WO2011137804A1

WO2011137804A1 - Method and apparatus for obtaining policy

Info

Publication number: WO2011137804A1
Application number: PCT/CN2011/074417
Authority: WO
Inventors: 郭建成; 尤正刚; 朱铎辉
Original assignee: 华为技术有限公司
Priority date: 2010-08-18
Filing date: 2011-05-20
Publication date: 2011-11-10
Also published as: CN102143135B; CN102143135A

Abstract

Embodiments of the invention provide a method and an apparatus for obtaining a policy, wherein the method includes: performing network layer identification for an obtained service message to identify the Internet Protocol (IP) address of a service server included in the service message (101); according to the mapping relationship between the obtained IP address of the service server and the service control and charging policy of the application protocol layer, obtaining the service control and charging policy of the application protocol layer corresponding to the IP address of the service server (102). The embodiments of the invention improve the forwarding performance of a network device and the efficiency for obtaining the service control and charging policy of the application protocol layer, and ensure normal communications of the network device.

Description

The present invention relates to communication technologies, and in particular, to a method and an apparatus for acquiring a policy. Background technique

In an IP network, the processing of the obtained service packets by some network devices needs to be performed according to certain service control and charging policies. If the network device needs to process the obtained service packet according to the service control layer and the accounting policy of the application layer (the seventh layer), the deep packet inspection (DPI) is required for the obtained service packet. The technology performs application protocol layer identification, that is, DPI resolution, in order to obtain the corresponding service control and charging policies of the application protocol layer. The network device needs to perform DPI analysis on a large number of obtained service packets, which results in an increase in the signaling processing load of the central processing unit (CPU), which reduces the forwarding performance of the network device, thereby affecting the normality of the network device. Communication; Because the protocol supported by DPI resolution is limited, if the protocol supported by DPI resolution is added, the version upgrade is required to implement the protocol, which reduces the flexibility of service packet identification and reduces the service control and charging policy of the application protocol layer. The acquisition efficiency affects the normal communication of network devices. Summary of the invention The embodiment of the invention provides a method and a device for acquiring a policy, which are used to improve the forwarding performance of the network device and the service control and the charging policy of the application protocol layer, and ensure the normal communication of the network device. A method of obtaining a strategy, including:

Performing network layer identification on the obtained service packet, and identifying the IP address of the service server included in the service packet;

The service control and charging policy of the application protocol layer corresponding to the IP address of the service server is obtained according to the mapping between the IP address of the service server and the service control and the charging policy of the application protocol layer.

The embodiment of the present invention further provides a method for acquiring a policy, including: a packet identification module, configured to perform network layer identification on the obtained service packet, and identify an IP address of the service server included in the service packet;

The policy obtaining module is configured to obtain, according to the mapping relationship between the IP address of the service server and the service control and the charging policy of the application protocol layer, the service control and charging policy of the application protocol layer corresponding to the IP address of the service server. . According to the foregoing technical solution, the embodiment of the present invention can learn the IP address of the service server and the service control layer of the application protocol layer according to the learned mapping relationship between the IP address of the service server and the service control layer and the application protocol layer. Mapping relationship of the charging policy, obtained and identified The service control and charging policy corresponding to the IP address of the service server included in the service packet, so that the network device can process the obtained service packet by using the service control and charging policy of the application protocol layer. In the embodiment of the present invention, since the network packet (the third layer) is identified by using the ordinary packet detection technology, and the IP address of the service server included in the service packet is identified, the service report is obtained. The service control and accounting policies of the application protocol layer corresponding to the IP address of the service server included in the text do not need to perform DPI resolution on the obtained service packets, thereby improving the forwarding performance of the network device and the service control and calculation of the application protocol layer. The acquisition efficiency of the fee policy ensures the normal communication of the network device. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work. 1 is a schematic flowchart of a method for acquiring a policy according to Embodiment 1 of the present invention;

2A is a schematic diagram of a network device according to Embodiment 2 of the present invention; FIG. 2B is a schematic flowchart of a method for acquiring a policy according to Embodiment 2 of the present invention; FIG. 3 is a schematic structural diagram of a device for acquiring a policy according to Embodiment 3 of the present invention.

detailed description The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention. FIG. 1 is a schematic flowchart of a method for acquiring a policy according to Embodiment 1 of the present invention. As shown in FIG. 1 , a method for acquiring a policy in this embodiment may include the following steps:

Step 101: Perform network layer identification on the obtained service packet, and identify the IP address of the service server included in the service packet. This embodiment may be applicable to any service control and calculation in the mobile communication network according to the application protocol layer. A fee-based policy, a network device that processes acquired packets. Specifically, the network device may perform network layer identification on the obtained service packet, and identify an IP address of the service server included in the service packet. In step 102, the service control and charging policy of the application protocol layer corresponding to the IP address of the service server is obtained according to the mapping between the IP address of the service server and the service control and the charging policy of the application protocol layer.

Specifically, the network device may obtain the service control and charging of the application protocol layer corresponding to the IP address of the service server according to the mapping between the IP address of the service server and the service control and the charging policy of the application protocol layer. Strategy. In other embodiments, step 101 above The foregoing network device may further perform the step of obtaining a mapping relationship between the IP address of the service server and the service control and charging policy of the application protocol layer. Specifically, the foregoing network device may first learn the mapping relationship between the domain name of the service server and the IP address of the service server, and further, according to the mapping relationship between the domain name of the service server and the service control and the charging policy of the application protocol layer, and the foregoing service. The mapping between the domain name of the server and the IP address of the service server, and the mapping between the IP address of the service server and the service control and charging policy of the application protocol layer. In this embodiment, by mapping the IP address of the service server and the service control and charging policy of the application protocol layer, the mapping between the IP address of the service server and the service control layer and the application protocol layer can be obtained. The relationship between the service control and the charging policy corresponding to the IP address of the service server included in the identified service packet, so that the service control and the charging policy of the application protocol layer can be utilized to perform the obtained service packet. deal with. In the embodiment of the present invention, the network packet (the third layer) is identified by using the ordinary packet detection technology, and the IP address of the service server included in the service packet is identified, and the service report is obtained. The service control and charging policy of the application protocol layer corresponding to the IP address of the service server included in the text does not need to perform DPI resolution on the obtained service packet, thereby improving the forwarding performance of the network device and the service control and calculation of the application protocol layer. The acquisition efficiency of the fee policy ensures the normal communication of the network device.

The method for obtaining the policy provided by the embodiment of the present invention may be applicable to any network device in the mobile communication network that needs to process the obtained packet according to the service control and charging policy of the application protocol layer, for example, a packet data network gateway (Packet) Data Network Gateway, referred to as P-GW), General Packet Radio Service (GPRS) support node (Gateway GPRS Supporting Node, GGSN for short), General Packet Radio Service (GPRS) Support Node > (Serving GPRS Supporting Node) SGSN) and other network devices. In order to make the method provided by this embodiment more clear, the GGSN (Fig. 2A) will be exemplified below. FIG. 2B is a schematic flowchart of a method for acquiring a policy according to Embodiment 2 of the present invention. As shown in FIG. 2B, the method for acquiring a policy in this embodiment may include the following steps:

Step 201: The GGSN learns the mapping relationship between the domain name of the service server and the IP address of the service server.

Specifically, in this step, the GGSN learns that the mapping relationship between the domain name of the service server and the IP address of the service server may include, but is not limited to, the following methods:

A. The GGSN learns the mapping relationship between the domain name of the service server and the IP address of the service server from the Domain Name System (DNS).

Specifically, the GGSN can obtain the mapping between the domain name of the service server and the IP address of the service server by intercepting the DNS packet returned by the DNS according to the DNS query request initiated by the terminal to the terminal, and obtaining the mapping relationship between the domain name of the service server and the IP address of the service server; Obtaining the DNS packet returned by the DNS according to the DNS query request initiated by itself, and parsing the DNS packet to obtain the mapping relationship between the domain name of the service server and the IP address of the service server.

B. The GGSN learns the domain name of the service server and the IP address of the service server from the configuration information. Mapping relations.

It should be noted that the mapping between the domain name of the service server and the IP address of the service server can also be learned from the peripheral network device by means of a peripheral network device (for example, SGSN) according to the specific network architecture of the network.

The mapping relationship between the domain name of the service server and the IP address of the service server learned by the GGSN in this step can be as shown in Table 1.

Table 1 Mapping between the domain name of the service server and the IP address of the service server

Step 202: The GGSN learns the IP address and application of the service server according to the mapping relationship between the domain name of the service server and the service control and the charging policy of the application protocol layer, and the mapping between the domain name of the service server and the IP address of the service server. Mapping between service control and charging policies at the protocol layer;

In this step, the mapping between the domain name of the service server set by the GGSN and the service control and charging policy of the application protocol layer may be as shown in Table 2; the IP address of the service server and the service control layer of the application protocol layer learned by the GGSN The mapping relationship of the accounting policy can be as shown in Table 3.

Table 2 Mappings between the domain name of the service server and the service control and accounting policies of the application protocol layer Service Control and Accounting Policy for the Domain Name Application Protocol Layer of the Service Server www.abc.com Strategy 1

Www.xyz.com Policy 2 Table 3 IP address of the service server and service control and charging policy of the application protocol layer IP address of the service server Service control and charging policy of the application protocol layer

61.172.201.194 Allow access

121.14.0.19 No access

Step 203: The GGSN performs network layer identification on the obtained service packet, and identifies an IP address (destination IP address) of the service server included in the service packet. Step 204: The GGSN according to the IP address and application protocol of the learned service server The mapping between the service control and the charging policy of the layer, and the service control and charging policy of the application protocol layer corresponding to the IP address of the service server.

Specifically, when the mobile station (MS) initiates access to the service server with the IP address of 61.172.201.194 through the GGSN, the GGSN may "allow access" according to the obtained service control and charging policy corresponding to the above IP address. The MS is allowed to access the service server. Specifically, when the mobile station (MS) initiates the access to the service server with the IP address of 121.14.0.19 through the GGSN, the GGSN can control the service corresponding to the obtained IP address. And the billing policy "no access" prohibits the MS from accessing the service server. In this embodiment, the GGSN can learn the IP address of the service server and the service control and charging policy of the application protocol layer according to the mapping between the IP address of the service server and the service control and charging policy of the application protocol layer. The mapping relationship is used to obtain the service control and charging policy corresponding to the IP address of the service server included in the identified service packet, so that the GGSN can use the service control and charging policy of the application protocol layer to obtain the service report. The text is processed. In the embodiment of the present invention, the GGSN only needs to identify the network packet (the third layer) of the obtained service packet by using the common packet detection technology, and identify the IP address of the service server included in the service packet. The service control and charging policy of the application protocol layer corresponding to the IP address of the service server included in the packet does not need to perform DPI resolution on the obtained service packet, thereby improving the forwarding performance of the GGSN and the service control of the application protocol layer. The acquisition efficiency of the charging policy ensures the normal communication of the GGSN.

Further, in this embodiment, the mapping relationship preset by the GGSN in the foregoing step 202 may also be a mapping relationship between the IP address (source IP address) of the terminal, the domain name of the service server, and the service control and charging policy of the application protocol layer. Correspondingly, in the foregoing step 203, the GGSN performs network layer identification on the obtained service packet, and can also identify the IP address of the terminal included in the obtained service packet. The mapping relationship preset by the GGSN in the foregoing step 202 can also be the terminal. The mapping between the IP address, the port of the terminal (the source port), the domain name of the service server, the port of the service server (the destination port), and the service control and charging policy of the application protocol layer. Correspondingly, the GGSN in the above step 203 is The obtained service packet is identified by the network layer, and the IP address of the terminal and the IP address of the service server are identified. In addition to the address, the transport layer (layer 4) can be further identified to identify the port of the terminal and the port of the service server.

It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the present invention is not limited by the described action sequence. Because certain steps may be performed in other sequences or concurrently in accordance with the present invention. In addition, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

In the above embodiments, the descriptions of the various embodiments are different, and the details are not described in the specific embodiments. For details, refer to related descriptions of other embodiments.

FIG. 3 is a schematic structural diagram of a device for acquiring a policy according to Embodiment 3 of the present invention. As shown in FIG. 3, the device for acquiring a policy in this embodiment may include a packet identification module 31 and a policy acquisition module 32. The packet identification module 31 performs network layer identification on the obtained service packet, and identifies the IP address of the service server included in the service packet. The policy acquisition module 32 is configured according to the IP address of the learned service server and the application protocol layer. The mapping between the service control and the charging policy obtains the service control and charging policy of the application protocol layer corresponding to the IP address of the service server. The functions of the foregoing methods in the first and second embodiments of the present invention may be implemented by the acquiring device of the policy provided by the embodiment of the present invention. The acquiring device of the foregoing policy may be located in any service control and charging policy that needs to be obtained according to the application protocol layer. Packets are processed on network devices, such as Packet Data Network Gateway (P-GW), Gateway General Packet Radio Service. (General Packet Radio Service, referred to as GPRS) support node (Gateway GPRS Supporting Node, GGSN for short), and the General Packet Radio Service (GPRS) support node (Serving GPRS Supporting Node, SGSN) network equipment.

Specifically, the policy obtaining module 32 may specifically include a first learning unit 321 and a second learning unit 322. The first learning unit 321 learns the mapping relationship between the IP address of the service server and the service control and charging policy of the application protocol layer, and the IP address and application protocol of the service server learned by the second learning unit 321 according to the first learning unit 321 is obtained. The mapping between the service control and the charging policy of the layer, and the service control and charging policy of the application protocol layer corresponding to the IP address of the service server.

Specifically, the first learning unit 321 may specifically include a first learned subunit 3211 and a second learned subunit 3212. The first learned sub-unit 3211 learns the mapping relationship between the domain name of the service server and the IP address of the service server, and the second learned sub-unit 3212 maps the service control and the charging policy of the application protocol layer according to the domain name of the service server set in advance. The relationship between the domain name of the service server and the IP address of the service server, which is known by the relationship and the first learned sub-unit 3211, is used to learn the mapping relationship between the IP address of the service server and the service control and charging policy of the application protocol layer.

Specifically, the first learned sub-unit 3211 may specifically learn the mapping relationship between the domain name of the service server and the IP address of the service server from the DNS, or may also obtain the mapping relationship between the domain name of the service server and the IP address of the service server from the configuration information.

Claims

Claim

A method for acquiring a policy, comprising:

The method according to claim 1, further comprising: learning a mapping relationship between an IP address of the service server and a service control and a charging policy of the application protocol layer.

The method according to claim 2, wherein the mapping between the IP address of the service server and the service control and charging policy of the application protocol layer is as follows:

The mapping between the domain name of the service server and the IP address of the service server is obtained; the mapping between the domain name of the service server and the service control and charging policy of the application protocol layer and the domain name of the service server and the IP address of the service server are obtained according to the preset The mapping relationship is obtained by knowing the mapping relationship between the IP address of the service server and the service control and charging policy of the application protocol layer.

The method according to claim 3, wherein the mapping relationship between the domain name of the service server and the IP address of the service server is as follows:

Obtain the mapping between the domain name of the service server and the IP address of the service server from the DNS of the domain name server. Relationship; or

The mapping between the domain name of the service server and the IP address of the service server is obtained from the configuration information.

A device for acquiring a policy, comprising: a message identification module, configured to perform network layer identification on the obtained service packet, and identify an IP address of the service server included in the service packet; The obtaining module is configured to obtain, according to the mapping relationship between the IP address of the service server and the service control and the charging policy of the application protocol layer, the service control and charging policy of the application protocol layer corresponding to the IP address of the service server.

The device according to claim 5, wherein the policy obtaining module comprises: a first learning unit, configured to learn a mapping relationship between an IP address of the service server and a service control and a charging policy of the application protocol layer;

a second learning unit, configured to acquire an application corresponding to an IP address of the service server according to a mapping relationship between an IP address of the service server and a service control and a charging policy of the application protocol layer, which is learned by the first learning unit Service control and charging policies at the protocol layer.

The device according to claim 6, wherein the first learning unit comprises: a first learning subunit, configured to learn a mapping relationship between a domain name of the service server and an IP address of the service server;

a second learned sub-unit for using a domain name of the service server and an application protocol layer according to a preset The mapping relationship between the service control and the charging policy and the mapping between the domain name of the service server and the IP address of the service server learned by the first learned sub-unit, and the service control and accounting of the IP address of the service server and the application protocol layer are learned. The mapping relationship of the fee policy.

8. The apparatus according to claim 7, wherein the first learned subunit is specifically configured to:

Obtain the mapping relationship between the domain name of the service server and the IP address of the service server from the DNS server; or