WO2016033986A1

WO2016033986A1 - Method and apparatus for implementing deep packet inspection

Info

Publication number: WO2016033986A1
Application number: PCT/CN2015/077874
Authority: WO
Inventors: 李小国
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-09-01
Filing date: 2015-04-29
Publication date: 2016-03-10
Also published as: CN105406977A

Abstract

Disclosed are a method and an apparatus for implementing deep packet inspection. The method comprises: use a DPI device to receive authentication, authorization and accounting (AAA) information and policy information from different comprehensive analysis systems, wherein the policy information is used for indicating a policy adopted to inspect service data and/or a policy adopted to implement statistical analysis on service data and report the service data to the comprehensive analysis system; the DPI device buffers the AAA information and the policy information; and the DPI device inspects the service data according to the buffered AAA information and policy information. Therefore, the problem of difficulty in implementing information sharing between DPI system devices and comprehensive analysis systems of different manufacturers is solved, so data is easily shared between the DPI devices, a unified data mining and analysis system is convenient to establish, and the storage and use performance and reliability of the AAA information and policy information are improved.

Description

Method and device for implementing deep packet inspection

Technical field

The present invention relates to the field of communications, and in particular, to a method and an apparatus for implementing deep packet inspection.

Background technique

Deep Packet Inspection (DPI) is a packet-based application layer traffic detection and control technology for different layers of data packets (such as IP address, application layer port, application layer protocol, payload content). Then, perform deep detection and analysis to obtain application layer information of the entire data stream or data packet, and then statistically analyze and control the traffic according to a system-defined strategy.

The DPI equipment deployed on the existing network of China Telecom uses the proprietary protocols of each manufacturer to interact with its own integrated system and application platform (referred to as the integrated system), which makes it difficult to share information between different provinces, and more deployments in the same province. DPI manufacturers' equipment needs to build independent sub-systems and strategic control systems, and data from different manufacturers is not easy to share.

Based on this, China Telecom defines the interface specification of DPI equipment and the comprehensive system, to standardize the analysis and reporting data of DPI equipment and unify the information interaction interface between it and the integrated system, to realize a unified data mining analysis system of the whole province and even the whole country. .

In summary, it can be seen that the existing DPI system implementation method has the above drawbacks, so it is necessary to provide a new DPI system implementation method according to the telecommunication specification to solve this problem.

In view of the related art, it is difficult to realize information sharing between DPI system equipment and the subdivision system of different manufacturers, and an effective solution has not been proposed.

Summary of the invention

The embodiment of the invention provides a method and a device for implementing deep packet inspection, so as to at least solve the problem that it is difficult to realize information sharing between DPI system devices and the subdivision system of different manufacturers in the prior art.

According to an embodiment of the present invention, a method for implementing deep packet inspection includes: the DPI device receives authentication and authorization (Acceptance, Accounting, AAA for short) information and policy information from different subdivision systems, where The policy information is a policy used to indicate the detection of the service data and/or a statistical analysis of the service data and reporting the strategy adopted by the comprehensive system; The DPI device caches the AAA information and the policy information; the DPI device detects the service data according to the cached AAA information and the policy information.

In the embodiment of the present invention, the DPI device receives the authentication and authorization charging AAA information and the policy information from the different computing system, and the DPI device receives the AAA information and the policy by using a Uc interface disposed on the DPI device. information.

In the embodiment of the present invention, the DPI device caches the AAA information and the policy information, and the DPI device obtains a copy of the AAA information obtained by copying the AAA information, and performs the policy information. a copy of the policy information obtained after the copying; the DPI device performs distributed caching on the AAA information and the copy of the AAA information, and performs distributed caching on the policy information and the copy of the policy information.

In the embodiment of the present invention, after the DPI device detects the service data according to the cached AAA information and the policy information, the method further includes: the DPI device generates a service CDR of the service data; The device performs statistics on the service CDRs according to the policy information, and obtains statistics data. The DPI device reports the service data to the multiplexed system.

In the embodiment of the present invention, the DPI device reports the service data to the system, and the DPI device reports the statistics to the UD interface on the DPI device. Subdivision system.

According to another embodiment of the present invention, there is provided an apparatus for implementing deep packet inspection, the apparatus being applied to a DPI device, comprising: a receiving module, configured to receive authentication and authorization charging AAA information and policy information from different subdivision systems The policy information is a policy used to indicate the detection of the service data and/or a statistical analysis of the service data and reporting the policy adopted by the system; the cache module is set as a cache Determining the AAA information and the policy information; the detecting module is configured to detect the service data according to the cached AAA information and the policy information.

In the embodiment of the present invention, the receiving module is further configured to receive the AAA information and the policy information by using a Uc interface that is disposed on the DPI device.

In the embodiment of the present invention, the cache module is further configured to obtain a copy of the AAA information obtained by copying the AAA information, and a copy of the policy information obtained by copying the policy information; and the AAA information and The AAA information copy is distributedly cached, and the policy information and the copy of the policy information are distributed and cached.

In the embodiment of the present invention, the device further includes: a generating module, configured to generate a service CDR of the service data; and a statistic module, configured to perform statistics on the service CDR according to the policy information, and obtain statistics The reporting module is configured to report the service data to the comprehensive system.

In the embodiment of the present invention, the reporting module is further configured to report the statistical data to the comprehensive counting system through a Ud interface disposed on the DPI device.

According to the embodiment of the present invention, the DPI device is used to receive the authentication and authorization charging AAA information and policy information from different system, wherein the policy information is used to indicate the policy used for detecting the service data and/or the service data is performed. Statistical analysis and reporting of the strategy adopted by the system; the DPI device caches AAA information and policy information; the DPI device detects the service data based on the cached AAA information and policy information, and solves the DPI system equipment and the integrated system of different manufacturers. It is difficult to realize the problem of information sharing, and thus the data sharing between DPI devices is easy to be shared, and the effect of establishing a unified data mining analysis system is improved, and the performance and reliability of AAA information and policy information storage and use are improved.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flowchart of a method for implementing deep packet inspection according to an embodiment of the present invention;

2 is a structural block diagram of an apparatus for implementing deep packet inspection according to an embodiment of the present invention;

3 is a structural block diagram 1 of an apparatus for implementing deep packet inspection according to an embodiment of the present invention;

4 is a block diagram of a functional module of a DPI system according to an embodiment of the present invention;

FIG. 5 is a flowchart of cooperation between AAA information processing modules of a DPI system according to an embodiment of the present invention; FIG.

6 is a flowchart of cooperation between a DPI system policy and a configuration information processing module according to an embodiment of the present invention;

FIG. 7 is a flowchart of cooperation between statistical data reporting modules of a DPI system according to an embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

In this embodiment, a method for implementing deep packet inspection is provided. FIG. 1 is a flowchart of a method for implementing deep packet inspection according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps:

In step S102, the DPI device receives the authentication and authorization charging AAA information and the policy information from the different system, wherein the policy information is used to indicate the policy used for detecting the service data and/or statistically analyze and report the service data. The strategy adopted by the comprehensive system;

Step S104, the DPI device caches AAA information and policy information.

Step S106: The DPI device detects the service data according to the cached AAA information and the policy information.

Through the above steps, the DPI device caches the received AAA information and policy information from different subdivision systems, and detects the service data according to the cached AAA information and policy information, compared to the DPI system of different manufacturers in the prior art. It is difficult to realize information sharing between the device and the integrated system, which makes it easy to share data between DPI devices, facilitates the establishment of a unified data mining and analysis system, and improves the performance and reliability of AAA information and policy information storage and use. Sex.

In the above step S102, the DPI device receives the AAA information and the policy information from the different system, and it should be noted that the DPI device can receive the information in multiple manners. In a preferred embodiment, the DPI device is set in the DPI. The Uc interface of the device receives AAA information and policy information.

In the above step S104, the DPI device caches the AAA information and the policy information. Similarly, the DPI device caches the information in multiple manners. In a preferred embodiment, the DPI device obtains the AAA information. A copy of the AAA information, and a copy of the policy information obtained by copying the policy information, and then the DPI device performs distributed caching on the AAA information and the AAA information copy, and distributedly caches the copy of the policy information and the policy information, thereby passing through the DPI system. The distributed cache is used to store AAA information and policy information, which solves the problem that AAA information and service data cannot be distributed to the same service processor for data association. At the same time, distributed cache provides distributed, multi-copy memory storage, and strategy. The storage and use of information and AAA information has higher performance and higher reliability.

In a preferred embodiment, after the DPI device detects the service data according to the cached AAA information and the policy information, the DPI device generates a service CDR of the service data, and the DPI device performs statistics on the service CDR according to the policy information, and obtains statistics. Data, the DPI device reports the business data to the integrated system, thereby realizing the information interaction between the DPI device and the integrated system.

The DPI device can also report the service data to the integrated system in a plurality of manners. In a preferred embodiment, the DPI device reports the statistical data to the integrated system through the Ud interface disposed on the DPI device.

In the embodiment, a device for implementing the deep packet detection is further provided, and the device is used to implement the foregoing embodiments and the preferred embodiments, and details are not described herein. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

2 is a structural block diagram of an apparatus for implementing deep packet inspection according to an embodiment of the present invention. The apparatus is applied to a DPI device. As shown in FIG. 2, the method includes: a receiving module 22 configured to receive authentication and authorization from different subdivision systems. Accounting AAA information and policy information, wherein the policy information is a policy used to indicate the detection of the service data and/or a statistical analysis of the service data and reporting the policy adopted by the system; the cache module 24, configured to cache AAA information and policy information; the detecting module 26 is configured to detect the service data according to the cached AAA information and the policy information.

In the embodiment of the present invention, the receiving module 22 is further configured to receive AAA information and policy information through a Uc interface disposed on the DPI device.

In the embodiment of the present invention, the cache module 24 is further configured to obtain a copy of the AAA information obtained by copying the AAA information, and a copy of the policy information obtained by copying the policy information; and distributedly buffering the AAA information and the AAA information copy. And distributed caching of copies of policy information and policy information.

3 is a block diagram of a structure of an apparatus for implementing deep packet inspection according to an embodiment of the present invention. As shown in FIG. 3, the apparatus further includes: a generating module 28, configured to generate a service bill for service data; and a statistics module 30, setting The statistics are obtained by collecting statistics on the business bills according to the policy information, and the reporting module 32 is configured to report the service data to the integrated system.

In the embodiment of the present invention, the reporting module 32 is further configured to report the statistical data to the integrated system through the Ud interface disposed on the DPI device.

The above-described problems in the related art will be described below in conjunction with the preferred embodiments, which combine the above-described embodiments and preferred embodiments thereof.

The technical problem to be solved by the preferred embodiment is to overcome the problem that the authentication, authorization, and accounting (AAA) information is delivered through the system and the service data cannot be distributed to the same service processor, and the policy. Information high performance, highly reliable storage and usage issues, providing a DPI system implementation that supports telecom specifications.

The implementation method of the DPI system in the preferred embodiment includes the following modules:

The service processing module detects and controls the service data according to the policy information, and generates a service bill;

a policy management module that manages and maintains user AAA information and policy information;

A statistical database that stores business bill records, analyzes, and statistically detects business data;

Uc interface module, AAA information, policy information and configuration information transmission interface between the DPI system and the integrated system, responsible for data transmission and reception and format conversion;

The Ud interface module, the DPI system reports the transmission adaptation interface of the statistical data to the comprehensive system, and is responsible for data transmission and reception and format conversion;

The statistics aggregation module dynamically maintains statistical tasks according to the statistical reporting policy and reports statistical data to the comprehensive system.

The distributed cache module stores distributed user AAA information and policy information in memory in a distributed, multi-copy manner.

4 is a functional block diagram of a DPI system according to an embodiment of the present invention. As shown in FIG. 4, a service processing module is connected with a policy management module, a distributed cache module, and a statistical database; a policy management module, a service processing module, and a statistical aggregation module. , Uc interface module, distributed cache module connection; statistical aggregation module and policy management module, Ud interface module, distributed cache module, statistical database connection.

The implementation method of the DPI system of the preferred embodiment includes the following steps: Step 1: Receive and parse the AAA information of the maintenance user through the Uc interface; Step 2, receive and parse the maintenance policy and configuration information through the Uc interface; Step 3, according to the management policy The information is detected and controlled by the service data, and the service CDR is generated. In step 4, the service CDR record is saved to the statistic database, and the service data is pre-stated, and the statistic data is dynamically obtained according to the statistical report policy, and reported to the ensemble through the Ud interface. Sub-system.

Compared with the prior art, the preferred embodiment introduces a distributed cache to store AAA information and policy information in the DPI system, and solves the problem that the AAA information and the service data cannot be distributed to the same service processor for data association, and Distributed cache provides distributed, multi-copy memory storage. The storage and use of policy information and AAA information has higher performance and higher reliability. It provides a DPI system implementation method based on the unified interface of telecom specifications. It makes the data of different manufacturers and different provinces more convenient to share, and it is easy to realize a unified data mining and analysis system of the whole province and even the whole country.

The preferred embodiments of the present invention will be further described in detail below with reference to the drawings and specific embodiments.

FIG. 5 is a flowchart of cooperation between AAA information processing modules of a DPI system according to an embodiment of the present invention. As shown in FIG. 5, the method includes the following steps:

In step S502, the AAA online information is sent to the Uc interface module of the DPI system.

Step S504, the Uc interface module receives the message, and converts to the internal message format of the DPI system and forwards the message to the policy management module.

Step S506, the policy management module parses the AAA information to obtain user information, and stores the user information in the distributed cache.

Step S508, the service processing module receives the service data packet and does not have corresponding user information locally, and queries the distributed cache to obtain the corresponding user information. If the user information is successfully queried, the query module information of the user information in the distributed cache is updated, AAA. After the online process ends, go to step S516 to process the AAA offline information;

Step S510: If the query of the user information in the distributed cache fails, the service processing module continues to query the policy management module for the user information.

Step S512, the policy management module sends an AAA information back-check message to the Uc interface module.

Step S514, the Uc interface module performs format conversion on the message and forwards the message to the system, and then proceeds to step 1 to continue processing the AAA information delivered by the system after the query;

In step S516, the AAA offline message is sent to the Uc interface module of the DPI system.

Step S518, the Uc interface module receives the message, and converts the internal message into a DPI system and forwards the message to the policy management module.

Step S520: After the policy management module queries and obtains the user information in the distributed cache, the user information in the distributed cache is deleted.

In step S522, the policy management module notifies the user of the service processing module that has queried the offline user information to go offline.

FIG. 6 is a flowchart of cooperation between a DPI system policy and a configuration information processing module according to an embodiment of the present invention. As shown in FIG. 6, the method includes the following steps:

Step S602, the service processing module starts initialization, and reads the policy and configuration information delivered by the integrated system into the distributed cache.

Step S604, the statistics aggregation module starts initialization, and reads the policy and configuration information delivered by the system in the distributed cache.

In step S606, the system provides the policy and configuration information to the Uc interface module of the DPI system.

Step S608, the Uc interface module receives the message, and converts it into a DPI system internal message format and forwards it to the policy management module.

Step S610, the Uc interface module returns a response message to the score system;

Step S612, the policy management module parses the policy information and the configuration information, and stores the information in the distributed cache.

Step S614, if the delivered policy and configuration information are required by the service module, notify all service processors to update the corresponding policy and configuration information;

Step S616, the service processing module obtains the updated policy and configuration information in the distributed cache, and detects and controls the service data according to the updated policy and configuration information.

Step S618: If the delivered policy and configuration information are required by the statistics aggregation module, notify the statistics aggregation module to update the corresponding policy and configuration information.

Step S620: The statistic aggregation module obtains the updated policy and configuration information from the distributed cache, and performs statistical analysis on the service CDR data according to the updated policy and configuration information.

FIG. 7 is a flowchart of cooperation between statistical data reporting modules of a DPI system according to an embodiment of the present invention. As shown in FIG. 7, the method includes the following steps:

Step S702, the service bill record generated by the service processing module is stored in a statistical database;

Step S704, pre-stating the service data according to different time granularities and classifications in the statistical database;

Step S706: The statistic aggregation module collects statistical data from the statistical database according to the current statistical reporting policy.

Step S708, the statistical aggregation module sends the statistical data to the Ud interface module.

In step S710, the Ud interface module performs format conversion on the statistical data and reports it to the integrated system.

In summary, the present invention makes it easy to share data between DPI devices by implementing a unified interface between the integrated system and the DPI system defined in the telecommunication specification, and is convenient for establishing a unified data mining and analyzing system; In the DPI system implementation method, a distributed cache module is introduced, which solves the problem that AAA information and service data cannot be distributed to the same service processor, and improves the performance and reliability of AAA information and policy information storage and use.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

The technical solution provided by the embodiment of the present invention can be applied to the deep packet inspection process, and the DPI device is used to receive the authentication and authorization charging AAA information and policy information from different system, wherein the policy information is used to indicate the detection of the service data. The adopted strategy and/or the statistical analysis of the business data and the reporting of the strategy adopted by the comprehensive system; the DPI device caches the AAA information and the policy information; the DPI device detects the service data according to the cached AAA information and the policy information, and solves the problem. It is difficult to realize information sharing between DPI system equipment and the subdivision system of different manufacturers, so that the data between DPI devices can be easily shared, and the effect of establishing a unified data mining and analysis system is improved, and AAA information and policy information are improved. Performance and reliability of storage and use.

Claims

A method for implementing deep packet inspection DPI includes:

The DPI device receives the authentication and authorization charging AAA information and the policy information from the different system, wherein the policy information is used to indicate a policy for detecting the service data and/or statistically analyze the service data. Reporting the strategy adopted by the integrated system;

The DPI device caches the AAA information and the policy information;

The DPI device detects the service data according to the cached AAA information and the policy information.
The method according to claim 1, wherein the DPI device receives authentication and authorization charging AAA information and policy information from different subdivision systems, including:

The DPI device receives the AAA information and the policy information through a Uc interface disposed on the DPI device.
The method of claim 1, wherein the DPI device caches the AAA information and the policy information, including:

And obtaining, by the DPI device, a copy of the AAA information obtained by copying the AAA information, and copying the policy information obtained by copying the policy information;

The DPI device performs distributed caching on the AAA information and the AAA information copy, and performs distributed caching on the policy information and the copy of the policy information.
The method of claim 1, wherein the DPI device after detecting the service data according to the cached AAA information and the policy information further includes:

The DPI device generates a service CDR of the service data;

The DPI device performs statistics on the service CDRs according to the policy information to obtain statistical data.

The DPI device reports the service data to the integrated system.
The method according to any one of claims 1 to 4, wherein the DPI device reports the service data to the system, including:

The DPI device reports the statistical data to the integrated system through a Ud interface disposed on the DPI device.
An apparatus for implementing a deep packet inspection DPI, the apparatus being applied to a DPI device, the device comprising:

a receiving module, configured to receive authentication and authorization charging AAA information and policy information from different system, wherein the policy information is used to indicate a policy for detecting service data and/or to perform the service data. Statistical analysis and reporting of the strategies adopted by the integrated system;

a cache module, configured to cache the AAA information and the policy information;

The detecting module is configured to detect the service data according to the cached AAA information and the policy information.
The apparatus of claim 6, wherein the receiving module is further configured to receive the AAA information and the policy information by a Uc interface disposed at the DPI device.
The device according to claim 6, wherein the cache module is further configured to obtain a copy of the AAA information obtained by copying the AAA information, and copying the policy information obtained by copying the policy information; The AAA information and the copy of the AAA information are distributed and distributed, and the policy information and the copy of the policy information are distributed and cached.
The apparatus of claim 6 wherein said apparatus further comprises:

Generating a module, configured to generate a service CDR of the service data;

The statistic module is configured to perform statistics on the service CDRs according to the policy information to obtain statistical data.

The reporting module is configured to report the service data to the comprehensive system.
The apparatus according to any one of claims 6 to 9, wherein the reporting module is further configured to report the statistical data to the plurality of sub-systems via a Ud interface provided on the DPI device.