WO2014008694A1

WO2014008694A1 - Signaling monitoring device for implementing ps domain distributed architecture

Info

Publication number: WO2014008694A1
Application number: PCT/CN2012/079599
Authority: WO
Inventors: 贾林; 于恒信; 宁大鹏
Original assignee: 北京中创信测科技股份有限公司
Priority date: 2012-07-09
Filing date: 2012-08-02
Publication date: 2014-01-16
Also published as: CN102932198B; CN102932198A

Abstract

Provided is a signaling monitoring device for implementing a PS domain distributed architecture, comprising: a Probe module, used to complete collection of original signaling data, add a timestamp, obtain from decoding user information, location information, network quality information, user behavior information, service traffic information, and a service result, and form a detailed CDR record; a Utrace module, used to complete association and marking of each interface CDR in a single service process, and map and fill in user identity information, user terminal information, and the like; a DMPP module, used to complete a function such as data statistics collection in advance, signaling association, alarm information processing, external interface output, and responding to a client query request; and a DMPA module, used to present various kinds of functions in client software, respond to a processing request submitted by a client, effectively complete execution of the processing request, and implement man-machine interaction.

Description

Signaling monitoring device for realizing PS domain distributed architecture

The invention belongs to the field of communications, and in particular relates to the field of business support technology. Background vein

The invention mainly implements local network voice service, domestic long distance voice service, international long distance voice service, intelligent network service, short message service, 3G voice/visual telephone service, VoIP service, MMS for CS domain, PS domain and FGW gateway office. Signaling monitoring and analysis of various telecommunication services such as WAP Internet service.

The signaling monitoring system bypasses and accurately replicates the signaling data transmitted on the signaling link from the signaling network through high-impedance bridging, mirroring access, and optical access. Analyze signaling link load, network resource usage, service signaling flow, and service exchange result through signaling data. It provides efficient and timely support for the management and maintenance of signaling networks and service quality monitoring and analysis. Provides stability and security for mobile network operations.

However, the existing monitoring system construction mode has always been linear from acquisition access, protocol analysis, and network indicator analysis, separately for quality analysis of signaling or statistical analysis for services alone; and usually by the same signaling It is completed by the monitoring system provider, which has a private interface inside and is not open to the public. The analysis results of the above stages of acquisition, analysis, statistics, analysis, etc., want to obtain information from the existing monitoring system, all need to negotiate and develop interfaces, and there are certain defects in communication and cooperation and timeliness.

Among them, PS focuses on Gn interface full GTP-C signaling record, HTTP service L7 record, FDR service flow record generation; and Gn service record and signaling record full association backfill; Provide upper layer service traffic according to network (APN, CI, etc.) The existing signaling monitoring system of dimensions such as service (service type) has the following defects: The hierarchical structure of the existing monitoring system is not clear, and the processing of complex logic by a single device leads to poor performance, and the processing result of the intermediate process is difficult to extract, and the data is difficult. Collection and network planning cannot flexibly respond to the explosive growth of PS domain traffic monitoring Wait.

The present invention is to provide an efficient, secure, stable, and smoothly evolved distributed signaling data acquisition and processing platform that can pass through high-impedance bridging, LanSwitch mirroring, and TAP without affecting the operator's network operation under normal conditions. Branching, splitter splitting, etc. collect various types of signaling links, perform protocol decoding, CDR synthesis, and reproduce the whole process of service connection, perform statistics on various indicators of network and services, and perform unified storage of various data. Summary of the invention

In order to solve the prior art problem, the present invention provides a signaling monitoring apparatus for implementing a PS domain distributed architecture, where the apparatus includes a Probe module, a Utrace module, a DMPP module, and a DMPA module, where: a Probe module is used to complete the original Collecting signaling data, time stamping, and obtaining user information, location information, network quality information, user behavior information, service flow information, and business results from decoding, synthesizing detailed CDR records; Utrace module, used to complete a single time The association and labeling of the CDRs of each interface in the service process, and mapping and filling the user identity information and user terminal information; DMPP module, used to complete pre-statistics, signaling association, alarm information processing, external interface output, and response Client query request and other functions; DMPA module, used to present various application functions in the client software, respond to the processing request submitted by the client, effectively complete the execution of the processing request, and realize human-computer interaction.

According to another aspect of the present invention, the collecting of the original signaling data of the Probe module, the time stamping is specifically acquiring the signaling data or service data of the corresponding link/port accessed through the collecting board, and The received original data packet is time stamped according to the synchronous clock source. According to another aspect of the present invention, the user information, the location information, the network quality information, the user behavior information, the service flow information, and the service result are specifically obtained from the decoding. In order to parse the original data packet binary code, the signaling code is parsed, and user information, location information, network quality information, user behavior information, service flow information, and service result are obtained from the decoding.

According to another aspect of the present invention, the Probe module further includes: a signaling collection unit, configured to receive original data in the link, and perform time stamping and the like; and a signaling recording and synthesizing unit, configured to use the original data The signaling plane data is decoded and synthesized; the service record synthesizing unit is configured to decode and synthesize the service plane data in the original data; and the original message storage unit is configured to store the original data stream corresponding to the synthesized record; Link information The statistics unit is configured to collect the original data packet traffic carried by the IP address of the bearer layer link between the network elements.

According to another aspect of the present invention, the DMPP module further completes: implementing CDR to BDR extension, expanding information that cannot be extracted in the original data, and expanding the generated BDR into the database according to external data; Forming a pre-statistical table based on the business record; storing the KPI data and the alarm data in the database; performing real-time service alarm according to the threshold threshold set by the system; and implementing response and support for the DMPA module access request.

According to another aspect of the present invention, the DMPP module further includes: a data processing unit and a DMPA processing support unit, wherein the data processing unit is configured to perform BDR extension, BDR extension, service alarm, and inventory storage; and the DMPA support unit is used to Complete statistical data interaction, instruction delivery, and service scheduling.

The technical solution of the present invention adopts a probe probe and an associated backfilling program in each remote computer room. In the PS collection scenario, the service processing board and the signaling processing board are integrated into the Probe device, and the degree of integration and normalization are compared. High, the device provides processing power and data output capabilities from DPI service analysis, GTP-C signaling analysis, and more. Moreover, the signaling decoding and the record synthesis are directly completed, and the data exchange between the service processing board and the signaling processing board is completed inside the device, and no external auxiliary network equipment and construction are needed, which is more convenient for project implementation and maintenance, which can effectively The operator saves the transmission bandwidth between the remote station and the central station. DRAWINGS

1 is a schematic diagram of a system architecture applied to a device proposed by the present invention;

2 is a schematic structural diagram of a signaling monitoring apparatus for implementing a PS domain distributed architecture according to the present invention;

Figure 3 is a schematic diagram of the function of the Probe module;

Figure 4 is a schematic diagram of the association and labeling of CDRs of each interface in a single service process; Figure 5 is a schematic diagram of the functions of the DMPP module. Specific ^

The invention will be described in detail below with reference to the accompanying drawings.

FIG. 1 is a schematic structural diagram of a system according to the present invention, as can be seen from the figure, the system structure is completed by The physical networking architecture can be divided into four layers, including a signaling access layer, a signaling acquisition layer, a signaling processing layer, and an application layer.

Signaling Access Layer: Provides physical access to various types of signaling links. In the communication network, the link types include E1/64K TDM links, 100M/1000M electrical ports, and various rate optical ports. The system access layer passes the high-impedance crossover +DXC convergence, LanSwitch mirroring/TAP, and splitting. The way to complete the physical access of the corresponding link.

Signaling collection layer: In addition to the need to deploy the probe to complete the collection of the original signaling data, after the timestamp and CDR synthesis, the signaling collection layer also needs to deploy the associated backfill server to complete the associated backfill server work of the CDR data.

Signaling processing layer: The signaling processing layer performs functions such as pre-statistics of data, signaling association, alarm information processing, external interface output, and response to client query requests. The processing layer will logically contain various server devices, including data analysis servers, cloud storage servers, interface servers, and web servers.

Application layer: Use the client software to present various application functions and realize human-computer interaction.

The signaling monitoring apparatus of the PS domain distributed architecture proposed by the present invention is applied to the above system. FIG. 2 is a schematic structural diagram of a signaling monitoring apparatus for implementing a PS domain distributed architecture according to the present invention. As can be seen from the figure, the device is composed of four main parts: Probe module, Utrace module, DMPP module, DMPA module, where:

An access layer module for providing physical access to various types of signaling links. In the communication network, the link types include E1/64K TDM links, 100M/1000M electrical ports, and various rate optical ports. The system access layer passes the high-impedance crossover +DXC convergence, LanSwitch mirroring/TAP, and splitting. The way to complete the physical access of the corresponding link.

The Probe module is configured to complete the collection of the original signaling data, time stamp, and obtain user information, location information, network quality information, user behavior information, service flow information, service results, and the like from the decoding, and synthesize detailed CDR records.

The Utrace module is used to complete the association and labeling of the CDRs of each interface in a single service process, and to map and fill the user identity information, user terminal information, and the like.

The DMPP module is used to perform pre-statistics of data, signaling association, alarm information processing, output to external interfaces, and response to client query requests.

DMPA module, used to present various application functions in the client software, responding to client submission The processing request, effectively complete the execution of the processing request, and realize human-computer interaction.

Each module will be described in detail below.

<1> Probe module.

The Probe module is deployed on the Probe device of the signaling collection layer, and is used to capture signaling data or service data of the corresponding link/port accessed through the acquisition board; and receive the original data packet according to the synchronous clock source. Time stamping; parsing the original data packet binary code, completing the analysis of the signaling code; and obtaining user information, location information, network quality information, user behavior information, service flow information, business results, etc. from the decoding, synthesizing the detailed service recording.

The Probe module is divided into five units: a signaling collection unit, a signaling record synthesis unit, a service record synthesis unit, an original message storage unit, and a link statistics unit. As shown in Figure 3, the functions of each unit are as follows:

a signaling collection unit, configured to receive original data in the link, and perform time stamping and the like; a signaling record synthesizing unit, configured to decode and synthesize the signaling plane data in the original data; It is used for decoding and synthesizing the business plane data in the original data; the original message storage unit is configured to store the original data code stream corresponding to the composite record; and the link information statistics unit is configured to pass the bearer layer chain between the network elements The IP address of the road, and the original packet traffic carried by it is counted.

<2> Utrace module

The Utrace module is deployed on the Utrace server of the signaling processing layer to complete the association and labeling of the CDRs of each interface in a single service process, and to map and fill user identity information and user terminal information.

Referring to FIG. 4, it is a schematic diagram of association and labeling of CDRs of interfaces in a single service process. The global association is divided into two levels: intra-interface association and inter-interface association. The signaling in the interface is externally associated through the inter-interface type. For example, the Gb signaling process association path is: Gb signaling process - Gb communication process - Gr signaling process and Gn communication process → MMS M0, MT, WAP GET and WAP POSTo

As shown in Figure 4: The arrows in the figure indicate the associated direction, and the one-way arrows indicate that only one-way associations can be made, such as the Gn signaling process can be associated with the Gn communication process. The two-way arrows can be associated with each other, such as the Gn communication process can be associated with the Gb communication process, and the Gb communication process can also be associated with the Gn communication process. The links labeled 1-3 indicate the internal association of the interface, such as the association between the Gb signaling process and the Gb communication process; the links labeled 4-9 indicate the inter-interface association, such as the association between the Gn communication process and the MMS service.

Gb interface association rules

Association ID: TLLI

Start Time: The current signaling time to search for the "Activate PDP Context Request" signaling with the TLLI forward 24 hours. If no required signaling is found, the start time is 540 seconds forward for the current signaling time.

End Time: The time at which the "Deactivate PDP Context Request" signaling is searched for by the current signaling. If no required signaling is found, the end time is 540 seconds backwards of the current signaling time.

Linked time range: Start time A 60 seconds <Association time range <End time + 60 seconds.

Special note: If associated with multiple Gb communication records, take the most recent record in time.

Gn interface association rules

GTP version 0 association identifier: TID tunnel endpoint identification number

GTP version 1 association identifier: The SGSN CP TEID in the PDP request message in the TEID and Gn communication process of the Gn signaling.

Start Time: The current signaling time to search for the "Create PDP Context Request" signaling with the TEID 24 hours forward. If no required signaling is found, the start time is 540 seconds forward for the current signaling time.

End Time: The time at which the "Delete PDP Context Request" signaling is searched for 24 hours after the current signaling. If no required signaling is found, the end time is 540 seconds backwards of the current signaling time.

<3> DMPP module The DMPP module is deployed on the analysis server and database server of the application processing layer to implement the extension of CDR to BDR, and expands the information that cannot be extracted from the original data according to external data (for example, the city to which IMSI belongs, IMEI Corresponding manufacturer and model, etc.; store the generated BDR into the database; for the basic function report, the DMPP program forms a pre-statistical table based on the business record; stores the KPI data and alarm data in the database; according to the threshold set by the system Threshold, real-time business alerting; and response and support for DMPA access requests.

Referring to Figure 5, the DMPP module further includes two units: a data processing unit and a DMPA processing support unit. The data processing unit mainly performs functions such as BDR extension, BDR extension, service alarm, and inventory storage; the DMPA support unit mainly performs statistical data interaction, instruction delivery, and service scheduling.

<4> DMPA module

The DMPA module is deployed on the web server of the application processing layer to provide download support for the user terminal software; respond to the processing request submitted by the client, and combine with the DMPP module to effectively complete the execution of the processing request, and obtain the return The resulting data is presented on the client side.

The system deploys probe probes and associated backfill procedures in each remote equipment room. In the PS collection scenario, the service processing board and the signaling processing board are integrated into the Probe device, and the degree of integration and normalization is high. Provides processing power and data output capabilities from DPI service analysis, GTP-C signaling analysis, and more. Directly complete the signaling decoding and record synthesis association. The data exchange between the service processing board and the signaling processing board is completed inside the device, and no external auxiliary network equipment and construction are needed, which is more convenient for project implementation and maintenance, which can effectively serve the operator. Save transmission bandwidth between the remote station and the central station. For large-traffic links, the EP device is used for filtering and equalizing the split access mode. At the same time, the large-flow probe is used, and the single station supports 10G traffic access processing. For the E1 link, the DXC is used to link the link and access the Probe. This saves the number of Probe devices. For the Gn interface on the software processing mechanism, the DPI service identification is performed, and the HTTP packet is deeply analyzed, including L7 transaction flow segmentation, L7 transaction parameter extraction (URL, Host, User-Agent, etc.), and traffic calculation. Etc., and directly output the L7 HTTP service record to the associated server. The load on the signaling processing portion can be greatly saved, thereby greatly reducing the number of signaling processing blades. For other interfaces, the EP is used to aggregate or filter the corresponding signaling from interfaces such as Gb, IuPS, Gr, and Gi to perform deep service analysis, parameter extraction, session synthesis, record output, and message storage to provide traffic access capability.

The system is based on a more open architecture and distributed software technology. It does not require a multi-core processing platform and special acceleration hardware. The unified χ86 architecture host can provide operators with new requirements and rapid development environment. The Probe runs on a stable Linux operating system running on a stable Linux or Solari s operating system. The synthesis software adopts an efficient multi-threaded multi-threaded data synthesis mechanism to ensure large data volume processing capability. The application software adopts a distributed processing architecture, which can effectively cope with concurrent large data volume read and write operations. The system uses an open platform architecture that is smoothly backward compatible with the evolution of the monitoring network. For the access layer, the collection layer, the processing layer, and the application layer, you can upgrade and expand the hardware by adding hardware devices. The system acquisition access mode uses high-impedance crossover, LanSwitch mirroring, TAP, and splitting, which does not affect the normal operation of the monitoring network. The system self-organizes the local area network and is isolated from the main network through the firewall. It does not affect the monitoring network.

In summary, although the invention has been disclosed above in the preferred embodiments, it is not intended to limit the invention. Various changes and modifications can be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, the scope of the invention is defined by the scope of the appended claims.

Claims

Claim

A signaling monitoring device for implementing a PS domain distributed architecture, the device comprising a Probe module, a Utrace module, a DMPP module, and a DMPA module, wherein:

The Probe module is configured to complete the collection of the original signaling data, time stamp, and obtain user information, location information, network quality information, user behavior information, service flow information, and service result from the decoding, and synthesize detailed CDR records;

The Utrace module is configured to perform association and labeling of CDRs of each interface in a single service process, and map and fill user identity information, user terminal information, and the like;

The DMPP module is configured to perform pre-statistics of data, signaling association, alarm information processing, output to external interfaces, and response to client query requests.

The DMPA module is used for presenting various application functions in the client software, responding to the processing request submitted by the client, effectively completing the execution of the processing request, and realizing human-computer interaction.

2. The apparatus according to claim 1, wherein the collecting of the original signaling data of the Probe module is performed by:

The signaling data or service data of the corresponding link/port accessed is captured by the acquisition board, and the received original data packet is time stamped according to the synchronous clock source;

3. The apparatus according to claim 1, wherein the obtaining user information, location information, network quality information, user behavior information, service flow information, and service result from decoding is specifically:

The original data packet binary code is parsed, the signaling code is parsed, and user information, location information, network quality information, user behavior information, service flow information, and service result are obtained from the decoding.

The apparatus of claim 1, wherein the Probe module further comprises: a signaling collection unit, configured to receive original data in the link, and perform time stamping and the like;

a signaling record synthesizing unit, configured to decode and synthesize signaling plane data in the original data;

a business record synthesizing unit, configured to decode and synthesize business face data in the original data; An original message storage unit, configured to store the original data code stream corresponding to the composite record;

The link information statistics unit is configured to collect the original data packet traffic carried by the bearer layer link between the network elements.

5. The apparatus according to claim 1, wherein the DMPP module further completes: implementing CDR to BDR extension, expanding information that cannot be extracted in the original data, expanding according to external data, and storing the generated BDR into a database;

For the basic function report, a pre-statistical table is formed based on the business record;

Store KPI data and alarm data in a database;

Real-time service alarms based on threshold thresholds set by the system;

Implement response and support for DMPA module access requests.

6. The apparatus of claim 1, wherein the DMPP module further comprises: a data processing unit and a DMPA processing support unit, wherein

The data processing unit is used to complete BDR extension, BDR extension, service alarm, and inventory storage; the DMPA support unit is used to complete statistical data interaction, instruction delivery, and service scheduling.