WO2011026345A1

WO2011026345A1 - Deep packet inspection system and packet processing method

Info

Publication number: WO2011026345A1
Application number: PCT/CN2010/072882
Authority: WO
Inventors: 宋晓丽; 杨波
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-09-02
Filing date: 2010-05-18
Publication date: 2011-03-10
Also published as: CN102006216A; CN102006216B

Abstract

A deep packet inspection system and a packet processing method are disclosed. The system comprises a management unit, a control unit and an enforcement unit, the enforcement unit comprises an inspection module and a policy control module, wherein the management unit is used for preserving and managing system information and is provided with the first interface for interaction with an entity in a next generation network; the inspection module performs deep packet inspection for data packets according to identification rules and obtains the first inspection result, the identification rules are issued through the first interface by the entity in the next generation network; the control unit is used for issuing a control policy, the control policy is generated according to the first inspection result and the system information; the policy control module is used for controlling the service flow according to the control policy in the next generation network environment. The technical solution is capable of controlling any service in the next generation network, therefore, the quality of service can be ensured and the needs of users can be met.

Description

Deep message detection system and message processing method

The present invention relates to the field of data communication, and in particular to an in-depth message detection system and a method for processing a deep message that can be simultaneously applied to an NGN (Next Generation Network) and a non-NGN environment. Background technique

With the increasing demand for network traffic control, the DPI (Deep Packet Inspection) device with deep packet inspection function is more and more widely used in the network. DPI equipment With business data flow identification and business data flow control capabilities, working in the transport layer to application layer (layer 2 to layer 7) of the OSI (Open System Interconnect) model, with high data stream processing capability, capable of network The services carried are identified and traffic management, and can be deployed on the backbone network, the metropolitan area network, and the network equipment inside the enterprise network.

The Resource Access Control Facility (RACF) in the NGN environment is based on the QoS (Quality of Service) control of the transmission resources in the NGN based on the transport layer authentication information, the service level, the network policy, and the traffic priority. In research technology, specific strategies include bandwidth reservation, bandwidth allocation, packet filtering, traffic shaping, and priority service processing. In the current RACF, there are two supported resource control modes, one is triggered from the service layer, and the other is UE (User equipment) triggered by transport layer signaling.

However, the above two resource control modes cannot be applied to all services in the NGN network, and are not universal. For example, for some services (such as games and network critical services), the above two resource control modes cannot be applied. Summary of the invention

The object of the present invention is to provide a deep message detection system and a message processing method, which can

All services in the NGN network are controlled.

In order to achieve the above object, the present invention provides a deep packet detection system, including a management unit, a control unit, and an execution unit, where the execution unit includes a detection module and a policy control module, where:

The management unit is configured to save and manage system information, and is provided with a first interface for interacting with an entity in a next generation network;

The detecting module is configured to: perform a deep packet detection on the data packet according to the identification rule, and obtain a first detection result, where the identification rule is a rule that is sent by the entity in the next generation network through the first interface;

The control unit is configured to deliver a control policy, where the control policy is a policy generated according to the first detection result and system information;

And a policy control module, configured to control service traffic in a next generation network environment according to the control policy.

The deep packet detection system, wherein the management unit is further provided with a second interface for interacting with an entity in a network other than the next generation network;

The detecting module performs deep packet inspection on the data packet according to the identification rule of the static configuration of the network management, and obtains the second detection result;

The control unit is further configured to generate a fourth control policy according to the second detection result and system information;

The policy control module is further configured to perform control of service traffic according to the fourth control policy.

The above-mentioned deep packet detection system, wherein the control strategy includes:

a first control policy generated by the control unit according to the first detection result and system information Slightly; and/or

An entity in the next generation network generates a second control policy based on the first detection result and the system information.

In the above-mentioned deep packet detection system, when the control policy is the first control policy, the control unit specifically includes:

a first receiving module, configured to receive the detection result;

a policy generating module, configured to generate the first control policy according to the detection result and the system information;

The first sending module is configured to send the first control policy to the policy control module. The above-mentioned deep packet detection system, wherein, when the control policy is the second control policy, the control unit specifically includes:

a first receiving module, configured to receive the detection result;

An uploading module, configured to upload the detection result to an entity in the next generation network by using the first interface;

a second receiving module, configured to receive the second control policy that is sent by the entity in the next generation network by using the first interface;

And a second sending module, configured to send the second control policy to the policy control module. The above-mentioned deep packet detection system, wherein the control policy further includes a third control policy; the control unit further includes:

And a third sending module, configured to send a third control policy of the network management static configuration received from the management unit to the policy control module.

The above-mentioned deep packet detection system, wherein the control unit further includes:

The information collection module is configured to collect and save the detection result obtained by the detection module for deep packet detection.

The above-mentioned deep packet detection system, wherein the control unit further includes: The associated stream processing module is configured to identify a service type used to generate the control policy according to the multiple detection results saved in the information collection module.

In order to achieve the above object, the embodiment of the present invention further provides a packet processing method, including: the deep packet detection system performs deep packet inspection on the data packet according to the identification rule sent by the entity in the next generation network, and obtains the first a test result;

Generating a control strategy according to the first detection result and system information

The deep packet inspection system controls the traffic according to the control policy.

The foregoing packet processing method, wherein, in a next generation network environment, the control policy includes:

a first control policy generated by the control unit according to the first detection result and system information; and/or

An entity in the next generation network generates a second control policy based on the first detection result and the system information. .

The foregoing packet processing method, wherein, in a network environment other than the next generation network, the deep packet detection system performs deep packet detection on the data packet according to the identification rule, and further includes:

Performing deep packet inspection on the data packet according to the identification rule of the static configuration of the network management system, and obtaining the second detection result;

The depth message detection system generates a fourth control policy according to the second detection result and system information;

The depth packet detection system performs control of service traffic according to the fourth control policy. The foregoing packet processing method, wherein the control policy further includes a third control policy for static configuration of the network management.

The invention has the following beneficial effects:

In the present invention, the data packet is sent by the detection module according to the identification rule issued by the entity in the NGN. Performing deep packet inspection to obtain a detection result, and then the policy control module is configured to control the traffic according to the control policy generated by using the detection result and the system information, so that any service in the NGN can be performed Control, therefore, can guarantee the quality of service and meet the needs of users.

In the present invention, the deep packet detection system and the packet processing method of the present invention can be simultaneously applied to other than NGN and NGN by setting an interface that interacts with an entity in the NGN and an entity in a network other than the NGN. Network, versatile. DRAWINGS

1 is a schematic structural diagram of a depth packet detecting system according to a first embodiment of the present invention; and FIG. 2 is a schematic diagram of a first structure of a control unit according to an embodiment of the present invention.

3 is a schematic diagram of a second structure of a control unit according to an embodiment of the present invention;

FIG. 4 is a schematic flowchart diagram of a method according to an embodiment of the present invention. detailed description

In the embodiment of the present invention, for the NGN network, the packet detection system identifies the packet according to the identification rule sent by the entity in the NGN network, and uses the detection result to control the service data packet, so that the NGN is used. All services in the network can achieve Qos control.

As shown in FIG. 1 , the deep packet detection system of the embodiment of the present invention includes a management unit, a control unit, and an execution unit, where the execution unit is provided with a detection module and a policy control module, where: the management unit is configured to save And managing system information, and setting a first interface that interacts with the first application domain in the NGN;

The detecting module is configured to perform a deep packet inspection on the data packet according to the identification rule, and obtain a first detection result, where the identification rule is that the entity set in the first application domain is provided by the management unit. Rules issued by the interface;

The control unit is configured to deliver a control policy, where the control policy is based on the first detection Results and strategies for generating system information;

The policy control module is configured to control service traffic according to a control policy;

The control policy is a policy generated according to the detection result and the system information. In a specific embodiment of the present invention, in the NGN environment, the control policy is:

The control unit generates and delivers the first control policy to the policy control module according to the first detection result and system information; and/or

The entity in the first application domain is generated and delivered to the second control policy of the policy control module according to the first detection result and the system information.

In a specific embodiment of the present invention, the entity in the first application domain is an RACF, a NACF (Network Attachment Control Function) entity, and an SCF (Service Control Function) entity.

In the specific embodiment of the present invention, the RACF is taken as an example for detailed description.

Meanwhile, in FIG. 1, although the management unit and the execution unit are connected by a control unit, it should be understood that the management unit may also be directly connected to the execution unit, and therefore, the RACF entity passes the The identification rule delivered by the interface provided by the management unit can be delivered to the execution unit by the management unit through the control unit, and the management unit and the execution unit can be directly connected to the management unit. Execution unit.

In a specific embodiment of the present invention, the control of the service traffic includes shaping, current limiting, packet modification, packet dropping, and the like.

In a specific embodiment of the present invention, the performing deep packet detection on the data packet according to the identification rule may include user identification, content identification, service identification, priority recognition, and the like.

In a specific embodiment of the present invention, the system information is preset by a network administrator, and the content includes but is not limited to: user information, service information, subscription policy information, and associated information.

The user information, service information, and subscription policy information are not described in detail here. The related information is described in detail below. Generally, considering the stability and processing capability of the system, the deep packet detection system is generally provided with multiple, where the associated information records a deep-text detection system that can be mutually backed up or has an associated relationship. If there is a problem in some units in the current depth detection system (such as abnormal system operation, heavy load, etc.), according to the related information, it can be processed by other deep packet inspection systems to ensure the stability of the system.

Whether the RACF or the control unit generates a control policy, it needs to consider user information, service information, and subscription policy information, as illustrated below.

Assume that the user-defined service type is recorded in the user information. When the control policy is formulated, it is determined whether the service type of the identified data packet is a customized service type. If not, the control policy is to discard the data packet. Otherwise, the control policy is to discard the data packet. For forwarding packets.

For example, if the subscription policy information is a data packet for discarding the P2P service, when the control policy is formulated, it is determined whether the service type of the identified data packet is a P2P service, and if yes, the control policy is to discard the data packet, otherwise, For forwarding packets.

Of course, it can be other information, not here - to give an explanation.

At the same time, it can be seen from the foregoing that the policy control module performs the control of the service traffic according to the control policy, where the control policy includes two situations, which may be the first control policy generated by the control unit according to the detection result and the system information, It may be a second control strategy generated by the RACF according to the detection result and the system information, and the structures of the control unit in each of the two cases are respectively described below.

When the control policy is the first control policy, the control unit needs to generate a control policy by combining the detection result and the system information. As shown in FIG. 2, the control unit specifically includes: a first receiving module, configured to receive The detection result;

The first sending module is configured to send the first control policy to the policy control module. When the control policy is the second control policy, and the management unit and the execution unit are connected by the control unit, as shown in FIG. 3, the control unit specifically includes: a first receiving module. , for receiving the detection result;

a uploading module, configured to upload the detection result to the RACF by using the management unit; and a second receiving module, configured to receive the second control policy that is sent by the RACF by using the management unit;

And a second sending module, configured to send the second control policy to the policy control module. Of course, in some cases, the control unit further includes:

Of course, considering the comprehensiveness of the system, the control unit may include all of the aforementioned modules (a first receiving module, a policy generating module, a first sending module, a second receiving module, and a second sending unit).

Moreover, it should be understood that all of the aforementioned units may be provided separately or collectively. At the same time, in order to facilitate billing, statistics and query, the control unit further includes:

The information collection module is configured to collect and save the detection result obtained by the detection module for deep packet detection, for charging, statistics, and query.

At the same time, for some services, such as an FTP service, it is necessary to use a plurality of packet detection results to confirm the service type. In this case, in the embodiment of the present invention, the control unit further includes an associated stream processing module. Identifying a service type according to the packet detection result saved in the information collection module, where the policy generation module generates the first control policy or the RACF generates the second control policy.

When the service type identified by the associated flow processing module is used by the policy generation module to generate the first control policy, the associated flow processing module is connected to the information collection module and the policy generation module, and Describe the service type identified by the associated stream processing module for the RACF When the second control policy is generated, the associated flow processing module is connected to the information collection module and the uploading module, and the uploading module is further configured to upload the service type detection result to the RACF through the management unit. .

Of course, in consideration of the fact that the RACF itself already has the control capability of the data message, in the embodiment of the present invention, the data message can also be controlled by the RACF.

Of course, in consideration of the application environment, in the embodiment of the present invention, the management unit is further provided with a second interface of an entity in a second application domain of a network other than the NGN.

When the deep packet inspection system is applied to a network environment other than the next generation network, the management unit is further provided with a second interface for interacting with an entity in a network other than the next generation network. In addition, the detecting module is further configured to perform deep packet detection on the data packet according to the static configuration rule of the network management, to obtain a second detection result, where the control unit is further configured to use the second detection result and the system information according to the second detection result. Generating a fourth control policy; the policy control module is further configured to perform control of service traffic in a network environment other than the next generation network according to the fourth control policy.

In a network other than the NGN, the entities in the second application domain include an AAA server, a security management entity, a linkage management entity, and the like.

When the apparatus of the embodiment of the present invention is applied to a non-NGN network (a network other than the NGN), as compared with the application to the NGN network, it can be seen from the above description that the difference is only in the difference of the interactive content and in the non-NGN network. The entity cannot control the data packet by itself, so its control policy must be generated by the control unit, so the generation of the control policy is the same as the first control policy, and will not be described in detail here.

The method for processing the text in the specific embodiment of the present invention is as shown in FIG. 4, and includes:

Step 41: The management unit of the deep packet detection system acquires the identification rule delivered by the entity in the application domain of the NGN through the first interface.

Step 42: The detection module in the deep packet detection system performs logarithm according to the identification rule. Perform deep packet inspection based on the packet to obtain the detection result;

Step 43: The policy control module in the deep packet detection system controls the traffic according to the control policy; the control policy is a policy generated according to the detection result and the system information.

In a specific embodiment of the invention, the control strategy for the NGN environment includes:

a first control policy generated by the control unit in the depth message detection system based on the detection result and system information; and/or

a second control policy generated by an entity in the first application domain according to the detection result and the system information.

When the control policy is the second control policy, the steps 42 and 43 further include: the detecting module in the deep packet detecting system uploading the detection result to the RACF through the management unit;

The management unit in the deep packet detection system acquires the second control policy by using the first interface, and sends the second control policy to the policy control module.

In a specific embodiment of the invention, the control strategy for a network environment other than NGN includes:

The control unit is further configured to generate a fourth control policy according to the second detection result and the system information; and the second detection result is that the detection module performs deep packet detection on the data packet according to the identification rule of the network management static configuration. The results obtained. In the prior art, in an NGN environment, certain services do not have resource request functions (such as games, network-critical services, etc.), and therefore, the network operator cannot guarantee the QoS of these high-quality services, and the embodiment of the present invention The device and method can solve the above problems.

It is assumed that the QoS guarantee needs to be provided for the game service, and the RACF first formulates an identification rule and sends it to the management unit in the deep packet detection system through the interface; After receiving the identification rule, the management unit sends the identification rule to the detection module directly or through the control unit;

After receiving the identification rule, the detecting module performs packet depth detection on the received data packet, and obtains the detection result;

After obtaining the test result, the control strategy can be formulated in two ways, respectively.

The detecting module sends the detection result to the control unit;

The control unit uses the system information and the detection result in the management unit to formulate a control strategy; the control unit delivers the control policy to the policy control module;

The policy control module uses the control policy to process the data packet accordingly.

For example, ^ below.

The control unit finds that the feature word of the current data packet is A according to the detection result;

For the service corresponding to the feature word A, the game service A, and the system information records that the game service A applies for the bandwidth value-added service, the control unit determines the corresponding control according to the detection result and the information in the management unit. The policy is "forwarding with the highest priority."

The policy control module forwards the data packet with the highest priority according to the control policy to ensure the Qos of the service.

Through the above processing, in the NGN environment, even if some services do not have resource request functions (such as games, or network-critical services, etc.), the network operator can guarantee the QoS of these high-quality services.

The detection module reports the detection result to the NACF through the interface set in the management unit;

NACF uses the system information and test results in the management unit to formulate control strategies; The NACF sends the control policy to the management unit through the interface set in the management unit. The management unit sends the control policy to the policy control module directly or through the control unit. The policy control module uses the control policy to perform corresponding data packet. deal with.

For example, ^ below.

According to the detection result, the NACF finds that the feature word of the current data packet is A;

For the service corresponding to the feature word A, the game service A, and the system information records that the game service A applies for the bandwidth value-added service, the NACF determines the corresponding control strategy according to the detection result and the information in the management unit. For "forwarding with the highest priority."

Of course, the above control strategy is merely an example, and the specific control strategy is not limited in the specific embodiment of the present invention.

The above description is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It should be considered as the scope of protection of the present invention.

Claims

Claim

A deep packet detection system, comprising: a management unit, a control unit and an execution unit, wherein the execution unit comprises a detection module and a policy control module, wherein:

The management unit is configured to save and manage preset system information, and is provided with a first interface for interacting with an entity in a next generation network;

The detecting module is configured to perform a deep packet inspection on the data packet according to the identification rule, and obtain a first detection result, where the identification rule is a rule that is sent by the entity in the next generation network through the first interface;

The control unit is configured to send a control policy, where the control policy is a policy generated according to the first detection result and the system information;

2. The deep packet inspection system according to claim 1, wherein the management unit is further provided with a second interface for interacting with an entity in a network other than the next generation network;

The detecting module performs deep packet inspection on the data packet according to the identification rule of the static configuration of the network management device, and obtains the second detection result;

The depth message detection system according to claim 1, wherein the control policy comprises:

a first control policy generated by the control unit according to the first detection result and system information; and/or a second control policy generated by an entity in the next generation network according to the first detection result and the system information.

The deep packet detection system according to claim 3, wherein, when the control policy is the first control policy, the control unit specifically includes:

a first receiving module, configured to receive the detection result;

The first sending module is configured to send the first control policy to the policy control module.

The deep packet detection system according to claim 3, wherein, when the control policy is the second control policy, the control unit specifically includes:

a first receiving module, configured to receive the detection result;

And a second sending module, configured to send the second control policy to the policy control module.

The deep packet inspection system according to any one of claims 1 to 5, wherein: the control policy further comprises a third control policy;

The control unit further includes: a third sending module, configured to send a third control policy of the network management static configuration received from the management unit to the policy control module.

The depth message detecting system according to any one of claims 1 to 5, wherein the control unit further comprises:

8. The deep packet inspection system according to claim 7, wherein the control The unit further includes: an associated stream processing module, configured to identify a service type used to generate the control policy according to the multiple detection results saved in the information collection module.

9. A text processing method, characterized in that:

The deep packet inspection system performs deep packet inspection on the data packet according to the identification rule sent by the entity in the next generation network, and obtains the first detection result;

Generating a control strategy according to the first detection result and the preset system information;

The packet processing method according to claim 9, wherein in the next generation network environment, the control policy comprises:

The packet processing method according to claim 9, wherein in the network environment other than the next generation network, the deep packet detection system performs deep text detection on the data packet according to the identification rule. The method also includes:

The depth packet detection system performs control of service traffic according to the fourth control policy.

The packet processing method according to claim 10, wherein the control policy further comprises: a third control policy configured by the network management system.