KR20060024092A - Apparatus and method of charging data verification in ip network - Google Patents

Abstract

The present invention discloses an apparatus and method for verifying billing data in an IP (Internet Protocol) network.

According to an aspect of the present invention, there is provided a verification apparatus for verifying billing data according to traffic of an IP (Internet Protocol) network, comprising: a flow generator for generating a simplified flow based on a source IP address by collecting packets from the IP network; A plurality of flow processors analyzing statistical flows generated by the flow generator to generate statistical data for traffic analysis; A billing server that verifies statistical data generated by the plurality of flow processors and billing data collected for billing; And a management server providing information of the traffic user to the flow processor.

According to the present invention, by generating a simplified flow consisting of only the information necessary for the billing data verification for verification of the billing data without generating a burden on the server, by generating statistical data and verifying with the actual billing data, the basis for more accurate billing It is possible to secure customer trust by presenting

Flow, billing, statistical data

Description

Apparatus and method of charging data verification in IP network}

1 is a block diagram illustrating a structure of an apparatus for verifying billing data in an IP network according to an embodiment of the present invention.

FIG. 2 is a block diagram illustrating a detailed structure of the flow generator of FIG. 1.

3 is a block diagram showing the structure of a general net flow datagram.

4 is a block diagram illustrating a net flow datagram structure according to an embodiment of the present invention.

5 is a block diagram showing a detailed structure of the flow processor of FIG.

FIG. 6 is a block diagram illustrating a data structure used by the flow processor of FIG. 5.

7 is a flowchart illustrating an operation of verifying billing data in an IP network according to an embodiment of the present invention.

The present invention relates to an apparatus and method for verifying billing data in an IP (Internet Protocol) network, and more particularly, to billing data verification in an IP network for verifying billing data using IP flow-based traffic analysis.

A flow represents a set of packets with the same characteristics and is unidirectional. Among them, Netflow, which is used mainly in the industry and is also referred to standardization organizations such as the Internet Engineering Task Force (IETF), is developed and used by Cisco.

This net flow basically has seven main fields: source IP, destination IP, application port number, IP protocol service type, and autonomous system (AS) number.

The above-mentioned net flow technologies are being standardized by organizations such as the IETF, and the main areas of use are Internet traffic analysis and design, billing, and security.

However, the net flow technology is based on a large-capacity server to analyze a single circuit as the Internet line becomes high speed and broadband, and various information processing technologies such as real-time data, high-speed processing, data compression technology, distributed processing technology, and data mining technology are used. Can be used at the same time can be used, there is a costly problem for this.

In addition, in a router or switch that is a device that generates net flow, the target hel may activate the entire net flow generation function for a circuit, and may not operate the function of forwarding a packet that is a function of the device itself, or may place a heavy load on the device. In other words, due to the use of one thousandths and one hundredths of sampling, the validity of billing data is weak.                         

Therefore, in the field of lossless data such as billing rather than actual traffic analysis, there is a problem in that traffic analysis is performed by separately attaching an external device such as PROOF.

In order to solve the above problem, the present invention compares the billing information with a simplified self-flow generator and a processor that processes flows collected by the flow generator, thereby verifying that the billing information for each user is justified. The purpose is to provide an apparatus and method for verifying billing data in a network.

Charging data verification apparatus in the IP network according to one feature of the present invention,

An apparatus for verifying billing data according to traffic of an Internet Protocol (IP) network, comprising: a flow generator for collecting a packet from the IP network and generating a simplified flow based on a source IP address; A plurality of flow processors analyzing statistical flows generated by the flow generator to generate statistical data for traffic analysis; A billing server that verifies statistical data generated by the plurality of flow processors and billing data collected for billing; And a management server providing information of the traffic user to the flow processor.

At this time, the flow generator, a packet collecting unit for collecting the packet in the IP network, and separating and storing only the header of the collected packet; A buffer for temporarily storing a header of a packet separated by the packet collecting unit; A sampling unit generating a simplified flow based on a source IP address using a header of a packet stored in the buffer; A flow generating unit for storing the flow information generated by the sampling unit and monitoring whether the corresponding flow is terminated and transmitting the terminated flow to the flow processor; And a flow transmitter for transmitting the flow transmitted from the flow generator to the flow processor.

In this case, the flow includes: the total number of packets and the number of bytes of the traffic; A start time and an end time at which the flow begins; Destination port information and IP protocol information of the traffic; A TCP (Transmission Control Protocol) flag for determining whether an error of the traffic occurs; And management code for storing code for flow management.

The flow generator may include a flow pool configured to store flow information generated by the sampling unit; A flow termination monitoring module configured to monitor a plurality of flows stored in the flow pool, determine a terminated flow, and transmit the terminated flow to the flow transmitter; And an IP pool that stores IP address information of the flow.

The flow processor may further include a buffer configured to temporarily store flows transmitted from the plurality of flow generators; A filtering unit which checks the flow stored in the buffer and filters the overlapping or error-producing flow; An ID processing unit for adding ID information provided from the management server to the flow using source IP information of the flow filtered by the filtering unit; A statistics processing unit for generating and storing traffic statistics data for the flow by using the flow in which ID information is additionally stored by the ID processing unit; A database storing the statistical data generated by the statistical processor in a table; And an interlocking unit providing ID information to the ID processing unit through interworking with the charging server and the management server, and receiving and transmitting statistical data from the statistical processing unit according to a request from the charging server.

The flow processor may include a generator manager configured to manage the plurality of flow generators; And an ID / IP management unit configured to periodically interwork with the management server and the management server through the interworking unit to present ID information in real time, and to present a dynamic IP in real time.

The statistical data stored in the database may include ID information of a user who generates the flow; Total packets and total octets of the flow; Each number of protocol IDs included in the flow; Start time and end time of the flow; Each number of destination IDs included in the flow; And number information of the flow and actual IP information of the user ID.

According to one feature of the invention the charging data verification method in the IP network,

A verification method for verifying billing data according to traffic on an Internet Protocol (IP) network, the verification method comprising: (a) collecting packets of the IP network and temporarily storing only headers of the corresponding packets; (b) generating and storing a simplified flow based on a source IP address using the header of the temporarily stored packet; (c) generating statistical data using the generated flow; and (d) receiving a signal requesting traffic verification and providing the statistical data to perform a comparison with billing data. .                     

In this case, storing the generated flow may include determining whether a flow having the same source IP address already exists using the source IP address of the generated flow; And if there is a flow having the same source IP address as the determination result, updating only the parameters of the flow.

If there is no flow having the same source IP address as a result of the determination, the method further includes adding and storing the flow as a new flow entry.

Parameters of the flow include the number of packets and bytes included in the flow, a destination IP, and a protocol ID.

The statistical data of step (c) may include ID information of a user who generates the flow; Total packets and total octets of the flow; Each number of protocol IDs included in the flow; Start time and end time of the flow; Each number of destination IDs included in the flow; And number information of the flow and actual IP information of the user ID.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the accompanying drawings, parts irrelevant to the description of the present invention are omitted in order to clearly describe the present invention, and the same or similar parts are denoted by the same reference numerals.

1 is a block diagram illustrating a structure of an apparatus for verifying billing data in an IP network according to an embodiment of the present invention.

Referring to Figure 1, connected to the optical splitter 120 for copying and distributing packets from the router 110 for the traffic analysis of the IP network 100 to perform the traffic analysis to generate the billing data, the billing data to verify The verification apparatus includes a flow generator 200, a flow processor 300, a charging server 400, and a management server 500.

The router 110 performs forwarding of packets transmitted and received on the IP network 100, and the optical splitter 120 physically copies and distributes the packets transmitted and received through the optical line.

The flow generator 200 generates a packet collected from the optical splitter 120 as a flow, and the flow processor 300 generates information related to billing using the flow generated by the flow generator 200.

The billing server 400 stores and manages billing data and authentication information for the user, and the management server 500 stores and manages user information.

Referring to the billing data verification device according to an embodiment of the present invention in more detail as follows.

2 is a block diagram showing a detailed structure of the flow generator 200 of FIG.

Referring to FIG. 2, the flow generator 200 includes a packet collector 210, a buffer 220, a sampling unit 230, a flow generator 240, and a flow transmitter 250.

In addition, the flow generator 240 includes a flow pool 241, a flow end monitoring module 242, and an IP pool 243.                     

The packet collector 210 collects the packets distributed by the optical splitter 120, cuts the header of the IP packet, and stores the header in the buffer 220.

The buffer 220 has a memory and temporarily stores a header of a packet stored by the packet collector 210.

In addition, the sampling unit 230 transforms the header information stored in the buffer 220 into a flow form and stores the result in the flow generating unit 240.

At this time, the flow generated by the sampling unit 230 is data having a different form from the net flow.

The flow pool 240 of the flow generator 240 stores the flow information, and the flow end monitoring module 242 monitors the state of the flow pool 241 and transmits the terminated flow to the flow transmitter 250. And, it is responsible for transmitting the result to the flow processor 300 using the Transmission Control Protocol (TCP) protocol and the error flow processing function.

In addition, the IP pool 243 stores an IP address such as a source IP address stored in the flow information, and allows the flow end monitoring module 242 to determine whether an error flow occurs.

The flow transmitter 250 transmits the generated flow to the flow processor 300 in real time using a TCP socket.

Referring to the operation of the flow generator 200 having the above structure in detail as follows.                     

First, the packet collector 210 collects packets distributed by the optical splitter 120 and stores the headers of the collected packets in the buffer 220.

The sampling unit 230 generates a flow using the header of the packet stored in the buffer 220. The generated flows are created according to source IP addresses, and packets having the same source IP address are generated with the same flow to store the number of packets and the octet number. In addition, destination port and protocol ID information of a packet having the same source IP address are also stored in the flow.

Information of the generated flow is stored in the flow pool 241 of the flow generator 240.

When generating a flow using headers of packets collected thereafter, it is determined whether a flow having the same source IP address is stored in the flow pool 241, and if there is a flow having the same information, the corresponding flow information Update the number of packets and octets in the header and add new protocol ID and destination port if present.

If there is no flow having the same source IP address, new flow information is generated and added to the flow pool 241.

If there is a flow having the same source IP address, and there is a TCP flag indicating that the packet is the last packet, the flow recognizes that the flow is terminated and transmits the flow to the flow processor 300 through the flow transmitter 250.

At this time, the flow termination monitoring module 242 checks the completed flow and delivers the flow to the flow transmitter 250.                     

The flow end monitoring module 242 recognizes the end of the flow as described above when the TCP header indicating that the packet is the last packet is present in the packet header information, and when the flow is first generated and started to be stored. This is the case when the flow time, which is a difference from the time of updating, passes the predetermined flow storage time.

In addition, when the flow pool 241 is full and no more flows can be stored, the flow end monitoring module 242 transfers the generated flows to the flow transmitter 250 from the oldest flow.

If the source IP address is not in the IP pool 243 in the flow information, the flow is terminated and the terminated flow is processed according to the error processing flag of the flow.

That is, when the error processing flag is '0', the result is terminated and the flow is transmitted to the flow transmitter 250 by setting the error bit to '01' in the management code which is the last field of the flow. At this time, the transmitted flow is filled with source IP address, destination IP address, source port, destination port, protocol ID, TCP flag, start time and end time.

In addition, when the error processing flag is '1', the error bit is set to '10' and only the source IP is loaded in the corresponding flow and transmitted to the flow transmitter 250.

If the error processing flag is '2', the flow is not transmitted and the flow information is stored locally. If the error processing flag is '3', the flow is not transmitted and the flow information is not stored.                     

As described above, the flow transmitted by the flow end monitoring module 242 is received by the flow transmitter 250 and transmitted to the flow processor 300 in real time using a TCP socket.

As mentioned above, the flow generated by the flow generator 200 has a different form from the general net flow, and the difference is as follows.

3 is a block diagram showing the structure of a typical netflow datagram.

Referring to FIG. 3, a general netflow datagram includes an IP address of a source, an IP address of a destination, an IP address of a next hop, an input interface index, an output interface index and a packet, and byte information, and a start time at which a flow is generated. Includes flow end time, source port, destination port, payload and TCP flags, IP protocol, type of service (TOS), source AS (autonomous system), destination AS, source netmask length, and destination netmask length.

The structure of a flow datagram according to a feature of the present invention having a form different from the above described netflow is as follows.

4 is a block diagram illustrating a flow datagram structure according to an exemplary embodiment of the present invention.

Referring to FIG. 4, a flow datagram according to an embodiment of the present invention includes a source IP address, a packet, a byte, a flow start time and end time, a destination port, a TCP flag, an IP protocol, and a management code.

Accordingly, as can be seen by comparing FIG. 3 and FIG. 4, the flow according to an embodiment of the present invention is simplified to store the lossless packet and compare the result with the charging information in order to verify whether the charging information is actually correct. It was.

The reason for the simplification is that the charge is used as the data for the destination IP, and the source port refers to the logical port of the customer's PC as the logical port of the source, so it does not mean much to the customer receiving the service. .

In addition, since the next hop IP address represents the next hop IP address of the router, it is not necessary to verify the charging information, and the input / output port index is not related to the charging information.

Therefore, generating a simplified flow as shown in FIG. 4 by omitting a field that is not associated with billing information reduces the amount of data occupied by the flow, thereby reducing the amount of devices or processes operating for generating the flow, thereby reducing load and increasing efficiency. Can bring

Next, the process of verifying billing data by processing the generated flow will be described.

5 is a block diagram illustrating a detailed structure of the flow processor 300 of FIG. 1.

Referring to FIG. 5, a flow processor 300 for processing flows transmitted from a plurality of flow generators 200 includes a generator manager 310, an ID / IP manager 320, a database 330, a buffer 340, The filtering unit 350, the ID processing unit 360, the statistical processing unit 370, and the linking unit 380 are included.

The generator manager 310 collectively distributes the IP pool 243 which is maintained in real time and manages the parameters used in each of the plurality of flow generators 200 accommodated by one flow processor 300. Function

In addition, the ID / IP management unit 320 interoperates with the management server 500 that manages the subscribers in real time to present the ID information in real time, and in real time the dynamic IP used in conjunction with a DHCP (Dynamic Host Configuration Protocol) server. It plays a role of presentization.

In addition, the database 330 stores processing information of the flow.

The buffer 30 temporarily stores the flows received from the plurality of flow generators 200, and the filtering unit 350 reads one flow information from the buffer 340 to display an error bit, an incorrect IP address, or a duplicate IP. It is responsible for filtering flows with addresses.

The ID processing unit 360 retrieves the IP corresponding to the IP address of the flow from the ID / IP management unit 320 and attaches the flow to the flow, and the statistical processing unit 370 performs time per ID to generate information on the charging. Packet daily / day / week / month / year is generated by the table and stored in the database 330.

At this time, the format of the generated statistical data will be described in detail with reference to FIG. 6.

And the interlocking unit 380 is interlocked with the billing server 400 and the management server 500, receives the subscriber's unique ID information from the management server 500, the billing server 400 receives the billing information used by the subscriber Received from the charging server (400).

FIG. 6 is a block diagram illustrating a data structure used by the flow processor 300 of FIG. 5.

Referring to FIG. 6, statistical data includes ID, total packets, total octets, protocol IDs (prolD1 to prolDn, prolETC), start time, end time, total use time, and destination port (dstProt1 ~). dstPort n, dstPortETC), number of flows, and actual IP (srclP1 to srlPn).

ID is a subscriber-specific ID received by the interlocking unit 380 in conjunction with the billing server 400 and the management server 500, and the total packet is the total packet usage used by the subscriber for hour / day / week / month / year. The collected data values.

The total octet is the value of the octet of the data used by the subscriber, the protocol ID is the protocol ID used by the subscriber, and values other than the protocol registered for management are counted and stored in ProlETC.

In addition, the destination port is a logical port value of the destination used by the subscriber, means a service used by the user, and dstPortETC is stored by counting the number other than the destination or service registered for management.

The start time is the time when the subscriber started the service for hour / day / week / month / year, and the end time is the time when the subscriber finished the service.

The number of flows is the number of flows used by the user during the corresponding period, which corresponds to the number of IPs assigned to each user by the DHCP server.

The real IP is the real IP used during the period and exists only in the statistics table.                     

When a request for whether the billing information for each ID is matched based on the basic statistical information, the processing information of the flow information for each period is transmitted to be used as a comparison data.

7 is a flowchart illustrating an operation of verifying billing data in an IP network according to an embodiment of the present invention.

Referring to FIG. 7, in order to verify billing data, first, when the optical splitter 120 distributes a packet (S701), the packet collecting unit 210 of the flow generating unit 200 collects the distributed packet to detect only the header. Stored in the buffer 220 (S702, S703).

In the stored packet, the sampling unit 230 generates a flow in the format of a flow form as shown in FIG. 4 using the header information (S704 and S705).

The generated flow is stored in the flow pool 241, and before it is stored, it is first determined whether a flow having the same source IP address as the flow is already stored in the flow pool 241 (S406), and the same source IP If there is a flow having an address, the parameter is updated in the flow (S708).

In this case, as described in the description of FIG. 2, the updating parameter updates the number of packets and octets and adds a new protocol ID and a destination port if present.

In addition, if there is no flow having the same source IP address in step S706, it is recognized as a new flow and an entry for the flow is added to the flow pool 241 and stored (S707).

In addition, when the flow end monitoring module 242 indicates that the TCP flag is the last packet with respect to the generated flow (S709), the flow is sent to the flow transmitter 250 to be transmitted to the flow processor 300 (S709). S710).

If it is not the last packet in step S709, the process of generating and storing the packet stored in the buffer 220 as a flow is repeated (S704 to S708).

Meanwhile, the flow transmitted to the flow processor 300 is stored in the buffer 340 (S711), and the filtering unit 350 filters out an error bit checked or an error IP address among the flows stored in the buffer 340. (S712).

Next, the ID / IP management unit 320 finds ID information according to the source IP address of the flow, adds ID information to the flow (S713), stores the flow in the database 330 (S714), and the statistics processing unit 370 ) Generates a statistical data table related to billing using the flow (S715).

The statistical data generated as described above is stored as a table in the database 330, and provides the statistical data to the billing server 400 when a verification request is made through linkage with the billing server 400 through the linking unit 380. .

The drawings and detailed description of the invention are merely exemplary of the invention, which are used for the purpose of illustrating the invention only and are not intended to limit the scope of the invention as defined in the appended claims or claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, the billing data verification apparatus and method in the IP network according to the present invention generates a simplified flow consisting of only the information necessary for billing for verification of billing data, without burdening the server, and provides statistical data By generating it, it is effective to provide a basis for more accurate charging through verification with actual charging data.

Claims (12)

In the verification device for verifying the billing data according to traffic of the IP (Internet Protocol) network, A flow generator for collecting a packet from the IP network and generating a simplified flow based on a source IP address; A plurality of flow processors analyzing statistical flows generated by the flow generator to generate statistical data for traffic analysis; A billing server that verifies statistical data generated by the plurality of flow processors and billing data collected for billing; And Management server for providing information of traffic users to the flow processor Charging data verification apparatus in the IP network including a. The method of claim 1, The flow generator, A packet collector which collects packets from the IP network and separates and stores only headers of the collected packets; A buffer for temporarily storing a header of a packet separated by the packet collecting unit; A sampling unit generating a simplified flow based on a source IP address using a header of a packet stored in the buffer; A flow generating unit for storing the flow information generated by the sampling unit and monitoring whether the corresponding flow is terminated and transmitting the terminated flow to the flow processor; And A flow transmitter for transmitting the flow transmitted from the flow generator to the flow processor Charging data verification apparatus in the IP network including a. The method of claim 1, The flow is, Total packet count and byte count of the traffic; A start time and an end time at which the flow begins; Destination port information and IP protocol information of the traffic; A TCP (Transmission Control Protocol) flag for determining whether an error of the traffic occurs; And Managed code to store code for flow management Charging data verification apparatus in the IP network including a. The method of claim 2, The flow generating unit, A flow pool for storing flow information generated by the sampling unit; A flow termination monitoring module configured to monitor a plurality of flows stored in the flow pool, determine a terminated flow, and transmit the terminated flow to the flow transmitter; And IP pool storing IP address information of the flow Charging data verification apparatus in the IP network including a. The method of claim 1, The flow processor, A buffer for temporarily storing flows transmitted from the plurality of flow generators; A filtering unit which checks the flow stored in the buffer and filters the overlapping or error-producing flow; An ID processing unit for adding ID information provided from the management server to the flow using source IP information of the flow filtered by the filtering unit; A statistics processing unit for generating and storing traffic statistics data for the flow by using the flow in which ID information is additionally stored by the ID processing unit; A database storing the statistical data generated by the statistical processor in a table; And The interlocking unit provides ID information to the ID processing unit through interworking with the charging server and the management server, and receives and transmits statistical data according to a request from the charging server from the statistical processing unit. Charging data verification apparatus in the IP network including a. The method of claim 5, The flow processor, A generator manager for managing the plurality of flow generators; And ID / IP management unit which performs the role of presenting ID information in real time and real-time dynamic IP in real time by periodically interworking with the management unit and the interworking unit. Charging data verification apparatus in the IP network further comprising a. The method of claim 5, Statistical data stored in the database, ID information of the user generating the flow; Total packets and total octets of the flow; Each number of protocol IDs included in the flow; Start time and end time of the flow; Each number of destination IDs included in the flow; And Number information of the flow and actual IP information of the user ID Charging data verification apparatus in the IP network including a. In the verification method for verifying billing data according to traffic of an IP (Internet Protocol) network, (a) collecting packets of the IP network and temporarily storing only headers of the corresponding packets; (b) generating and storing a simplified flow based on a source IP address using the header of the temporarily stored packet; (c) generating statistical data using the generated flow: and (d) receiving a signal requiring traffic verification and providing said statistical data to perform a comparison with billing data; Charging data verification method in the IP network including a. The method of claim 8, In step (b), Storing the generated flow, Determining whether there is already a flow having the same source IP address using the source IP address of the generated flow; And If there is a flow having the same source IP address as the result of the determination, updating only the parameters of the flow Charging data verification method in the IP network including a. The method of claim 9, If there is no flow having the same source IP address as a result of the determination, the method of verifying billing data in the IP network further comprising adding and storing the flow as a new flow entry. The method of claim 10, The parameter of the flow is Billing data verification method in the IP network including the number of packets and bytes, the destination IP, the protocol ID included in the flow. The method of claim 8, Statistical data of step (c), ID information of the user generating the flow; Total packets and total octets of the flow; Each number of protocol IDs included in the flow; Start time and end time of the flow; Each number of destination IDs included in the flow; And Number information of the flow and actual IP information of the user ID Charging data verification method in the IP network including a.

Images