US20220217582A1 - User plane replicator - Google Patents
User plane replicator Download PDFInfo
- Publication number
- US20220217582A1 US20220217582A1 US17/686,737 US202217686737A US2022217582A1 US 20220217582 A1 US20220217582 A1 US 20220217582A1 US 202217686737 A US202217686737 A US 202217686737A US 2022217582 A1 US2022217582 A1 US 2022217582A1
- Authority
- US
- United States
- Prior art keywords
- data traffic
- physical
- actions
- autonomous vehicle
- redirected
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
- 230000009471 action Effects 0.000 claims abstract description 23
- 238000003860 storage Methods 0.000 claims description 34
- 230000006870 function Effects 0.000 claims description 23
- 230000000694 effects Effects 0.000 abstract description 5
- 238000004891 communication Methods 0.000 description 22
- 238000000034 method Methods 0.000 description 17
- 238000004088 simulation Methods 0.000 description 8
- 238000007726 management method Methods 0.000 description 7
- 238000012545 processing Methods 0.000 description 4
- 238000013473 artificial intelligence Methods 0.000 description 3
- 238000007792 addition Methods 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 230000006378 damage Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- 238000010801 machine learning Methods 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 239000002184 metal Substances 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000001902 propagating effect Effects 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 230000001052 transient effect Effects 0.000 description 2
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 2
- 230000006399 behavior Effects 0.000 description 1
- 230000000903 blocking effect Effects 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 230000001010 compromised effect Effects 0.000 description 1
- 230000008878 coupling Effects 0.000 description 1
- 238000010168 coupling process Methods 0.000 description 1
- 238000005859 coupling reaction Methods 0.000 description 1
- 238000001152 differential interference contrast microscopy Methods 0.000 description 1
- 238000009429 electrical wiring Methods 0.000 description 1
- 238000005538 encapsulation Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 230000007274 generation of a signal involved in cell-cell signaling Effects 0.000 description 1
- 238000002955 isolation Methods 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 239000000203 mixture Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 230000003252 repetitive effect Effects 0.000 description 1
- 230000010076 replication Effects 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 230000002441 reversible effect Effects 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 208000037974 severe injury Diseases 0.000 description 1
- 230000009528 severe injury Effects 0.000 description 1
- 238000004904 shortening Methods 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
- 239000003053 toxin Substances 0.000 description 1
- 231100000765 toxin Toxicity 0.000 description 1
- 108700012359 toxins Proteins 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 230000007723 transport mechanism Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W28/00—Network traffic management; Network resource management
- H04W28/02—Traffic management, e.g. flow control or congestion control
- H04W28/06—Optimizing the usage of the radio link, e.g. header compression, information sizing, discarding information
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/30—Services specially adapted for particular environments, situations or purposes
- H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
- H04W4/44—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P] for communication between vehicles and infrastructures, e.g. vehicle-to-cloud [V2C] or vehicle-to-home [V2H]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
- H04W12/122—Counter-measures against attacks; Protection against rogue devices
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45595—Network integration; Enabling network access in virtual machine instances
Definitions
- Networks such as 5G may be designed to segment traffic into a control plane and user plane structure. Traffic from mobile devices may traverse gNodeBs and then may be delivered to the user plane serving gateway (e.g., user-SGW) after attachment and authentication.
- U-SGW's may be virtual network functions (VNFs).
- VNFs virtual network functions
- U-SGW's may be implemented in multiple regional datacenters in response to user demand and in order to optimize data traffic. Traffic delivered to and from user plane network elements may be unprotected from malicious software that may cause poor performance, malicious attacks, or errors.
- the user plane replicator may capture and evaluate data traffic when it enters a communication network.
- the UPR may capture and evaluate data traffic before it affects the core network or before it is delivered to the end device (e.g., mobile device). After capturing the data traffic, the UPR may replicate the effect of the data traffic on mobile devices or other devices and take an appropriate corrective action, if needed.
- an apparatus may include a processor and a memory coupled with the processor that effectuates operations.
- the operations may include obtaining an indication that a first device is connected with a network; based on the first device connecting with the network, obtaining redirected data traffic, wherein the redirected traffic is from the device to a second device; simulating the data traffic on a virtual machine that replicates the image of the second device; based on the simulating, determining a risk score for the data traffic; and based on the risk score, sending instructions to not allow the data traffic to be sent to the second device.
- FIG. 1 illustrates an exemplary system that may implement a user plane replicator.
- FIG. 2 illustrates an exemplary method that may use a user plane replicator.
- FIG. 3 illustrates another exemplary method that may use a user plane replicator.
- FIG. 4 illustrates a schematic of an exemplary network device.
- FIG. 5 illustrates an exemplary communication system that provides wireless telecommunication services over wireless communication networks.
- FIG. 6A is a representation of an exemplary network.
- FIG. 6B is a representation of an exemplary hardware platform for a network.
- IoT devices Internet of things (IoT) devices, autonomous vehicles (AVs), or other end devices may be more susceptible to malicious hackers based on their possible repetitive contact or accessibility with end users without initial screening for malicious intent. Further, because any hack of IoT devices, AVs, or mobile devices may result in financial loss, extensive property damage, severe injury, or loss of human life, it is even more important that these end devices are secure. For example, a hacked IoT device may release toxins in the air that may be harmful to humans or release water that may cause major property damage. In another example, AVs (e.g., an autonomous car) may be maliciously or dangerously configured to go speeds of 80 mph in a 35 MPH zone or travel on sidewalks instead of streets.
- AVs e.g., an autonomous car
- a maliciously configured phone may activate financial transfer programs that should not be activated.
- a user plan replicator also referred herein as replicator
- FIG. 1 illustrates an exemplary system that may implement a user plane replicator.
- System 100 may include user plane replicator (UPR) 101 , mobile device 106 , base station 105 , mobile device 104 (e.g., phone or laptop), IoT device 103 , or AV 102 . All such devices may be communicatively connected with each other via network 107 , base station 105 , base station 108 , or the like.
- AV 102 may be a vehicle designed for air, land, or water. Examples of apparatuses that may fall into the scope of IoT device 103 may include connected security systems, thermostats, cars, electronic appliances, lights in household and commercial environments, alarm clocks, speaker systems, vending machines, and pressure sensors and release valves, among other things.
- system 100 may include a wired network or wireless network (e.g., 5G, LTE, Wi-Fi).
- Replicator 101 also referred herein as UPR 101
- Each apparatus image may be replicated as a virtual machine (VM) 109 or virtual network function (VNF) 110 that may simulate the functions of the end apparatuses (e.g., IoT device 103 or AV 102 ).
- VM virtual machine
- VNF virtual network function
- FIG. 2 illustrates an exemplary method that uses a user plane replicator.
- AV 102 may connect to network 107 and be authenticated.
- replicator 101 may determine if it already has an authenticated image of AV 102 . This may be determined by comparing a first image of AV 102 to an already possessed first replicated image of AV 102 in VM 109 (or VNF 110 ) on replicator 101 . If the first image matches the first replicated image, then replicator 101 may use the first replicated image for any future simulations. The comparison may be of identifiers, hash function results, or the like associated with the first image and the first replicated image.
- an image of AV 102 may be uploaded to replicator 101 (e.g., VM 109 ) to become the first replicated image.
- the first image may be replicated if there is no image of AV 102 already in replicator 101 or there is a new image (e.g., second image) on AV 102 that should be replicated into a second replicated image.
- the new image may be because of a software update of AV 102 .
- replicator 101 may determine the risk score (e.g., worthiness) of data traffic to AV 102 from mobile device 106 (or vice versa).
- Replicator 101 may obtain data traffic from mobile device 106 and simulate the functions of AV 102 using VM 109 . There may be expected results based on the simulation. In example, based on the data traffic from mobile device 106 , a speaker in AV 102 should project audio (e.g., a voice) sourced from mobile device 106 .
- Replicator 101 may score (e.g., to get a risk score) the simulated interaction of VM 109 (with the first replicated image) to what is expected to happen.
- the expectation may be based on previous actions for devices similar to AV 102 or specific to AV 102 .
- the actions may be based on machine learning or artificial intelligence.
- the score may indicate the risk of negative consequences to people or property if the data traffic (e.g., commands or other data) are sent to AV 102 .
- the score may further be influenced based on a threat level of the action that would be taken by AV 102 . For example, increasing the speed of AV 102 over the legal speed of the road (or air way) may be considered a high threat level, while turning on the inside light of the vehicle may be considered a low threat level.
- the threat level may be a factor that determines whether the risk score is high (e.g., 60%), low (e.g., 10%), medium (e.g., 35%), or the like.
- replicator 101 may allow or not allow the data traffic obtained in step 114 to proceed to AV 102 , based on the score being within a threshold number.
- the score is in the low range then data traffic is allowed.
- the score is in the high range (e.g., above 59%) then the data traffic is not allowed.
- the score is in the medium range (e.g., between 34 and 59%), then an alert may be sent to an authorized user associated with AV 102 (e.g., occupant of AV 102 or administrator for AV 102 ) to authorize the data traffic.
- being above or below a certain number of data traffic flows indicated to be medium or high may trigger allowing, not allowing, or sending an alert.
- replicator 101 may send the data traffic to AV 102 .
- replicator 101 may remedy the issue with the first image of AV 102 .
- replicator 101 may send instructions to AV 102 to install a previous validated image (e.g., a basic default image).
- the previous validated image may be stored on replicator 101 or some other device in system 100 , such as another server (not shown), a nearby AV (not shown), mobile device 104 , or the like.
- FIG. 3 illustrates an exemplary method that uses a user plane replicator.
- replicator 101 may be times where replicator 101 is only used based on certain factors, which is described in more detail herein.
- data traffic e.g., traffic obtained from mobile device 106
- VM 109 may have a first replicated image and AV 102 may include a matching first image. This determination may be based on one or more different factors.
- the factors may include number of trips, total number of people for trips within a period, or total number of people within AV 102 for a trip, detected number of connections via Wi-Fi, Bluetooth, or the like, or GPS coordinates of mobile devices within a radius of AV 102 , among other things.
- the aforementioned factors may be significant because the increased number of interactions with end users may increase the possibility of interacting with users that have malicious intent (or have hacked devices that are compromised) interact with AV 102 .
- Additional factors may include period of time since last simulation, travel history of AV 102 riders within a period, number of packages delivered by AV 102 , type of packages delivered by AV 102 , destination of AV 102 , average risk score in a period, geographical location (e.g., proximate to another device, such as within 10 feet), or type of applications active on mobile device 104 , IoT device 103 , or AV 102 , among other things. It is contemplated that disclosed factors may be associated with any of the devices described herein and their use may be influenced by machine learning or artificial intelligence.
- the data traffic is directed to VM 109 to be simulated.
- determining a risk score for the data traffic based on the risk score, allowing or not allowing the data traffic. Steps of FIG. 2 and FIG. 3 may be combined or skipped as necessary.
- Replicator 101 or other network devices may perform all or some of the steps as described in FIG. 2 and FIG. 3 .
- replicator 101 may be used.
- AV 102 may be redirect data traffic from nearby mobile device 104 (e.g., rider in AV 102 ) to replicator 101 before accepting the data traffic.
- replicator 101 may be used with any mix of mobile devices, IoT devices, AVs, or other devices.
- UPR 101 may capture and evaluate data traffic when it exits the U-SGW and before it is delivered to the mobile device (e.g., UE). UPR 101 may capture and evaluate all data traffic before it affects the 5G core network. On the reverse flow, UPR 101 may evaluate data traffic before it is delivered to mobile device 106 . UPR 101 may replicate the effect of the data traffic on mobile devices and take appropriate action such as blocking or modifying traffic, capturing the traffic for Communications Assistance for Law Enforcement Act (CALEA) purposes, or improving the performance of the network by compressing data or other data manipulation.
- CALEA Communications Assistance for Law Enforcement Act
- service providers may achieve efficiencies in the network and potentially offer new services associated with improving the performance and security of mobile devices, IoT devices, or AVs, among other devices connected with the network.
- UPR 101 may act as a Big Data repository for central collection of end-user activity. The effect of malicious code may be evaluated before it hits the 5G Core Network and the mobile device. In the event of a malicious attack to the network, UPR 101 may filter traffic and shut off network traffic to a selected number of devices affected instead of the whole network. UPR 101 may have an Artificial Intelligence (AI) machine functionality in which it learns the behavior of connected devices generally for a category of devices or specific to a particular device. Based on this learning, UPR 101 may determine the appropriate risk score for the data traffic and whether to allow the data traffic to proceed within a service provider network.
- AI Artificial Intelligence
- the replication and simulation may be done for end devices in the communication network of a service provider, as well as intermediary devices (MME, PGW, SGW, eNodeB, gNodeB, etc.) along a communications path of the network.
- MME mobile management Entity
- network elements may be considered “images” that are stored in containers.
- VNFs virtual network functions
- Images may be used to represent VNFs. These images may be moved in and out of worker machines who conduct the real work processed. The images may be stored in containers. Containers may be considered programs which provide the work environment, so images can be moved in an out for execution in worker nodes. The process of creating “worker nodes” and moving images in and out of containers residing in worker nodes is often called orchestration.
- Virtual machines can be isolated software containers, operating independent of other virtual machines. Such isolation can assist in realizing virtual-machine-based virtual environments that can execute applications and provide services with availability, flexibility, and security, in some cases, surpassing those on traditional, non-virtualized systems.
- Virtual machines can encapsulate a complete set of virtual hardware resources, including an operating system and all its applications, inside a software package. Encapsulation can make virtual machines quite portable and manageable. Indeed, virtual machines can be hardware-independent, and can be portably provisioned and deployed on one of multiple different computing devices, operating systems, and environments. Indeed, depending on the availability of computing devices within a cloud environment (e.g., UPR 101 ) a particular virtual machine 109 may be provisioned on any one (or multiple) of the devices included in a cloud environment.
- a cloud environment e.g., UPR 101
- a virtual machine manager may be provided in connection with a cloud computing system (or other system hosting virtual infrastructure).
- Virtual machine managers, or hypervisors may be implemented as software- and/or hardware-based tools used in the virtualization of hardware assets (i.e., as virtual machines 109 ) on one or more host computing devices (e.g., UPR 101 ).
- a virtual machine manager may be used to run multiple virtual machines, including virtual machines with different guest operating systems, on one or more host computers (e.g., UPR 101 ).
- the virtual machine manager may provide a shared virtual operating platform for multiple virtual appliances and guest operating systems and enable a plurality of different virtual machines (and guest operating systems) to be instantiated and run on computing devices and hardware hosting virtual infrastructure (e.g., UPR 101 or mobile device 104 ).
- virtual machine managers in some instances may be run natively, or as “bare metal,” directly on host computing devices' hardware to control the hardware and to manage virtual machines provisioned on the host devices. In other instances, “hosted” virtual machine managers may be provided that is run within the operating system of another host machine, including conventional operating system environments.
- a virtual component can be programmed to perform application specific functions that may be associated with microcontroller, sensor, motors, actuators, lighting, or radio frequency identification (RFID), among other things.
- RFID radio frequency identification
- VM 109 may be used or VNF 110 may be used.
- the simulation is done by the virtual image.
- a virtual machine includes its own operating system.
- An example is VMWARE.
- a virtual image can be moved to “worker nodes” for execution. They do not need a full virtual machine environment.
- the images may be considered VNFs and can be stored in “container” products such as Docker. Therefore, there may be simulation of the data traffic on a VNF that may be a virtual machine, or a container image moved to a worker computing node for execution. The movement of these VNF images for execution is performed by orchestration software.
- FIG. 4 is a block diagram of network device 300 that may be connected to or comprise a component of system 100 .
- Network device 300 may comprise hardware or a combination of hardware and software. The functionality to facilitate telecommunications via a telecommunications network may reside in one or combination of network devices 300 .
- network 4 may represent or perform functionality of an appropriate network device 300 , or combination of network devices 300 , such as, for example, a component or various components of a cellular broadcast system wireless network, a processor, a server, a gateway, a node, a mobile switching center (MSC), a short message service center (SMSC), an automatic location function server (ALFS), a gateway mobile location center (GMLC), a radio access network (RAN), a serving mobile location center (SMLC), or the like, or any appropriate combination thereof.
- MSC mobile switching center
- SMSC short message service center
- ALFS automatic location function server
- GMLC gateway mobile location center
- RAN radio access network
- SMLC serving mobile location center
- network device 300 may be implemented in a single device or multiple devices (e.g., single server or multiple servers, single gateway or multiple gateways, single controller or multiple controllers). Multiple network entities may be distributed or centrally located. Multiple network entities may communicate wirelessly, via hard wire, or any appropriate combination thereof.
- Network device 300 may comprise a processor 302 and a memory 304 coupled to processor 302 .
- Memory 304 may contain executable instructions that, when executed by processor 302 , cause processor 302 to effectuate operations associated with mapping wireless signal strength.
- network device 300 is not to be construed as software per se.
- network device 300 may include an input/output system 306 .
- Processor 302 , memory 304 , and input/output system 306 may be coupled together (coupling not shown in FIG. 4 ) to allow communications between them.
- Each portion of network device 300 may comprise circuitry for performing functions associated with each respective portion. Thus, each portion may comprise hardware, or a combination of hardware and software. Accordingly, each portion of network device 300 is not to be construed as software per se.
- Input/output system 306 may be capable of receiving or providing information from or to a communications device or other network entities configured for telecommunications.
- input/output system 306 may include a wireless communications (e.g., 3G/4G/GPS) card.
- Input/output system 306 may be capable of receiving or sending video information, audio information, control information, image information, data, or any combination thereof. Input/output system 306 may be capable of transferring information with network device 300 . In various configurations, input/output system 306 may receive or provide information via any appropriate means, such as, for example, optical means (e.g., infrared), electromagnetic means (e.g., RF, Wi-Fi, Bluetooth®, ZigBee®), acoustic means (e.g., speaker, microphone, ultrasonic receiver, ultrasonic transmitter), or a combination thereof. In an example configuration, input/output system 306 may comprise a Wi-Fi finder, a two-way GPS chipset or equivalent, or the like, or a combination thereof.
- optical means e.g., infrared
- electromagnetic means e.g., RF, Wi-Fi, Bluetooth®, ZigBee®
- acoustic means e.g., speaker, microphone, ultra
- Input/output system 306 of network device 300 also may contain a communication connection 308 that allows network device 300 to communicate with other devices, network entities, or the like.
- Communication connection 308 may comprise communication media.
- Communication media typically embody computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media.
- communication media may include wired media such as a wired network or direct-wired connection, or wireless media such as acoustic, RF, infrared, or other wireless media.
- the term computer-readable media as used herein includes both storage media and communication media.
- Input/output system 306 also may include an input device 310 such as keyboard, mouse, pen, voice input device, or touch input device. Input/output system 306 may also include an output device 312 , such as a display, speakers, or a printer.
- input device 310 such as keyboard, mouse, pen, voice input device, or touch input device.
- output device 312 such as a display, speakers, or a printer.
- Processor 302 may be capable of performing functions associated with telecommunications, such as functions for processing broadcast messages, as described herein.
- processor 302 may be capable of, in conjunction with any other portion of network device 300 , determining a type of broadcast message and acting according to the broadcast message type or content, as described herein.
- Memory 304 of network device 300 may comprise a storage medium having a concrete, tangible, physical structure. As is known, a signal does not have a concrete, tangible, physical structure. Memory 304 , as well as any computer-readable storage medium described herein, is not to be construed as a signal. Memory 304 , as well as any computer-readable storage medium described herein, is not to be construed as a transient signal. Memory 304 , as well as any computer-readable storage medium described herein, is not to be construed as a propagating signal. Memory 304 , as well as any computer-readable storage medium described herein, is to be construed as an article of manufacture.
- Memory 304 may store any information utilized in conjunction with telecommunications. Depending upon the exact configuration or type of processor, memory 304 may include a volatile storage 314 (such as some types of RAM), a nonvolatile storage 316 (such as ROM, flash memory), or a combination thereof. Memory 304 may include additional storage (e.g., a removable storage 318 or a non-removable storage 320 ) including, for example, tape, flash memory, smart cards, CD-ROM, DVD, or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, USB-compatible memory, or any other medium that can be used to store information and that can be accessed by network device 300 . Memory 304 may comprise executable instructions that, when executed by processor 302 , cause processor 302 to effectuate operations to map signal strengths in an area of interest.
- volatile storage 314 such as some types of RAM
- nonvolatile storage 316 such as ROM, flash memory
- additional storage e.g., a removable storage 318 or a
- FIG. 5 depicts an exemplary diagrammatic representation of a machine in the form of a computer system 500 within which a set of instructions, when executed, may cause the machine to perform any one or more of the methods described above.
- One or more instances of the machine can operate, for example, as processor 302 , user plane replicator (UPR) 101 , mobile device 106 , base station 105 , mobile device 104 , IoT device 103 , AV 102 , and other devices of FIG. 1 .
- the machine may be connected (e.g., using a network 502 ) to other machines.
- the machine may operate in the capacity of a server or a client user machine in a server-client user network environment, or as a peer machine in a peer-to-peer (or distributed) network environment.
- the machine may comprise a server computer, a client user computer, a personal computer (PC), a tablet, a smart phone, a laptop computer, a desktop computer, a control system, a network router, switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine.
- a communication device of the subject disclosure includes broadly any electronic device that provides voice, video or data communication.
- the term “machine” shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methods discussed herein.
- Computer system 500 may include a processor (or controller) 504 (e.g., a central processing unit (CPU)), a graphics processing unit (GPU, or both), a main memory 506 and a static memory 508 , which communicate with each other via a bus 510 .
- the computer system 500 may further include a display unit 512 (e.g., a liquid crystal display (LCD), a flat panel, or a solid state display).
- Computer system 500 may include an input device 514 (e.g., a keyboard), a cursor control device 516 (e.g., a mouse), a disk drive unit 518 , a signal generation device 520 (e.g., a speaker or remote control) and a network interface device 522 .
- the embodiments described in the subject disclosure can be adapted to utilize multiple display units 512 controlled by two or more computer systems 500 .
- presentations described by the subject disclosure may in part be shown in a first of display units 512 , while the remaining portion is presented in a second of display units 512 .
- the disk drive unit 518 may include a tangible computer-readable storage medium 524 on which is stored one or more sets of instructions (e.g., software 526 ) embodying any one or more of the methods or functions described herein, including those methods illustrated above. Instructions 526 may also reside, completely or at least partially, within main memory 506 , static memory 508 , or within processor 504 during execution thereof by the computer system 500 . Main memory 506 and processor 504 also may constitute tangible computer-readable storage media.
- FIG. 6A is a representation of an exemplary network 600 .
- Network 600 e.g., system 100
- network 600 may comprise an SDN—that is, network 600 may include one or more virtualized functions implemented on general purpose hardware, such as in lieu of having dedicated hardware for every network function. That is, general purpose hardware of network 600 may be configured to run virtual network elements to support communication services, such as mobility services, including consumer services and enterprise services. These services may be provided or measured in sessions.
- a virtual network functions (VNFs) 602 may be able to support a limited number of sessions. Each VNF 602 may have a VNF type that indicates its functionality or role. For example, FIG. 6A illustrates a gateway VNF 602 a and a policy and charging rules function (PCRF) VNF 602 b . Additionally or alternatively, VNFs 602 may include other types of VNFs. Each VNF 602 may use one or more virtual machines (VMs) 604 to operate. Each VM 604 may have a VM type that indicates its functionality or role. For example, FIG.
- FIG. 6A illustrates a management control module (MCM) VM 604 a , an advanced services module (ASM) VM 604 b , and a DEP VM 604 c .
- MCM management control module
- ASM advanced services module
- DEP DEP
- VMs 604 may include other types of VMs.
- Each VM 604 may consume various network resources from a hardware platform 606 , such as a resource 608 , a virtual central processing unit (vCPU) 608 a , memory 608 b , or a network interface card (NIC) 608 c .
- hardware platform 606 may include other types of resources 608 .
- FIG. 6A illustrates resources 608 as collectively contained in hardware platform 606
- the configuration of hardware platform 606 may isolate, for example, certain memory 608 c from other memory 608 c .
- FIG. 6B provides an exemplary implementation of hardware platform 606 .
- Hardware platform 606 may comprise one or more chasses 610 .
- Chassis 610 may refer to the physical housing or platform for multiple servers or other network equipment.
- chassis 610 may also refer to the underlying network equipment.
- Chassis 610 may include one or more servers 612 .
- Server 612 may comprise general purpose computer hardware or a computer.
- chassis 610 may comprise a metal rack, and servers 612 of chassis 610 may comprise blade servers that are physically mounted in or on chassis 610 .
- Each server 612 may include one or more network resources 608 , as illustrated. Servers 612 may be communicatively coupled together (not shown) in any combination or arrangement. For example, all servers 612 within a given chassis 610 may be communicatively coupled. As another example, servers 612 in different chasses 610 may be communicatively coupled. Additionally or alternatively, chasses 610 may be communicatively coupled together (not shown) in any combination or arrangement.
- each chassis 610 and each server 612 may differ.
- FIG. 6B illustrates that the number of servers 612 within two chasses 610 may vary. Additionally or alternatively, the type or number of resources 610 within each server 612 may vary.
- chassis 610 may be used to group servers 612 with the same resource characteristics. In another aspect, servers 612 within the same chassis 610 may have different resource characteristics.
- the number of sessions that may be instantiated may vary depending upon how efficiently resources 608 are assigned to different VMs 604 .
- assignment of VMs 604 to particular resources 608 may be constrained by one or more rules.
- a first rule may require that resources 608 assigned to a particular VM 604 be on the same server 612 or set of servers 612 .
- the rules may require that all of these resources 608 be sourced from the same server 612 .
- VM 604 may require splitting resources 608 among multiple servers 612 , but such splitting may need to conform with certain restrictions. For example, resources 608 for VM 604 may be able to be split between two servers 612 . Default rules may apply. For example, a default rule may require that all resources 608 for a given VM 604 must come from the same server 612 .
- An affinity rule may restrict assignment of resources 608 for a particular VM 604 (or a particular type of VM 604 ). For example, an affinity rule may require that certain VMs 604 be instantiated on (that is, consume resources from) the same server 612 or chassis 610 . For example, if VNF 602 uses six MCM VMs 604 a , an affinity rule may dictate that those six MCM VMs 604 a be instantiated on the same server 612 (or chassis 610 ).
- an affinity rule may dictate that at least the MCM VMs 604 a and the ASM VMs 604 b be instantiated on the same server 612 (or chassis 610 ).
- Affinity rules may restrict assignment of resources 608 based on the identity or type of resource 608 , VNF 602 , VM 604 , chassis 610 , server 612 , or any combination thereof.
- An anti-affinity rule may restrict assignment of resources 608 for a particular VM 604 (or a particular type of VM 604 ).
- an affinity rule which may require that certain VMs 604 be instantiated on the same server 612 or chassis 610
- an anti-affinity rule requires that certain VMs 604 be instantiated on different servers 612 (or different chasses 610 ).
- an anti-affinity rule may require that MCM VM 604 a be instantiated on a particular server 612 that does not contain any ASM VMs 604 b .
- an anti-affinity rule may require that MCM VMs 604 a for a first VNF 602 be instantiated on a different server 612 (or chassis 610 ) than MCM VMs 604 a for a second VNF 602 .
- Anti-affinity rules may restrict assignment of resources 608 based on the identity or type of resource 608 , VNF 602 , VM 604 , chassis 610 , server 612 , or any combination thereof.
- resources 608 of hardware platform 606 may be assigned to be used to instantiate VMs 604 , which in turn may be used to instantiate VNFs 602 , which in turn may be used to establish sessions.
- the different combinations for how such resources 608 may be assigned may vary in complexity and efficiency. For example, different assignments may have different limits of the number of sessions that can be established given a particular hardware platform 606 .
- Gateway VNF 602 a may require five VMs 604 instantiated on the same server 612
- PCRF VNF 602 b may require two VMs 604 instantiated on the same server 612 .
- each of two servers 612 may have sufficient resources 608 to support 10 VMs 604 .
- first server 612 may be instantiated with 10 VMs 604 to support two instantiations of gateway VNF 602 a
- second server 612 may be instantiated with 9 VMs: five VMs 604 to support one instantiation of gateway VNF 602 a and four VMs 604 to support two instantiations of PCRF VNF 602 b . This may leave the remaining resources 608 that could have supported the tenth VM 604 on second server 612 unused (and unusable for an instantiation of either a gateway VNF 602 a or a PCRF VNF 602 b ).
- first server 612 may be instantiated with 10 VMs 604 for two instantiations of gateway VNF 602 a and second server 612 may be instantiated with 10 VMs 604 for five instantiations of PCRF VNF 602 b , using all available resources 608 to maximize the number of VMs 604 instantiated.
- each gateway VNF 602 a and each PCRF VNF 602 b may support. This may factor into which assignment of resources 608 is more efficient. For example, consider if each gateway VNF 602 a supports two million sessions, and if each PCRF VNF 602 b supports three million sessions. For the first configuration—three total gateway VNFs 602 a (which satisfy the gateway requirement for six million sessions) and two total PCRF VNFs 602 b (which satisfy the PCRF requirement for six million sessions)—would support a total of six million sessions.
- the second configuration two total gateway VNFs 602 a (which satisfy the gateway requirement for four million sessions) and five total PCRF VNFs 602 b (which satisfy the PCRF requirement for 15 million sessions)—would support a total of four million sessions.
- the first configuration may seem less efficient looking only at the number of available resources 608 used (as resources 608 for the tenth possible VM 604 are unused)
- the second configuration is actually more efficient from the perspective of being the configuration that can support more the greater number of sessions.
- an integer programming problem may be formulated.
- a telecommunications system wherein management and control utilizing a software designed network (SDN) and a simple IP are based, at least in part, on user equipment, may provide a wireless management and control framework that enables common wireless management and control, such as mobility management, radio resource management, QoS, load balancing, etc., across many wireless technologies, e.g.
- SDN software designed network
- a simple IP may provide a wireless management and control framework that enables common wireless management and control, such as mobility management, radio resource management, QoS, load balancing, etc., across many wireless technologies, e.g.
- LTE, Wi-Fi, and future 5G access technologies decoupling the mobility control from data planes to let them evolve and scale independently; reducing network state maintained in the network based on user equipment types to reduce network cost and allow massive scale; shortening cycle time and improving network upgradability; flexibility in creating end-to-end services based on types of user equipment and applications, thus improve customer experience; or improving user equipment power efficiency and battery life—especially for simple M2M devices—through enhanced wireless management.
- While examples of a telecommunications system in which messages associated with the user plane replicator can be processed and managed have been described in connection with various computing devices/processors, the underlying concepts may be applied to any computing device, processor, or system capable of facilitating a telecommunications system.
- the various techniques described herein may be implemented in connection with hardware or software or, where appropriate, with a combination of both.
- the methods and devices may take the form of program code (i.e., instructions) embodied in concrete, tangible, storage media having a concrete, tangible, physical structure. Examples of tangible storage media include floppy diskettes, CD-ROMs, DVDs, hard drives, or any other tangible machine-readable storage medium (computer-readable storage medium).
- a computer-readable storage medium is not a signal.
- a computer-readable storage medium is not a transient signal. Further, a computer-readable storage medium is not a propagating signal.
- a computer-readable storage medium as described herein is an article of manufacture.
- the program code When the program code is loaded into and executed by a machine, such as a computer, the machine becomes a device for telecommunications.
- the computing device In the case of program code execution on programmable computers, the computing device will generally include a processor, a storage medium readable by the processor (including volatile or nonvolatile memory or storage elements), at least one input device, and at least one output device.
- the program(s) can be implemented in assembly or machine language, if desired.
- the language can be a compiled or interpreted language, and may be combined with hardware implementations.
- the methods and devices associated with a telecommunications system as described herein also may be practiced via communications embodied in the form of program code that is transmitted over some transmission medium, such as over electrical wiring or cabling, through fiber optics, or via any other form of transmission, wherein, when the program code is received and loaded into and executed by a machine, such as an EPROM, a gate array, a programmable logic device (PLD), a client computer, or the like, the machine becomes an device for implementing telecommunications as described herein.
- a machine such as an EPROM, a gate array, a programmable logic device (PLD), a client computer, or the like
- PLD programmable logic device
- client computer or the like
- the program code When implemented on a general-purpose processor, the program code combines with the processor to provide a unique device that operates to invoke the functionality of a telecommunications system.
- a telecommunications system has been described in connection with the various examples of the various figures, it is to be understood that other similar implementations may be used or modifications and additions may be made to the described examples of a telecommunications system without deviating therefrom.
- a telecommunications system as described in the instant application may apply to any environment, whether wired or wireless, and may be applied to any number of such devices connected via a communications network and interacting across the network. Therefore, a telecommunications system as described herein should not be limited to any single example, but rather should be construed in breadth and scope in accordance with the appended claims.
- a method, system, computer readable storage medium, or apparatus may obtain an indication that a first device is connected with a network; based on the first device connecting with the network, obtain redirected data traffic, wherein the redirected traffic is from the device to a second device; simulate the redirected data traffic on a virtual machine that replicates the image of the second device; based on the simulating, determine a risk score for the redirected data traffic; and based on the risk score, send instructions to not allow the redirected data traffic to be sent to the second device.
- the obtaining the redirected data traffic may be further based on the first device being proximate to the second device or the first device running multiple other applications that are not related to the application that originated the redirected data traffic.
- the second device may be an autonomous vehicle or an internet of things device.
- the apparatus may send an alert to a third device to remedy the image of the second device, wherein the remedy may include sending an updated image to the second device to replace the current image of the second device.
- the replicator may alter the data sent to the device based on what it is learned after execution. All combinations in this paragraph (including the removal or addition of steps) are contemplated in a manner that is consistent with the other portions of the detailed description.
- the functions may be distributed over multiple devices.
Abstract
A replicator device may capture and evaluate data traffic before it affects the core network or before it is delivered to the end device. After capturing the data traffic, the replicator may replicate the effect of the data traffic on mobile devices or other devices and take an appropriate corrective action.
Description
- This application claims priority to and is a continuation of U.S. patent application Ser. No. 16/400,141 filed May 1, 2019. The contents of the foregoing are hereby incorporated by reference into this application as if set forth herein in full.
- Networks, such as 5G, may be designed to segment traffic into a control plane and user plane structure. Traffic from mobile devices may traverse gNodeBs and then may be delivered to the user plane serving gateway (e.g., user-SGW) after attachment and authentication. U-SGW's may be virtual network functions (VNFs). U-SGW's may be implemented in multiple regional datacenters in response to user demand and in order to optimize data traffic. Traffic delivered to and from user plane network elements may be unprotected from malicious software that may cause poor performance, malicious attacks, or errors.
- The user plane replicator (UPR) may capture and evaluate data traffic when it enters a communication network. The UPR may capture and evaluate data traffic before it affects the core network or before it is delivered to the end device (e.g., mobile device). After capturing the data traffic, the UPR may replicate the effect of the data traffic on mobile devices or other devices and take an appropriate corrective action, if needed.
- In an example, an apparatus may include a processor and a memory coupled with the processor that effectuates operations. The operations may include obtaining an indication that a first device is connected with a network; based on the first device connecting with the network, obtaining redirected data traffic, wherein the redirected traffic is from the device to a second device; simulating the data traffic on a virtual machine that replicates the image of the second device; based on the simulating, determining a risk score for the data traffic; and based on the risk score, sending instructions to not allow the data traffic to be sent to the second device.
- This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. Furthermore, the claimed subject matter is not limited to limitations that solve any or all disadvantages noted in any part of this disclosure.
- Reference will now be made to the accompanying drawings, which are not necessarily drawn to scale.
-
FIG. 1 illustrates an exemplary system that may implement a user plane replicator. -
FIG. 2 illustrates an exemplary method that may use a user plane replicator. -
FIG. 3 illustrates another exemplary method that may use a user plane replicator. -
FIG. 4 illustrates a schematic of an exemplary network device. -
FIG. 5 illustrates an exemplary communication system that provides wireless telecommunication services over wireless communication networks. -
FIG. 6A is a representation of an exemplary network. -
FIG. 6B is a representation of an exemplary hardware platform for a network. - Internet of things (IoT) devices, autonomous vehicles (AVs), or other end devices may be more susceptible to malicious hackers based on their possible repetitive contact or accessibility with end users without initial screening for malicious intent. Further, because any hack of IoT devices, AVs, or mobile devices may result in financial loss, extensive property damage, severe injury, or loss of human life, it is even more important that these end devices are secure. For example, a hacked IoT device may release toxins in the air that may be harmful to humans or release water that may cause major property damage. In another example, AVs (e.g., an autonomous car) may be maliciously or dangerously configured to go speeds of 80 mph in a 35 MPH zone or travel on sidewalks instead of streets. In another example associated with an SMS text between mobile phones, while most SMS text may be displayed as text or an emoji on a remote mobile phone user display, a maliciously configured phone may activate financial transfer programs that should not be activated. As disclosed herein, a user plan replicator (also referred herein as replicator) may create images of devices connected with a network, capture data traffic emanating from the devices, and determine whether to forward the data traffic based on virtual simulations. The capture and subsequent simulation may be done before data traffic enters the core network.
-
FIG. 1 illustrates an exemplary system that may implement a user plane replicator.System 100 may include user plane replicator (UPR) 101,mobile device 106,base station 105, mobile device 104 (e.g., phone or laptop), IoTdevice 103, orAV 102. All such devices may be communicatively connected with each other vianetwork 107,base station 105,base station 108, or the like. AV 102 may be a vehicle designed for air, land, or water. Examples of apparatuses that may fall into the scope ofIoT device 103 may include connected security systems, thermostats, cars, electronic appliances, lights in household and commercial environments, alarm clocks, speaker systems, vending machines, and pressure sensors and release valves, among other things. It is contemplated thatsystem 100 may include a wired network or wireless network (e.g., 5G, LTE, Wi-Fi). Replicator 101 (also referred herein as UPR 101) may include an image of each apparatus (e.g., IoTdevice 103,mobile device 106,base station 105,mobile device 104, IoTdevice 102, or AV 201) connected withnetwork 107, which may be apparatuses within a core network, access network, or local area network. There may multiple replicator 101s distributed throughout a network and they may exchange images with each other as necessary. Each apparatus image may be replicated as a virtual machine (VM) 109 or virtual network function (VNF) 110 that may simulate the functions of the end apparatuses (e.g.,IoT device 103 or AV 102). -
FIG. 2 illustrates an exemplary method that uses a user plane replicator. Atstep 111,AV 102, for example, may connect tonetwork 107 and be authenticated. Atstep 112,replicator 101 may determine if it already has an authenticated image ofAV 102. This may be determined by comparing a first image ofAV 102 to an already possessed first replicated image ofAV 102 in VM 109 (or VNF 110) onreplicator 101. If the first image matches the first replicated image, thenreplicator 101 may use the first replicated image for any future simulations. The comparison may be of identifiers, hash function results, or the like associated with the first image and the first replicated image. Atstep 113, an image of AV 102 (e.g., the first image) may be uploaded to replicator 101 (e.g., VM 109) to become the first replicated image. The first image may be replicated if there is no image ofAV 102 already inreplicator 101 or there is a new image (e.g., second image) onAV 102 that should be replicated into a second replicated image. The new image may be because of a software update ofAV 102. - At
step 114,replicator 101 may determine the risk score (e.g., worthiness) of data traffic toAV 102 from mobile device 106 (or vice versa).Replicator 101 may obtain data traffic frommobile device 106 and simulate the functions ofAV 102 using VM 109. There may be expected results based on the simulation. In example, based on the data traffic frommobile device 106, a speaker inAV 102 should project audio (e.g., a voice) sourced frommobile device 106.Replicator 101 may score (e.g., to get a risk score) the simulated interaction of VM 109 (with the first replicated image) to what is expected to happen. The expectation may be based on previous actions for devices similar toAV 102 or specific toAV 102. For example, the actions may be based on machine learning or artificial intelligence. The score may indicate the risk of negative consequences to people or property if the data traffic (e.g., commands or other data) are sent toAV 102. The score may further be influenced based on a threat level of the action that would be taken by AV 102. For example, increasing the speed ofAV 102 over the legal speed of the road (or air way) may be considered a high threat level, while turning on the inside light of the vehicle may be considered a low threat level. The threat level may be a factor that determines whether the risk score is high (e.g., 60%), low (e.g., 10%), medium (e.g., 35%), or the like. - At
step 115,replicator 101 may allow or not allow the data traffic obtained instep 114 to proceed toAV 102, based on the score being within a threshold number. In a first example, if the score is in the low range then data traffic is allowed. In a second example, if the score is in the high range (e.g., above 59%) then the data traffic is not allowed. In a third example, if the score is in the medium range (e.g., between 34 and 59%), then an alert may be sent to an authorized user associated with AV 102 (e.g., occupant ofAV 102 or administrator for AV 102) to authorize the data traffic. In a fourth example, being above or below a certain number of data traffic flows indicated to be medium or high (e.g., three previous traffic flows with the same risk score) may trigger allowing, not allowing, or sending an alert. - At
step 116, when the data traffic is allowed thenreplicator 101 may send the data traffic toAV 102. Atstep 117, when the data traffic not allowed thenreplicator 101 may remedy the issue with the first image ofAV 102. For example,replicator 101 may send instructions toAV 102 to install a previous validated image (e.g., a basic default image). The previous validated image may be stored onreplicator 101 or some other device insystem 100, such as another server (not shown), a nearby AV (not shown),mobile device 104, or the like. -
FIG. 3 illustrates an exemplary method that uses a user plane replicator. There may be times wherereplicator 101 is only used based on certain factors, which is described in more detail herein. Atstep 121, there may be a determination whether data traffic (e.g., traffic obtained from mobile device 106) should be directed toVM 109 to simulateAV 102.VM 109 may have a first replicated image andAV 102 may include a matching first image. This determination may be based on one or more different factors. For example, with reference toAV 102 being used as a ride hailing service, the factors may include number of trips, total number of people for trips within a period, or total number of people withinAV 102 for a trip, detected number of connections via Wi-Fi, Bluetooth, or the like, or GPS coordinates of mobile devices within a radius ofAV 102, among other things. The aforementioned factors may be significant because the increased number of interactions with end users may increase the possibility of interacting with users that have malicious intent (or have hacked devices that are compromised) interact withAV 102. Additional factors may include period of time since last simulation, travel history ofAV 102 riders within a period, number of packages delivered byAV 102, type of packages delivered byAV 102, destination ofAV 102, average risk score in a period, geographical location (e.g., proximate to another device, such as within 10 feet), or type of applications active onmobile device 104,IoT device 103, orAV 102, among other things. It is contemplated that disclosed factors may be associated with any of the devices described herein and their use may be influenced by machine learning or artificial intelligence. - At
step 122, based on the factors ofstep 121, the data traffic is directed toVM 109 to be simulated. Atstep 123, based on the simulation of the data traffic, determining a risk score for the data traffic. Atstep 124, based on the risk score, allowing or not allowing the data traffic. Steps ofFIG. 2 andFIG. 3 may be combined or skipped as necessary.Replicator 101 or other network devices may perform all or some of the steps as described inFIG. 2 andFIG. 3 . - It is contemplated that there may be an attempt to send data traffic remotely through a core network or directly (e.g., point-to-point communication). For example,
mobile device 106 may remotely send tomobile device 104 throughnetwork 107 or directly send via Wi-Fi or Bluetooth. Even in the aforementioned situations,replicator 101 may be used. In a scenario with regard to attempted direct communication,AV 102 may be redirect data traffic from nearby mobile device 104 (e.g., rider in AV 102) toreplicator 101 before accepting the data traffic. It is further contemplated thatreplicator 101 may be used with any mix of mobile devices, IoT devices, AVs, or other devices. - In a 5G context,
UPR 101 may capture and evaluate data traffic when it exits the U-SGW and before it is delivered to the mobile device (e.g., UE).UPR 101 may capture and evaluate all data traffic before it affects the 5G core network. On the reverse flow,UPR 101 may evaluate data traffic before it is delivered tomobile device 106.UPR 101 may replicate the effect of the data traffic on mobile devices and take appropriate action such as blocking or modifying traffic, capturing the traffic for Communications Assistance for Law Enforcement Act (CALEA) purposes, or improving the performance of the network by compressing data or other data manipulation. UsingUPR 101, service providers may achieve efficiencies in the network and potentially offer new services associated with improving the performance and security of mobile devices, IoT devices, or AVs, among other devices connected with the network. -
UPR 101 may act as a Big Data repository for central collection of end-user activity. The effect of malicious code may be evaluated before it hits the 5G Core Network and the mobile device. In the event of a malicious attack to the network,UPR 101 may filter traffic and shut off network traffic to a selected number of devices affected instead of the whole network.UPR 101 may have an Artificial Intelligence (AI) machine functionality in which it learns the behavior of connected devices generally for a category of devices or specific to a particular device. Based on this learning,UPR 101 may determine the appropriate risk score for the data traffic and whether to allow the data traffic to proceed within a service provider network. It is contemplated herein that the replication and simulation may be done for end devices in the communication network of a service provider, as well as intermediary devices (MME, PGW, SGW, eNodeB, gNodeB, etc.) along a communications path of the network. - Also note that in 5G network elements may be considered “images” that are stored in containers. In other words, they may be considered not “real” machines but rather virtual network functions (VNFs). Images may be used to represent VNFs. These images may be moved in and out of worker machines who conduct the real work processed. The images may be stored in containers. Containers may be considered programs which provide the work environment, so images can be moved in an out for execution in worker nodes. The process of creating “worker nodes” and moving images in and out of containers residing in worker nodes is often called orchestration.
- Virtual machines can be isolated software containers, operating independent of other virtual machines. Such isolation can assist in realizing virtual-machine-based virtual environments that can execute applications and provide services with availability, flexibility, and security, in some cases, surpassing those on traditional, non-virtualized systems. Virtual machines can encapsulate a complete set of virtual hardware resources, including an operating system and all its applications, inside a software package. Encapsulation can make virtual machines quite portable and manageable. Indeed, virtual machines can be hardware-independent, and can be portably provisioned and deployed on one of multiple different computing devices, operating systems, and environments. Indeed, depending on the availability of computing devices within a cloud environment (e.g., UPR 101) a particular
virtual machine 109 may be provisioned on any one (or multiple) of the devices included in a cloud environment. - In some instances, a virtual machine manager (not shown) may be provided in connection with a cloud computing system (or other system hosting virtual infrastructure). Virtual machine managers, or hypervisors, may be implemented as software- and/or hardware-based tools used in the virtualization of hardware assets (i.e., as virtual machines 109) on one or more host computing devices (e.g., UPR 101). A virtual machine manager may be used to run multiple virtual machines, including virtual machines with different guest operating systems, on one or more host computers (e.g., UPR 101). The virtual machine manager may provide a shared virtual operating platform for multiple virtual appliances and guest operating systems and enable a plurality of different virtual machines (and guest operating systems) to be instantiated and run on computing devices and hardware hosting virtual infrastructure (e.g.,
UPR 101 or mobile device 104). Further, virtual machine managers, in some instances may be run natively, or as “bare metal,” directly on host computing devices' hardware to control the hardware and to manage virtual machines provisioned on the host devices. In other instances, “hosted” virtual machine managers may be provided that is run within the operating system of another host machine, including conventional operating system environments. Lastly, a virtual component can be programmed to perform application specific functions that may be associated with microcontroller, sensor, motors, actuators, lighting, or radio frequency identification (RFID), among other things. - With the above in mind,
VM 109 may be used orVNF 110 may be used. The simulation is done by the virtual image. Note that a virtual machine (VM) includes its own operating system. An example is VMWARE. A virtual image can be moved to “worker nodes” for execution. They do not need a full virtual machine environment. The images may be considered VNFs and can be stored in “container” products such as Docker. Therefore, there may be simulation of the data traffic on a VNF that may be a virtual machine, or a container image moved to a worker computing node for execution. The movement of these VNF images for execution is performed by orchestration software. -
FIG. 4 is a block diagram ofnetwork device 300 that may be connected to or comprise a component ofsystem 100.Network device 300 may comprise hardware or a combination of hardware and software. The functionality to facilitate telecommunications via a telecommunications network may reside in one or combination ofnetwork devices 300.Network device 300 depicted inFIG. 4 may represent or perform functionality of anappropriate network device 300, or combination ofnetwork devices 300, such as, for example, a component or various components of a cellular broadcast system wireless network, a processor, a server, a gateway, a node, a mobile switching center (MSC), a short message service center (SMSC), an automatic location function server (ALFS), a gateway mobile location center (GMLC), a radio access network (RAN), a serving mobile location center (SMLC), or the like, or any appropriate combination thereof. It is emphasized that the block diagram depicted inFIG. 4 is exemplary and not intended to imply a limitation to a specific implementation or configuration. Thus,network device 300 may be implemented in a single device or multiple devices (e.g., single server or multiple servers, single gateway or multiple gateways, single controller or multiple controllers). Multiple network entities may be distributed or centrally located. Multiple network entities may communicate wirelessly, via hard wire, or any appropriate combination thereof. -
Network device 300 may comprise aprocessor 302 and amemory 304 coupled toprocessor 302.Memory 304 may contain executable instructions that, when executed byprocessor 302,cause processor 302 to effectuate operations associated with mapping wireless signal strength. As evident from the description herein,network device 300 is not to be construed as software per se. - In addition to
processor 302 andmemory 304,network device 300 may include an input/output system 306.Processor 302,memory 304, and input/output system 306 may be coupled together (coupling not shown inFIG. 4 ) to allow communications between them. Each portion ofnetwork device 300 may comprise circuitry for performing functions associated with each respective portion. Thus, each portion may comprise hardware, or a combination of hardware and software. Accordingly, each portion ofnetwork device 300 is not to be construed as software per se. Input/output system 306 may be capable of receiving or providing information from or to a communications device or other network entities configured for telecommunications. For example input/output system 306 may include a wireless communications (e.g., 3G/4G/GPS) card. Input/output system 306 may be capable of receiving or sending video information, audio information, control information, image information, data, or any combination thereof. Input/output system 306 may be capable of transferring information withnetwork device 300. In various configurations, input/output system 306 may receive or provide information via any appropriate means, such as, for example, optical means (e.g., infrared), electromagnetic means (e.g., RF, Wi-Fi, Bluetooth®, ZigBee®), acoustic means (e.g., speaker, microphone, ultrasonic receiver, ultrasonic transmitter), or a combination thereof. In an example configuration, input/output system 306 may comprise a Wi-Fi finder, a two-way GPS chipset or equivalent, or the like, or a combination thereof. - Input/
output system 306 ofnetwork device 300 also may contain acommunication connection 308 that allowsnetwork device 300 to communicate with other devices, network entities, or the like.Communication connection 308 may comprise communication media. Communication media typically embody computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. By way of example, and not limitation, communication media may include wired media such as a wired network or direct-wired connection, or wireless media such as acoustic, RF, infrared, or other wireless media. The term computer-readable media as used herein includes both storage media and communication media. Input/output system 306 also may include aninput device 310 such as keyboard, mouse, pen, voice input device, or touch input device. Input/output system 306 may also include anoutput device 312, such as a display, speakers, or a printer. -
Processor 302 may be capable of performing functions associated with telecommunications, such as functions for processing broadcast messages, as described herein. For example,processor 302 may be capable of, in conjunction with any other portion ofnetwork device 300, determining a type of broadcast message and acting according to the broadcast message type or content, as described herein. -
Memory 304 ofnetwork device 300 may comprise a storage medium having a concrete, tangible, physical structure. As is known, a signal does not have a concrete, tangible, physical structure.Memory 304, as well as any computer-readable storage medium described herein, is not to be construed as a signal.Memory 304, as well as any computer-readable storage medium described herein, is not to be construed as a transient signal.Memory 304, as well as any computer-readable storage medium described herein, is not to be construed as a propagating signal.Memory 304, as well as any computer-readable storage medium described herein, is to be construed as an article of manufacture. -
Memory 304 may store any information utilized in conjunction with telecommunications. Depending upon the exact configuration or type of processor,memory 304 may include a volatile storage 314 (such as some types of RAM), a nonvolatile storage 316 (such as ROM, flash memory), or a combination thereof.Memory 304 may include additional storage (e.g., aremovable storage 318 or a non-removable storage 320) including, for example, tape, flash memory, smart cards, CD-ROM, DVD, or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, USB-compatible memory, or any other medium that can be used to store information and that can be accessed bynetwork device 300.Memory 304 may comprise executable instructions that, when executed byprocessor 302,cause processor 302 to effectuate operations to map signal strengths in an area of interest. -
FIG. 5 depicts an exemplary diagrammatic representation of a machine in the form of acomputer system 500 within which a set of instructions, when executed, may cause the machine to perform any one or more of the methods described above. One or more instances of the machine can operate, for example, asprocessor 302, user plane replicator (UPR) 101,mobile device 106,base station 105,mobile device 104,IoT device 103,AV 102, and other devices ofFIG. 1 . In some embodiments, the machine may be connected (e.g., using a network 502) to other machines. In a networked deployment, the machine may operate in the capacity of a server or a client user machine in a server-client user network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. - The machine may comprise a server computer, a client user computer, a personal computer (PC), a tablet, a smart phone, a laptop computer, a desktop computer, a control system, a network router, switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. It will be understood that a communication device of the subject disclosure includes broadly any electronic device that provides voice, video or data communication. Further, while a single machine is illustrated, the term “machine” shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methods discussed herein.
-
Computer system 500 may include a processor (or controller) 504 (e.g., a central processing unit (CPU)), a graphics processing unit (GPU, or both), amain memory 506 and astatic memory 508, which communicate with each other via abus 510. Thecomputer system 500 may further include a display unit 512 (e.g., a liquid crystal display (LCD), a flat panel, or a solid state display).Computer system 500 may include an input device 514 (e.g., a keyboard), a cursor control device 516 (e.g., a mouse), adisk drive unit 518, a signal generation device 520 (e.g., a speaker or remote control) and anetwork interface device 522. In distributed environments, the embodiments described in the subject disclosure can be adapted to utilizemultiple display units 512 controlled by two ormore computer systems 500. In this configuration, presentations described by the subject disclosure may in part be shown in a first ofdisplay units 512, while the remaining portion is presented in a second ofdisplay units 512. - The
disk drive unit 518 may include a tangible computer-readable storage medium 524 on which is stored one or more sets of instructions (e.g., software 526) embodying any one or more of the methods or functions described herein, including those methods illustrated above. Instructions 526 may also reside, completely or at least partially, withinmain memory 506,static memory 508, or withinprocessor 504 during execution thereof by thecomputer system 500.Main memory 506 andprocessor 504 also may constitute tangible computer-readable storage media. -
FIG. 6A is a representation of anexemplary network 600. Network 600 (e.g., system 100) may comprise an SDN—that is,network 600 may include one or more virtualized functions implemented on general purpose hardware, such as in lieu of having dedicated hardware for every network function. That is, general purpose hardware ofnetwork 600 may be configured to run virtual network elements to support communication services, such as mobility services, including consumer services and enterprise services. These services may be provided or measured in sessions. - A virtual network functions (VNFs) 602 may be able to support a limited number of sessions. Each
VNF 602 may have a VNF type that indicates its functionality or role. For example,FIG. 6A illustrates agateway VNF 602 a and a policy and charging rules function (PCRF)VNF 602 b. Additionally or alternatively,VNFs 602 may include other types of VNFs. EachVNF 602 may use one or more virtual machines (VMs) 604 to operate. EachVM 604 may have a VM type that indicates its functionality or role. For example,FIG. 6A illustrates a management control module (MCM)VM 604 a, an advanced services module (ASM)VM 604 b, and a DEP VM 604 c. Additionally or alternatively,VMs 604 may include other types of VMs. EachVM 604 may consume various network resources from ahardware platform 606, such as aresource 608, a virtual central processing unit (vCPU) 608 a,memory 608 b, or a network interface card (NIC) 608 c. Additionally or alternatively,hardware platform 606 may include other types ofresources 608. - While
FIG. 6A illustratesresources 608 as collectively contained inhardware platform 606, the configuration ofhardware platform 606 may isolate, for example,certain memory 608 c fromother memory 608 c.FIG. 6B provides an exemplary implementation ofhardware platform 606. -
Hardware platform 606 may comprise one ormore chasses 610.Chassis 610 may refer to the physical housing or platform for multiple servers or other network equipment. In an aspect,chassis 610 may also refer to the underlying network equipment.Chassis 610 may include one ormore servers 612.Server 612 may comprise general purpose computer hardware or a computer. In an aspect,chassis 610 may comprise a metal rack, andservers 612 ofchassis 610 may comprise blade servers that are physically mounted in or onchassis 610. - Each
server 612 may include one ormore network resources 608, as illustrated.Servers 612 may be communicatively coupled together (not shown) in any combination or arrangement. For example, allservers 612 within a givenchassis 610 may be communicatively coupled. As another example,servers 612 indifferent chasses 610 may be communicatively coupled. Additionally or alternatively,chasses 610 may be communicatively coupled together (not shown) in any combination or arrangement. - The characteristics of each
chassis 610 and eachserver 612 may differ. For example,FIG. 6B illustrates that the number ofservers 612 within twochasses 610 may vary. Additionally or alternatively, the type or number ofresources 610 within eachserver 612 may vary. In an aspect,chassis 610 may be used togroup servers 612 with the same resource characteristics. In another aspect,servers 612 within thesame chassis 610 may have different resource characteristics. - Given
hardware platform 606, the number of sessions that may be instantiated may vary depending upon how efficientlyresources 608 are assigned todifferent VMs 604. For example, assignment ofVMs 604 toparticular resources 608 may be constrained by one or more rules. For example, a first rule may require thatresources 608 assigned to aparticular VM 604 be on thesame server 612 or set ofservers 612. For example, ifVM 604 uses eightvCPUs memory 608 b, and 2NICs 608 c, the rules may require that all of theseresources 608 be sourced from thesame server 612. Additionally or alternatively,VM 604 may require splittingresources 608 amongmultiple servers 612, but such splitting may need to conform with certain restrictions. For example,resources 608 forVM 604 may be able to be split between twoservers 612. Default rules may apply. For example, a default rule may require that allresources 608 for a givenVM 604 must come from thesame server 612. - An affinity rule may restrict assignment of
resources 608 for a particular VM 604 (or a particular type of VM 604). For example, an affinity rule may require thatcertain VMs 604 be instantiated on (that is, consume resources from) thesame server 612 orchassis 610. For example, ifVNF 602 uses sixMCM VMs 604 a, an affinity rule may dictate that those sixMCM VMs 604 a be instantiated on the same server 612 (or chassis 610). As another example, ifVNF 602 usesMCM VMs 604 a,ASM VMs 604 b, and a third type ofVMs 604, an affinity rule may dictate that at least theMCM VMs 604 a and theASM VMs 604 b be instantiated on the same server 612 (or chassis 610). Affinity rules may restrict assignment ofresources 608 based on the identity or type ofresource 608,VNF 602,VM 604,chassis 610,server 612, or any combination thereof. - An anti-affinity rule may restrict assignment of
resources 608 for a particular VM 604 (or a particular type of VM 604). In contrast to an affinity rule—which may require thatcertain VMs 604 be instantiated on thesame server 612 orchassis 610—an anti-affinity rule requires thatcertain VMs 604 be instantiated on different servers 612 (or different chasses 610). For example, an anti-affinity rule may require thatMCM VM 604 a be instantiated on aparticular server 612 that does not contain anyASM VMs 604 b. As another example, an anti-affinity rule may require thatMCM VMs 604 a for afirst VNF 602 be instantiated on a different server 612 (or chassis 610) thanMCM VMs 604 a for asecond VNF 602. Anti-affinity rules may restrict assignment ofresources 608 based on the identity or type ofresource 608,VNF 602,VM 604,chassis 610,server 612, or any combination thereof. - Within these constraints,
resources 608 ofhardware platform 606 may be assigned to be used to instantiateVMs 604, which in turn may be used to instantiateVNFs 602, which in turn may be used to establish sessions. The different combinations for howsuch resources 608 may be assigned may vary in complexity and efficiency. For example, different assignments may have different limits of the number of sessions that can be established given aparticular hardware platform 606. - For example, consider a session that may require
gateway VNF 602 a andPCRF VNF 602 b.Gateway VNF 602 a may require fiveVMs 604 instantiated on thesame server 612, andPCRF VNF 602 b may require twoVMs 604 instantiated on thesame server 612. (Assume, for this example, that no affinity or anti-affinity rules restrict whetherVMs 604 forPCRF VNF 602 b may or must be instantiated on the same ordifferent server 612 thanVMs 604 forgateway VNF 602 a.) In this example, each of twoservers 612 may havesufficient resources 608 to support 10VMs 604. To implement sessions using these twoservers 612,first server 612 may be instantiated with 10VMs 604 to support two instantiations ofgateway VNF 602 a, andsecond server 612 may be instantiated with 9 VMs: fiveVMs 604 to support one instantiation ofgateway VNF 602 a and fourVMs 604 to support two instantiations ofPCRF VNF 602 b. This may leave the remainingresources 608 that could have supported thetenth VM 604 onsecond server 612 unused (and unusable for an instantiation of either agateway VNF 602 a or aPCRF VNF 602 b). Alternatively,first server 612 may be instantiated with 10VMs 604 for two instantiations ofgateway VNF 602 a andsecond server 612 may be instantiated with 10VMs 604 for five instantiations ofPCRF VNF 602 b, using allavailable resources 608 to maximize the number ofVMs 604 instantiated. - Consider, further, how many sessions each
gateway VNF 602 a and eachPCRF VNF 602 b may support. This may factor into which assignment ofresources 608 is more efficient. For example, consider if eachgateway VNF 602 a supports two million sessions, and if eachPCRF VNF 602 b supports three million sessions. For the first configuration—threetotal gateway VNFs 602 a (which satisfy the gateway requirement for six million sessions) and twototal PCRF VNFs 602 b (which satisfy the PCRF requirement for six million sessions)—would support a total of six million sessions. For the second configuration—twototal gateway VNFs 602 a (which satisfy the gateway requirement for four million sessions) and fivetotal PCRF VNFs 602 b (which satisfy the PCRF requirement for 15 million sessions)—would support a total of four million sessions. Thus, while the first configuration may seem less efficient looking only at the number ofavailable resources 608 used (asresources 608 for the tenthpossible VM 604 are unused), the second configuration is actually more efficient from the perspective of being the configuration that can support more the greater number of sessions. - To solve the problem of determining a capacity (or, number of sessions) that can be supported by a given hardware platform 605, a given requirement for
VNFs 602 to support a session, a capacity for the number of sessions each VNF 602 (e.g., of a certain type) can support, a given requirement forVMs 604 for each VNF 602 (e.g., of a certain type), a give requirement forresources 608 to support each VM 604 (e.g., of a certain type), rules dictating the assignment ofresources 608 to one or more VMs 604 (e.g., affinity and anti-affinity rules), thechasses 610 andservers 612 ofhardware platform 606, and theindividual resources 608 of eachchassis 610 or server 612 (e.g., of a certain type), an integer programming problem may be formulated. - As described herein, a telecommunications system wherein management and control utilizing a software designed network (SDN) and a simple IP are based, at least in part, on user equipment, may provide a wireless management and control framework that enables common wireless management and control, such as mobility management, radio resource management, QoS, load balancing, etc., across many wireless technologies, e.g. LTE, Wi-Fi, and future 5G access technologies; decoupling the mobility control from data planes to let them evolve and scale independently; reducing network state maintained in the network based on user equipment types to reduce network cost and allow massive scale; shortening cycle time and improving network upgradability; flexibility in creating end-to-end services based on types of user equipment and applications, thus improve customer experience; or improving user equipment power efficiency and battery life—especially for simple M2M devices—through enhanced wireless management.
- While examples of a telecommunications system in which messages associated with the user plane replicator can be processed and managed have been described in connection with various computing devices/processors, the underlying concepts may be applied to any computing device, processor, or system capable of facilitating a telecommunications system. The various techniques described herein may be implemented in connection with hardware or software or, where appropriate, with a combination of both. Thus, the methods and devices may take the form of program code (i.e., instructions) embodied in concrete, tangible, storage media having a concrete, tangible, physical structure. Examples of tangible storage media include floppy diskettes, CD-ROMs, DVDs, hard drives, or any other tangible machine-readable storage medium (computer-readable storage medium). Thus, a computer-readable storage medium is not a signal. A computer-readable storage medium is not a transient signal. Further, a computer-readable storage medium is not a propagating signal. A computer-readable storage medium as described herein is an article of manufacture. When the program code is loaded into and executed by a machine, such as a computer, the machine becomes a device for telecommunications. In the case of program code execution on programmable computers, the computing device will generally include a processor, a storage medium readable by the processor (including volatile or nonvolatile memory or storage elements), at least one input device, and at least one output device. The program(s) can be implemented in assembly or machine language, if desired. The language can be a compiled or interpreted language, and may be combined with hardware implementations.
- The methods and devices associated with a telecommunications system as described herein also may be practiced via communications embodied in the form of program code that is transmitted over some transmission medium, such as over electrical wiring or cabling, through fiber optics, or via any other form of transmission, wherein, when the program code is received and loaded into and executed by a machine, such as an EPROM, a gate array, a programmable logic device (PLD), a client computer, or the like, the machine becomes an device for implementing telecommunications as described herein. When implemented on a general-purpose processor, the program code combines with the processor to provide a unique device that operates to invoke the functionality of a telecommunications system.
- While a telecommunications system has been described in connection with the various examples of the various figures, it is to be understood that other similar implementations may be used or modifications and additions may be made to the described examples of a telecommunications system without deviating therefrom. For example, one skilled in the art will recognize that a telecommunications system as described in the instant application may apply to any environment, whether wired or wireless, and may be applied to any number of such devices connected via a communications network and interacting across the network. Therefore, a telecommunications system as described herein should not be limited to any single example, but rather should be construed in breadth and scope in accordance with the appended claims.
- In describing preferred methods, systems, or apparatuses of the subject matter of the present disclosure—user plane replicator—as illustrated in the Figures, specific terminology is employed for the sake of clarity. The claimed subject matter, however, is not intended to be limited to the specific terminology so selected, and it is to be understood that each specific element includes all technical equivalents that operate in a similar manner to accomplish a similar purpose. In addition, the use of the word “or” is generally used inclusively unless otherwise provided herein.
- This written description uses examples to enable any person skilled in the art to practice the claimed subject matter, including making and using any devices or systems and performing any incorporated methods. The patentable scope is defined by the claims, and may include other examples that occur to those skilled in the art (e.g., skipping steps, combining steps, or adding steps between exemplary methods disclosed herein). Such other examples are intended to be within the scope of the claims if they have structural elements that do not differ from the literal language of the claims, or if they include equivalent structural elements with insubstantial differences from the literal languages of the claims.
- Methods, systems, and apparatuses, among other things, as described herein may provide for determining whether to send data traffic through or to a device. A method, system, computer readable storage medium, or apparatus may obtain an indication that a first device is connected with a network; based on the first device connecting with the network, obtain redirected data traffic, wherein the redirected traffic is from the device to a second device; simulate the redirected data traffic on a virtual machine that replicates the image of the second device; based on the simulating, determine a risk score for the redirected data traffic; and based on the risk score, send instructions to not allow the redirected data traffic to be sent to the second device. The obtaining the redirected data traffic may be further based on the first device being proximate to the second device or the first device running multiple other applications that are not related to the application that originated the redirected data traffic. The second device may be an autonomous vehicle or an internet of things device. Further the apparatus may send an alert to a third device to remedy the image of the second device, wherein the remedy may include sending an updated image to the second device to replace the current image of the second device. The replicator may alter the data sent to the device based on what it is learned after execution. All combinations in this paragraph (including the removal or addition of steps) are contemplated in a manner that is consistent with the other portions of the detailed description. The functions may be distributed over multiple devices.
Claims (20)
1. An apparatus comprising:
a processor; and
a memory coupled with the processor, the memory storing executable instructions that, when executed by the processor, cause the processor to effectuate operations comprising:
based on a first device connecting with a network, obtaining redirected data traffic, wherein the redirected data traffic is from the first device intended for a physical second device, and wherein the physical second device is associated with a vehicle;
based on the obtaining the redirected data traffic, creating an image of the physical second device using a virtual machine;
receiving, by the virtual machine, the redirected data traffic;
simulating, using the redirected data traffic by the virtual machine, actions of the physical second device, resulting in simulated actions;
based on the simulating, determining a risk score for the redirected data traffic, wherein the risk score is based on a threat level of one or more actions of the simulated actions that would be taken by the physical second device if the redirected data traffic would have been sent to the physical second device; and
based on the risk score, permitting data traffic from the first device to be sent to the physical second device.
2. The apparatus of claim 1 , wherein the first device is a mobile device.
3. The apparatus of claim 1 , wherein the physical second device is an autonomous vehicle.
4. The apparatus of claim 3 , wherein the one or more actions of the simulated actions is an increase in speed of the autonomous vehicle.
5. The apparatus of claim 1 , wherein the physical second device is an Internet-of-Things (IoT) device.
6. The apparatus of claim 1 , wherein the operations further comprise altering the data traffic, resulting in altered data traffic, and sending the altered data traffic.
7. The apparatus of claim 1 , wherein the operations further comprise sending an alert to a third device to remedy the image of the physical second device, and wherein the remedy comprises sending an updated image to the physical second device.
8. A non-transitory computer readable storage medium storing computer executable instructions that, when executed by a computing device, cause the computing device to effectuate operations comprising:
based on a determination that a first device is communicatively coupled with a network, obtaining redirected data traffic, wherein the redirected data traffic is from the first device intended for a physical second device, and wherein the physical second device is associated with a vehicle;
based on the obtaining the redirected data traffic, creating an image of the physical second device using a virtual network function;
receiving, by the virtual network function, the redirected data traffic;
simulating, using the redirected data traffic by the virtual network function, actions of the physical second device, resulting in simulated actions;
based on the simulating, determining a risk score for the redirected data traffic, wherein the risk score is based on a threat level of one or more actions of the simulated actions that would be taken by the physical second device if the redirected data traffic would have been sent to the physical second device; and
based on the risk score, permitting data traffic from the first device to be sent to the physical second device.
9. The non-transitory computer readable storage medium of claim 8 , wherein the obtaining the redirected data traffic is based on the first device being within a threshold distance from the physical second device.
10. The non-transitory computer readable storage medium of claim 8 , wherein the physical second device is an autonomous vehicle.
11. The non-transitory computer readable storage medium of claim 10 , wherein the one or more actions of the simulated actions is an increase in speed of the autonomous vehicle.
12. The non-transitory computer readable storage medium of claim 8 , wherein the physical second device is an Internet-of-Things (IoT) device.
13. The non-transitory computer readable storage medium of claim 8 , wherein the operations further comprise altering the data traffic, resulting in altered data traffic, and sending the altered data traffic.
14. The non-transitory computer readable storage medium of claim 8 , wherein the operations further comprise sending an alert to a third device to remedy the image of the physical second device, and wherein the remedy comprises sending an updated image to the physical second device.
15. A system comprising:
one or more processors; and
memory coupled with the one or more processors, the memory storing executable instructions that, when executed by the one or more processors, cause the one or more processors to effectuate operations comprising:
based on detecting a first device connecting with a network, obtaining redirected data traffic, wherein the redirected data traffic is from the first device intended for an autonomous vehicle;
based on the obtaining the redirected data traffic, creating an image of the autonomous vehicle using a virtual network function;
receiving, by the virtual network function, the redirected data traffic;
simulating, using the redirected data traffic by the virtual network function, actions of the autonomous vehicle, resulting in simulated actions;
based on the simulating, determining a risk score for the redirected data traffic, wherein the risk score is based on a threat level of one or more actions of the simulated actions that would be taken by the autonomous vehicle if the redirected data traffic had been sent to the autonomous vehicle; and
based on the risk score, permitting data traffic from the first device to be sent to the autonomous vehicle.
16. The system of claim 15 , wherein the obtaining the redirected data traffic is based on the first device being within a threshold distance from the autonomous vehicle.
17. The system of claim 15 , wherein the operations further comprise altering the data traffic, resulting in altered data traffic, and sending the altered data traffic.
18. The system of claim 15 , wherein the first device is a second autonomous vehicle.
19. The system of claim 15 , wherein the first device is an Internet-of-Things (IoT) device.
20. The system of claim 15 , wherein the operations further comprise sending an alert to a third device to remedy the image of the autonomous vehicle, and wherein the remedy comprises sending an updated image to the autonomous vehicle.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US17/686,737 US20220217582A1 (en) | 2019-05-01 | 2022-03-04 | User plane replicator |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US16/400,141 US11304091B2 (en) | 2019-05-01 | 2019-05-01 | User plane replicator |
US17/686,737 US20220217582A1 (en) | 2019-05-01 | 2022-03-04 | User plane replicator |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/400,141 Continuation US11304091B2 (en) | 2019-05-01 | 2019-05-01 | User plane replicator |
Publications (1)
Publication Number | Publication Date |
---|---|
US20220217582A1 true US20220217582A1 (en) | 2022-07-07 |
Family
ID=73017065
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/400,141 Active US11304091B2 (en) | 2019-05-01 | 2019-05-01 | User plane replicator |
US17/686,737 Abandoned US20220217582A1 (en) | 2019-05-01 | 2022-03-04 | User plane replicator |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/400,141 Active US11304091B2 (en) | 2019-05-01 | 2019-05-01 | User plane replicator |
Country Status (1)
Country | Link |
---|---|
US (2) | US11304091B2 (en) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11894983B2 (en) * | 2020-03-16 | 2024-02-06 | Red Hat, Inc. | Simulation and testing of infrastructure as a service scale using a container orchestration engine |
US20230289435A1 (en) * | 2022-03-10 | 2023-09-14 | Denso Corporation | Incident response according to risk score |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20160337169A1 (en) * | 2015-05-13 | 2016-11-17 | Cisco Technology, Inc. | Peer-assisted image update with self-healing capabilities |
US20180144139A1 (en) * | 2016-11-21 | 2018-05-24 | Zingbox, Ltd. | Iot device risk assessment |
US20190132345A1 (en) * | 2017-10-27 | 2019-05-02 | Atto Research Co., Ltd. | Apparatus for network function virtualization using software defined networking and operation method thereof |
US20200076831A1 (en) * | 2018-01-31 | 2020-03-05 | International Business Machines Corporation | Torrent attack detection |
US20200314116A1 (en) * | 2019-03-26 | 2020-10-01 | International Business Machines Corporation | Remote interference assessment and response for autonomous vehicles |
US10893059B1 (en) * | 2016-03-31 | 2021-01-12 | Fireeye, Inc. | Verification and enhancement using detection systems located at the network periphery and endpoint devices |
Family Cites Families (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10356080B2 (en) * | 2017-03-17 | 2019-07-16 | Verizon Patent And Licensing Inc. | System and method for centralized authentication and authorization for cloud platform with multiple deployments |
US11297103B2 (en) * | 2018-04-30 | 2022-04-05 | Battelle Memorial Institute | High-fidelity model-driven deception platform for cyber-physical systems |
US11290437B2 (en) * | 2018-12-27 | 2022-03-29 | Beijing Voyager Technology Co., Ltd. | Trusted platform protection in an autonomous vehicle |
-
2019
- 2019-05-01 US US16/400,141 patent/US11304091B2/en active Active
-
2022
- 2022-03-04 US US17/686,737 patent/US20220217582A1/en not_active Abandoned
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20160337169A1 (en) * | 2015-05-13 | 2016-11-17 | Cisco Technology, Inc. | Peer-assisted image update with self-healing capabilities |
US10893059B1 (en) * | 2016-03-31 | 2021-01-12 | Fireeye, Inc. | Verification and enhancement using detection systems located at the network periphery and endpoint devices |
US20180144139A1 (en) * | 2016-11-21 | 2018-05-24 | Zingbox, Ltd. | Iot device risk assessment |
US20190132345A1 (en) * | 2017-10-27 | 2019-05-02 | Atto Research Co., Ltd. | Apparatus for network function virtualization using software defined networking and operation method thereof |
US20200076831A1 (en) * | 2018-01-31 | 2020-03-05 | International Business Machines Corporation | Torrent attack detection |
US20200314116A1 (en) * | 2019-03-26 | 2020-10-01 | International Business Machines Corporation | Remote interference assessment and response for autonomous vehicles |
Also Published As
Publication number | Publication date |
---|---|
US20200351708A1 (en) | 2020-11-05 |
US11304091B2 (en) | 2022-04-12 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10884814B2 (en) | Mobile edge-cloud security infrastructure | |
US11429408B2 (en) | System and method for network function virtualization resource management | |
EP4002904A1 (en) | Technologies for radio equipment cybersecurity and multiradio interface testing | |
KR20210149576A (en) | Multi-entity resource, security and service management in edge computing deployments | |
Santos et al. | Towards low-latency service delivery in a continuum of virtual resources: State-of-the-art and research directions | |
US20220217582A1 (en) | User plane replicator | |
US10742516B1 (en) | Knowledge aggregation for GAN-based anomaly detectors | |
US20200007445A1 (en) | Enhanced service function chain | |
Fernando et al. | Opportunistic fog for IoT: Challenges and opportunities | |
Thurgood et al. | Cloud computing with Kubernetes cluster elastic scaling | |
US10628198B2 (en) | Hypervisor management of migration notification and response messages for virtual machines | |
US11909845B2 (en) | Methods and systems for managing applications of a multi-access edge computing environment | |
da Silva Barbosa et al. | A platform for cloudification of network and applications in the Internet of Vehicles | |
Chiang et al. | Management and orchestration of edge computing for iot: A comprehensive survey | |
WO2016093847A1 (en) | Discovery mechanism for service server connection | |
US20220329529A1 (en) | 5g filters for virtual network functions | |
Kirsanova et al. | Fog computing state of the art: concept and classification of platforms to support distributed computing systems | |
US20210037061A1 (en) | Managing machine learned security for computer program products | |
US11743790B2 (en) | 5G and SDN powered virtualized personal device framework | |
Snehi et al. | SDN‐Based Cloud Combining Edge Computing for IoT Infrastructure | |
US11658821B2 (en) | Cybersecurity guard for core network elements | |
US20210182093A1 (en) | Native cloud live traffic migration to counter suspected harmful traffic | |
US11108652B2 (en) | Server assisted network discovery (SAND) | |
US20220377105A1 (en) | Intelligent orchestration to combat denial of service attacks | |
KR102266051B1 (en) | Method for processing huge data and constructing high performance nfv system |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
AS | Assignment |
Owner name: AT&T MOBILITY II LLC, GEORGIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MARIA, ARTURO;REEL/FRAME:059572/0353 Effective date: 20190424 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |