WO2006013187A1

WO2006013187A1 - Network access control for a failsafe network transmission

Info

Publication number: WO2006013187A1
Application number: PCT/EP2005/053696
Authority: WO
Inventors: Michael Menth; Joachim Charzinski
Original assignee: Siemens Aktiengesellschaft
Priority date: 2004-07-30
Filing date: 2005-07-28
Publication date: 2006-02-09
Also published as: EP1771980A1; CN1993938A

Abstract

The invention relates to a method for load limitation in a communication network (AS1) formed by links and nodes. In a communication network (AS1) the load limitation is carried out by a checking of the validity comprising at least one validity check, relating to a first node (X) and a second node (C). The load for transmission is thus transmitted in the communication network (AS1), such as to first pass by the first node (X) and subsequently by the second node (C). Non-validation of the load for transmission occurs on exceeding a threshold value for the valid load on at least one validity check. According to the invention, network transmission to a further communication network (AS2) is taken into account, whereby a network input node of a further communication network (AS2), formed by links and nodes is determined as second node (C), or a network output node of a further communication network (AS2) formed by links and nodes is determined as first node (X). The above permits network transmissions to be taken into account on checking the load validity. Redundant resources, for example, can thus be used for prevention of drop-out in network transmissions on determining thresholds related to checking of load validity.

Description

description

Network access control for a fail-safe gateway

The invention relates to a method, a network element and a communication network for traffic limitation in a communication network formed with links and nodes.

One of the most important developments currently in the field of networks is the further development of data networks for the

Transmission of real-time traffic, such as voice, video or audio data.

The most widespread and widely used network technology in the area of data networks is based on the transmission of data packets by means of the so-called IP protocol (Internet Protocol). The most important use case of this network technology is the so-called Internet, actually a network in which data can be exchanged practically worldwide via interconnected networks, which are also called autonomous systems (of the English autonomous system). Conventionally, packet-oriented networks such as the Internet were provided for the transmission of data in the context of a so-called "best effort", ie for a data transmission without the guarantee of quality of service features real-time traffic mechanisms must be provided for the provision of quality of service features.

An important approach to ensuring quality of service for transmission over packet-oriented networks is strict control of traffic flowing into and out of the network (the term "policing" is also common in English.) Access control then often still remains extended with other measures, for example, for rapid response to incidents in order to be able to guarantee the quality of service. A more recent approach to access control in packet-oriented networks is described in the publications WO2004021947 and WO2004021648. In this case, an entry node and an exit node are determined for traffic to be routed through a packet network, and access controls are carried out based on these entry and exit nodes. This can be done, for example, by limiting the traffic flowing between the input node and the output node (WO 2004021647) or by carrying out separate checks for the traffic entering the input node and for the traffic exiting at the output node (WO2004021648). , By means of such access controls, it is possible to ensure that overload situations are avoided within the network and, as a result, reliable statements about the

Quality of service are enabled. In this way, the individual networks or autonomous systems of a network network can be extended for transmission in compliance with quality of service characteristics. For transmission over several networks, it must also be ensured that in the transmission between the individual networks, the quality of service features realized within the networks (often also referred to as quality of service) are likewise guaranteed. This applies, on the one hand, to a traffic restriction to avoid an overload, and, on the other hand, to a redundancy for intercepting faults or failures.

One way to meet these quality criteria when transmitting between networks is to provide two or more links between the various networks representing mutual reserve links or backup links, and at the same time to dimension the traffic so that during normal operation and the various sturgeon scenarios no overload occurs. Such handling of links between different networks or inter-domain links proves difficult in coordination with access control within the individual networks (or intra-domain access control), because both Problems are coupled with each other. The determination of the parameters in the intra-domain access control would then have to take place in accordance with the interdomain conditions.

The object of the invention is to improve the access control in packet-oriented networks with regard to the requirements of the inter-domain transmission of traffic.

The task is solved by the subjects of the independent claims.

The invention is based on a method in which a check of admissibility is carried out for a network or autonomous system for traffic formed by links and nodes, which refers to a first and a second node. This verification of admissibility is realized by means of one or more admissibility checks. The two nodes, ie the first and the second node, are related to the traffic to be transmitted in such a way that the traffic is to pass first the first node and later the second node. The first node may, for example, be a network input node or a traffic-generating node, ie a source node of the communication network. In the admissibility check (s), it is checked whether the approval of the traffic to be transmitted would lead to the exceeding of a limit value and that the transmission would not be permitted if approval would entail exceeding at least one limit value. According to the invention, a network input node of a further communications network formed with links and nodes, into which the traffic to be transmitted is to be transmitted, is not defined as the second node, as is conventionally the case, for a network output node of the considered communications network. Alternatively, a network output node of a further communication network is defined as the first node, from which the traffic is to be transmitted to the considered communication network. Both alternatives are obvious. se for different networks of a network but also for the same network (eg, first and second nodes belong to other networks) combine.

As a result of the displacement of the first or second reference point or node into another network upstream or downstream of the traffic to be transmitted, the network transition between two networks is included in the concept for traffic limitation. Dimensioning the limit values for the admissibility checks for limiting traffic in the communications network in question in terms of the requirements of avoiding overload and providing redundancy thus takes into account the transition between the two networks, so that there is no separate problem for this case must be solved. To provide redundancy, it is advantageous if both networks are connected by at least two links. For example, At least two links are then provided, which lead from the considered communication network to the network node representing the second node of the further communication network, so that if one link fails, the second can assume the traffic conducted via this link. In the alternative, then at least two links lead from the output node of the other network to the be¬ considered communication network.

The verification of admissibility can be carried out for individual packages or flows. It is also possible to provide for an admissibility check only for certain traffic classes and to accept delays and the throwing of parcels in the case of low-priority traffic classes or a low-priority traffic class. Typically, such a traffic class will be used for conventional data traffic.

There are various possibilities for realizing a check of the permissibility, which refers to a first and a second node. Examples are: • An admissibility check by means of a limit value for the traffic volume between the first and the second node.

Two admissibility checks, namely a first admissibility check with the aid of a limit value for the traffic passing through the first node and a second permissibility check with the aid of a limit value for traffic passing through the second node.

• Many admissibility checks, namely for links affected by the traffic to be transmitted, a first link - related admissibility check using a limit value for the traffic passing the first node and the link, and a second link - related admissibility check using a limit value for the second node and respective link passing traffic.

The subject of the invention also comprises a network element with means for carrying out a method according to the invention. Such a network element may e.g. be given by:

• A device for access control or admission control unit, e.g. a side-by-side computer that is placed next to a router or a remote resource management unit, a so-called bandwidth broker, or a software component in a router that operates according to a method of the invention.

A network management unit or a network control server or network control server which calculates the admission control budgets and / or configures them in the above-mentioned units.

A network planning tool which uses the method according to the invention in determining the necessary link capacities for a given traffic or the traffic permissible in a network.

• A unit (eg in network management or elsewhere) that is involved in contract negotiations with neighboring Network operators (manually or automatically) calculates whether a desired SLA (Service Level Agreement) can be realized and / or with which alternative parameters (eg bandwidth request) the SLA could be promised.

In addition, the subject invention comprises a communication network with means for carrying out a method according to the invention. Such a communication network can in particular comprise a network element with means for carrying out a method according to the invention.

In the following, the subject invention is explained in more detail in the context of an embodiment with reference to figures. 1 shows a conventional linking of networks for a secure intermediate domain routing. FIG. 2 A connection of different networks by

Links for an inventive approach.

In FIG. 1 and FIG. 2, three networks or autonomous systems AS1, AS2 and AS3 are shown. Traffic can enter and leave these networks through edge nodes. As an example, some of the figures with ER (ER: Egress Router) designated edge nodes are located in the figures. Typically, for transmission between two autonomous systems, e.g. ASl and

AS2, reliability is achieved by using two edge nodes of the networks and each of these four nodes is connected to each, for example A, B, C and D. Now if, for example, traffic from the edge node or edge point X on the autonomous system ASl and If the autonomous system AS2 is to be transmitted to the boundary point Y and from there into the autonomous system AS3, the rank points A, B, C and D provide a fail-safe networking of the intermediate domain transition from the autonomous system AS1 to the autonomous system AS2. If, for example, the link between A and C fails, the traffic that was passed directly from A to C can now be indirectly routed via B or D to C. However, this traditional approach brings the It is difficult to take account of any incidents that may arise in the network as regards admissibility restrictions or policing. This means that, for example, when the link between A and C fails, the traffic routed via B does not lead to an overload at point B. This problem is in networks, which work with a Zulitäts¬ checking ability, which refer to edge nodes or edge points be¬ pull, eg X and A or X and B difficult to handle. In the procedure according to the invention, which is described with reference to FIG. 2, the permissibility is checked, which relates to two edge points, wherein the second edge point is located in the following network. For the traffic which, analogously to FIG. 1, is to be transmitted from the point X via the autonomous systems AS1 and AS2 to the point Y and further to the autonomous system AS3, an admissibility check is now carried out which does not affect the points X and A , or X and B, but refers to the points X and C, that is, to points located in different networks.

It is advantageous to have at least two links leading from the autonomous system AS1 to the point C of the autonomous system AS2. In this case, therefore, there are two points in the first network and one in the second network, each connected to each one. The same applies to the further transmission of traffic from the autonomous system AS2 to the autonomous system AS3. If the link between points A and C fails, the traffic is now routed via point B to C. By fixing the limits for the admissibility check or policing, it is possible to ensure that overload situations such as the failure of the link between A and C do not result in overload situations.

For example, an admissibility check is given which relates to the total traffic transmitted between points X and C. When new traffic to be transmitted between these points is registered at Point X. It will be checked whether the approval of this traffic would exceed the limit. If this is not the case, traffic is transferred between points X and C. It can be calculated on the basis of the topology of the network and the traffic matrix which limit values for edge point can be set to edge-point relationships, so that in view of the distribution of the traffic in the network, overload situations do not occur. Redundancy or interference scenarios can be taken into account by carrying out a corresponding determination of the limits for the admissibility check for all relevant interference scenarios, ie for all topologies of the network that result from corresponding failures and then the minimum over all the incidents considered the limit values for the maximum permissible traffic are used as limit values, so that even if one of the disruptive scenarios occurs, the traffic volume to be transmitted in the network or via the network to another network does not constitute an overload.

Claims

claims

1. A traffic limiting method in a communication network (AS1) formed with links and nodes, wherein - the traffic restriction is checked by means of a verification of the admissions, which relates to a first node (X) and a second node (C) and comprises at least one admissibility check is carried out, where

the traffic to be transmitted is to be transmitted in the communication network (AS1) in such a way that it passes first the first node (X) and later the second node (C), and

- Non-admission of the traffic to be transmitted when exceeding a limit value for the permissible traffic in at least one admissibility check is carried out, characterized in that as the second node (C) a network input node of another formed with links and nodes communication network (AS2) is set or as the first Node (X) a Netzausgangs¬ node of another formed with links and nodes communication network (AS2) is set.

2. The method according to claim 1, characterized in that

as second node (C) a network input node of a further communication network formed with links and nodes

(AS2) is set, and

the first node (X) is a network input node or a traffic generating node of the communication network (AS1),

3. The method according to claim 1, characterized in that - As the first node (X) a network output node of another formed with links and nodes communication network (AS2) is set, and

- The second node (C) is a network output node or a destination node.

4. The method according to any one of the preceding claims, characterized in that the verification of the permissibility for individual packets or flows is performed.

5. The method according to any one of the preceding claims, characterized in that at least two the communication network (ASL) with the further communication network (AS2) connecting links for the transmission of the first node (X) and the second node (C) passing traffic.

6. The method according to any one of the preceding claims, characterized in that for at least one low priority traffic class no admissibility check is performed.

7. The method according to any one of the preceding claims, characterized in that

an admissibility check is carried out by means of a limit value for the traffic volume between the first node (X) and the second node (C).

8. The method according to any one of the preceding claims 1 to 6, characterized in that

a first admissibility check by means of a limit value for the traffic passing through the first node (X) and a second admissibility check is carried out with the aid of a limit value for the traffic passing through the second node (C).

9. The method according to any one of the preceding claims 1 to 6, characterized in that

for links affected by the traffic to be transmitted, a first link-related admissibility check with the aid of a limit value for the traffic passing the first node (X) and the respective link and a second link-related admissibility check with the aid of a limit value for the link second node (C) and the respective link passing traffic is performed.

10. Network element, in particular network nodes, with means for

Implementation of a method according to one of claims 1 to 9.

11. Communication network (ASI) with means for carrying out a method according to one of claims 1 to 9.