WO2009030172A1

WO2009030172A1 - A method and system for controlling network service

Info

Publication number: WO2009030172A1
Application number: PCT/CN2008/072220
Authority: WO
Inventors: Zhenzhu Lv; Chuntao Wang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-09-06
Filing date: 2008-09-01
Publication date: 2009-03-12

Abstract

A method for controlling network service which is transferred among the terminals by policy enforcement point includes: (a) policy enforcement point obtains dynamic deep packet inspection service controlling policy from policy decision point; (b) policy enforcement point detects service identifier of data stream from terminals by deep packet inspection method; policy enforcement point selects dynamic deep packet inspection service controlling policy matching the service type of data stream and processes the data stream according to the dynamic deep packet inspection service controlling policy. A corresponding system for controlling network service is also provided. Processing data stream by dynamic deep packet inspection service controlling policy realizes the different service qualities guarantee when different users use network service. Meanwhile, the control of network service is realized by providing dynamic policy control and then the cost of network operation is reduced.

Description

Method and system for controlling network service

This application claims priority to Chinese Patent Application No. 200710145628.0, entitled "A Method and System for Controlling Network Services", filed on September 06, 2007, the entire contents of which is incorporated herein by reference. In the application.

Technical field

The present invention relates to the field of communications, and in particular, to a method and system for controlling network services.

Background technique

With the continuous development of IP technology, IP-based broadband bearer networks will become the next generation telecommunications network. The quality of service (QoS) and security issues of telecommunications services are key issues that must be addressed in IP-based next-generation telecommunications networks. In the next generation telecommunication network, in order to ensure service transmission, it is necessary to effectively control the use of the entire bearer network, especially for the voice or multimedia service based on the P2P method that is constantly appearing on the network.

At present, relevant standards organizations in the industry have proposed similar bearer control layers to achieve QoS guarantee. For example, in the PCC (Policy and Charging Control Architecture) of 3GPP (The Third Generation Partnership Project), the data flow is passed through a policy control mechanism based on service and user subscription information. At the gateway (GW), the gateway implements control functions based on dynamic policies issued by the Policy and Charging Rules Function (Factors for Policy Control and Flow-based Accounting Control) to ensure the legitimacy of data flows. Traffic policing and shaping, and queue scheduling.

And at ETSI (European Telecommunications Standardization Institute) TISPAN (Telecommunications and

In the Internet Protocol Harmonization Over Networks, a similar RACS (Resource and Admission Control Sub-system) architecture, the functionality of SPDF is similar. Part of the functions of the PCRF of 3GPP. Of course, the two standards are slightly different in terms of the implementation details of the access network due to their inconsistency.

However, both the current 3GPP PCC and ETSI TISPAN RACS proposed QoS control procedures and related strategies are mainly for session-based services, that is, PDF (Policy Control Function) is to obtain dynamic service information by interacting with AF (adaptive module). . However, such QoS control mechanisms cannot be applied to current P2P (Peer-to-Peer) services such as Skype, BT, MSN, and the like. Such P2P The biggest feature of the service is: The third-party content provider provides and controls the service, and the network operator's device does not participate in the signaling interaction process of the service establishment. Therefore, the network operator cannot ensure that the third-party AF will actively interact with the PDF before requesting the service, so that the network operator cannot guarantee the dynamic policy control that can implement such a service, which is not conducive to the operation and maintenance of the network.

At present, the method of implementing the network control is mainly to place a firewall in front of the edge node of the core network boundary, and to implement the control of the P2P service by statically configuring the policy of the P2P service on the firewall. However, in this solution, the policy for P2P services is implemented through static configuration and the control cannot be refined to specific users, and cannot be flexibly applied to various service operation modes (for example, users are allowed to use P2P services for paying extra charges). Other users are not allowed to use it). At the same time, the new P2P service has the characteristics of rapid emergence and development. Therefore, when the P2P service changes, the service policy configuration rule can be added or modified through frequent manual operations, which is not conducive to network operation and maintenance.

Summary of the invention

Embodiments of the present invention provide a method for controlling network services, which solves the problem in the above-mentioned next generation telecommunication network.

The control strategy of P2P services is too simple and not flexible enough.

The embodiment of the invention further provides a system for controlling network services, which solves the defect that the control strategy for the P2P service in the next generation telecommunication network is too simple and not flexible enough.

To achieve the above objective, the technical solution of the embodiment of the present invention is implemented as follows:

A method for controlling network services, where the network services are transmitted between terminals via a policy enforcement point, including the following steps:

(a) The policy enforcement point obtains a dynamic deep packet inspection service control strategy from the policy decision point;

(b) the policy enforcement point uses a deep packet inspection method to identify a service identifier of the data stream from the terminal; and selects a dynamic deep packet detection service control policy that matches the service type of the data stream, and according to the dynamic The deep packet inspection service control policy processes the data stream.

A system for controlling network services, the network services being transmitted between terminals via a policy enforcement point, including a policy enforcement point, a policy decision point, a user subscription database, and an operator policy database connected to the network,

The policy decision points include:

a policy generation module, where the policy generation module obtains user subscription information and business policy information locally, or obtains user subscription information from the user subscription database and acquires the industry from the operator policy database. Transmitting policy information, and generating a dynamic deep packet inspection service control policy according to the user subscription information and the business policy information;

The policy enforcement points include:

a deep packet inspection module, configured to detect and identify a user identifier and a service identifier of a data stream from the terminal by using a deep packet inspection method;

And a policy execution module, configured to process the data flow from the terminal according to the dynamic deep packet inspection service control policy obtained from the policy decision point.

Compared with the prior art, the technical solution provided by the embodiment of the present invention, for the network service forwarded between the terminals through the policy execution point, uses the dynamic deep packet detection service control obtained from the policy decision point by the policy execution point. The strategy processes the data flow and implements dynamic control of such services, thereby solving the shortcomings of the existing next-generation telecommunication network that the control strategy for such services is too simple and not flexible; and realizing the network operators to such services Control, which reduces the cost of network operations. At the same time, the embodiment of the present invention can implement differentiated service quality assurance when different users use the network service. DRAWINGS

1 is a schematic structural diagram of a system for controlling a network service according to an embodiment of the present invention;

2 is a flowchart of a method for controlling a network service in an embodiment of the present invention;

Figure 3 is a schematic view of the first embodiment of the method of Figure 2;

Figure 4 is a schematic illustration of a second embodiment of the method of Figure 2.

detailed description

The invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

FIG. 1 is a schematic structural diagram of a system for controlling network services in an embodiment of the present invention. The system for controlling network services includes a Policy Enforcement Point (PEP) 12 connected to a network, a Policy Decision Point (POP) 15, and a Subscription Profile Repository (SPR) 13 and The Policy Provision Repository (PPR) 14 , wherein the policy enforcement point 12 is connected to a plurality of terminals 11 , so that the terminal 11 can perform data transmission via the policy execution point 12 . The user refers to a virtual entity that enters the system using the user ID on the terminal 11 and uses the system, and the user's operation in the system is implemented by the terminal 11.

The operator policy database 14 includes service policy information, and the service policy information includes The SLA (Service Level Agreement) policy and the service feature mode information of the user group, the service or the third-party operator, and the service feature mode information includes the P2P service feature mode information. The user subscription database 13 includes user subscription information, which is information signed with the network operator, and the information is based on user-level quality of service (QoS) policy information, including user group information, user service quality subscription information, and service. Order relationship, etc.

The policy decision point 15 retrieves the policy from the operator policy database 14 and the user subscription database 13 and interprets the policy and sends the policy to the policy enforcement point 12 for execution. The policy decision point 15 needs to translate the policies retrieved from the operator policy database 14 and the user subscription database 13 into a format that the corresponding policy enforcement point 12 can understand. The policy decision point 15 also receives the policy request message from the policy enforcement point 12 and returns the corresponding policy.

In this embodiment, the policy decision point 15 includes a policy generation module 151. The policy generation module 151 obtains service policy information from the operator policy database 14, and obtains user subscription information from the user subscription database 13, and then according to the service policy information and The user subscription information generates a dynamic deep packet inspection service control strategy. The dynamic deep packet inspection service control policy includes a user identifier, a service identifier, and at least one of the following three: a quality of service level, a current limit number, and an uplink and downlink bandwidth, and the dynamic deep packet inspection service control policy may further include other some information.

The policy enforcement point 12 includes a deep packet inspection module 121 and a policy enforcement module 122. The deep packet inspection module 121 is configured to detect and identify the user identifier of the data packet from the terminal 11 and the service identifier of the marked service type by using a Deep Packet Inspection (DPI) method. The policy execution module 122 is configured to obtain a specific policy from the policy decision point 15 and process the data flow passing through the policy execution point 12 according to the specific policy obtained above. The data flow is transmitted from one terminal to another terminal, and the policy enforcement point 12 is an intermediate node in the data channel. In practical applications, the policy execution point 12 includes a gateway, a firewall, a router, a security operating system, and the like. In this embodiment, after the policy execution point 12 identifies the data packet type by the deep data packet detecting module 121, the policy execution module 122 detects the data flow of the service control policy processing terminal 11 according to the dynamic deep data packet from the policy decision point 15. For example, CAR (Committed Access Rate), traffic limiting, marking priority, congestion avoidance, packet loss, and so on.

In this embodiment, a first trigger module is included, and the first trigger module triggers the policy generation module 151 to generate a corresponding dynamic depth number when receiving the policy request message from the policy execution point 12. According to the packet detection service control policy, the policy request message includes the user identifier obtained by the deep packet inspection module 121 and the service identifier generation.

In another embodiment of the present invention, a second triggering module is configured to trigger the policy generation module 151 to generate a corresponding dynamic deep packet inspection service control policy when the terminal 11 receives the online message, the online message Information including a user identification or similar tag login terminal 11. At this time, the policy generation module 151 acquires the service policy information of all types of services from the operator policy database 14, and generates a plurality of dynamic deep packet inspection service control policies to be transmitted to the policy execution point 12. After the policy execution point 12 identifies the data stream by the deep packet inspection method, the dynamic depth packet detection service control policy matching the service type of the data stream is selected to process the data stream.

As shown in FIG. 2, it is a flowchart of a method for controlling network services according to an embodiment of the present invention. The network service is transmitted between the terminals 11 via the policy enforcement point 12, and includes the following steps:

Step S21: The policy execution point 12 acquires a dynamic deep packet inspection service control policy of the corresponding user from the policy decision point 15. The dynamic deep packet inspection service control policy is generated by the policy decision point 15 according to the user subscription information of the user subscription database and the business policy information of the operator policy database. Of course, the dynamic deep packet inspection service control strategy can also be directly set as needed. The dynamic deep packet inspection service control policy includes a user identifier, a service identifier, and at least one of the following three: a quality of service level, a current limit number, and an uplink and downlink bandwidth.

The policy decision point 15 generates a dynamic deep packet inspection service control policy upon receiving the policy request message from the policy enforcement point 12, or generates a dynamic deep packet inspection service control policy upon receiving the online message of the terminal 11.

Step S22: The policy execution point processes the data flow from the terminal according to the dynamic deep data packet detection service control policy. For example, CAR, current limit, mark priority, congestion avoidance, packet loss, etc.

As shown in FIG. 3, it is a data flow diagram of the first embodiment of the method of FIG. 2.

First, after the policy execution point 12 is started or during the operation, by interacting with the network management or the supplier policy database 14 or other third-party database, the interaction process belongs to the prior art, and thus does not appear in the figure. The result of the interaction is expressed, and the service feature pattern information and the corresponding service identifier are sent to the policy execution point 12 for record keeping. The policy execution point 12 can also obtain the service feature mode information and the corresponding service identifier in a static configuration manner.

In this embodiment, the service feature mode information includes P2P service feature mode information, for example, The business feature mode of BT download is "|13|BitTorrent protocol". Of course, other types of service feature mode information may also be included in a specific application.

The service identifier may be information of the quintuple information (including the source and destination IP addresses, the source and destination port numbers, and the protocol number), the service name string, the service identifier index, or the port number used to identify the service.

In addition, after the policy decision point 15 is initiated, the user subscription information is obtained from the user subscription database 13 and the user subscription information is saved to its local record. Similarly, after the policy decision point 15 is started, the service policy information is obtained from the vendor policy database 14 and the service policy information is saved to its local record. The service policy information includes the service identifier and the corresponding operator policy rule.

The terminal 11 initiates a service to generate a data stream and sends the data stream to the policy enforcement point 12. When the policy execution point 12 receives the data stream, it performs deep packet inspection on the data stream, identifies the service identifier corresponding to the data stream, and obtains the user identifier corresponding to the data stream, and then proceeds to the policy according to the service identifier and the user identifier. The decision point 15 initiates a policy request message to obtain a data flow processing policy, where the policy request message carries a user identifier and a service identifier. In this process, for unrecognized traffic, you can implement packet loss or use BF (ie, best effort forwarding) to schedule and forward.

As a flexible and effective service identification technology, DPI technology has been rapidly developed in recent years in firewalls, service control gateways, and policy control systems. The so-called "depth" is compared with the normal message analysis hierarchy. The normal message analysis only analyzes the content below the transport layer of the IP packet, including the source address, destination address, source port, destination port, and protocol type. In addition to the previous analytic hierarchy analysis, DPI also adds application layer analysis.

In this embodiment, the DPI method is used to identify the service identifier of the data stream, and the content of the transport layer may be identified first. For example, if the port number used by the fixed FTP service is identified, the data stream may be determined as a File Transfer Protocol (FTP). The data flow of the service can obtain the service identifier corresponding to the data flow by the correspondence between the stored service type and the service identifier. If the service type cannot be determined by analyzing the content of the transport layer, further in-depth analysis is performed to match the service feature mode information. , Get the business identifier of the data stream. For example, if DPI detection is performed on the data stream and "|13|BitTorrent protocol" is detected, the policy execution point 12 can obtain the service identifier of the BT service by matching the locally stored service feature pattern information.

The policy decision point 15 determines and associates the policy information according to the user identifier and the service identifier in the policy request, and determines, when the policy decision point 15 determines that the data flow belongs to the P2P service according to the service identifier, the policy decision Point 15 generates a dynamic deep packet inspection service control strategy. If the user has the user subscription information locally, the user obtains the user subscription information directly; if the policy decision point 15 has the local service policy information, the user subscription information is directly obtained from the local; Local user-free data and service information data, query and obtain user subscription information according to the user identifier to the user subscription database 13, and query and obtain business policy information according to the service identifier to the vendor policy database 14, and then according to the user subscription information and business policy information. A comprehensive decision is made to generate a dynamic deep packet inspection service control policy and return to the policy enforcement point 12. The dynamic deep packet inspection service control policy includes a user identifier, a service identifier, a quality of service level, a current limit number, and an uplink and downlink bandwidth.

Subsequent occurrences of other events, such as termination/subscription of the business relationship by the end user, or changes in the information of the supplier policy database 14 may also trigger the policy decision point 15 to actively update the dynamic deep packet inspection service control policy. Since the dynamic deep packet inspection service control policy is generated when the terminal accesses the system, when the terminal accesses the system, if the user subscription database or the vendor policy database changes, a new dynamic deep data packet is generated according to the changed information. The service control policy is detected, so that the dynamic deep packet inspection service control policy is automatically updated.

Finally, the policy enforcement point 12 detects the service control policy according to the obtained deep data packet, and implements corresponding policy scheduling, such as priority marking, traffic policing/shaping, or congestion processing, on the data flow.

As shown in FIG. 4, it is a schematic diagram of a second embodiment of the method of FIG. 2.

First, the policy decision point 15 obtains user subscription information by interacting with the user subscription database 13 , wherein the user subscription information includes user group information, user service quality level, and service subscription relationship. At the same time, the policy decision point 15 also obtains service policy information of all types of services by interacting with the operator policy database 14, wherein each service policy information includes an SLA policy based on the user group, the service or the third party operator, and also features of the P2P service. Mode information and corresponding service identifiers.

When receiving the user online message, the policy decision point 15 performs comprehensive decision according to the user subscription information and the service policy information of all types of services, and forms a plurality of dynamic deep packet inspection service control policies, wherein the user online message includes the user identifier, and each The dynamic deep packet inspection service control policy includes at least one of a user identifier, a service identifier, and a QoS level, a current limit number, and an uplink and downlink bandwidth, and the dynamic deep packet detection service control policy is sent to the policy execution point 12 .

Subsequent events such as termination/subscription of business relationships by end users, or number of supplier policies According to the information change of the library 14, etc., the policy decision point 15 is also triggered to update the dynamic deep packet inspection service control strategy. In this embodiment, the policy decision point 15 can learn the status of the uplink and the offline of the terminal 11 in two ways: First, the status of the uplink and the offline of the terminal 11 is directly reported to the policy decision point 15 through the policy execution point 12; The NASS notifies the policy decision point 15 that the terminal 11 goes online and offline.

If the policy decision point 15 receives the user subscription information locally, the policy decision point 15 directly obtains the user subscription information locally; if the user does not have the user subscription information locally, the policy decision point 15 actively signs the user to the user. Obtained in database 13. Similarly, if the policy decision point 15 locally has the service policy information, the user subscription information is directly obtained from the local; or the service policy information does not exist locally, and the policy decision point 15 actively obtains the information from the vendor policy database 14.

The policy decision point 15 sends all the dynamic deep packet inspection service control policies and all the service feature mode information and the corresponding service identifiers to the policy enforcement point 12 after the dynamic deep packet detection service control policy is generated. When the data flow reaches the policy execution point 12, the policy execution point 12 uses the deep data packet detection method to match the service feature mode information to identify the service type of the data flow and the corresponding service identifier, and according to the identified service identifier, multiple The dynamic deep packet inspection service control policy selects a dynamic deep packet detection service control policy that matches the service identifier, and implements corresponding policy scheduling, such as priority marking, traffic policing/shaping, or congestion processing actions on the data flow; The data stream implements packet loss or uses BF mode scheduling and forwarding.

It can be seen from the foregoing that, in the technical solution provided by the embodiment of the present invention, for a network service that is forwarded between terminals through a policy execution point, for example, a P2P service, a policy execution point requests a dynamic deep data packet from a policy decision point. The service control policy is detected, and a corresponding deep packet inspection service control policy is performed on the data flow corresponding to the network service. With the solution of the invention, the policy decision point can generate a dynamic deep packet inspection service control strategy, thereby solving the defect that the control strategy of the P2P service in the existing next generation telecommunication network is too simple and not flexible enough.

In addition, in the technical solution of the embodiment of the present invention, when the dynamic deep packet detection service control policy is generated, the service information may be dynamically generated according to the subscription information of the user, thereby facilitating the service operator to implement flexible control on the service for different users. For example, users who pay extra fees are allowed to use P2P services, which makes it easier for operators to operate and maintain the network.

In addition, the network service control is implemented by using the technical solution of the embodiment of the present invention, and the prior art is not required. When a firewall is used for service control during operation, manual operation is frequently performed to add and modify business policy configuration rules, thereby saving human resources and simplifying the business control process.

The above description is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A method for controlling network services, wherein the network service is transmitted between terminals via a policy enforcement point, and the method includes the following steps:

(a) the policy enforcement point obtains the dynamic deep packet inspection service control policy from the policy decision point; (b) the policy enforcement point uses the deep packet detection method to identify the service identifier of the data stream from the terminal; selecting and the data The dynamic deep packet detection service control policy matched by the traffic type of the flow, and the data flow is processed according to the dynamic deep packet inspection service control policy.

The method for controlling network services according to claim 1, wherein the step (a) further comprises:

(al) The policy decision point dynamically generates a dynamic deep packet inspection service control policy based on the user subscription information and the business policy information.

The method for controlling network services according to claim 1, wherein the step (a) further comprises: (al) the policy decision point, when receiving the user online message, according to the user subscription information and the service policy The information dynamically generates a dynamic deep packet inspection service control strategy.

4. The method of controlling network services according to claim 3, wherein the steps are

(al) specifically includes:

(all') policy decision point detects that the user is online;

(al2, ) the policy decision point directly obtains the user subscription information and the service policy information of all types of services from the local; or obtains the user subscription information from the user subscription database, and obtains the business policy information of all types of services from the operator policy database;

(al3, ) The policy decision point dynamically generates a plurality of dynamic deep packet inspection service control policies according to the user subscription information and the service policy information.

The service execution point obtains the service feature mode information and the corresponding service identifier from the network management or the operator policy database or other third-party database, or obtains the service feature mode information and the corresponding service identifier in a static configuration manner. ;

When receiving the data flow from the terminal, the policy enforcement point uses the deep packet detection method to match the service feature pattern, and identifies the corresponding service identifier and user identifier of the data stream; The policy enforcement point generates a policy request message according to the service identifier, and sends the policy request message to the policy decision point.

The method of controlling network services according to claim 5, further comprising:

( al ) The policy decision point generates a dynamic deep packet inspection service control policy according to the user subscription information and the service policy information when receiving the policy request message from the policy enforcement point, where the policy request message includes the user identifier and the service identifier.

The method for controlling network services according to claim 6, wherein the step (al) specifically includes:

( al l ) the policy decision point receives the policy request message sent by the policy enforcement point, where the policy request message includes a user identifier and a service identifier;

(al2) the policy decision point obtains the user subscription information locally according to the user identifier, and obtains the service policy information locally according to the service identifier;

Or obtaining user subscription information from the user subscription database according to the user identifier, and obtaining service policy information from the operator policy database according to the service identifier;

(al3) The policy decision point generates a dynamic deep packet inspection service control policy according to the user subscription information and the service policy information.

The method for controlling network services according to any one of claims 1 to 7, wherein the dynamic deep packet inspection service control policy includes a user identifier, a service identifier, and a quality of service level and a current limit. At least one of the number of times and the uplink and downlink bandwidth.

9. A system for controlling network services, wherein the network service is transmitted between terminals via a policy enforcement point, including a policy enforcement point, a policy decision point, a user subscription database, and an operator policy database connected to the network, wherein

The policy decision points include:

a policy generation module, which acquires user subscription information and business policy information locally, or obtains user subscription information from the user subscription database, and obtains business policy information from the operator policy database, and according to the user subscription information and the business policy. Information generation dynamic deep packet inspection service control strategy;

The policy enforcement points include: a deep packet inspection module, configured to detect and identify a user identifier and a service identifier of a data stream from the terminal by using a deep packet inspection method;

The system for controlling network services according to claim 9, further comprising a first triggering module, wherein when the first triggering module receives the policy request message from the policy execution point, the triggering policy generating module generates A dynamic deep packet detection service control policy corresponding to the user, where the policy request message includes a user identifier and a service identifier.

The system for controlling network services according to claim 9, further comprising a second triggering module, wherein the second triggering module triggers a policy generating module when receiving an online message from the terminal;

The policy generation module acquires service policy information of all types of services from a local or carrier policy database, and generates a plurality of dynamic deep packet detection service control policies to be transmitted to the policy execution module in the policy execution point;

The policy execution module selects a dynamic deep packet detection service control policy processing data stream that matches the service type of the data flow according to the data flow service identifier identified by the deep data packet detection module.