RU2789815C2 - Systems and methods for network segmentation - Google Patents

Abstract

FIELD: communication.

SUBSTANCE: network segmentators receive messages with a request for creation and select network segments based on policies, indicate to the following transit router that it has smaller cost of routing for reception of messages, and check received messages to identify messages with the request for creation, indicate to DNS server that it has a higher priority than other network elements, and receive messages with the request for creation based on a higher priority. New messages with the request for creation are sent to selected network segments based on received messages with the request for creation. A network creates and sends suitable response messages to the request for creation to establish future connection to the selected network segment.

EFFECT: provision to wireless network operators of a possibility of segmentation of a base network.

15 cl, 11 dwg

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to U.S. Provisional Application No. 62/645484, filed March 20, 2018, entitled "Systems and Methods for Non-Intrusive Network Slicing", which is incorporated herein by reference in its entirety.

FIELD OF TECHNOLOGY

[0002] The present disclosure relates generally to traffic routing in mobile communication networks, and in particular to systems and methods for routing traffic using network segmentation techniques.

BACKGROUND OF THE INVENTION

[0003] Some wireless carriers have deployed applications known as GTP proxy functions. The GTP intermediary typically functions as an intermediate node between different mobile network operators (MNOs) and is used for interoperability. As an example, a GTP intermediary can be considered an entry point for carrier users who are roaming on other networks. The roaming network will send all GTP related traffic, signaling and user plane to the home GTP proxy; from the roaming network, the GTP proxy is considered to be the selected GGSN or PGW. The GTP proxy terminates this roaming traffic and subsequently proxies the traffic to the real GGSN or PGW. In this mode of operation, the GTP proxy hides the topology of the real (real) GGSN/PGW, it may as well perform other functions to change and enforce the traffic associated with the GTP. As the name suggests, the GTP proxy always remains an intermediary throughout the duration of a UE session; for example, all UE session traffic goes through the GTP proxy.

SUMMARY OF THE INVENTION

[0004] In some embodiments, the method includes receiving, at a network segmenter in a network system, a first message from a first network node of the network system; determining, with the network segmenter, a destination address (destination address) from the first message; determining, with the network segmenter, whether the message type of the first message is a predetermined message type; routing the first message to a second network node of the network system associated with the destination address if the determined message type of the first message is not a predetermined message type; and if the determined message type of the first message is a predetermined message type: determining the destination type from the first message, selecting, by the network segmenter, a second destination address for the first message based on one or more of the network segmenter policy or foreign policy, wherein the second item destination is associated with a third network node of the network system whose destination type is the same as a certain destination type, using the network segmenter to generate a new message of the predetermined type including the second destination address, and to route the new message of the predetermined type to the third network node network system associated with the second destination address.

[0005] In some embodiments, the predefined message type is a create request message.

[0006] In some embodiments, the first node is one or more of a Mobility Management Entity (MME), a Serving General Packet Radio Service (GPRS) Support Node (SGSN), a Serving Gateway (SGW), an Enhanced Packet Data Gateway (ePDG), or a trusted WLAN.

[0007] In some embodiments, the specific destination type comprises a General Packet Radio Service (GPRS) Gateway Support Node (GGSN), a Serving Gateway (SGW), or a Packet Switched Network Gateway (PGW).

[0008] In some embodiments, selecting the second destination address for the first message based on one or more of the network segmenter policy or foreign policy comprises: determining, by the network segmenter, one or more of the user equipment (UE) bandwidth level associated with the first the message, the enterprise associated with the UE associated with the first message, the traffic rate of the UE associated with the first message, the security level or requirement of the UE associated with the first message, or the employee status of the owner of the UE associated with the first message; and selecting, with the network segmenter, a second destination associated with one or more of the UE's bandwidth level, the UE's enterprise, the UE's traffic rate, the UE's security level or requirement, or the UE owner's employee status, from the plurality of second destinations.

[0009] In some embodiments, selecting a second destination address for the first message based on one or more of the network segmenter policy or foreign policy comprises determining one or more of the user equipment IMSI associated with the first message, the location of the user equipment associated with the first message, an access point name (APN) associated with the first message, an IMEI of the user equipment associated with the first message, a radio access technology type associated with the first message, or a timestamp of the first message.

[0010] In some embodiments, the implementation of the method further includes receiving using the network segmenter response message from the third network node; and using the network segmenter to generate a new response message including: a destination address associated with the second network node as the source address of the new response message and an indication of the second destination address associated with the third network node in the message content of the new response message.

[0011] In some embodiments, the method further includes storing in the network segmenter one or more of an address associated with the first network node or a destination address before receiving a response message from the third network node; and deleting by the network segmenter the stored one or more of the address associated with the first network node or the destination address after generating a new response message.

[0012] In some embodiments, the method further includes, using the network segmenter, indicating to the next hop router that the router associated with the network segmenter has a lower cost of routing to the second network node than the estimated cost of routing from other routers in the network system to the second network node, before receiving the first message, where the lower cost of routing to the second network node is less than the actual cost of routing to the second network node.

[0013] In some embodiments, the method includes receiving, at a network segmenter in a network system, a create request message from a first network node, wherein the create request message contains an address associated with the network segmenter as the first destination address; determining the destination type from the create request message; selecting, by the network segmenter, a second destination address for the creation request message based on one or more of the network segmenter policy or foreign policy, wherein the destination is associated with a second network node of the network system whose destination type matches the determined destination type; generating, with the network segmenter, a new create request message including a second destination address and a message content from the create request message; and routing the new create request message to a second network node of the network system associated with the second destination address.

[0014] In some embodiments, the implementation of the method further includes receiving using the network segmenter response message from the second network node; and generating, by the network segmenter, a new response message including the address associated with the second network node in the message content of the new response message and the address associated with the network segmenter as the source address.

[0015] In some embodiments, the method further includes storing in the network segmenter one or more of an address associated with the first network node or a second destination address before receiving a response message from the second network node; and deleting by the network segmenter the stored one or more of the address associated with the first network node or the second destination address after generating a new response message.

[0016] In some embodiments, the first node is one or more of a Mobility Management Entity (MME), a Serving General Packet Radio Service (GPRS) Support Node (SGSN), a Serving Gateway (SGW), an Enhanced Packet Data Gateway (ePDG), or a trusted WLAN.

[0017] In some embodiments, the particular destination type comprises a General Packet Radio Service (GPRS) Gateway Support Node (GGSN), a Serving Gateway (SGW), or a Packet Switched Network Gateway (PGW).

[0018] In some embodiments, selecting a second destination address for a create request message based on one or more of a network segmenter policy or a foreign policy comprises: determining, with the network segmenter, one or more of the user equipment (UE) bandwidth level associated with the first message, the enterprise associated with the UE associated with the first message, the traffic rate of the UE associated with the first message, the security level or requirement of the UE associated with the first message, or the employee status of the owner of the UE associated with the first message, and selecting, by the network segmenter, a second destination address associated with one or more of the UE's bandwidth level, the UE's enterprise, the UE's traffic rate, the UE's security level or requirement, or the UE owner's employee status, from the plurality of second destinations.

[0019] In some embodiments, the method further includes indicating to the domain name system in the network system that the address associated with the network segmenter has a higher priority than at least the second network node before receiving the create request message.

[0020] In some embodiments, a network segmenter in a network system includes: a processor; and an information carrier containing instructions that cause the processor to perform the following steps: receive, at a network segmenter in the network system, a first message from a first network node of the network system; determine the destination address from the first message using the network segmenter; determine with the network segmenter whether the message type of the first message is a predetermined message type; route the first message to a second network node of the network system associated with the destination address if the determined message point type of the first message is not a predetermined message type; and if the determined message type of the first message is a predetermined message type: determine the destination type from the first message, select with the network segmenter a second destination address for the first message based on one or more of the network segmenter policy or foreign policy, with the second item destination is associated with a third network node of the network system, whose destination type is the same as a certain destination type, create a new message of predetermined type including the second destination address using the network segmenter, and route the new message of predetermined type to the third network node network system associated with the second destination address.

[0021] In some embodiments, the predefined message type is a create request message.

[0022] In some embodiments, the first node is one or more of a Mobility Management Entity (MME), a Serving General Packet Radio Service (GPRS) Support Node (SGSN), a Serving Gateway (SGW), an Enhanced Packet Data Gateway (ePDG), or a trusted WLAN.

[0023] In some embodiments, a certain type of destination contains a locking unit of support for the general package radio broadcasting service (GPRS) (GGSN), serving a gateway (SGW) or a gateway of a network of packages (PGW).

[0024] In some embodiments, the selection of the second destination address for the first message based on one or more of the network segmenter policy or foreign policy comprises causing the processor to determine, using the network segmenter, one or more of the throughput level of the user equipment (UE) associated with the first message, the enterprise associated with the UE associated with the first message, the traffic rate of the UE associated with the first message, the security level or requirement of the UE associated with the first message, or the employee status of the owner of the UE associated with the first message, and select, with the network segmenter, a second destination address associated with one or more of the UE's bandwidth level, the UE's enterprise, the UE's traffic rate, the UE's security level or requirement, or the UE owner's employee status, from the plurality of second destinations.

[0025] In some embodiments, selecting a second destination address for the first message based on one or more of the network segmenter policy or foreign policy comprises determining one or more of the user equipment IMSI associated with the first message, the location of the user equipment associated with the first message, the access point name (APN) associated with the first message, the IMEI of the user equipment associated with the first message, the type of radio access technology associated with the first message, or the timestamp of the first message.

[0026] In some embodiments, the processor is further caused to: receive, with a network segmenter, a response message from a third network node; and create a new response message using the network segmenter, including: the destination address associated with the second network node as the source address of the new response message and an indication of the second destination address associated with the third network node in the message content of the new response message.

[0027] In some embodiments, the processor is further caused to: store in the network segmenter one or more of the address associated with the first network node or the destination address before receiving a response message from the third network node; and delete with the network segmenter the stored one or more of the address associated with the first network node or the destination address after generating a new response message.

[0028] In some embodiments, the processor is further prompted to indicate by the network segmenter to the next hop router that the router associated with the network segmenter has a lower cost of routing to the second network node than the estimated cost of routing from other routers in the network system to the second network node , before receiving the first message, where the smaller cost of routing to the second network node is less than the actual cost of routing to the second network node.

[0029] In some embodiments, a network segmenter in a network system includes: a processor; and an information carrier with instructions contained therein, which cause the processor to perform the following steps: receive, at a network segmenter in a network system, a create request message from a first network node, wherein the create request message contains an address associated with the network segmenter as the first address appointments; determine the destination type from the create request message; using the network segmenter to select a second destination address for the creation request message based on one or more of the network segmenter policy or foreign policy, the destination being associated with a second network node of the network system whose destination type matches the determined destination type; using the network segmenter to generate a new create request message including the second destination address and the content of the message from the create request message; and route the new create request message to the second network node of the network system associated with the second destination address.

[0030] In some embodiments, the processor is further caused to: receive, with a network segmenter, a response message from a second network node; and using the network segmenter to create a new response message including the address associated with the second network node in the message content of the new response message and the address associated with the network segmenter as the source address.

[0031] In some embodiments, the processor is further caused to: store in the network segmenter one or more of the address associated with the first network node or the second destination address before receiving a response message from the second network node; and delete with the network segmenter the stored one or more of the address associated with the first network node or the second destination address after generating a new response message.

[0032] In some embodiments, the first node is one or more of a Mobility Management Entity (MME), a Serving General Packet Radio Service (GPRS) Support Node (SGSN), a Serving Gateway (SGW), an Enhanced Packet Data Gateway (ePDG), or a trusted WLAN.

[0033] In some embodiments, the specific destination type comprises a General Packet Radio Service (GPRS) Gateway Support Node (GGSN), a Serving Gateway (SGW), or a Packet Switched Network Gateway (PGW).

[0034] In some embodiments, selecting a second destination address for a create request message based on one or more of the network segmenter policy or foreign policy comprises prompting the processor to: determine, with the network segmenter, one or more of the user equipment (UE) throughput level associated with the first message, the enterprise associated with the UE associated with the first message, the traffic rate of the UE associated with the first message, the security level or requirement of the UE associated with the first message, or the employee status of the owner of the UE associated with the first message , and select, with the network segmenter, a second destination address associated with one or more of the bandwidth level of the UE, the enterprise of the UE, the traffic rate of the UE, the security level or requirement of the UE, or the employee status of the owner of the UE, from the plurality of second destination addresses.

[0035] In some embodiments, the processor is further prompted to indicate to the domain name system in the network system that the address associated with the network segmenter has a higher priority than at least the second network node before receiving the create request message.

BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The various objects, features and advantages of the disclosed invention may be more fully appreciated with reference to the following detailed description of the disclosed invention when considered in relation to the following drawings, in which like reference numerals identify like elements.

[0037] FIG. 1 is a system diagram showing a network system.

[0038] FIG. 2A and 2B are system diagrams showing network systems in accordance with some embodiments of the present disclosure.

[0039] FIG. 3 is a diagram showing a network segmenter in accordance with some embodiments of the present disclosure.

[0040] FIG. 4A and 4B are flowcharts showing message flows for GTP-C messages that are not session establishment requests or PDP context establishment requests, in accordance with some embodiments of the present disclosure.

[0041] FIG. 5A and 5B are flow diagrams showing message flows for GTP-C messages that are session establishment requests or PDP context establishment requests, in accordance with some embodiments of the present disclosure.

[0042] FIG. 6A and 6B are flow charts showing processes for routing uplink packets in a network using a non-aggressive network segmenter or a minimally aggressive network segmenter in accordance with some embodiments of the present disclosure.

[0043] FIG. 7 is a flow diagram showing the process of routing downlink packets in a network using a non-aggressive network segmenter or a minimally aggressive network segmenter in accordance with some embodiments of the present disclosure.

DETAILED DESCRIPTION

[0044] Systems and methods are disclosed for enabling wireless network operators to segment the core network into different segments so that control plane and user plane functionality can be separated for a different group of mobile users. In some embodiments, the systems and methods described herein are implemented without affecting the configuration of any existing network functions (e.g., MME, SGSN, DNS server, Serving Gateway (SGW), Packet Switched Network Gateway (PGW), GGSN, TWAN, and ePDG, described below). In some embodiments, only DNS server updates are needed without affecting other network functions.

[0045] In some embodiments, the network segmenting methods described in this document include a flexible application that determines the correct locking segment (SGW, PGW and/or GGSN, called the right -wing network of the network) for use in UE/PDN devices /PDP. Appendix by checking and/or receiving the signal traffic GTP-C of the operator from MME, SGSN, SGW, TWAN and/or EPDG (combined with the "left" elements of the network) to the right elements and on the basis of how the application is configured can output the correct segment network to which future communication should be routed. In accordance with some options for the implementation of such functional capabilities, you can achieve when the network segmentator is inserted between at least one left element and associated right elements. In some embodiments, where the network segmentator is located between the SGW (left) and PGW (right), the network segmentator selects only PGW for future communication. In addition, the SGW learns from the MME/SGSN about the originally selected PGW.

[0046] In contrast to the GTP proxies described above, the embodiments of the systems and methods described in this document employ a network slicing approach to classify UEs in a flexible manner by selecting the correct network segment to anchor a UE session, establishing a gateway association, and subsequently removing itself from the traffic flow. UE session. This process may be performed in a non-aggressive or minimally invasive manner such that existing nodes in the mobile operator's core network are unaware of the presence of this new slicing application.

[0047] In some non-aggressive embodiments, the network segmenter can be implemented without modification in the left network elements or the DNS server. A network segmenter can be inserted between one or more left network elements and one or more right network elements. The network segmentator may inform the next hop router between one or more of one or more of the one or more left network elements that it has a lower routing cost to one or more of one or more of the one or more right network elements than other routers in the network system that allow routing to one or several of one or more right network elements. Accordingly, the network segmenter can intercept messages between one or more of the one or more left network elements and one or more of the one or more right network elements without updating the DNS server or instructing one or more left elements that the messages should be directed to the network segmenter. As described in more detail below, the non-aggressive network segmenter may inspect messages to identify messages with a create request. When create request messages are received, the nonaggressive network segmenter may select a network segment that may be different, but not necessarily, from the network segment selected by the left element in the original create request message. The non-aggressive network segmenter can also receive non-creating response messages, which the non-aggressive network segmenter can route according to routers that do not perform network sharding functions.

[0048] In some minimally aggressive embodiments, the DNS server may be given an indication that the IP address associated with the minimally aggressive network segmenter has a higher priority than one or more of the right entries. Accordingly, when one or more left elements query the DNS server, one or more left elements receive an indication that the least aggressive network sharder has a higher priority than the right elements to which creation messages would otherwise be routed. As described in more detail below, one or more of the left elements may direct create request messages to an IP address associated with a minimally aggressive network segmenter. The minimally aggressive network segmenter may then apply the techniques described in this document to forward the create message to the selected network segment (eg, one or more right elements) and return one or more left elements a response that informs one or more left elements that which segment to send future messages to. Such future messages can be routed directly to the selected segment along a path that bypasses the network segmenter. Thus, given the explanations in this document, the terms "non-aggressive" and "minimally aggressive" are used simply to identify various embodiments and do not impose any further restrictions on the scope of the invention.

[0049] In some embodiments, the network segmenter appears as a layer 3 router on the interface facing the MME, SGSN, SGW, TWAN, or ePDG, and on the interface with other network functions, the network segmenter acts as a router and as an IP host. As described in more detail below, this allows the implementation of a network segmenter without disrupting other network functions in some non-aggressive embodiments. In some minimally invasive embodiments, the network segmenter can be made visible to the DNS server to act as a SGW, GGSN, and/or PGW.

[0050] In some non-aggressive embodiments, when session control packets (eg, GTP-C) from the MME, SGSN are sent to the SGW or GGSN, or from the SGW, TWAN, or ePDG to the PGW, the network segmenter informs the next hop router before the MME, SGSN, SGW, TWAN, and ePDG, or directly to MME, SGSN, SGW, TWAN, and ePDG, that it can reach the SGW, PGW, or GGSN at a lower routing cost than other routers in the network capable of reaching the SGW, PGW, or GGSN.

[0051] In some embodiments, the network segmenter examines incoming packets and determines whether it should apply a sharding function to the incoming packets. For GTP-C packets that are not session creation requests (eg GTPv2) or PDP context creation requests (eg GTPv1), the network segmenter routes the packets to their destination as a router. For session creation requests or PDP context creation requests, the network segmenter uses the information (e.g., UE IDs, location, APN, etc.) from the request along with locally configured policies and policies retrieved from the foreign policy database to select which network segment should be used for a specific session. The DNS servers used by the MME, SGSN, TWAN and/or ePDG may also be sources of policy information.

[0052] In some minimally invasive embodiments, the MME/SGSN can discover the network segmenter in the same way that a SGW, PGW, or GGSN can be discovered, eg from a DNS server. A TWAN or ePDG can discover a network segmenter in the same way that a PGW can be discovered, for example from DNS servers. The network segmentator may receive a session creation request (eg, via GTPv2) or a PDP context creation request (eg, GTPv1) without invoking a routing cost change method. Once a create request packet is received, the rest of the processing can be performed similarly to the non-aggressive embodiments.

[0053] In some embodiments, once a segment is selected, the network segmenter creates a new session creation request or PDP context creation request using the local host IP address and sends the request to the selected segment, which may be a different segment than the one selected by the MME SGSN, TWAN and/or EPDG. This allows the response to go back to the network segmenter, which generates a session creation response or a PDP context creation response to be sent back to the MME, SGSN, TWAN and/or ePDG. The source IP address used in this case is set to match the destination IP address in the original request.

[0054] FIG. 1 is a system diagram showing a network system. Fig. 1 shows a User Equipment (UE) 102, a RAN Node 104, a Mobility Management Entity (MME) 106, a Serving General Packet Radio Service (GPRS) Support Node 108 (SGSN), a Serving Gateway 112 (SGW), a Packet Switched Network Gateway 114 ( PGW), GPRS Support Gateway Node (GGSN) 116, Domain Name System (DNS) 120, Gi network 130, dubious wireless local area network (WLAN) 140, enhanced packet data gateway (ePDG) 142, trusted WLAN 150, and trusted network 152 access to WLAN (TWAN).

[0055] UE 102 connects to network system 100 via RAN node 104, which may be an evolved Node B (eNodeB) in a 4G network, or a radio network controller (RNC) for 3G, or a base station subsystem (BSS) for 2G. UE 102 includes computing devices configured to connect to a mobile data network (eg, mobile phones, tablets, laptops). Node 104 RAN is the radio part of the cell site. One RAN node 104 may contain multiple radio transmitters, receivers, control sites, and power supplies. RAN node 104 may be reversed for MME 106 and SGSN 108. Reverse connection is the process of moving packets or communication signals over relatively long distances to a separate location for processing, such as a data center operated by a network operator. The SGSN 108 routes and forwards user data packets, also acting as a mobility anchor for the user plane during inter-RAN handover. The MME 106 is a control node in the network system 100. The MME 106 performs mobility and session management for the UE 102 while it is in the 4G network. SGSN 108 and GGSN 116 are used to route traffic in a 2G or 3G system, while MME 106, SGW 112 and PGW 114 are used to route traffic in a 4G/EPC system. UE 102 may access the network through two different types of WLAN. As shown in FIG. 1, WLAN 150 is trusted by the network operator, while WLAN 140 is not trusted by the network operator. WLANs 140, 150 connect devices using wireless communication to form local area networks (LANs), for example, in limited areas. WLANs 140, 150 may be embedded in network system 100 via ePDG 142 and TWAN 152, respectively, to communicate between WLANs 140, 150 and PGW 114 over S2b and S2a interfaces, respectively. For trusted WLAN 150, UE 102 may access the network using TWAN 152 and PGW 114. For questionable WLAN 140, UE 102 may access the network using ePDG 142 and PGW 114.

[0056] When UE 102 joins a network, multiple control messages are exchanged between network elements to create a data session (e.g., 3G session, 4G session) and provide data connectivity for UE 102. As explained above, RAN node 104 may reverse for MME 106/SGSN 108. MME 106/SGSN 108 routes and forwards packets (eg, user plane packets from SGSN 108 to GGSN 116) and/or sends other messages to SGW 112, PGW 114, and GGSN 116. In some network implementations, the GGSN operates as a serving node in a General Packet Radio Service (GPRS) network, and the PGW acts as a serving node in an Evolved Packet Core (EPC) network. PGW 114 and GGSN 116 route packets to and from Gi network 130 . PGW 114 may also route packets to and from trusted WLAN 150 and questionable WLAN 140 via TWAN 152 and ePDG 142, respectively. The Gi network 130 may include any enterprise or source servers. The 130 Gi network can connect to the Internet or any other third party server.

[0057] DNS 120 translates domain names into IP addresses and can be queried by any of the network nodes described above. DNS 120 can be implemented on servers connected to network nodes via an internal or external network connection. Each of the network nodes described above can be configured to communicate with DNS 120.

[0058] As discussed above, the GTP proxy can be between, for example, SGW 112 and PGW 114 and/or SGSN 108 and GGSN 116. However, as discussed above, GTP proxy can be aggressive.

[0059] FIG. 2A is a system diagram showing a network system with a non-aggressive network segmenter in accordance with some embodiments of the present disclosure. Fig. 2A shows a mobility management entity 202 serving GPRS support node (SGSN) 204, TWAN 205a, ePDG 205b, network segmenter 206, SGW 207, router 208, router 210, host IP addresses 212, policy server/database 220, server/ domain name system (DNS) database 120, segment 1 230, serving gateway 232 (SGW), packet switched network gateway (PGW) 234, gateway GPRS support node 236 (GGSN), segment 2 240, serving gateway 242 (SGW) , a packet switched network gateway (PGW) 244, a GPRS support gateway node 246 (GGSN), segment 3 250, a serving gateway 252 (SGW), a packet switched network gateway (PGW) 254, and a GPRS support gateway node 256 (GGSN).

[0060] MME 202 functions similarly or the same as MME 106, which is shown in FIG. 1 and described in the accompanying text, and SGSN 204 functions similarly to SGSN 108 as shown in FIG. 1 and described in the accompanying text. SGW 207, 232, 242, 252; PGW 234, 244, 254; The GGSNs 236, 246, 256 also function similarly to the SGWs 112, PGWs 114 and GGSNs 116 shown in FIG. 1 and described in the accompanying text, and TWAN 205a and ePDG 205b function similarly to TWAN 152 and ePDG 142, respectively, which are shown in FIG. 1 and described in the accompanying text. Note that although only single MMEs 202, SGSN 204, SGW 207, TWAN 205a, and ePDG 205b are shown in FIG. 2A that are found on the left side of the network segmentator 206a, several of these elements may be included and may be connected to one or more SGWs 232, 242, 252, PGWs 234, 244, 254, and/or GGSNs 236, 246, 256. As shown in FIG. . 2A, the SGW can be on both sides of the network segmenter due to the interface it supports (S4/S11 on one side and S5/S8 on the other side). A network segmenter 206a may be implemented in the network to route traffic from "access network-facing nodes to data network-facing nodes" (eg, from left elements to right elements) and vice versa.

[0061] Network segmenter 206a may include a router 208 for transmitting and receiving packets between network segmenter 206a and MME 202, SGSN 204, SGW 207, TWAN 205a, ePDG 205b, and a router 210 for transmitting and receiving packets between network segmenter 206a and SGW 232/242/252, PGW 234/244-254 and GGSN 236/246/256. For network segmenter 206a, router 208 may inform the next hop router or directly to the MME, SGSN, SGW, TWAN, and ePDG that it has the lowest routing cost, as discussed above. Thus, all traffic, regardless of type, can be routed to network segmenter 206a, regardless of type. As shown in FIG. 2A, the network segmenter may consult one of policy 220 and DNS 120 for the policy associated with the received packet. In particular, network sharder 206a may check session creation requests or PDP context creation requests and their respective responses to determine if a change is needed. The network segmenter 206a routes other GTP-C packets through the network segments without any inspection or processing. Packets from router 208 are sent to router 210 and vice versa. Policy 220 may be local to network segmenter 206a, an external database, or a combination thereof. Policy 220, which is explained in greater detail throughout this disclosure, may include various rules applied by network segmenter 206a.

[0062] For example, as described in more detail below, for an incoming request for creating a session (or a request for creating a PDP context), a request may include IP MME, SGSN, SGW, TWAN or EPDG as an IP address of the source and IP address SGW, PGW or the GGSN selected by the MME, SGSN, TWAN, or ePDG as the destination IP address. In some embodiments, the 206A segmentator can determine on the basis of 220 policy, which should be used by another SGW, PGW or GGSN. Examples of such scenarios include, but are not limited when the operator has a dedicated segment for a particular corporate client (when it is found that UE belongs to the enterprise, the network segmentator sends a request to the indicated segment for the client), when one or more segments are used for secure users (The network segmental can be configured to detect such users, for example, based on identifying characteristics, and the direction of the request from them in one or more safe segments), and when the new segment is considered experienced for a specific function, for example, high throughput (the operator may want to test that one The segment with specific UE, for example, internal devices of employees, and the network segmentator can direct the devices of employees to that segment using the segmentator). An approximate policy of choosing a gateway can list a certain right element or be a list of right elements associated with a pre -established group of users. In another approximate policy of choosing a gateway, a politician can list one or more characteristics of the right element for choosing (for example, supporting high -speed data) for specific users, types of sessions, etc. An approximate policy of admission priorities can assign priority to users or groups of users when a network segmentator overloaded. For example, you can ignore the requests of the creation of a session from a particular group or groups of inexperienced users, if the network segmentator is overloaded (or higher than the threshold use), so that the network segmentator does not choose new network segments for inexperienced users. When the 206A network segmenter determines that another SGW, PGW or GGSN should be used, the 206A network segmentator replaces the IP source using its IP 212 host and IP appointment using the SGW or GGSN, selected by the network -based segmentator. Since the source IP corresponds to the 206A network segmented, the response from SGW, PGW or GGSN will return to the 206A network segment. Then it replaces the IP destination using that in MME, SGSN, SGW, TWAN or EPDG, from which the source request was accepted, and the IP source using the SGW or GGSN IP address, the SGSN, TWAN or EPDG, so IP- the source address of the response is the destination IP address of the original request.

[0063] Segments 230, 240, 250 refer to network segments, each of which is a partition of a network infrastructure into multiple network infrastructures. For example, segments 230, 240, 250 may all operate on the same hardware platform, but may be implemented as separate logical networks in software. Segments can also be implemented on different hardware platforms or virtualization infrastructures.

[0064] FIG. 2B is a system diagram showing a network system with a minimally aggressive network segmenter in accordance with some embodiments of the present disclosure. The elements in FIG. 2B with similar FIGS. 2A numbers function similarly as described in this document. In some embodiments, FIG. 2B is different from FIG. 2A in that the minimally aggressive network segmenter 206b includes the IP address 214 of the host. As shown in FIG. 2B, the host IP address 214 of the minimally aggressive network segmenter 206b is visible to MME 202, SGSN 204, SGW 207, TWAN 205a, and ePDG 205b. Unlike the embodiment shown in FIG. 2A, MME 202, SGSN 204, SGW 207, TWAN 205a, and ePDG 205b can be modified to send session request messages directly to the host IP address 214 at the minimally aggressive network segmenter 206b. As discussed above with respect to the non-aggressive network segmenter 206a, the minimally aggressive network segmenter 206b can determine the appropriate anchor from the available network segments (eg, by applying the various policies 220 described throughout this disclosure) and forward the message to the appropriate node by changing its IP 214 to message with the destination IP address of a suitable network element in network segments 230, 240, 250. Network segmentator 206b can be referred to as minimally aggressive because the MME, SGSN, SGW, TWAN, and ePDG first send a session creation request addressed to the host IP address 214 at network segmentator 206b, while the initial session creation requests discussed with reference to FIG. 2A are addressed to the network element(s) on network segments 230, 240, or 250, but are routed to the network segmenter because the network segmenter informs the next hop routers or MME, SGSN, SGW, TWAN, and ePDG that it has a lower routing cost to the right elements relative to other routers. However, the minimally aggressive network sharder 206b can be considered stateless because session state information is not maintained on the network sharder as in non-aggressive embodiments. The reason is that the non-aggressive network segmentator 206a and the minimally aggressive network segmentator 206b do not need to maintain any stored information about received or forwarded messages after sending the return message to the original left element. Thus, in some embodiments, only the left and/or right network elements keep session state information, and the network segmenter does not. However, in other embodiments, the network segmenter may record, store, or maintain session state information, or may otherwise function as a "state changing" network element. In some embodiments, for requests without creation, network segmenter 206b does not receive any traffic because MME, SGSN, SGW, TWAN, and ePDG route directly to the selected segment that is indicated to the left element in the return message from network segmenter 206b, and not directly to IP. - the host address 214 of the network segmenter 206b, and because the network segmenter 206b can be implemented so that it does not inform the next hop routers that the network segmenter 206b has a lower cost of routing to the right elements.

[0065] FIG. 3 is a diagram showing a minimally or non-aggressive network segmenter in accordance with some embodiments of the present disclosure. Fig. 3 shows a control module 301, a policy server interface module 302, a policy enforcement module 303, a routing control module 304, and a packet forwarding module 305.

[0066] The control module 301 provides the network segmentator 206a or 206b with the function of configuration management, operation management, performance management (e.g., tracking the number of requests received, the number of responses received, the number of requests that are forwarded, the number of responses that are forwarded, etc. ) and fault management (eg, monitoring the health of nodes belonging to different segments, monitoring connectivity to the policy database, generating alarms when peers in segments are down or the DB is unavailable, etc.). The control module 301 allows the user to control and monitor the network segmenter 206a or 206b, including the various modules in the network segmenter 206a or 206b.

[0067] The policy application module 303 performs network slicing policy application to determine the right SGW, PGW, and GGSN to use in processing a session creation request or a PDP context creation request. In some embodiments, the policy enforcement module 303 uses a locally configured policy that may be stored in the policy enforcement module 303 or stored in the network segmentator 206a or 206b, as well as policies received from external servers via the policy server interface module 302 with external servers, for example, a Subscriber Policy Repository (SPR) that can store subscriber permissions and grouping information such as enterprise client status, security level, and so on.

[0068] The packet forwarder 305 checks incoming packets. For session creation request or PDP context creation request messages and their corresponding response messages, the packet forwarding module sends them to the policy enforcement module 303 . In some non-aggressive embodiments, for other packets, the forwarding module 305 simply forwards the packets to the appropriate network interface based on the forwarding rules defined by the routing control module 304, such as IP 10.10.2.4, mask 255.255.0.0, interface port 1, or IP 10.20.3.1 , mask 255.255.0.0, interface port 2.

[0069] FIG. 4A and 4B are flowcharts showing message flows for GTP-C messages that are not a session establishment request or a PDP context establishment request, in accordance with some embodiments of the present disclosure. The message flow in FIG. 4A may be associated with the non-aggressive network segmenter 206a shown in FIG. 2A, in accordance with some embodiments.

[0070] Referring to step 402, the MME 202 routes the GTP-C, which is not a session creation request, to the network segmenter 206a. The MME 202 can route the request to the network segmenter 206a because the network segmenter 206a informs the next hop router or directly to the MME, SGSN, SGW, TWAN, and ePDG that router 208 has the lowest routing cost. Thus, all packets, regardless of type, can be sent to the network segmenter 206a. The received request contains the source IP address associated with the MME 202 and the destination IP address of the SGW 232 in segment 1 230.

[0071] Referring to step 404, the network segmentator 206a determines that the packet is not a session creation request (also referred to in this document as "other control messages"), and routes the packet to the destination IP associated with the request, which is the SGW 232 in the segment 1 230. Thus, routers 208 and 210 act as normal routers.

[0072] Referring to step 406, network segmenter 206a receives from SGW 232 in segment 1 230 a response that contains the source IP address associated with SGW 232 in segment 1 and the destination address associated with MME 202.

[0073] Referring to step 408, network segmenter 206a determines that the packet is not a session establishment response and routes the packet to the destination IP associated with the response, which is the IP address associated with MME 202. Thus, routers 208 and 210 act like regular routers.

[0074] The message flow of FIG. 4B may be associated with the minimally aggressive network segmenter 206b shown in FIG. 2B, in accordance with some embodiments. As shown in FIG. 4B, referring to step 422, the MME 202 routes the GTP-C, which is not a session creation request, directly to the SGW 232 in segment 1 230. The reason is, as described in more detail below, that the left element, for example MME 202, will receive an indication in response message of the selected segment and will route traffic directly to that selected segment. Referring to step 424, network segmenter 206b does not participate in traffic between MME 202 and SGW 232 in segment 1 230. Similarly, in step 432, network segmenter 206b is bypassed in communication between MME 202 and SGW 232 in segment 1 230.

[0075] FIG. 5A and 5B are flowcharts showing the message flow for GTP-C messages that are session establishment requests or PDP context establishment requests for the non-aggressive network segmenter 206a (FIG. 5A) and the minimally aggressive network segmenter (FIG. 5B), in in accordance with some embodiments of the present disclosure. The similarly labeled steps function similarly between FIGS. 5A and 5B, unless otherwise noted below.

[0076] Referring to steps 502a and 205b, the network element, such as MME 202, routes the GTP-C, which is a session creation request, to the network segmenter 206a/206b. The request contains the source IP address associated with the MME 202 and the destination IP address of the SGW 232 in segment 1 230. In some embodiments, as shown in the non-aggressive embodiment of FIG. 5A, the MME 202 request was routed to the network segmentator 206a because the network segmenter 206a informed the next hop router (for example, the router between the left network element and the network segmentator 206a) or directly to the MME, SGSN, SGW, TWAN and ePDG that the network segmenter 206a lower routing cost than other routers on the network. For example, network segmenter 206a may be configured to indicate a routing cost that is zero or below an assumed threshold that other routers may indicate. Accordingly, routers attempting to route from left elements to right elements in FIG. 2A will route messages, including create and non-create messages, through network segmentator 206a because routers see network segmentator 206a as having less cost of routing to network segments relative to other routers. As shown in FIG. 5B, during deployment of network segmentator 206b, DNS 120 may be updated to include network segmentator 206b of FIG. 2B as the right node with the highest priority. This can be done by manual reconfiguration during deployment, or can be done automatically by network segmenter 206b. Thus, when the left entry queries the DNS for the right entry to send a create request, DNS 120 will return IP address 214 as the highest priority entry, even if the network segmenter is not a PGW, SGW, or GGSN. Accordingly, network segmenter 206b receives initial creation messages from left elements to right elements directly at IP address 214.

[0077] Referring to step 504a, the network segmentator 206a determines that the packet is a session creation request and applies a policy to determine a better segment than that specified in the session creation request. At step 504b, network segmentator 206b may not need to determine that the packet is a create request because network elements, such as MME 202, only route create requests to network segmentator 206b explicitly using IP address 214 (this may be because future messages can be routed directly to the right element selected by the network segmenter 206b). At steps 504a and 504b, network segmenters 206a/206b apply one or more policies to identify whether a different network segment should be used. In some embodiments, the network segmenters 206a/206b use the information elements from the MME/SGSN's session creation and/or source IP requests as input. The information used includes (but is not limited to) any one or more of IMSI, location, access point name (APN), device ID, IMEI, radio access technology type, and time of day. The network segmenter 206a/206b then searches the locally configured policies for the best match based on the information identified above. For example, the best match may be defined by an operator who wishes to use a specific SGW and a specific PGW for a particular group of users, such as users in some location, with some IMSI, with some type of APN, etc. A locally configured policy may identify the IMSI of users and associate them with given SGW and PGW. The policy may also refer to establishing communication with a foreign policy server. The network segmenter 206a/206b then polls the external server to determine the best segment to use. The external servers may contain similar policies that instruct the network segmentator 206a/206b to make similar locally configured policy selections based on similar information. The network segmentator 206a/206b may also assign its IP address as the source IP address for the modified session creation request or PDP context creation request. One of ordinary skill in the art would understand from the present disclosure that instead of modifying an existing session creation request or PDP context creation request, a new session creation request or PDP context creation request could be created with the required information.

[0078] Referring to step 506, the network segmentator 206a/206b sends a GTP-C session creation request to the policy-selected segment (which in this figure is, for example, SGW 242 in segment 2 (240)), and sets the source address as the network segmenter's own IP address.

[0079] Referring to step 508, network segmentator 206a/206b receives a response from SGW 242 in segment 2 240 that has a source IP address associated with SGW 242 in segment 2 and a destination address associated with network segmentator 206a/206b (e.g., IP address 212).

[0080] Referring to steps 510a and 510b, network segmenter 206a/206b determines that the packet is a session establishment response and creates a new response (or modifies an existing response) with the source IP address associated with segment 1 230 (source address assumed MME in Fig. 5A) or network segmenter 206b (the source address assumed by the MME in Fig. 5B) and the destination IP address associated with the MME 202. In some embodiments, the content of the message from the SGW in segment 2 may already contain an IP address , which the MME 202 should use for future communication with the SGW. Exemplary content and relevant processing of MME 202 are specified by 3GPP, for example (eg, 29.274 and 29.060).

[0081] Referring to steps 512a and 512b, network segmenter 206a sends a response to MME 202 with updated source IP (SGW 232 in segment 1 230 in FIG. 5A or network segmenter 206b in FIG. 5B) and destination address at MME 202. Even if the source IP indicates that the response came from segment 1 230, the content of the response comes from SGW 242 in segment 2 240. The content includes information informing the MME 202 of the ID of the segment and gateway selected by the network segmentator 206a/206b, so that the MME 202 can communicate with the selected segment and gateway in future messaging associated with the UE session. In some embodiments, the IP address of the selected segment may be included in the content of the message in accordance with, for example, 3GPP standards 29.274 for GTPv2 messages or 29.060 for GTPv1 messages. In some embodiments, segment 1 and segment 2 are two different sets of SGWs, PGW and GGSN. Segments can offer different features. For example, segment 1 may only contain SGWs, PGWs, and GGSNs that can handle normal rate user traffic, while segment 2 may contain SGWs, PGWs, and GGSNs that can support faster user traffic. As another example, the network segmenter 206a may be used to direct UEs that are capable of the 5G throughput level to a high-speed segment so that the network can provide those UEs with the best possible service.

[0082] In some embodiments, the network may use multiple instances of network segmenters to provide redundancy. In such a redundant embodiment, multiple segmenters may be introduced into the network, and for non-aggressive embodiments, a subset or all of them may be considered equal cost routes to the SGW/PGW and the GGSN. Removing or failing one such segmenter does not affect the operation of the network because messages can be routed through other instances of the segmenter. In some minimally invasive embodiments, each network segmenter can be given its own IP address 214. Accordingly, when one of the many network segmenters fails, the left elements can detect the failure and use other network segmenters instead.

[0083] FIG. 6A and 6B are flowcharts showing processes for routing uplink packets in a network using non-aggressive and minimally aggressive network segmenters, respectively, in accordance with some embodiments of the present disclosure.

[0084] Referring to step 602, the network segmenter 206a receives a message from the first node. In some embodiments, the first node may be one of MME, SGW, SGSN, TWAN, or ePDG.

[0085] Referring to step 604, the network segmentator 206a determines the message type associated with the first node. The message type may be one of a session creation request, a PDP creation request, or another control message (eg, a non-session creation request such as a bearer change request, a session delete request, etc.).

[0086] Referring to step 606, the network segmenter 206a selects a network segment based on the segmenter's policy when the message type contains a session creation request or a PDP creation request. As described above, when the message type contains a session creation request or a PDP creation request, the network segmenter 206a looks up the policy in the database or internal or external policy server based on the information associated with the first node, such as one or more of the IMSI, location, point name access (APN), device ID, IMEI, radio access technology type, MS-ISDN and time of day. In some embodiments, the network segmenter may record the content of the incoming request, the target segment assigned by the initiating network node, the selected target segment, and/or other identifying information about the request, which may be used to populate and/or redirect new response messages based on the response messages received. from the right elements. The use of such recorded information will be described, for example, with reference to FIG. 5A and 7. In some non-aggressive embodiments, network segmenter 206a may also receive messages with a request type without being created. In such embodiments, non-create request type messages are routed by network segmenter routers without selecting a new network segment, as discussed, for example, with reference to FIG. 4a.

[0087] Referring to step 608, network segmentator 206a creates a new session creation request or PDP creation request (or changes the received request) with a different source and destination IP address than the source and destination IP address associated with the received message. For example, the source IP address associated with the new message is the IP address associated with the network segmenter 206a, and the destination IP address is associated with the selected network segment.

[0088] Referring to step 610, network segmentator 206a routes a new session creation request or PDP creation request to the second node in the selected network segment. As described above, in some embodiments, the first node may be one of MME, SGW, SGSN, TWAN, or ePDG. In some embodiments, the implementation of the second node may be made in the form of one of the SGW, PGW and GGSN. Network segmentator 206a may route traffic between at least MME and SGW, SGSN and SGW, SGSN and GGSN, SGW and PGW, TWAN and PGW, and ePDG and PGW.

[0089] FIG. 6B shows the process for network segmenter 206b, which is similar to the process shown in FIG. 6A for network segmenter 206a.

[0090] Referring to step 612, network segmenter 206b receives a message from the first left node. In some embodiments, the first node may be one of MME, SGW, SGSN, TWAN, or ePDG. Since the network segmenter 206b expects to receive creation requests directly from such network elements at the host IP address 214 of the network segmenter 206b as the destination address, the network segmentator 206b does not need to determine the message type associated with the message, and additionally does not need to inform the following hop routers, that the network segmenter 206b has a lower routing cost relative to other routers.

[0091] referring to stage 616, the 206B network segment selects the network segment based on the segmental policy. As described above, the 206B network segmentator is looking for a policy in the database or internal or external politician based on information associated with the first node, for example, one or more from IMSI, location, access point (APN), IM devices, IMEI, type of technology radio access, MS-ISDN and time of day. In some embodiments of the 206B network, the contents of the incoming request, the target segment assigned by the initiating network node, the selected target segment and/or other identifying information about the request that can be used to fill out and/or redirect new response messages based on response messages, taken from the right elements. The use of such recorded information is described, for example, with reference to FIG. 5b and 7.

[0092] Referring to step 618, network segmentator 206b creates a new session creation request or PDP creation request (or changes the received request) with a different source and destination IP address than the source and destination IP address associated with the received message. For example, the source IP address associated with the new message is the IP address associated with the network segmenter 206b, and the destination IP address is associated with the selected network segment.

[0093] Referring to step 620, network segmentator 206b routes a new session creation request or PDP creation request to a second node in the selected network segment. As described above, in some embodiments, the first node may be one of MME, SGW, SGSN, TWAN, or ePDG. In some embodiments, the implementation of the second node may be made in the form of one of the SGW, PGW and GGSN. Network segmentator 206a may route traffic between at least MME and SGW, SGSN and SGW, SGSN and GGSN, SGW and PGW, TWAN and PGW, and ePDG and PGW.

[0094] FIG. 7 is a flowchart showing a process for routing downlink packets in a network using a non-aggressive or minimally aggressive network segmenter in accordance with some embodiments of the present disclosure.

[0095] Referring to step 702, the network segmenter 206a/206b receives a session creation response or a PDP creation response. The network segmentator 206a/206b receives a session creation response or a PDP creation response only for responses to requests that were routed through the network segmentator 206a/206b.

[0096] Referring to step 704, network segmenter 206a/206b creates a new response (or modifies the received response) based on the information recorded when the original request was processed, as well as the contents of the incoming response. The recorded information includes the IP address of the MME, SGSN, TWAN, and/or ePDG that sent the original session creation request or PDP context creation request. The information also includes the destination IP address of the original session creation request or PDP context creation request. In some embodiments, the recorded MME, SGSN, TWAN, and/or ePDG address becomes the destination IP address of the new response message. For the network segmenter 206a, the recorded destination IP address from the original creation message may become the source IP of the new message. For network segmentator 206b, host IP address 214 at network segmentator 206b may become the source IP address for the new message. The content of the incoming response message can be copied into a new response message, but modified to indicate that the selected segment (eg, segment 2 in the example above) should be used for future communications, as discussed above. The IP address of the selected segment may be included in the content of the message in accordance with, for example, 3GPP standards 29.274 for GTPv2 messages or 29.060 for GTPv1 messages.

[0097] Referring to step 706, the network segmentator 206a/206b transmits a new response to the first node. In some embodiments, the response includes content indicating the IP address of the selected segment and host, as described above with reference to block 706. By providing this information, further messages sent by the first node to the network can be directed to the selected second node. In some embodiments, at step 706, network segmenter 206a/206b removes any recorded information associated with the creation messages discussed with reference to FIG. 6A/6B and the response messages discussed with reference to FIG. 7. Thus, the network no longer maintains any established session information after redirecting the response message to the left element, making the network segmenter a "stateless" solution.

[0098] In addition to the network segmentation capabilities described above, the network segmenter 206a/206b can also be used for the following purposes discussed below.

[0099] In accordance with some embodiments, network segmenters 206a and/or 206b may be used to service gateways. The Network Segmenter can be implemented in a live network to help move users from one gateway to another without impacting operations. This allows the network operator to perform upgrades, live network load balancing, or other tasks that can be simplified with adaptive or managed network slicing. As soon as the procedure is completed, the network segmenter can be easily removed.

[0100] In accordance with some embodiments, network segmenters 206a and/or 206b may be used for troubleshooting. The network sharder can be used to force a PDN or PDP context to be applied to a specific set of gateways, such as for debugging purposes. The same function can also be used to test a new gateway capability or gateway users. For example, specific users can be downloaded or downloaded from a new or upgraded gateway as appropriate to properly test new features. Since the network segmenter has access to many different types of information, including, for example, IMSI, location, access point name (APN), device ID, IMEI, radio access technology type, and time of day, the network operator can control the conditions of the test scenario for specific characteristics users or other network elements.

[0101] In some embodiments, the benefits of using a network segmenter 206a and/or 206b may include those described below.

[0102] In some embodiments, the network segmenter may be transparent to the MME or SGSN. No changes to the existing network function are needed, such as MME, SGSN, TWAN, ePDG, DNS server, SGW, PGW, and GGSN. It is much easier to implement the network segmenter function compared to the traditional mediation approach. Also, even for a minimally aggressive sharder, the change only needs to happen in the DNS server.

[0103] In some embodiments, network segmentators 206a, 206b may not change their state. The network segmenter 206a/206b does not need to maintain the session state, rather, the session state is still maintained by the MME/SGSN/TWAN/ePDG and SGW/PGW/GGSN. Thus, the network segmenter 206a/206b cannot add another failure region to the network. A network segmenter failure cannot affect established sessions.

[0104] In some embodiments, the network segmenters disclosed herein may provide broader segment selection functions than can be achieved using DNS-based solutions in existing MME/SGSN/TWAN/ePDGs. The network segmenter allows the operator to use any UE related information to determine the correct segment to use.

[0105] The invention described herein may be implemented in digital electronic circuits or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or combinations thereof. The invention described herein may be implemented as one or more computer program products, for example, one or more computer programs tangibly embodied in a storage medium (for example, computer-readable memory) or embodied in a propagated signal, for execution by a data processing or control device. its operation (for example, a programmable processor, a computer or several computers). A computer program (also known as a program, software, software application, or code) may be written in any kind of programming language, including translated or interpreted languages, and it may be deployed in any form, including a stand-alone program or module, component, subroutine, or another unit suitable for use in the computing environment. The computer program does not necessarily correspond to the file. A program may be stored in a part of a file that stores other programs or data, in a single file dedicated to the program in question, or in multiple coherent files (for example, files that store one or more modules, subroutines, or pieces of code). A computer program may be deployed for execution on a single computer or on multiple computers at a single site or distributed across multiple sites and interconnected via a communications network.

[0106] The processes and logical flows described in this description of the invention, including the steps of the method according to the invention described in this document, can be performed by one or more programmable processors executing one or more computer programs to perform the functions of the invention described in this document, by influencing on the input data and shaping the output. Processes and logic flows can also be executed with dedicated logic, and the device of the invention described herein can be implemented with dedicated logic, such as FPGA (Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit).

[0107] Processors suitable for executing a computer program include, by way of example, both general purpose and special purpose microprocessors and any one or more processors in any form of digital computer. Typically, the processor will receive instructions and data from ROM or RAM, or both. The integral elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include, or be operably connected to receive data or transmit data, or both, one or more mass storage devices for data storage, such as magnetic, magneto-optical disks, or optical disks. Storage media suitable for implementing computer program instructions and data include all types of non-volatile memory including, by way of example, semiconductor memory devices (eg, EPROM, EEPROM, and flash memory devices); magnetic disks (such as internal hard drives or removable drives); magneto-optical disks; and optical discs (eg CDs and DVDs). The processor and storage device may be supplemented with or included in dedicated logic circuits.

[0108] In order to provide for user interaction, the invention described in this document can be implemented on a computer with a display device, such as a CRT (cathode ray tube) monitor or LCD (liquid crystal display), to display information to the user and a keyboard and pointing device, such as a mouse or a trackball with which the user can provide input to the computer. Other types of devices may equally well be used to provide user interaction. For example, the feedback provided to the user may be any type of sensory feedback (eg, visual feedback, auditory feedback, or tactile feedback), and any form of output from the user may be received, including audio, speech, or tactile input.

[0109] The invention described herein may be implemented in a computing system that includes an internal component (eg, a data server), an intermediate component (eg, an application server), or an external component (eg, a client computer with a graphical user interface or a web browser through which a user can interact with an implementation of the invention described in this document), or any combination of such internal, intermediate, and external components. The components of the system may be interconnected using any form or medium of digital communication, such as a communications network. Examples of communication networks include a local area network (LAN) and a wide area network (WAN), such as the Internet.

[0110] It is to be understood that the disclosed invention is not limited to application to the design features and component arrangements set forth in the following description or illustrated in the drawings. The disclosed invention is capable of other embodiments and of being practiced and carried out in a variety of ways. It is also to be understood that the language and terminology used in this document is intended to be descriptive and should not be construed as limiting.

[0111] As such, those skilled in the art will appreciate that the concept on which this disclosure is based can be readily used as a basis for designing other structures, methods, and systems to accomplish several of the objectives of the disclosed invention. Therefore, it is important that the claims be considered to include such equivalent constructions, to the extent that they do not deviate from the spirit and scope of the disclosed invention.

[0112] Although the disclosed invention has been described and illustrated in the above exemplary embodiments, it is understood that the present disclosure is by way of example only and that numerous changes may be made to the details of the implementation of the disclosed invention without departing from the spirit and scope of the disclosed invention, which is limited only by the following. invention formula.

Claims (43)

1. A method for routing wireless traffic, comprising the steps of: receiving, at a network segmentation means in the network system, a first message from a first network node of the network system; determining, by means of the network segmentation tool, a first destination address from the first message; determining by the network segmentation means that the message type of the first message is a predetermined message type; determining a destination type from the first message; identifying, based on one or more of the network segmentation tool policy and foreign policy, a second network node of the network system having said destination type; creating, by means of the network segmentation means, a new message of said predetermined message type, wherein the source address of this message is the address of the network segmentation means, and the destination address of this new message is the address of the second network node; And routing this new message of the predetermined message type to the second network node, the network segmenter acts as both a router and an IP host. 2. The method according to claim 1, in which the mentioned previously established type of message is a message with the creation request, while the message with a request for creation is one of the messages with a request for creating a session and a message requesting the creation of the PDP context. 3. The method of claim 1, wherein the first network node is one or more of a Mobility Management Entity (MME), a Serving General Packet Radio Service (GPRS) Support Node (SGSN), a Serving Gateway (SGW), an Evolved Packet Data Gateway ( ePDG) and trusted WLAN. 4. The method of claim 1, wherein said defined destination type comprises a General Packet Radio Service (GPRS) Gateway Support Node (GGSN), a Serving Gateway (SGW), or a Packet Switched Network Gateway (PGW). 5. The method of claim 1, wherein said identification of the second network node comprises the steps of: determine by means of a network segmentation means one or more of the throughput level of the user equipment (UE) associated with the first message, the enterprise associated with the UE associated with the first message, the traffic rate of the UE associated with the first message, the security level or requirement the UE associated with the first message and the employee status of the owner of the UE associated with the first message, and selecting, by means of the network segmentation means, a destination address associated with one or more of the bandwidth level of the UE, the enterprise of the UE, the traffic rate of the UE, the security level or requirement of the UE, and the employee status of the owner of the UE, from the plurality of destination addresses. 6. The method of claim 1, wherein said identifying the second network node comprises determining one or more of an International Mobile Subscriber Identity (IMSI) of the user equipment associated with the first message, a location of the user equipment associated with the first message, an access point name (APN) associated with the first message, an International Mobile Device Identity (IMEI) number of the user equipment associated with the first message, a radio access technology type associated with the first message, and a timestamp of the first message. 7. The method according to claim 1, further comprising the steps of: receiving, by means of the network segmentation means, a response message from the second network node; And using the network segmentation tool, a new response message is created, including: the third network node as the source address of this new response message, and an indication of the second network node in the message content of this new response message. 8. The method of claim 7, further comprising the steps of: storing in the network segmenter one or more of an address associated with the first network node and said destination address before receiving a response message from the third network node; And at least one address associated with the first network node or said destination address is removed by the network segmentation means after said new response message is generated. 9. The method of claim 1, further comprising indicating by means of the network segmenter to the next hop router that the router associated with the network segmenter has a lower cost of routing to a third network node than the estimated cost of routing from other routers in network system to a third network node, before said receipt of the first message, where this lower cost of routing to the third network node is less than the actual cost of routing to the third network node. 10. A network segmentation tool in a network system, comprising: CPU; And a storage medium containing instructions that cause the processor to perform the following steps: receive, at the network segmentation means in the network system, a first message from the first network node of the network system; determine the first destination address from the first message; determine that the message type of the first message is a predetermined message type; determine the destination type from the first message; identify, based on one or more of the network segmentation tool policy and the foreign policy, a second network node of the network system having said destination type; create a new message of said predetermined message type, wherein the source address of the new message is the address of the network segmenter and the destination address of the new message is the address of the second network node; And route this new message of a predetermined message type to a second network node, the network segmenter acts as both a router and an IP host. 11. The network segmentation means of claim 10, wherein said predetermined message type is a create request message, the create request message being one of a session create request message and a PDP context create request message. 12. The network segmentation means of claim 10, wherein the first network node is one or more of a Mobility Management Entity (MME), a Serving General Packet Radio Service (GPRS) Support Node (SGSN), a Serving Gateway (SGW), an Evolved Packet Gateway data (ePDG) and trusted WLAN. 13. The network segmentation tool of claim 10, wherein said destination type comprises a General Packet Radio Service (GPRS) Gateway Support Node (GGSN), a Serving Gateway (SGW), or a Packet Switched Network Gateway (PGW). 14. The network segmentation tool according to claim 10, wherein said identification of the second network node contains an instruction to the processor: determine one or more of a throughput level of a user equipment (UE) associated with the first message, an enterprise associated with the UE associated with the first message, a traffic rate of the UE associated with the first message, a security level or requirement of the UE associated with the first message and the employee status of the owner of the UE associated with the first message, and select a destination address associated with one or more of the bandwidth level of the UE, the enterprise of the UE, the traffic rate of the UE, the security level or requirement of the UE, and the employee status of the owner of the UE, from the plurality of destination addresses. 15. The network segmentation means of claim 10, wherein said second network node identification comprises determining one or more of an International Mobile Subscriber Identity (IMSI) of a user equipment associated with the first message, a location of the user equipment associated with the first message, a point name access (APN) associated with the first message, the International Mobile Device Identity (IMEI) of the user equipment associated with the first message, the type of radio access technology associated with the first message, and the timestamp of the first message.

Images