KR101522405B1 - Method and apparatus of deep packet inspection in access network - Google Patents

Abstract

The present invention discloses a method of a deep packet inspection and an access switch that works on the access network. A deep packet inspection method according to an embodiment of the invention includes the following steps: the step to receive policy data on the deep packet inspection decision from a network controller; the step to receive packet flows from a terminal connected with a core network through the access switch; the step to decide packets to be analyzed in depth out of the packet flows received based on the policy data; the step to transmit the packets to be analyzed to the deep packet inspection device; and the step to receive the analysis results on the packets from the deep packet inspection device.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to network communication, and more particularly, to a method and apparatus for deep packet inspection in an access network.

Deep packet inspection (DPI) is a technique used to coordinate network traffic. DPI can be checked not only for the header of the packet but also for the payload. Due to this feature, DPI is applied for various purposes such as QoS adjustment, performance optimization in network security device and WAN accelerator. By examining the payload of a packet, DPI can identify the type and intent of the traffic, which is very useful for blocking hacking detection and malicious codes at the network end. It can also be used to apply QoS by segmenting traffic types.

However, these DPIs require more resources and time because they inspect large amounts of data (i.e., headers and payloads). Therefore, there is a need for a technique capable of performing DPI while saving resources and time compared with the conventional technique.

A problem to be solved by the present invention is to provide a software defined network (SDN) based DPI device and method operating in an access network.

Another problem to be solved by the present invention is to provide a DPI apparatus and method that can reduce the traffic analysis capacity and reduce the implementation cost of the apparatus by screening the DPI target traffic.

In one aspect of the present invention, a method for inspecting an in-depth packet performed by an access switch according to an embodiment of the present invention includes receiving policy information regarding a packet determination for a deep packet inspection from a network controller, Receiving a packet flow from a terminal connected to a core network, determining a packet to be subjected to in-depth packet analysis among the packet flows based on the policy information, transmitting the object packet to a deep packet inspection device, And receiving an analysis result of the target packet from the packet inspection device.

The analysis result may include application code indicating the type of the target packet and flow control setting information of the target packet.

The flow control setting information may include a transmission priority of the target packet and a bandwidth range to be guaranteed in transmission of the target packet.

The application code may be determined based on information of a flow pattern DB provided in the deep packet inspection device.

The policy information may include information on a minimum required packet number for each type of traffic flow, and the target packet may be determined as the minimum required packet number.

The type of the traffic flow can be determined by the MAC address of the terminal obtained from the packet flow, the destination MAC address of the packet flow, and the input port information.

The deep packet inspection apparatus is an SDN controller (SDN controller) performing a network management / control function in a software defined network, and the access switch includes an SDN client providing a communication interface with the SDN controller can do.

The SDN client and the SDN controller may communicate using an open flow protocol.

In another aspect of the present invention, an access switch operating in an access network according to an embodiment of the present invention includes a packet receiving unit for receiving a packet flow from a terminal connectable to a network, a receiving unit for receiving the packet flow from the packet receiving unit, A packet classifying unit for selecting an object packet and requesting the deep packet inspection apparatus for analysis; a flow control unit for controlling the packet flow based on the analysis result of the deep packet inspection apparatus; And a packet transmission unit for transmitting the packet.

The DPI apparatus and method according to an embodiment of the present invention can perform analysis / metering / control of local traffic existing in an access network only in an access network, and it is easy to improve the accuracy of mapping between a subscriber line and a facility line. By utilizing the access switch function provided by SDN, the DPI function is distributed to the access switch and the SDN controller, and the low-level DPI access switch performs only the flow classification and control function provided by the device, and the traffic analysis and control decision Can be implemented in the SDN controller to reduce the implementation cost.

Through the interworking with SDN, it is possible to classify and control traffic of the entire range of L1 ~ L7, and it is possible to reliably transmit the traffic using the SDN protocol.

1 schematically illustrates a network structure including a DPI device operating in an access network according to an embodiment of the present invention.
2 is a block diagram schematically showing the structure of an access switch according to an embodiment of the present invention.
3 is a block diagram schematically illustrating the structure of an SDN controller according to an embodiment of the present invention.
4 is a message flow diagram illustrating a method for in-depth investigation of a packet flow according to an embodiment of the present invention.
5 is a message flow diagram illustrating a flow metering process in another embodiment of the present invention.
6 is a block diagram illustrating a configuration of a flow entry field generated by an access switch.
7 shows an example of the flow pattern DB configuration of the SDN controller.
8 shows an example of the QoS policy DB configuration of the SDN controller.
9 shows an example of the flow storage DB configuration of the SDN controller.

While the present invention has been described in connection with certain exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and similarities. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In addition, numerals (e.g., first, second, etc.) used in the description of the present invention are merely an identifier for distinguishing one component from another.

Also, in this specification, when an element is referred to as being "connected" or "connected" with another element, the element may be directly connected or directly connected to the other element, It should be understood that, unless an opposite description is present, it may be connected or connected via another element in the middle.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to facilitate a thorough understanding of the present invention, the same reference numerals are used for the same means regardless of the number of the drawings.

1 schematically illustrates a network structure including a DPI device operating in an access network according to an embodiment of the present invention.

In FIG. 1, the Internet terminal 10 is a network device having a network access interface through an access network, which is a device that allows a service user to access the Internet and receive related services. A set-top box, a laptop, a PC, and a smart phone terminal using internet services such as Internet, WEB, IPTV, VOIP, cloud, P2P, etc. If the device can access the network through the access network, It can be a user terminal mentioned in the embodiment. Hereinafter, for convenience of description, a specific type of terminal may be exemplified to describe an embodiment. However, unless otherwise stated, the present invention is not limited to the specific example of the terminal, It can also be applied to terminals.

The access switch 20 according to the embodiment of the present invention can perform flow creation and control as low as possible based on the ASIC in addition to performing the function as the access switch 20 of the existing access network, The flow analysis request, the metering telegram, and the flow control processing requested by the SDN controller 30 to the SDN controller 30.

The SDN controller 30 can perform a function of analyzing a packet flow that requires a high-grade, which is difficult to perform in the access switch 20. [ It is possible to distinguish the application attributes based on the analyzed information to determine whether there is harmful traffic or to determine the QoS control related policy, and thereby, the access switch 20 can be set. According to the embodiment, it is possible to determine whether the total amount is controlled based on the metering information collected for each flow. The SDN controller functions as a deep packet inspection device, and the functions of the SDN controller and the functions as a deep packet inspection device are made up of logically distinct entities. Hereinafter, the SDN controller means a network entity capable of performing both a function as an SDN controller and a function as a deep packet inspection device, unless otherwise specified.

1, the DPI function may be distributed to the access switch 20 and the SDN controller 30 and may be performed by cooperation of the access switch 20 and the SDN controller 30. [ Through the DPI analysis, it is possible to provide metering and control of total amount by internet service used by terminal, QoS provision for paid service such as IPTV / cloud / VOD, and harmful traffic control function in case of harmful traffic.

The flow classification and flow control functions are distributed at a low level by distributing the DPI function to the access switch 20 and the SDN controller 30 and the traffic analysis and control decisions requiring relatively high- (30), thereby enabling centralized and unified traffic control.

In the embodiment of the present invention, the flow analysis can be limited to necessary packets according to the basic type. The access switch 20 collects only the minimum packets for each flow type and provides them to the SDN controller 30, Can only collect metering information. The SDN controller 30 may perform flow analysis based on the packet provided by the access switch 20, and may perform harmful traffic blocking, QoS control, etc. according to the result. In addition, according to the embodiment, it is possible to calculate usage amount and total amount control for each service based on the metering information collected periodically. Hereinafter, the structure and signaling procedure of the access switch 20 for implementing the above-described method will be described in more detail with reference to the drawings.

2 is a block diagram schematically showing the structure of the access switch 20 according to the embodiment of the present invention.

The access switch 20 according to the embodiment of the present invention includes a packet receiving unit 21, a flow classification unit 22, a flow control unit 23, a packet transfer unit 24, and an SDN client 25.

The packet receiving unit 21 can receive the data packet from the terminal 10 and the SDN controller 30. [ And receives a data packet transmitted from the terminal 10 and a control message from the SDN controller 30 (for example, a configuration message such as an Operations, Administration and Maintenance (OAM) message and a QoS policy) To the flow classifying unit 22 so that flow classification can be performed.

The flow classifying unit 22 delivers the OAM message to the SDN client 25, and the data packet received from the terminal 10 determines whether the corresponding data packet is a new flow. If it is determined as a new flow, a flow entry may be created in the flow table and the packet may be collected to request deep packet analysis. If it is determined that the flow is an existing flow other than the new flow, only the metering information can be updated. That is, the flow classifying unit 22 determines whether the data packet received by the data packet is a new flow, and determines whether or not to request a DPI according to the result.

The flow control unit 23 updates reception information in the flow table of the harmful traffic interception, QoS setting, and total amount control OAM message transmitted from the SDN controller 30 to the SDN client 25, and the flow control unit 23 updates the flow table information Lt; RTI ID = 0.0 > a < / RTI > data packet.

The packet transmission unit 24 transmits a data packet and a control message (OAM message).

3 is a block diagram schematically illustrating the structure of an SDN controller 30 according to an embodiment of the present invention.

The SDN controller 30 according to the embodiment of the present invention includes an SDN server OAM receiving unit 31, a flow analyzing unit 32, a flow control policy managing unit 33, a flow information storing DB 34, an SDN server OAM transmitting unit 35, a flow pattern DB 36, a flow QoS DB 37, and a flow metering management unit 38. [

The SDN server OAM receiving section 31 receives the OAM message transmitted from the individual access switch 20 under the control of the SDN controller 30.

The flow analyzer 32 analyzes packets based on the information of the flow pattern DB 36 when the flow analysis request is received from the SDN client 25 to detect application attributes and determine codes.

The flow control policy management unit 33 determines whether to block harmful traffic and set QoS based on the application code determined by the flow analysis unit 32 and the flow QoS policy DB. The total amount control process may be further performed according to whether the total amount is determined by the flow metering management unit according to the embodiment.

The flow information DB 34 stores the flow control policy determined by the flow control policy management unit and the metering information transmitted from the metric management unit.

The SDN server OAM transmission unit 35 transmits an OAM message to the SDN client 25 connected thereto.

The flow pattern DB 36 can be set / updated by the administrator as a pattern information database for packet flow analysis.

The flow QoS DB 37 can be set / updated by the administrator as a QoS policy database for each application attribute.

4 is a message flow diagram illustrating a method for in-depth investigation of a packet flow according to an embodiment of the present invention.

The access switch 20 receives, from the SDN controller 30, necessary packet number setting information necessary for packet depth investigation for each packet type (S105). The access switch 20 determines a packet type for a packet received from the terminal 10 and determines whether to perform a new flow based on the number of packets according to the minimum required packet number setting information according to the packet type.

Thereafter, when a packet flow is generated from the terminal 10 and the access switch receives the packet flow (S107), it is determined whether the received packet flow is a new packet flow and a new flow is detected (S110). As explained in conjunction with the structure of the access switch 20, the depth packet inspection method according to the embodiment of the present invention does not perform deep packet inspection for all data packets, but performs deep packet inspection for new flows only, The target packet can be reduced.

When a new flow is detected, a flow entry is created (S120) and an analysis request packet is collected (S130). At this time, the collected analysis request packet refers to the minimum required packet number acquired in S105 and collects the minimum number of required packets.

When the collected analysis request packet is transmitted to the SDN controller 30 in step S135, the SDN controller 30 performs the flow analysis S140, the flow application code determination S150, the harmful traffic and QoS control decision S160, Management table storage (S170) may be performed.

The procedures of S150, S160, and S170 are operations of the SDN controller 30 according to the flow analysis performed by the SDN controller 30, and some of them may be omitted or related procedures may be added according to the embodiment. The flow analysis S140 may be a process of determining the type of a flow to be analyzed with reference to the flow pattern DB 36 as described above and determines a flow application code indicating the type of the flow according to the result )can do.

When the flow analysis is completed, the SDN controller 30 transmits a flow analysis result response to the access switch 20 (S175). The flow analysis result response may include the application code determined in S150 and the flow control setting information.

Upon receiving the flow analysis result, the access switch 20 sets the flow-and-tree application code (S180) and sets the flow entry control field (S190). The application code and the flow entry control field will be described in more detail below.

5 is a message flow diagram illustrating a flow metering process in another embodiment of the present invention.

The metering procedure of FIG. 5 may be performed in parallel with the in-depth packet inspection procedure for the new flow described in FIG. As described above, the metering procedure of FIG. 5 may be metered for all packets regardless of whether they are new flows, whereas the procedure of FIG. 4 is for a new flow.

When a packet flow is generated from the terminal 10 (S205) and the access switch 20 receives it, a flow entry is generated (S210). The flow entry may include start time information. The flow metering information may be updated according to the amount of packets transmitted from the terminal 10 (S220). The access switch 20 transmits the flow metering status to the SDN controller 30 (S225). The flow metering status delivery may be periodic or, in some embodiments, in response to a request from the SDN controller 30. In another embodiment, when the flow metering information updating process exceeds a predetermined threshold value, it may be transmitted to the SDN controller 30. At this time, a predetermined threshold value may be set according to the terminal 10. In the embodiment of the present invention, updating of the flow metering information is performed by the access switch 20, so that flow metering for each terminal 10 (per subscriber) is possible.

When the flow metering status is transmitted from the access switch 20, the SDN controller 30 determines whether the total amount is exceeded (S230). If the flow metering status is exceeded, the flow control setting information is transmitted to the access switch 20 (S232) do.

When the packet flow transmitted by the terminal 10 ends (S235), the access switch 20 updates the flow metering information (S240). The flow metering information may include information on an end time at which the packet flow has been completed by the terminal 10.

The access switch creates and stores a flow entry file (S250) and deletes the flow entry (S260). The flow entry file created in S250 is transferred to the SDN controller 30 (S265) and can be stored in the flow information storage DB 34 via the flow metering management unit of the SDN controller 30. [

6 is a block diagram illustrating the configuration of the flow entry field 600 generated by the access switch 20. As shown in FIG.

The flow entry field may include a classification field 610, a meter field 620, and an action field 630.

The type field 610 may include a source MAC address of the packet, that is, a MAC address of the terminal 10, a destination MAC address of the packet, and input port information. The in-depth packet inspection method according to the embodiment of the present invention is performed at the terminal of the access switch 20 adjacent to the terminal 10, so that the MAC address of the terminal 10 and the destination of the packet MAC address, and input port information.

The type field 610 may further include application code. The application code indicates the type of the flow as a code given by the SDN controller 30 for the new flow requested to conduct the deep packet inspection as described in Fig.

The Meter field 620 sets the result of metering the packet transmission amount of the UE 10 as its set value. The control field 630 stores information for QoS control for the flow, for example, priority, , Whether or not the flow is discarded, and the like.

7 to 9 show an example of the flow pattern DB 36, QoS policy DB, and flow storage DB configuration of the SDN controller 30, respectively.

In the flow pattern DB in FIG. 7, the minimum number of necessary packets to be used for the deep packet inspection is set according to the type of the flow, and the flow pattern and the application code corresponding to the pattern are set and stored. The SDN controller 30 can transmit the minimum required packet number setting information to the access switch 20 by referring to the flow pattern DB 36 in S105 of FIG. 4 as described above.

The QoS policy DB of FIG. 8 stores QoS setting values for each application code. That is, the priority information includes application code priority, a range of allowable bandwidth (minimum bandwidth, maximum bandwidth), and processing operation (for example, discarding or forwarding) of the packet. In the procedure of FIG. 4, when the SDN controller 30 assigns the application to the flow through the deep packet inspection, the QoS control for the flow can be performed based on the applied application code and the QoS policy DB.

Referring to FIG. 9, the flow storage DB may be mapped with the identification information of the access device, the input port, the identifier of the terminal 10, and the flow entry field of FIG.

Meanwhile, in implementing the embodiment of the present invention, the operation / function of each entity described above may be implemented in the form of a program command that can be executed through various electronic means for processing information, and may be recorded in a storage medium. The storage medium may include program instructions, data files, data structures, and the like, alone or in combination.

Program instructions to be recorded on the storage medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of software. Examples of storage media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, magneto-optical media and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. The above-mentioned medium may also be a transmission medium such as a light or metal wire, wave guide, etc., including a carrier wave for transmitting a signal designating a program command, a data structure and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as devices for processing information electronically using an interpreter or the like, for example, a high-level language code that can be executed by a computer.

The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

The above-described embodiments include examples of various aspects. While it is not possible to describe every possible combination for expressing various aspects, one of ordinary skill in the art will recognize that other combinations are possible. Accordingly, it is intended that the invention include all alternatives, modifications and variations that fall within the scope of the following claims.

Claims (14)

In a deep packet inspection method performed by an access switch,
Receiving policy information on a packet determination of a deep packet inspection from a network controller;
Receiving a packet flow from a terminal connected to the core network by the access switch;
Determining a packet to be analyzed for the deep packet analysis among the packet flows based on the policy information;
Transmitting the object packet to a deep packet inspection device; And
And receiving an analysis result of the target packet from the deep packet inspection device. The method according to claim 1,
Wherein the analysis result includes application code indicating a type of the target packet and flow control setting information of the target packet. 3. The method of claim 2,
Wherein the flow control setting information includes a transmission priority of the target packet and a bandwidth range to be guaranteed in transmission of the target packet. 3. The method of claim 2,
Wherein the application code is determined based on information of a flow pattern DB provided in the deep packet inspection device. The method according to claim 1,
Wherein the policy information includes minimum required packet number information for each type of traffic flow,
Wherein the number of the target packets is determined according to the minimum required number of packets. 6. The method of claim 5,
Wherein the type of the traffic flow is determined by the MAC address of the terminal obtained from the packet flow and the destination MAC address and input port information of the packet flow. The method according to claim 1,
The deep packet inspection device is an SDN controller that performs network management / control functions in a software defined network,
Wherein the access switch comprises an SDN client providing a communication interface with the SDN controller. 8. The method of claim 7,
Wherein the SDN client and the SDN controller communicate using an open flow protocol. A packet receiving unit for receiving a packet flow from a terminal connectable to a network;
A packet classifying unit for receiving the packet flow from the packet receiving unit, selecting a packet to be subjected to deep packet inspection and requesting the deep packet inspection apparatus for analysis;
A flow controller for controlling the packet flow based on an analysis result of the deep packet inspection device;
And a packet transfer unit for transferring the packet flow to the core network under the control of the flow control unit,
Wherein the analysis result of the deep packet inspection device includes application code indicating the type of the target packet and flow control setting information of the target packet
Access switch. delete 10. The method of claim 9,
Wherein the application code is determined based on information of a flow pattern DB provided in the deep packet inspection device. 10. The method of claim 9,
Wherein the deep packet inspection target packet is determined according to the packet flow type. 13. The method of claim 12,
Wherein the type of the packet flow is determined by a MAC address of the terminal and a destination MAC address and input port information of the packet flow. 13. The method of claim 12,
Wherein the deep packet inspection target packet is selected by the number of packets determined according to the type of the packet flow.

Images