
• the Master Node receives ATPv6 packets from the Local Active Nodes. At regular intervals, the Master Node transmits ATPv6 packets containing critical network utiUzation information forwarded from other Local Active Nodes. Upon AJPv6 signaUng query from a Local Active Node requesting additional network information, the Master Node responds with an AIPv6 packet providing the necessary information.
• This practices enables the direct communication of hosts to a service/poUcy management platforms that registers network utiUzation, transmission and service parameters to centrally execute host requests.
• aU service management and poUcy capabiUties are executed in a singular platform.
• DSL customers in such a solution utilize a software proxy that maintains a database, enabUng AIPv6 signaUng to the Local-Master Control System that matches requested parameters with service level authority and network capabiUty, thereby overcoming the best- effort, edge-based, diverse platform service management structure of the current practice.
• NAICS strategy provides the determination of dynamic policy rather than the current practice of statically appUed, administratively determined firewalls.
• NAICS enables constant monitoring, immediate response and a dynamic poUcy implementation that ensures the filtering of maUcious traffic while aUowing open access of the Internet community to the web server.
• the fundamental NAICS-Web Server architecture entails three components. The first component is an edge router connecting a Web Server(s) to a Wide Area Network (WAN), Local Area Network (LAN) or pubUc Internet. The router interfaces with a NAICS Active Node Security Platform that mediates transmission between the router and the Web Server. The final component of this architecture is a Web Server enabled as an active node.
• Routers forward client's request to the NAICS Active Node Security Platform.
• the NAICS passively forwards incoming transmissions (i.e., transmissions from the network, through the router, and destined for the Web Server) unless those packets are AIPv6 enabled.
• AIPv6 packets are processed, the contained code is read and necessary decisions are executed.
• AU other packets are transparently forwarded to the active node enabled Web Server.
• the Web Server executes decisions in a manner consistent with current practices.
• packets transmitted from the Web Server are encapsulated in AIPv6 packets.
• the NAICS platform processes each ATPv6 packet transmitted from the Web Server towards the router.
• the NAICS platform contains tables enabUng it to read the ALPv6 packets and record the contents of the packet in appropriate tables.
• This monitoring functionaUty is consistent with and builds from the basic capabiUty of an active node.
• the NAICS platform Based on algorithms determined to monitor for activities consistent with distributed denial of services attacks, the NAICS platform records packets transmitted from the web server and matches tables detailing the records of these packets with said algorithms.
• the algorithms can execute predetermined scripts that manipulate networking devices.
• the NAICS platform utiUzes two mechanisms to adapt networking devices to rectify effects debiUtating network performance. Utilizing an interface to Telnet scripts, the NAICS platform reconfigures the access Ust of the router accepting traffic to the Web Server.
• the NAICS platform executes script that engenders the performance of a traceroute command, determining the source of the attack. UtiUzing the same mechanism to reconfigure access Usts, the NAICS platform can reconfigure the access Ust to include the address range of the entire router originating the attack. This mechanism rectifies an attacker's attempt to dynamically utilize new IP addresses through the blocking of the entire range of addresses originating the attack.
• the second mechanism enables the NAICS platform to utiUze ATPv6 packets to reconfigure the active node enabled Web Server.
• the NAICS platform chooses code consistent with a script called from a services attack.
• the AIPv6 packet deUvers the code that reconfigures the Web Server to manipulate network parameters to block IP addresses and TCP/UDP ports responsible for distributed denial of service attacks.
• active node functionaUty can be provided to end-users.
• a component in the web server enables hosts to download an active node software proxy that optimizes transmission between hosts and a web server.
• Incoming transmissions from the router through the NAICS platform to the Web Server are processed and optimized by the NAICS platform.
• the Hosts transmits AIPv6 packets to the Web Server. These packets will be processed by the NAICS platform mediating traffic between the network and the Web Server.
• the NAICS platform reads the contained code in the AJPv6 platform and processes the packet accordingly.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Telephonic Communication Services (AREA)

Applications Claiming Priority (3)

Publications (1)

Family

ID=22678217

Family Applications (1)

Country Status (7)

Families Citing this family (14)

Family Cites Families (2)

• 2001
  • 2001-02-22 CN CN 01808489 patent/CN1426639A/zh active Pending
  • 2001-02-22 WO PCT/US2001/005690 patent/WO2001063809A1/en not_active Application Discontinuation
  • 2001-02-22 AU AU2001241664A patent/AU2001241664A1/en not_active Abandoned
  • 2001-02-22 EP EP01912930A patent/EP1264431A1/de not_active Withdrawn
  • 2001-02-22 CA CA002407557A patent/CA2407557A1/en not_active Abandoned
  • 2001-02-22 EA EA200200896A patent/EA004189B1/ru not_active IP Right Cessation
  • 2001-02-22 JP JP2001562882A patent/JP2003524994A/ja active Pending

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events