WO2012037817A1

WO2012037817A1 - Method and system for implementing strategy synchronization

Info

Publication number: WO2012037817A1
Application number: PCT/CN2011/074749
Authority: WO
Inventors: 杨波
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-09-20
Filing date: 2011-05-27
Publication date: 2012-03-29
Also published as: CN101945021A; CN101945021B

Abstract

A method and system for implementing strategy synchronization are provided in the present invention. The method comprises: all deep packet inspection (DPI) devices in a network perform service flow recognition, and if a first DPI device recognizes a service, the connection information and service information corresponding to the service are reported to a resource and admission control function (RACF) device; the RACF device determines a service control strategy according to the service information and transmits the connection information and the service control strategy to the all DPI devices in the network; the all DPI devices in the network perform service recognition according to the connection information; if recognizing the service according to the connection information, a second DPI device controlles the service according to the service control strategy. The present invention can solve the problem of the implementation of strategy synchronization of the DPI devices under a network generation network (NGN) environment.

Description

Method and system for realizing policy synchronization

Technical field

The present invention relates to the field of communications, and in particular, to a method and system for implementing policy synchronization in an NGN (Network Generation Network) environment.

Background technique

DPI technology is called "Deep Packet Inspection" and is called "deep packet inspection". The so-called "depth" is compared with the normal message analysis hierarchy. "Common message detection" only analyzes the contents of the IP packet below 4 layers, including the source address, destination address, source port, destination port, and protocol type. In addition to the previous analytic hierarchy analysis, DPI also adds application layer analysis to identify various applications and their content.

Using IP packet technology as the bearer network technology, and combining fixed and mobile communications, it can provide richer multimedia services. The architecture of the ITU (International Telecommunication Union) is shown in Figure 1. The RACF (Resource and Admission Control Function) includes: PD-FE (Policy Decision Function Entity) and The TRC-FE, the PD-FE is based on the media stream session information (obtained from the SCF (Service Control Function)), and the user's transmission resource subscription information (obtained from the NACF (Network Attachment Control Function) Make a preliminary QoS (Quality Of Service) resource decision, and then interact with TRC-FE (Transport Resource Control Function Entity) to confirm whether there are enough QoS resources, and finally make a final The decision is made and the decision is sent to the PE-FE (Policy Execute Function Entity).

In the existing NGN environment, due to network routing, etc., when the uplink and downlink traffic of one service of the network does not pass through the same DPI device, the DPI cannot satisfy the policy synchronization of the service. As shown in Figure 2, the uplink traffic of the FTP application passes through the DPI A and then goes to the application server through the network routing. The downlink traffic passes through the network routing and then passes through the DPI B to reach the user side. This may duplicate a service by the DPI A and DPI B devices. Identification, at the same time may lead to the same business, in DPI The control rules on A and DPI B are different.

Summary of the invention

It is an object of the present invention to provide a method and system for implementing policy synchronization to achieve policy synchronization of DPI devices in an NGN environment.

In order to solve the above technical problem, the present invention provides a method for implementing policy synchronization, including: all the deep packet inspection devices in the network identify the service flow, and if the first deep packet inspection device identifies a service, the service is Corresponding connection information and service information reporting resource admission control function (RACF) device;

Determining, by the RACF device, a service control policy according to the service information, and then sending the connection information and the service control policy to all deep packet inspection devices in the network; and all deep packet inspection devices in the network according to The connection information is used for service identification. If the second deep packet inspection device identifies the service according to the connection information, the service is controlled according to the service control policy.

The step of identifying the service flow by all the deep packet detecting devices in the network includes: Each deep packet detecting device identifies the service flow passing through the deep packet detecting device according to the preset service identification template.

The step of determining, by the RACF device, the service control policy according to the service information includes: the RACF device acquiring the subscription information of the service and the user according to the service information, and determining the service control policy according to the network usage situation.

The above methods also include:

Each deep packet inspection device adds the connection information to its own service identification template before performing service identification based on the connection information.

The above methods also include:

Before identifying the service flow, each deep packet inspection device registers with the RACF device to carry information of the deep packet inspection device.

In order to solve the above problems, the present invention also provides a system for implementing policy synchronization, including multiple a deep packet inspection device and a resource admission control function (RACF) device, wherein the deep packet inspection device is configured to: identify a service flow, and if a service is identified, the connection information and service information corresponding to the service And reporting the RACF device; and performing service identification according to the connection information sent by the RACF device, and if the service corresponding to the connection information sent by the RACF device is identified, performing service control according to the RACF device The policy controls the business;

The RACF device is configured to: after receiving the connection information and the service information reported by the deep packet inspection device, determine a service control policy according to the received service information, and then the received connection information and the determined service The control policy is sent to the deep packet inspection device.

The deep packet inspection device is configured to identify the service flow by: identifying the service flow passing through the deep packet inspection device according to the preset service identification template.

The RACF device is configured to determine the service control policy by: obtaining subscription information between the service and the user according to the received service information, and determining the service control policy according to the network usage.

The deep packet inspection device is further configured to: add the connection information delivered by the RACF device to the service identification template of the RACF device, and the connection information includes: Destination IP address, source IP address, destination port, source port, and protocol type of the service. The deep packet inspection device is further configured to register with the RACF device to carry information of the deep packet inspection device before identifying the service flow.

In summary, the method and system for implementing policy synchronization provided by the present invention solves the problem of realizing DPI device policy synchronization in an NGN environment.

BRIEF abstract

The drawings are intended to provide a further understanding of the invention, and are intended to be a part of the description of the invention. In the drawings: Figure 1 is a schematic diagram of an existing NGN architecture; 2 is a schematic diagram of a situation in which a service does not pass through the same DPI device in the prior art; FIG. 3 is a schematic diagram of an NGN architecture of the present invention;

4 is a schematic diagram of a system for implementing policy synchronization according to an embodiment of the present invention;

FIG. 5 is a flowchart of a method for implementing policy synchronization according to an embodiment of the present invention.

Preferred embodiment of the invention

The present invention provides a method for implementing DPI device policy synchronization in an NGN environment. Since the DPI and the NGN resource admission control function (RACF) device have no interface (as shown in FIG. 1), the first need to be in the two. Interfaces are set up between devices (as shown in Figure 3) to complete the interaction of policy information between the DPI device and the RACF device.

The core of the present invention is that when a DPI device identifies a specific service, the DPI device reports the connection information and the service information of the identified service to the RACF device, and after determining the corresponding service control policy according to the service information, the RACF device will The connection information and the corresponding service control policy are sent to all the DPI devices in the network for service identification, so that the DPI device has the same service control policy for the same service, and cannot perform different service control policies for the uplink and downlink of the same service. The goal of policy synchronization can be achieved.

For a better understanding of the invention, the invention will be further described in conjunction with the drawings and specific embodiments.

FIG. 4 is a schematic diagram of a system for implementing policy synchronization according to an embodiment of the present invention. As shown in FIG. 4, the system mainly includes: a RACF device and multiple DPI devices, such as DPI A, DPI B, DPI C, and DPI D.

The DPI devices A, B, C, and D in the network are all registered with the RACF to inform the RACF of the information of the DPI devices available in the network, including but not limited to the network address, capacity, and device status of the DPI. When the DPI A device according to the feature word (for example, the BT download service has a characteristic bittorrent in the message, then by identifying the bittorrent, the DPI device knows that this is a BT service, and the bittorrent is a feature word) discovers a service flow ( For example, when the FTP (File Transfer Protocol) service is used, the corresponding connection information is notified to the RACF. The RACF queries the NACF user subscription information and makes business control policy decisions based on the network conditions. The service control policy, such as the traffic, rate, and service priority of the service, informs the API, A, B, C, and D devices of the DPI in the network, and the ^C and D devices in the network according to the received service control policy and connection information. The connection information is found to find the connection data stream. When the DPI device D discovers the connection service flow, the service flow is controlled according to the received control policy.

FIG. 5 is a flowchart of a method for implementing policy synchronization according to an embodiment of the present invention. As shown in FIG. 5, the method includes the following steps:

S10. The DPI device identifies the service flow. If a DPI device identifies a service, the connection information and the service information of the service are reported to the RACF device.

Specifically, each DPI device in the network may use a preset service identification template, such as an identification template of the BT service as a keyword Bittorrent, and the DPI device deeply identifies the service flow through itself, and when the service is identified, the connection of the service is extracted. Information, such as network quintuple information, destination IP address, source IP address, destination port, source port, and protocol type, etc.; also extracts the service information, such as VOIP telephone service information.

S20. The RACF device determines a corresponding control policy according to the service information.

Specifically, after the DPI device reports the connection information of the service to the RAC F device, the RACF device queries the NACF, obtains the subscription information of the service and the user, and determines the control policy according to the network usage.

S30, the RACF sends the connection information and the control policy to all DPI devices in the network;

S40. All DPI devices in the network perform service identification according to the connection information. If a DPI device identifies a service according to the connection information, the service is controlled according to the control policy.

Specifically, the RACF sends the connection information and the control policy to all DPI devices in the network. After receiving the connection information and the control policy, the other DPI devices add the connection information to the service identification template to speed up the search.

All DPI devices in the network find a new service identification template (that is, new connection information). If the connection is found, the corresponding service is considered to be found, and the service is controlled according to the received RACF control policy. . According to the above method, the control strategy of the same service in the network can be realized, and the efficiency of deep recognition of the DPI device can be improved.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be accomplished by a program instructing the associated hardware, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware or in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

The above is only a preferred embodiment of the present invention, and of course, the present invention may be embodied in various other embodiments without departing from the spirit and scope of the invention. Corresponding changes and modifications are intended to be included within the scope of the appended claims.

Industrial applicability

Compared with the prior art, the method and system for implementing policy synchronization provided by the present invention solves the problem of implementing DPI device policy synchronization in an NGN environment.

Claims

Claim

1. A method for implementing policy synchronization, comprising:

All the deep packet inspection devices in the network identify the service flow, and if the first deep packet inspection device identifies a service, the connection information and the service information corresponding to the service are reported to the resource admission control function (RACF) device;

2. The method according to claim 1, wherein the step of identifying, by the deep packet detecting device in the network, the service flow comprises:

Each deep packet inspection device identifies the service flow passing through the deep packet inspection device according to a preset service identification template.

3. The method according to claim 1, wherein the step of determining, by the RACF device, the service control policy according to the service information comprises:

The RACF device acquires subscription information of the service and the user according to the service information, and determines the service control policy according to the network usage.

4. The method of any of claims 1-3, further comprising:

5. The method of claim 4, further comprising:

Each deep packet inspection device registers with the RACF device to carry information of the deep packet inspection device before identifying the traffic flow.

6. A system for implementing policy synchronization, comprising a plurality of deep packet inspection devices and a resource admission control function (RACF) device, wherein

The deep packet inspection device is configured to: identify a service flow, and if a service is identified, Reporting the connection information and the service information corresponding to the service to the RACF device; and performing service identification according to the connection information sent by the RACF device, and if the service corresponding to the connection information sent by the RACF device is identified, Controlling the service according to the service control policy delivered by the RACF device;

7. The system of claim 6 wherein

8. The system of claim 6 wherein

9. The system of any of claims 6-8, wherein

The deep packet inspection device is further configured to: add the connection information delivered by the RACF device to the service identification template of the RACF device, and the connection information includes: Destination IP address, source IP address, destination port, source port, and protocol type of the service.

10. The system of claim 9, wherein

The deep packet inspection device is further configured to register with the RACF device to carry information of the deep packet inspection device before identifying the service flow.