KR100655187B1 - System and method for analyzing the amount of data transmitted - Google Patents

Abstract

In order to accurately and reliably calculate and analyze the amount of data transmission between the subscriber and the service server, the data transmitted between the subscriber and the service server are copied and output separately, and the source identification information and the destination are respectively copied and output. (destination) Determining whether the data to be calculated with only one of the identification information, classifying the data by communication protocol, and if the data is a TCP / IP protocol, the Acknowledgment Number of the TCP header of the data to be calculated corresponds. To determine whether the data has been transmitted until only the data that is equal to or greater than the sum of the sequence number and the data amount of the TCP body is transmitted, and whether the data has been completed until the transaction is completed using the temporal comparison or identification information. Data transmission analysis system and methods The.

Data, Mobile Phone, Packet, Mobile Phone, Mobile Communication

Description

System and method for analyzing the amount of data transmitted}

1 is a block diagram conceptually illustrating an example in which a data transfer analysis system 100 according to a preferred embodiment of the present invention is used.

2 is a diagram illustrating a process of calculating and charging a user data packet confirmed to be transmitted in a charging data network according to an embodiment of the present invention.

Figure 3 is a block diagram showing the internal configuration of the billing segmentation analysis device 120 according to a preferred embodiment of the present invention.

4 is a diagram illustrating a packet copying and extracting process of the packet copying apparatus 110 according to the preferred embodiment of the present invention.

5 is a flowchart conceptually illustrating a process of identifying a source and a destination of an extracted data packet.

6 is a flowchart conceptually illustrating a process of classifying identified data packets by protocols;

7 is a flow diagram conceptually illustrating a structure for reconstructing classified Transmission Control Protocol (TCP) data.

8 is a flowchart conceptually showing an HTTP service processing structure as a packet reconstructed the TCP data of FIG.

9 is a flowchart conceptually illustrating an SSL service processing structure with the analyzed packet of FIG. 6 or FIG.

10 is a flowchart conceptually illustrating a VOD service processing structure with the analyzed packets of FIGS. 5 and 6;

* Explanation of symbols for the main parts of the drawings

100 Data Transmission Analysis System 110 Packet Copy Device

120 billing segmentation information analysis device 130 billing segmentation information processing device

140 billing processing system 150 service gateway server

160 content providers 170 internet

10 Packet Switcher 102 Target Determination Unit

104 Data classification unit 106 Transmission completion determination unit

108 Data Checksum 110 Transaction Completed Determination Unit

The present invention relates to a data throughput analysis system and method thereof. In particular, the present invention relates to a data throughput analysis system and method for analyzing whether data transmission is completed and a transaction is completed in a data communication network.

Charging system that generates and transmits CDR (Call Detail Record) data by recording packet usage and usage time by service / content by user by copying data flowing from network of packet exchanger in router or dummy hub as the current data service is activated. This is being introduced. Packet usage provided by such a system is calculated by calculating the data usage flowing in the network.

Conventional data transfer calculation methods and charging methods have the following problems.

First, in terms of packet collection, a method of collecting data in a port mirror or a dummy hub in a conventional router has a problem in its transmission capacity.

That is, in case of collecting data through the port mirror method in the router, the maximum 100Mbits of bi-directional 100Mbits per second (TX / RX total 200Mbps) that can be used in Full Duplex Mode of Fast Ethernet is transmitted to one Ethernet line. Data (RX 100Mbps) can be transmitted, and the remaining 100Mbits can be processed for a few seconds through internal buffering, but when more than that, data cannot be received.

On the other hand, in the case of Dummy Hub, since a single input Ethernet frame is transmitted to all Ethernet Lines connected to the Dummy Hub, more data may be lost than the Port Mirror method in a router.

Second, in terms of billing reliability, in calculating the data packet transmission amount in the billing method used in the conventional CDMA1100 1X and EV-DO, it is not simply data confirmed that the packet has been transmitted to the destination, but simply data flowed from the network. The packet transmission amount is calculated and the subscriber data is extracted to calculate the packet transmission amount. Therefore, data that is not actually transmitted can be wrongly calculated as being transmitted data, which may lead to unfair charging.

Third, in the final processing of the data, conventionally, the data is finally processed at the time when the corresponding bidirectional or unidirectional FIN Flag is received and the ACK message for the FIN Flag transmitted in both directions is not normally processed. There is a problem that the billing is unfairly added to the subscriber because the billing amount of data that was not finally transmitted to the subscriber station or the contents provider on the wireless network is included in the billing.

Fourth, even if charging is performed on the transmitted data in packet units, if it is not confirmed that all data in one unit transaction is completed in the transaction dimension, if the unit transaction does not complete and the transmission fails in the middle, the previous transmission is performed. There is a problem that charging can be performed unjustly for some data that has been completed, and conventionally, there is no processing for confirming whether data transmission is completed at the transaction level.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and an object of the present invention is to provide a data transmission amount analysis system and method capable of more accurately and reliably calculating and analyzing the amount of data transmitted.

In order to achieve the above object, the present invention, in the data transmission amount analysis system for calculating and analyzing the amount of data transmitted between the first and second data transceiver connected to the data communication network, the first and second data transmission and reception apparatus A data copying unit for copying and outputting data transmitted between them; A calculation analysis unit for calculating and / or analyzing a transmission amount of the data output by the data copy unit as transmission data in the direction of the first or second data transmission / reception apparatus; And information indicating the start or end of the transmission amount calculation and / or analysis as information including identification information of the first and / or second data transmission / reception apparatus to be calculated and / or analyzed. And an information processor configured to provide a predetermined external device with information about a transmission amount of data transmitted between the first and second data transceivers calculated and / or analyzed by the calculation analyzer, wherein the calculation analyzer comprises: Among the data output from the data copying unit, for data transmitted from the first data transceiver to the second data transceiver, source identification information included in the data and identification information of the first data transceiver Compare only or transmit and receive destination identification information included in the data and the second data Value identification information, and on the other hand, with respect to data transmitted from the second data transmission / reception apparatus to the first data transmission / reception apparatus, only source identification information included in the data is compared with identification information of the second data transmission / reception apparatus, or An object discriminating unit which compares only destination identification information included in the data with identification information of the first data transmitting / receiving device to determine whether the data is subject to calculation and analysis; A data classifying unit classifying the data output by the data copying unit for each communication protocol of the data; And when the data is a TCP / IP protocol, only the data that is equal to or larger than the sum of the corresponding Sequence Number and the amount of data of the TCP body is determined as data that has been transmitted by acknowledgment number of the TCP header of the data to be calculated. It provides a data transmission amount analysis system including a transmission completion determination unit.

According to another aspect of the present invention, the present invention provides a data transmission amount analysis method for calculating and analyzing the amount of data transmitted between the first and second data transceiver connected to the data communication network, (1) calculation and / or analysis Receiving information indicating the start of the transmission amount calculation and / or analysis as information including identification information of the first and / or second data transmission / reception apparatus to be subjected to; (2) copying and outputting data transmitted between the first and second data transceiving devices; (3) calculating and / or analyzing a transmission amount of the data output by the data copying unit as transmission data in a direction of the first or second data transmission / reception apparatus; And (4) transmitting information on the amount of transmission calculated and / or analyzed in step (3) to an external device, wherein step (3) comprises (5) outputting in step (2). Among the data, for data transmitted from the first data transceiver to the second data transceiver, only source identification information included in the data and identification information of the first data transceiver are compared or not. Compared with the destination identification information included and the identification information of the second data transceiver, the data transmitted from the second data transceiver to the first data transceiver is included in the data. Compares only source identification information with identification information of the second data transmission / reception apparatus, or includes a destination included in the data Determining whether the data is the target of calculating the art and analyzed by comparing only the identification information of the specific information from the first data transmitting and receiving apparatus; (6) classifying the data output in step (2) for each communication protocol of the data; And (7) When the data is a TCP / IP protocol, only transmission of data for which the Acknowledgment Number of the TCP header of the data to be calculated is equal to or greater than the sum of the corresponding Sequence Number and the data amount of the TCP body is completed. It provides a data transmission analysis method comprising the step of determining the data.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. 1 is a block diagram conceptually illustrating an example in which the data transfer amount analysis system 100 according to a preferred embodiment of the present invention is used. As shown in Fig. 1, the data transfer amount analysis system (hereinafter, also simply referred to as "system") 100 according to the present embodiment is a packet copying apparatus 110, a billing segmentation information analyzing apparatus 120, and a billing segmentation information processing. Device 130. The packet copying apparatus 110, the billing segmentation information analyzing apparatus 120, and the billing segmentation information processing apparatus 130 are examples of the data copying unit, the calculation analyzing unit, and the information processing unit of the present invention, respectively.

The packet switch 10 includes a PDSN (Packet Data Support Node), which is a synchronous packet switch, a Serving GPRS Support Node (SGSN), a Gateway GPRS Support Node (GGSN), and the like, which are an asynchronous packet switch. The packet switch 10 is a core component of a data core network (DCN), which is a system for providing packet data service to a mobile subscriber, and is a reciprocal between a radio access network (RAN) corresponding to a wireless network connection and a data core network (DCN). It is a device that connects wireless signal to IP network through interworking. On the other hand, the packet switch 10 is an example of the first or second data transmission and reception apparatus of the present invention.

The packet switch 10 is connected to the billing segmentation information processing device 130 via the signaling path 11, and via the data path 103 via the packet copy device 110 via the data path 12 to the service gateway. It is connected to the server 150 and the Internet 170 to enable the transmission and reception of data packets between the subscriber terminal (not shown), the content provider 160 and the Internet 170. Meanwhile, the subscriber terminal is an example of the first or second data transmission / reception apparatus of the present invention, and the content provider 160 is an example of the second or first data transmission / reception apparatus of the present invention.

The packet copying apparatus 110 is connected to the billing segmentation information analyzing apparatus 120 through the service server directional data copying path 14 and the packet switcher directional data copying path 15 to convert the data packet into the billing segmentation information analyzing apparatus 120. Also send).

The billing segmentation information processing device 130 is connected to the packet switch 10 and the billing processing system 140, and includes a billing number including a subscriber number and a user IP address assigned by the packet switch 10 from the packet switch 10. Receives the start message and transmits the message to the billing segmentation information analysis device 120.

The billing segmentation information analyzing apparatus 120 analyzes the transmitted data to generate a low data record (RDR), and transmits the generated RDR to the billing segmentation information processing apparatus 130. The billing segmentation information processing device 130 transmits the received RDR to the billing processing system 140. In addition, the billing segmentation information processing device 130 transmits the billing stop message to the billing segmentation information processing device 130 when the packet switch 10 completes the call setup. 120). If data to be analyzed by this message remains, a final low data record (RDR) is generated and transmitted to the billing segmentation information processing unit 130, and the billing segmentation information processing unit 130 is configured to perform a final billing processing procedure. do.

The billing segmentation information analyzing apparatus 120 performs data packet filtering and packet reconstruction, extracts the information and the amount of transmission for each service from the data actually confirmed to the subscriber station as data used by the subscriber station, and processes the billing segmentation information. Transmit to device 130. Details of the billing segmentation information analysis device 120 will be described later.

The billing segmentation information processing apparatus 130 transmits the billing start or end message received from the packet exchanger 10 to the billing segmentation information analyzing apparatus 120 and transmits the RDR (RDR) transmitted from the billing segmentation information analyzing apparatus 120. Data Record) is transmitted to the billing processing system 140. In addition, the billing segmentation information processing apparatus 130 may manage user sessions and information internally.

2 is a diagram illustrating a process of calculating and charging a user data packet confirmed to be transmitted in a charging data network according to an embodiment of the present invention. The packet switch 10 transmits the charging start message S100 to the charging segmentation information processing apparatus 130. As described above, the charging start message includes information such as the subscriber number and the IP address assigned by the packet switch 10. The billing segmentation information processing apparatus 130 transmits the received billing initiation message to the billing segmentation information analyzing apparatus 120 (S110) and instructs the subscriber to start collecting and analyzing data. In addition, when data collection and analysis has normally started in the billing segmentation information analyzing apparatus 120, the billing start message is transmitted to the billing processing system 140 (S111).

The billing segmentation information analyzing apparatus 120, among the packets copied and transmitted by the packet copying apparatus 110, the source IP (Source IP) of the IP header of the packet copied to the service server direction matches the IP assigned to the user or Or, if the destination IP (Destination IP) of the IP header of the packet copied to the packet exchanger matches the IP assigned to the user, the packet is reconfigured.

In addition, the billing segmentation information analysis device 120 analyzes a transaction corresponding to various protocols such as a Transmission Control Protocol (TCP) service, an HTTP service, an SSL service, and a VOD service on a transmission confirmed packet to perform a RDR (Row Data Record). In operation S120, the generated low data record (RDR) is transmitted to the billing segmentation information processing apparatus 130. On the other hand, the source IP and the destination IP is an example of source identification information and destination identification information of the first or second data transmission and reception apparatus of the present invention.

When the billing segmentation information processing device 130 receives the RDR message from the billing segmentation information analysis device 120, the corresponding user session information is changed, and then the billing system 140 transmits the RDR message to the billing processing system 140 (S132).

In addition, as soon as the RDR is generated, the billing segmentation information analyzing apparatus 120 increments the sequence number inside the RDR message and transmits it to the billing segmentation information processing apparatus 130 (S121). ) Transmits the corresponding RDR message to the charging processing system 140 (S133).

On the other hand, if the packet exchanger 10 transmits the charging stop message to the charging segmentation information processing apparatus 130 (S101), the charging segmentation information processing apparatus 130 receives the charging stop request message from the charging segmentation information analysis apparatus 120. (S134). Finally, the billing segmentation information analysis device 120 receives a billing stop request message, and if a transaction under analysis exists, transmits the corresponding RDR message to the billing segmentation information processing device 130 (S122). The response message is transmitted to the billing segmentation information processing device 130 (S123). Otherwise, if the transaction under analysis does not exist, only the charging stop response message is transmitted to the charging segmentation information processing apparatus 130 (S123).

If the RDR message is transmitted before the billing breakdown response message is transmitted, the billing segmentation information processing device 130 transmits the corresponding RDR message to the billing processing system 140 (S135), and the billing breakdown response message is the billing segmentation information analyzing device. When transmitted at 120, the user session information is finally processed and transmitted to the billing processing system 140 (S136) to finally perform the actual billing processing.

3 is a block diagram showing the internal configuration of the billing segmentation analysis device 120 according to a preferred embodiment of the present invention. The billing segmentation analyzing apparatus 120 according to the present embodiment includes a target determining unit 102, a data classification unit 104, a transmission completion determining unit 106, a data checking unit 108, and a transaction completion determining unit 110. Include.

When the object determining unit 102 receives the charging start message from the charging segmentation information processing apparatus 130, the object determining unit 102 checks whether the data transmitted is data for the subscriber included in the received charging start message, thereby transmitting data. Determine whether the target is to be calculated.

That is, the target determination unit 102 compares only the source IP included in the packet with the IP address of the allocated subscriber station in the packet transmitted from the packet copying apparatus 110 to the service server. Compare only the destination IP included in the packet with the IP address of the content provider 160, and compare only the source IP included in the packet with the IP address of the content provider 160 with respect to the packet transmitted in the packet exchanger direction. The source IP and the destination of the transmitted packet are identified by comparing only the destination IP included in the packet with the IP address of the assigned subscriber station.

Therefore, according to the present invention, since the input direction of the data is designated in advance as the source or destination direction, it is possible to determine whether the data is the calculation target by comparing only the IP of either the source or the destination, thereby improving the efficiency of the system.

The data checksum unit 108 receives the packet copied by the packet copy apparatus 110, performs IP checksum of the IP header based on the IP protocol, and checks whether an error has occurred in the transmitted data.

The data classifying unit 104 receives the packet data copied by the packet copying apparatus 110, grasps the format of the packet data, and classifies the packet data into communication protocols to which the packet data belongs. The data classifying unit 104 in this embodiment classifies the copied packet data into TCP, HTTP, SSL, VOD, and the like.

The transmission completion determination unit 106 confirms whether the data has been transmitted. That is, when the data is the TCP / IP protocol, the transmission completion determination unit 106 determines that the Acknowledgment Number of the TCP header of the data to be calculated is equal to or greater than the sum of the corresponding Sequence Number and the data amount of the TCP body. Only the data is determined as the transferred data. Therefore, according to the present invention, since the data transfer amount is calculated only for the data that has been confirmed to be transferred, the reliability of the data transfer amount is increased.

On the other hand, the billing segmentation analysis apparatus 120 of the present invention completes the transaction for determining whether the transaction between the subscriber and the service server is completed for the transmission data determined by the transmission completion determining unit 106 to be completed. The determination unit 110 further includes.

The transaction completion determination unit 110, when the data is the HTTP protocol, the request side memory (1102) for storing the data transmitted from the request (Request) side of the subscriber terminal and the service server and the response of the subscriber terminal and the service server A response side memory 1104 for storing data transmitted from the (Response) side. The transaction completion determination unit 110 determines whether the transactions on both sides have been completed by matching the data on both sides stored in the requesting and response side memories 1102 and 1104 in chronological order.

In another embodiment, the transaction completion determining unit 110, when the data is the HTTP protocol, and the information generated in the data transmitted from the response side as information contained in the data that can be identified from the request side and the request from the request side; In the same manner, it further includes a transaction key generation unit 1106 for generating a transaction key for the data transmitted from the requesting side. The transaction completion determination unit 110 compares the transaction key generated by the transaction key generation unit 1106 with the request side identification information included in the data transmitted from the response side, and determines whether the transaction on both sides is completed. The transaction key generation unit 1106 of this embodiment generates, in advance, information stored by encoding a URL on the response side into an 8-byte size using a predetermined algorithm as a transaction key of the transaction, and stores it in a predetermined memory.

Therefore, according to the present invention, it is possible to determine whether not only the transmitted data but also the transaction is completed, so that it is possible to provide the basic data capable of performing data charging reliably.

4 is a diagram illustrating a packet copying and extracting process of the packet copying apparatus 110 according to an exemplary embodiment of the present invention. When the service server direction input signal 210 output from the packet switch 10 is generated, the packet copy apparatus 110 provides a service server direction copy output signal 212, and provides the Internet with the service server direction output signal 211. Or output to the service gateway server 150. On the other hand, when the packet switch direction input signal 220 output from the Internet 170 or the service gateway server 150 is generated, the packet switch direction output signal 222 is provided, and the packet switch direction output signal 221 is provided. Output to the packet switch 10.

That is, the packet copy apparatus 110 of the present invention has a first output unit and a second output unit which copy and output the data input to the service server direction and the packet exchanger direction separately. Therefore, according to the present invention, by providing two output units corresponding to two inputs, it is possible to solve the problem of data transmission capacity in the packet collection step. On the other hand, the packet copy here is a tapping (Tapping) process, where the tapping is to copy the electrical signal to the electrical connection to extract the same signal.

5 is a diagram conceptually illustrating a structure of collecting the data packet of FIG. 4. By checking whether there is a service server direction copy output signal 212 of the packet copying apparatus 110 (S200), it is checked whether a frame of the corresponding data link layer exists (S201). If the frame exists, the frame is analyzed to determine whether it is an IP protocol (S202), and the IP header information is analyzed and extracted (S203), and the IP checksum error is checked to see if the frame is normal (S204). If the frame is normal, the packet analysis process of FIG. 6 is performed by checking whether the destination IP (Destination IP) and the destination port (Destination Port) of the IP header are service server IPs and ports to be analyzed (S205). When the packet analysis process is completed and other situations described above, the process proceeds to checking whether there is a packet switch-client direction copy output signal 222 of the packet copying apparatus 110 (S210).

Collecting a frame in the direction of the packet switch is the same as the above-described steps S201, S202, S203, and S204. If the frame is normal, the source IP and the source port of the IP header are normal. Source Port) checks whether the service server IP and the port to be analyzed (S211). If the packet is related to the service server, the packet analysis process of FIG. 6 is performed. When the packet analysis process is completed and other situations described above, go to the step of checking whether there is a service server direction copy output signal 212 and start again (S200).

FIG. 7 is a diagram conceptually illustrating a structure of analyzing the collected data of FIG. 5 for each service. If the source IP is a packet directed to the service server, and the source IP is a packet directed to the packet exchanger, the destination IP should be processed from the charging start message S131 by the charging segmentation information processing apparatus 130. Check whether the terminal IP (S300). If there is no information (Call Session) for the user generated by the charging start message (S131), it ends. Otherwise, if it exists, check whether it is Transmission Control Protocol (TCP) from the information analyzed by the Ethernet frame (S301). In the case of Transmission Control Protocol (TCP), Transmission Control Protocol (TCP) Header information is extracted (S303), and a Transmission Control Protocol (TCP) Checksum error is checked (S303) to check whether the corresponding packet is normal. If an error occurs, the analysis ends. If normal, the TCP (Transmission Control Protocol) packet reconstruction of FIG. 7 is performed (S304). If there is data to be analyzed as a result (S305), whether the packet is a Transmission Control Protocol (TCP) service (S306), HTTP service (S307), SSL service (S308), and checks the corresponding service analysis process. A process is performed for a Transmission Control Protocol (TCP) service (S320), an HTTP service (S330) of FIG. 8, an SSL service (S340) of FIG. 9, and a VOD service (S350) of FIG. 10. The analysis ends when all service processing is performed.

Check whether it is TCP (Transmission Control Protocol) (S301), and if it is not TCP (Transmission Control Protocol), check again whether it is UDP (User Datagram Protocol) (S311). In case of User Datagram Protocol (UDP), User Datagram Protocol (UDP) Header information is extracted (S312), and a User Datagram Protocol (UDP) Checksum error is checked (S313). If normal, the VOD service of FIG. 10 is performed (S350). The analysis is terminated when an error is issued and after the VOD service is performed.

FIG. 7 is a diagram conceptually illustrating a structure for extracting transmission confirmed data by reconfiguring Transmission Control Protocol (TCP) data among the structures of FIG. 4 analyzed. Check whether there is a TCP session composed of terminal IP / PORT and service server IP / PORT using the packet information. If it does not exist, the analysis is terminated if it is a previously created TCP session or if the TCP RST Flag exists. If not, a TCP session is created. If the TCP SIN Flag does not exist, abnormal generation information is stored in the TCP session. If the TCP Payload data exists, the data is stored in the TCP Request Stack if it is a service server direction packet. Otherwise, the analysis is terminated after storing in the TCP Response Stack.

If the same TCP session exists, if it is a service server direction TCP packet, it is checked whether the corresponding TCP packet is a retransmission packet by comparing the sequence number of the TCP header with existing stored information. If the packet is a retransmission packet, the analysis ends. If it is not the packet, check whether the TCP SYN Flag exists, and if so, store the generated TCP session termination information in the memory to be transmitted to the already generated TCP session termination service and service processing, and the result of FIG. The data S305 to be analyzed is present. In addition, a new TCP session is created. If payload data exists, the analysis is completed after storing the information in the TCP request stack.

If the TCP SYN Flag does not exist, check whether TCP Payload Data exists and store it in the TCP Request Stack. In addition, when the acknowledgment number of the TCP header is equal to or greater than the sum of the packet sequence number of the response stack and the payload data amount, the packet stored in the response stack may be analyzed for the result of FIG. 6 (S305). Save the data. Then, it checks whether the response FIN state corresponding to the Acknowledgment Number of the TCP header is changed to the TCP response FIN end state. Also, check whether TCP FIN Flag exists and change the status of TCP Request to FIN. Or, if the TCP RST Flag is present, or if both the TCP Request and Response are in the FIN termination state, the data is stored to be analyzed (S305) and the corresponding TCP session is terminated. If not, change the information of the TCP session and finish the analysis.

If the same TCP session exists, if it is not a service server-oriented TCP packet (or a packet exchanger-oriented TCP packet), it is checked whether the corresponding TCP packet is a retransmission packet by comparing the sequence number of the TCP header with existing stored information. If the packet is a retransmission packet, the analysis ends. If not, check if TCP Payload Data exists and store it in the TCP Response Stack. In addition, when the acknowledgment number of the TCP header is equal to or greater than the sum of the packet sequence number and the payload data amount of the request stack, the packet stored in the request stack can be analyzed for the result of FIG. 6 (S305). Save the data. Then, it checks whether the Request FIN state corresponding to the Acknowledgment Number of the TCP Header is changed to the TCP Request FIN end state. Also, check whether TCP FIN Flag exists and change the status of TCP Response to FIN. Alternatively, if the TCP RST Flag is present or both TCP Request / Response is in the FIN termination state, the data is stored to be analyzed (S305) and the corresponding TCP session is terminated. If not, change the information of the TCP session and finish the analysis.

FIG. 8 is a conceptual diagram illustrating the structure of the HTTP service process (S330) of FIG. 6 as a completed packet in which TCP (Transmission Control Protocol) data of FIG. 6 is reconstructed. Check whether a TCP session exists for the acknowledged packet. If the TCP session exists, but the TCP session state is SSL service state, the analysis process is terminated through the SSL service process.

If the TCP session exists and the TCP session state is not the SSL service state, if the TCP FIN Flag packet or the billing request message sent from the billing segmentation information processing apparatus 130 (S134), data to be transmitted remains. Check if it exists, create and send a low data record (RDR), delete the HTTP transaction, and delete the TCP session.

If it is determined that the HTTP response start message is not a TCP FIN or a charge stop request message and is not a service server direction message, the HTTP response message is analyzed, an HTTP request is generated after generating a transaction key. Find Transaction After changing the information on the transaction, check whether the response to the HTTP request is terminated, and if it is determined that it is terminated, generate a RDR (Row Data Record) and transmit it to the billing segmentation information processing device 130, and delete the HTTP transaction. do. Otherwise, if there is unanalyzed data, the unsaved data is stored in the response stack.

If it is not an HTTP response start message, check whether there is an unresolved stack saved last for the HTTP response. If there is an unanalyzed stack, add it and reanalyze it and save it. If it is determined that the response to the HTTP request is terminated, and determines that the response is terminated, a RDR (Row Data Record) is generated and transmitted to the billing segmentation information processing apparatus 130, and the HTTP transaction is deleted. Otherwise, if there is unanalyzed data, the unsaved data is stored in the response stack.

If it is determined that the HTTP Request start message is not a TCP FIN or a billing request message, but the service server direction message, the HTTP Request Header information is analyzed and stored while storing the information about the HTTP Transaction. After analyzing the header information, the transaction key for the HTTP request is created by the transaction generation rule, and the analysis of the HTTP service is terminated. Otherwise, if all the header information for the HTTP request could not be analyzed, the unresolved information is stored in the request stack. If it is not an HTTP Request start message, but the SSL service start message, after changing to the SSL service state for the TCP session, the analysis process and ends through the SSL service processing. If it is not an SSL service start message, if there is an unanalyzed stack stored at the end of the HTTP request, add it and reanalyze it. As a result of re-analysis, when the corresponding header information is analyzed, the transaction key for the HTTP request is created by the transaction generation rule, and then the HTTP service analysis is terminated. Otherwise, if all the header information for the HTTP request could not be analyzed, the unresolved information is stored in the request stack. If there is no unanalyzed stack stored at the end of HTTP request, it is added to the relevant transaction information and completed.

If it is a message directed to the service server, it stores new TCP session information. In addition, when the packet is determined to be an HTTP request start message, the HTTP request header information is analyzed and stored while storing information on the HTTP transaction. After analyzing the header information, the transaction key for the HTTP request is created by the transaction generation rule, and the analysis of the HTTP service is terminated. Otherwise, if all the header information for the HTTP request could not be analyzed, the unresolved information is stored in the request stack.

FIG. 9 is a diagram conceptually illustrating an SSL service processing structure with the analyzed packet of FIG. 7 or 8. FIG. Check whether a TCP session exists for the acknowledged packet. If it does not exist, if it is a service server direction message, it creates and stores new TCP session information. Then, it checks whether the SSL request start message, analyzes the SSL request header, and stores the corresponding request transaction information. When the analysis of the SSL Request Header is completed, the key generated by the key generation rule for the SSL request is stored in the transaction, and the state of the SSL transaction is changed to the response state. If the analysis of the SSL request is not complete, the unresolved information is stored in the request start stack.

If there is a TCP session, and the TCP FIN Flag or the billing stop message S100 transmitted from the packet switch 10 is received from the billing segmentation information processing apparatus 130 (S134), if there is data to be transmitted, RDR (Row Data Record) is generated and transmitted to the billing segmentation information processing device 130, and deletes the corresponding SSL Transaction and TCP session, and deletes only the corresponding TCP session if there is no data to be transmitted.

If a TCP session exists and is not a TCP FIN Flag or a billing stop message (S134), check whether the SSL Request Start message is for the service server direction message. If the message is the SSL request start message, the request transaction information is stored by analyzing the SSL request header. When the analysis of the SSL Request Header is completed, the key generated by the key generation rule for the SSL request is stored in the transaction, and the state of the SSL transaction is changed to the response state. If the analysis of the SSL request is not completed, the unresolved information is stored in the request start stack.

If it is not the SSL Request start message, check whether it is the SSL Request end message, and if it is the SSL Request end message, search the transaction for the SSL Request end message by analyzing the message. If the searched transaction exists, the information is saved. When the termination message for the SSL request is analyzed and completed, the terminal generates a low data record (RDR) and transmits it to the billing segmentation information processing apparatus 130 and deletes the corresponding SSL transaction. If the analysis is not completed, it is saved in the request end stack of the transaction and the SSL transaction status is changed to the SSL termination status.

If it is not an SSL request end message, check whether there is an unresolved stack saved last for the SSL request. If present, if SSL is terminated, re-analyze by adding the message to the SSL Request End Stack. The result of re-analysis is stored, the SSL request end message is checked for completion of analysis, and when terminated, a RDR (Row Data Record) is generated and transmitted to the billing segmentation information processing device 130, and the corresponding SSL transaction is deleted. If the analysis is not completed, it is saved in the request end stack of the transaction and the SSL transaction status is changed to the SSL termination status. If SSL is not terminated, add the message to SSL request start stack and reanalyze it. When the reanalysis result completes the analysis of the SSL request header, the key generated by the key generation rule for the SSL request is stored in the transaction, and the state of the SSL transaction is changed to the response state. If the analysis of the SSL request is not completed, the unresolved information is stored in the request start stack.

If the TCP session exists and is not the TCP FIN Flag or the charging stop message (S134), it is checked whether the packet response message is the SSL response start message. If the message is an SSL request start message, the message is analyzed to find the corresponding request transaction information. If the transaction exists, save the analyzed information and check whether the response to the SSL request is terminated and change the SSL transaction to the SSL transmission state. Otherwise, if there is data that cannot be analyzed, the information is stored in the response stack and the transaction is changed to the SSL response state.

If it is not an SSL response start message, check whether there is an unanalyzed stack for the last transaction for the SSL response. If it exists, re-analyze it by adding the contents of the SSL Response Stack. Save the re-analyzed result in the relevant transaction information and check whether the response to the SSL request is terminated and change the SSL transaction to the SSL transmission state. Otherwise, if there is data that cannot be analyzed, the information is stored in the response stack, and the transaction is changed to the SSL response state.

FIG. 10 is a diagram conceptually illustrating a VOD service processing structure with the analyzed packets of FIGS. 6 and 7. VOD service processing is a combination of TCP's RTSP and UDP's RTCP / RTP. Check that a VOD session exists for the message. If the VOD session does not exist, if the message is a service server direction, the VOD session information is newly generated and the analyzed information is stored. After analyzing the message, check whether it is the RTSP start message and create a new RTSP Transaction. It analyzes additionally and saves RTSP start information. When RTSP start message analysis is completed, change VOD Transaction status to VOD start response and save. Otherwise, if RTSP start message analysis is not completed, the unresolved information is stored in the start stack of transaction, and the VOD transaction state is changed to VOD start request state and saved. If not the RTSP start message, the analysis ends.

If there is a VOD session, if it is not a TCP FIN flag or a charging stop message (S134), but a TCP packet, it is checked whether the message is a service server direction message. If the result of the check is a service server direction message, if the RTSP start message, a new RTSP transaction is created. It analyzes additionally and saves RTSP start information. When RTSP start message analysis is completed, change VOD Transaction status to VOD start response and save. Otherwise, if RTSP start message analysis is not completed, the unresolved information is stored in the start stack of transaction, and the VOD transaction state is changed to VOD start request state and saved. If not the RTSP start message, the analysis ends. If RTSP end message is not RTSP start message, the relevant RSTP end message is analyzed to find Transaction for RTSP end message. If the transaction exists, save the analysis contents in transaction information and check whether the analysis of RTSP end message is completed. When the analysis is completed, the VOD Transaction status is changed to the termination response state and stored. Otherwise, the unanalyzed information is stored in the RSTP end stack and the VOD transaction completion state is changed. If it is not an RTSP start / end message, check if there is a stack that was not analyzed last for the transaction. If present, if the state of VOD Transaction is not end request state, re-analyze by adding message to start stack. Save the reanalyzed result to RSTP start information and check if RTSP start message analysis is completed. If analysis is completed, change VOD Transaction status to VOD start response and save. Otherwise, if RTSP start message analysis is not completed, the unresolved information is stored in the start stack of transaction, and the VOD transaction state is changed to VOD start request state and saved. If the status of the VOD Transaction is in the end request state, the message is added to the end request stack and re-analyzed. The reanalyzed result is added and saved in the relevant transaction information. When RTSP end message analysis is completed, the VOD transaction status is changed to the VOD start response state and stored. Otherwise, if RTSP start message analysis is not completed, the unresolved information is stored in the start stack of transaction, and the VOD transaction state is changed to VOD start request state and saved.

If it is a packet switch direction message and the RSTP end response message, the RSTP end response message is analyzed. If there is a transaction for RTSP end response message, it is added and stored in the relevant transaction information. When the analysis of the RSTP end response message is completed, a RDR (Row Data Record) is generated and transmitted to the billing segmentation information processing apparatus 130, and the VOD transaction and the VOD session are deleted. If the analysis is not completed, the relevant information is stored in the termination response stack, and the transaction state is changed to the termination response state. If it is not an RTSP end response message, check if it is an RTSP start response message. In case of RTSP start response message, RSTP start response message is analyzed and if transaction for RTSP start response message exists, it is additionally stored in the relevant transaction information. When the analysis of the RSTP start response message is completed, the VOD transaction status is changed to the service transmission state and stored. If the analysis is not completed, the information is stored in the start response stack, and the transaction state is changed to the start response state. If it is not RTSP start / end response message, check whether it is in end response status. In case of termination response status, RSTP message is added to termination response stack and re-analyzed. The reanalyzed result is stored in the corresponding transaction, and when the analysis of the RSTP termination response message is completed, a RDR (Row Data Record) is generated, transmitted to the billing segmentation information processing device 130, and the VOD Transaction and the VOD session are deleted. If the analysis is not completed, the relevant information is stored in the termination response stack, and the transaction state is changed to the termination response state. If the message is not in the end response state, add it to the RTSP start response stack and reanalyze it. After re-analyzed content is saved in the relevant transaction, if the result is analysis completion of RSTP start response message, VOD transaction status is changed to service transmission state. If the analysis is not completed, the information is stored in the start response stack, and the transaction state is changed to the start response state. If it is not RTSP start / end response message, check whether it is in end response status.

If the message is not a TCP packet, check if it is an RTCP message. In case of RTCP message, the contents are analyzed and the status transmitted to the terminal is checked and stored. If it is not an RTCP message, check if it is an RTP message. In case of an RTP message, the contents of the RTP are analyzed and the transmission status is confirmed and stored in the terminal.

While the invention has been described above in connection with the preferred embodiments mentioned above, it is possible to make various modifications or variations without departing from the spirit of the invention. Accordingly, the appended claims include such modifications and variations as fall within the spirit of the invention.

For example, the data receiving apparatus of the present invention has been illustrated and described as a portable terminal, but the present invention is not limited thereto, and can be applied to various communication terminals charged by packet data transmission amount in data communication such as wired terminal and wired / wireless LAN. Of course.

In addition, in the above embodiment has been illustrated and described the charging system, the present invention is not limited to this, it can be applied to a network having an IP address and a subscriber telephone number. That is, if only the IP address is known and the subscriber's telephone number is not known, the present invention can also be applied to find out call status information or log messages until the subscriber's telephone number can be recognized.

As described above, according to the present invention, therefore, the data transfer amount is calculated only for the data which has been confirmed that the transfer has been completed, so that unfair data charging can be prevented and the reliability of the data transfer amount is increased.

In addition, according to the present invention, it is possible to determine whether not only the transmitted data but also the transaction is completed, so that it is possible to provide the basic data capable of performing data charging reliably.

In addition, according to the present invention, the data copying apparatus includes two output units corresponding to two inputs, thereby solving the problem of data transmission capacity in the data collection step.

In addition, according to the present invention, in determining whether the data is to be calculated, by specifying the input direction of the data in the source or destination direction in advance, it is possible to determine whether the data is to be calculated by comparing only the IP of either the source or the destination. The efficiency of the system is improved.

Further, according to the present invention, in the final processing of the data, the TCP session is maintained until the FIN flag of the data transmitted in both directions and the packet of Acknowledgment Number for the FIN flag Sequence Number exists, and the FIN flag and TCP When data of the body is transmitted together, the processing of the data is processed before the FIN flag, thereby eliminating the problem that charging is performed on data that was not finally transmitted to the subscriber station or service provider.

Claims (14)

In the data transmission amount analysis system for calculating and analyzing the amount of data transmitted between the first and second data transceiver connected to the data communication network, A data copying unit which copies and outputs data transmitted between the first and second data transmitting and receiving apparatuses; A calculation analysis unit for calculating and / or analyzing a transmission amount of the data output by the data copy unit as transmission data in the direction of the first or second data transmission / reception apparatus; And Transmitting information indicating the start or end of the transmission amount calculation and / or analysis as information including identification information of the first and / or second data transmission / reception apparatus to be calculated and / or analyzed, to the calculation analysis unit; And an information processor configured to provide a predetermined external device with information about a transmission amount of data transmitted between the first and second data transceivers calculated and / or analyzed by the calculation analyzer. The calculation analysis unit, Among the data output from the data copying unit, the data transmitted from the first data transmitting and receiving device to the second data transmitting and receiving device includes source identification information included in the data and identification of the first data transmitting and receiving device. Compares only information or compares only destination identification information included in the data with identification information of the second data transmission / reception device, and compares data transmitted from the second data transmission / reception device to the first data transmission / reception device. The data is calculated by comparing only the source identification information included in the data with the identification information of the second data transceiver or the destination identification information included in the data and the identification information of the first data transceiver. To determine if it is the subject of analysis A discrimination unit; A data classifying unit classifying the data output by the data copying unit for each communication protocol of the data; And In the case where the data is a TCP / IP protocol, only the data that has been transmitted is determined as data that has been transmitted only for data whose Acknowledgment Number of the TCP header of the data to be calculated is equal to or larger than the sum of the corresponding Sequence Number and the data amount of the TCP body. Data transmission amount analysis system including a transmission completion determination unit. The method of claim 1, The data copy unit, A first output unit configured to copy and output data transmitted from the first data transceiver to the second data transceiver; And And a second output unit configured to copy and output data transmitted from the second data transceiver to the first data transceiver. The method of claim 1, And the calculation analyzer further comprises a data checksum unit for checking whether data errors have occurred by performing IP checksum of an IP header on the data output by the data copy unit. The method of claim 1, If the data is a TCP / IP protocol, the calculation analyzer may include a FIN flag in a TCP header of data transmitted in both the first and second data transceivers, and a packet of an Acknowledgment Number corresponding to the FIN flag Sequence Number. A data transfer analysis system that maintains a TCP session until it exists and processes the data before the FIN flag when the FIN flag and the TCP body data are transmitted together. The method of claim 1, The calculation analysis unit, And a transaction completion determination unit for determining whether the transaction between the first and second data transmission / reception apparatuses is completed with respect to the transmission data determined to have been transmitted by the transmission completion determination unit. The method of claim 5, The transaction completion determination unit, if the data is HTTP protocol, A request side memory configured to store data transmitted from a request side of the first and second data transceiving devices; And A response side memory for storing data transmitted from a response side of the first and second data transmission and reception apparatuses, And a data transfer amount analysis system for determining whether the transaction of both sides is completed by chronologically matching data of both sides stored in the requesting and response memory. The method of claim 5, The transaction completion determination unit, Data transmitted from the requesting side data transmitting / receiving apparatus in the same manner as information generated in the data transmitted from the response side data transmitting / receiving apparatus for identifying information that is a request from the requesting side data transmitting / receiving apparatus. Further comprising a transaction key generation unit for generating a transaction key with respect to, And comparing the transaction key generated by the transaction key generator with request-side identification information included in the data transmitted from the response-side data transceiver to determine whether the transaction on both sides is completed. In the data transmission amount analysis method for calculating and analyzing the amount of data transmitted between the first and second data transceiver connected to the data communication network, (1) receiving information indicating the start of the transmission amount calculation and / or analysis as information including identification information of the first and / or second data transmission / reception apparatus subject to calculation and / or analysis; (2) copying and outputting data transmitted between the first and second data transceiving devices; (3) calculating and / or analyzing a transmission amount of the data output by the data copying unit as transmission data in a direction of the first or second data transmission / reception apparatus; And (4) transmitting information on the amount of transmission calculated and / or analyzed in step (3) to an external device, Step (3), (5) Among the data output in the step (2), for the data transmitted from the first data transmission / reception apparatus to the second data transmission / reception apparatus, source identification information and the first data included in the data are included. Compares only identification information of the transceiver, or compares only identification information of the second data transceiver with destination identification information included in the data, from the second data transceiver to the first data transceiver; For the transmitted data, only the source identification information included in the data and the identification information of the second data transceiver are compared, or the destination identification information included in the data and the identification information of the first data transceiver are compared. Determining whether the data is subject to calculation and analysis; (6) classifying the data output in step (2) for each communication protocol of the data; And (7) When the data is a TCP / IP protocol, data that has been transmitted only for data that is equal to or larger than the sum of the corresponding sequence number and the data amount of the TCP body, in which the acknowledgment number of the TCP header of the data to be calculated is equal Steps to Determine Data throughput analysis method comprising a. The method of claim 8, In step (2), Data transmission amount analysis method in which data transmitted from the first data transceiver to the second data transceiver and data transmitted from the second data transceiver to the first data transceiver are copied and output through separate transmission lines, respectively . The method of claim 8, The step (3) further comprises the step of (8) performing an IP checksum of the IP header on the data output by the data copying unit to determine whether an error of the data has occurred. The method of claim 8, In step (3), if the data is a TCP / IP protocol, there is a FIN flag in the TCP header of the data transmitted in both the first and second data transceiving devices, and the Acknowledgment Number for the FIN flag Sequence Number is present. A method of analyzing a data transmission amount that maintains a TCP session until a packet exists and processes the data before the FIN flag when the FIN flag and the TCP body data are transmitted together. The method of claim 8, In the step (3), (9) a data transmission amount analysis method further comprising determining whether the transaction between the first and second data transmission / reception apparatuses is completed with respect to the transmission data determined to have been transmitted by the transmission completion determining unit; . The method of claim 12, In step (9), if the data is HTTP protocol, (10) storing data transmitted from a request side of the first and second data transceiving devices in a request side memory; And (11) storing data transmitted from a response side of the first and second data transmission / reception apparatuses in a response side memory, In the step (9), data transmission amount analysis method for determining whether the transaction of both sides is completed by correlating the data of both sides stored in the request-side and response-side memory in chronological order. The method of claim 12, Step (9), (12) From the requesting side data transmitting / receiving apparatus in the same manner as the information generated in the data transmitted from the responding side data transmitting / receiving apparatus to generate information for identifying the request from the requesting side data transmitting / receiving apparatus. Generating a transaction key for the transmitted data; In the step (9), by comparing the transaction key generated in the step (12) and the request side identification information included in the data transmitted from the response data transmitting and receiving apparatus, the amount of data transmission for determining whether the transaction of both sides is completed; Analytical Method.

Images