Patent Application
20160352921
The invention relates to an arrangement, a computer program code and a method for call data record processing.
Monitoring of a live telecommunications network yields a massive amount of information. U.S. Pat. No. 7640015 discloses processing of call data records (CDR). However, further sophistication is desirable in order to process the information in a more efficient way.
The present invention seeks to provide an improved arrangement, computer program code and method.
According to an aspect of the present invention, there is provided an arrangement comprising: one or more processors; and one or more memories including computer program code, the one or more memories and the computer program code configured to, with the one or more processors, cause the arrangement at least to: obtain a plurality of call and session records CP-XDR of a control plane produced by analysing communication in a monitored telecommunications network; aggregate call data records CP-CDR of the control plane from call and session records CP-XDR of the control plane on the basis of a subscriber identifier, each call data record CP-CDR of the control plane comprising a subscriber identifier as a key and further comprising one or more protocol addresses of a mobile subscriber identified by the subscriber identifier; create a control plane data structure comprising subscriber identifier-protocol address-pairs gathered from the call data records CP-CDR of the control plane; obtain a plurality of call and session records UP-XDR of a user plane produced by analysing communication in the monitored telecommunications network; and aggregate the call and session records UP-XDR of the user plane on the basis of the control plane data structure such that call and session records UP-XDR of the user plane including the same protocol address are aggregated together.
According to another aspect of the present invention, there is provided a non-transitory computer-readable storage medium comprising computer program code which, when executed on one or more computing apparatuses, causes the one or more computing apparatuses at least to: obtain a plurality of call and session records CP-XDR of a control plane produced by analysing communication in a monitored telecommunications network; aggregate call data records CP-CDR of the control plane from call and session records CP-XDR of the control plane on the basis of a subscriber identifier, each call data record CP-CDR of the control plane comprising a subscriber identifier as a key and further comprising one or more protocol addresses of a mobile subscriber identified by the subscriber identifier; create a control plane data structure comprising subscriber identifier-protocol address-pairs gathered from the call data records CP-CDR of the control plane; obtain a plurality of call and session records UP-XDR of a user plane produced by analysing communication in the monitored telecommunications network; and aggregate the call and session records UP-XDR of the user plane on the basis of the control plane data structure such that call and session records UP-XDR of the user plane including the same protocol address are aggregated together.
According to another aspect of the present invention, there is provided a method comprising: obtaining a plurality of call and session records CP-XDR of a control plane produced by analysing communication in a monitored telecommunications network; aggregating call data records CP-CDR of the control plane from call and session records CP-XDR of the control plane on the basis of a subscriber identifier, each call data record CP-CDR of the control plane comprising a subscriber identifier as a key and further comprising one or more protocol addresses of a mobile subscriber identified by the subscriber identifier; creating a control plane data structure comprising subscriber identifier-protocol address-pairs gathered from the call data records CP-CDR of the control plane; obtaining a plurality of call and session records UP-XDR of the user plane produced by analysing communication in the monitored telecommunications network; and aggregating the call and session records UP-XDR of the user plane on the basis of the control plane data structure such that call and session records UP-XDR of the user plane including the same protocol address are aggregated together.
Example embodiments of the present invention are described below, by way of example only, with reference to the accompanying drawings, in which
The following embodiments are only examples. Although the specification may refer to “an” embodiment in several locations, this does not necessarily mean that each such reference is to the same embodiment(s), or that the feature only applies to a single embodiment. Single features of different embodiments may also be combined to provide other embodiments. Furthermore, words “comprising” and “including” should be understood as not limiting the described embodiments to consist of only those features that have been mentioned and such embodiments may contain also features/structures that have not been specifically mentioned.
It should be noted that while Figures illustrate various embodiments of apparatuses, they are simplified block diagrams that only show some structures and functional entities. The connections shown in these Figures are logical connections; the actual physical connections may be different. Interfaces between the various elements may be implemented with suitable interface technologies, such as a message interface, a method interface, a sub-routine call interface, a block interface, or any hardware/software means enabling communication between functional sub-units. It is apparent to a person skilled in the art that the described apparatuses may also comprise other functions and structures. It should be appreciated that details of some functions, structures, and the protocols used for communication are irrelevant to the actual invention. Therefore, they need not be discussed in more detail here.
In an example embodiment, a control plane probe 104 is used to monitor 134 communication in a control plane telecommunications interface 130, and a user plane probe 120 is used to monitor 136 communication in a user plane telecommunications interface 132.
In an example embodiment, the control plane telecommunications interface 130 is between a serving gateway (S-GW) 116 and a mobility management entity (MME) 114. In an example embodiment, an MME pool 112 comprises a plurality of mobility management entities 114.
In an example embodiment, the control plane telecommunications interface 130 is an S11 interface.
In an example embodiment, the user plane telecommunications interface 132 is between a base station 108 and a serving gateway/packet data network gateway (S/P-GW) 116.
In an example embodiment, the user plane telecommunications interface 132 is an S1-U interface.
The base station 108 may be called, depending on the system, a Node B, enhanced or evolved NodeB (eNB), a home eNode B (HeNB), an access point (AP), an IEEE 802.11 based access point, a femto node, a femto base station, or any other equipment belonging to the network infrastructure of the telecommunications network 106, and implementing the radio communication interface with a mobile terminal 110. Functionalities of the base station 108 may include: all radio protocols, mobility management, all retransmissions, header compression, and packet data convergence protocols. The mobility management entity 114 is a control plane entity and the user plane bypasses MME 114 directly to a serving gateway (S-GW) 116.
In addition to, or instead of, these mentioned example embodiments, the monitoring 134, 136 of the communication in the telecommunications network 106 may be directed to other interfaces as well, such as those described in various telecommunications standard specifications.
In an example embodiment, the telecommunications network 106 is monitored 134, 136 in order to examine control plane traffic 130 and user plane traffic 132 caused by a mobile terminal 110 communicating 150 with the base station 108. In an example embodiment, the mobile terminal 110 communicates (with packet data transfer, for example) with services 118 obtained through the telecommunications network infrastructure 108, 114, 116.
In an example embodiment, the mobile terminal 110 is a portable electronic communication apparatus. A non-exhaustive list of the types of the mobile terminal 110 includes: a mobile phone, a smartphone, a tablet computer, a phablet, a smartwatch, a general-purpose mobile computing device.
In an example embodiment, control plane signalling 130 is used to agree S11 GTP-C TEID and IP address pairs, APN, PDN address, Bearer context (bearer id, S1-U GTP-U TEID and IP address pairs) etc. The mobile terminal 110 may be identified with an IMSI. The connection 150 may be tracked using S11-MME GTP-C TEID and MME IP address pair and S11-SGW GTP-C TEID and SGW IP address pair.
In an example embodiment, the S1-U tunnel 132 is used to tunnel mobile traffic 150 between the eNB 108 and the S-GW 116. The tunnel 132 may be identified with S1 U eNB GTP-U TEID and eNB IP address pair and S1 U SGW GTP-U TEID and SWG IP address pair. The tunnel 132 may be allocated to the mobile terminal 110 using 311 control plane signalling 130, S1-U to S11 correlation may be made using tunnel identifiers that are signalled in the S11 interface 130.
The probes 104, 120 may comprise at least one network interface card to capture data packets 130, 132 from the monitored telecommunications network 106. Special high performance network interface cards are available from various vendors. The network interface card may be connected to the telecommunications network 106 passively through a connection, either using a pass-through connection or a network tap. The network interface card may timestamp and deliver data for (real-time or almost real-time) analysis or to be stored into a capture file (for non-real-time analysis). Note that in the example embodiment of
As was explained earlier, the analysis by the probes 104, 120 may be performed in an online or offline manner. During the online analysis, packets captured by the probes 104, 120 are instantly (without unnecessary delays, i.e., in real-time or near real-time) analysed. In the offline analysis, the packets are first recorded into the capture file, and, after an undefined period, the capture file is imported to the arrangement 100 by an input/output 230, by a communication interface 232, for example. As a result of the analysis in the control plane probe 104, a plurality of control plane call and session records CP-XDR 138 is produced and transferred to the arrangement 100 for mediation and correlation. As a result of the analysis in the user plane probe 120, a plurality of user plane session records UP-XDR 140 is produced and transferred to the arrangement 100 for mediation and correlation,
In an example embodiment, the probes 104, 120 comprise a computer running protocol analyzer software. The software may be modified from existing protocol analyzer software such as EXFO PowerHawk Pro.
In an example embodiment, the mediation arrangement 100 may be responsible for one or more MME areas 102A, 102B, and the mediation arrangement 100 may transfer 142, 144 the results to a central server 122.
With reference to
The arrangement 100 may be any electronic arrangement capable of processing data as described in the following. A non-exhaustive list of the types of the arrangement 100 includes: one or more electronic digital computers, one or more desktop computers, one or more portable computers, one or more laptop computers, one or more tablet computers, or any other electronic arrangement performing the processing such as at least one rack-mounted processing unit, or any combination of these various computing resources. The arrangement 100 may employ an operating system such as Microsoft Windows, Apple Mac OS X, or Linux, for example. Besides being a single apparatus, the arrangement 100 may be implemented in a distributed fashion employing communicatively coupled sub-units.
In an example embodiment, the software may implement a user interface 234 with suitable hardware, which allows controlling the operations of the arrangement 100 and monitoring the results of the operations carried out by the arrangement 100.
The arrangement 100 comprises one or more processors 200 and one or more memories 210 including computer program code 212. The one or more memories 210 and the computer program code 212 are configured to, with the one or more processors 200, cause the arrangement 100 to perform various operations described later.
The term ‘processor’ 200 refers to a device that is capable of processing data. Depending on the processing power needed, the arrangement 100 may comprise several processors 200 such as parallel processors or a multicore processor. When designing the implementation of the processor 200, a person skilled in the art will consider the requirements set for the size and power consumption of the arrangement 100, the necessary processing capacity, production costs, and production volumes, for example.
The term ‘memory’ 210 refers to a device that is capable of storing data run-time (=working memory) or permanently (=non-volatile memory). The working memory and the non-volatile memory may be implemented by a random-access memory (RAM), dynamic RAM (DRAM), static RAM (SRAM), a flash memory, a solid state disk (SSD), PROM (programmable read-only memory), a suitable semiconductor, or any other means of implementing an electrical computer memory.
The processor 200 and the memory 210 may be implemented by an electronic circuitry. A non-exhaustive list of implementation techniques for the processor 200 and the memory 210 includes, but is not limited to: logic components, standard integrated circuits, application-specific integrated circuits (ASIC), system-on-a-chip (SoC), application-specific standard products (ASSP), microprocessors, microcontrollers, digital signal processors, special-purpose computer chips, field-programmable gate arrays (FPGA), and other suitable electronics structures.
In an example embodiment, a system clock 220 constantly generates a stream of electrical pulses, which cause the various transferring operations within the arrangement 100 to take place in an orderly manner and with specific timing.
In an example embodiment, the processor 200 may be implemented as a microprocessor implementing functions of a central processing unit (CPU) on an integrated circuit, The CPU is a logic machine executing the computer program code 212. The computer program code 212 may be coded as a computer program using a programming language, which may be a high-level programming language, such as C, C++, or Java, or a low-level programming language, such as a machine language, or an assembler, for example. The CPU may comprise a set of registers 202, an arithmetic logic unit (ALU) 204, and a control unit (CU) 206. The control unit 206 is controlled by a sequence of the computer program code 212 transferred to the CPU from the (working) memory 210. The control unit 206 may contain a number of microinstructions for basic operations. The implementation of the microinstructions may vary, depending on the CPU design. The microprocessor 200 may also have an operating system (a dedicated operating system of an embedded system, a real-time operating system, or even a general-purpose operating system), which may provide the computer program code 212 with system services.
The computer program code 212 may be implemented by software and/or hardware. In an example embodiment, the software may be written by a suitable programming language, and the resulting executable code 212 may be stored on the memory 210 and run by the processor 200.
An example embodiment provides a computer-readable medium 240 comprising a computer program comprising the computer program code 212 which, when loaded into the arrangement 100 causes the arrangement to perform the described example embodiments. The example embodiments of the arrangement 100 may be used to enhance the operation of the computer program code 212. There are many ways to structure the computer program code 212. In an example embodiment, the operations of the computer program code 212 may be divided into functional modules, sub-routines, methods, classes, objects, applets, macros, etc., depending on the software design methodology and the programming language used. In modern programming environments, there are software libraries, i.e. compilations of ready-made functions, which may be utilized by the computer program code 212 for performing a wide variety of standard operations. In an example embodiment, the computer program code 212 may be in source code form, object code form, executable file, or in some intermediate form. The computer-readable medium 240 may comprise at least the following: any entity or device capable of carrying computer program code 212 to the arrangement 100, a record medium, a computer memory, a read-only memory, an electrical carrier signal, a telecommunications signal, and a software distribution medium. In some jurisdictions, depending on the legislation and the patent practice, the computer-readable medium 240 may not be the telecommunications signal. In an example embodiment, the computer-readable medium 240 may be a non-transitory computer-readable storage medium.
In an example embodiment, the functionality of the hardware may be designed by a suitable hardware description language (such as Verilog or VHDL), and transformed into a gate-level netlist (describing standard cells and the electrical connections between them), and after further phases the chip implementing the processor 200, memory 210 and the code 212 of the arrangement 100 may be fabricated with photo masks describing the circuitry.
In an example embodiment, the processor 200 and the memory 210 are separate entities, communicatively coupled together by an appropriate serial bus, for example. In general interfaces between the various elements may be implemented with suitable interface technologies, such as a message interface, a method interface, a sub-routine call interface, a block interface, an appropriate serial/parallel bus, or any hardware/software means enabling communication between various sub-units of the arrangement 100.
The one or more memories 210 and the computer program code 212 are configured to, with the one or more processors 200, cause the arrangement 100 to obtain a plurality of control plane call and session records CP-XDR 138 produced by analysing communication in the monitored telecommunications network 106 (by the CP probe 104), and aggregate control plane call data records CP-CDR from control plane call and session records CP-XDR on the basis of a subscriber identifier, each control plane call data record CP-CDR comprising a subscriber identifier as a key and further comprising one or more protocol addresses.
In an example embodiment, the subscriber identifier comprises an international mobile subscriber identity (IMSI).
In an example embodiment, the protocol address comprises an Internet protocol IP address of a mobile subscriber identified by the subscriber identifier and a GPRS tunnelling protocol tunnel endpoint identifier GP-TEID.
The one or more memories 210 and the computer program code 212 are configured to, with the one or more processors 200, cause the arrangement 100 to create a control plane data structure comprising subscriber identifier-protocol address-pairs gathered from the control plane call data records CP-CDR.
The one or more memories 210 and the computer program code 212 are configured to, with the one or more processors 200, cause the arrangement 100 to obtain a plurality of user plane call and session records UP-XDR 140 produced by analysing communication in the monitored telecommunications network 106 (by the UP probe 120), and aggregate the user plane call and session records UP-XDR on the basis of the control plane data structure.
The probes 104, 120 produce call and session records XDRs, both for the control plane and the user plane. XDRs represent calls and session with very high detail level and user plane records do not include information about the subscriber. Consequently, the XDRs are correlated and aggregated to higher abstraction level call data records CDRs containing all relevant information for network monitoring. The example embodiments provide scalable high performance mediation (correlation and aggregation) of control and user plane call and session records XDRs to provide CDRs.
The user plane probe 120 may provide comma separated value (CSV) formatted subscriber records, i.e., user plane UP XDRs, containing all transport layer IP address+TEID pairs captured during the monitoring period. The UP XDRs may contain volume, jitter, and other similar information for at least top applications.
The control plane probe 104 may provide CSV formatted control plane CP XDRs containing interface specific session records containing IMSI, transport layer IP+TEID pairs and validity times, cells, and session end failure causes. In order to separate success causes from failure causes, CP XDRs may include a configurable list of failure causes per cause type. Each CP XDR may include at least IMSI and new/removed transport layer IP+TEID info and currently valid transport layer IP+TEID info.
CP and UP XDRs are correlated and aggregated to CDRs that are provided to the central server 122 for displaying the network state.
Mediation may be pipelined through multiple steps. A split step splits the CSV records to multiple files to allow separate processing of results in multiple mediation functions. A correlate step extracts IMSI, IP+TEID information and correlates UP to CP using it. An aggregate step writes results to CDR files.
The mediation may be done as follows:
In step 1, IP+TEID map is created on bases of CP XDRs containing data for the monitoring period. IP+TEID is the key, value is CDR. There may be multiple simultaneous processes, processing IMSI sharded (splitted) CSV file chains.
In step 2, CDRs are enriched with UP data. There may be multiple simultaneous enrichment processes processing IP+TEID shared CSV file chains. Processing handles CDRs for the whole period at once.
In step 3, CDRs are written to one or multiple IMSI sharded CDR CSV files. There can be multiple write processes running simultaneously.
Processing may be pipelined per batch, after completing previous period processing stage, processing of the next period stage is started immediately when data is available.
The scaling may be done as follows:
CP XDRs are split by multiple IMSI groups by a modulo of a hash key.
Each IMSI group is assigned for a certain mediation process.
UP XDRs are provided to every mediation process, this may be done, because UP XDRs contain low volume subscriber records.
Bottleneck in this arrangement 100 may be in providing UP XDRs to every mediation process, but it is not a problem because 1 million subscribers provide 1000-10000 records per second, and one mediation process processes easily 100000 XDRs. So the arrangement 100 scales well to very large MME sites containing even tens of millions of subscribers.
In an example embodiment, the plurality of the control plane call and session records CP-XDR 138 is obtained from analysing (by the CP probe 104) the communication in the first link 130 between the serving gateway 116 and the mobility management entity 114 in the monitored telecommunications network 106, and the plurality of the user plane call and session records UP-XDR 140 is obtained from analysing (by the UP probe 120) the communication in the second link 132 between the base station 108 and the serving gateway and/or the packet data network gateway 116 in the monitored telecommunications network 106. This example embodiment is illustrated in
In an example embodiment, the input 138, 140 may be provided as compressed CSV files in up to 7 different formats:
LTE signalling protocols: S1-AP (S1 interface), X2-AP (X2 interface), and GTPC (S5/S8, S4, S3, S10, S11 interfaces);
PS Core signalling protocols: Gb, IuPS, and Gn;
User plane (common format for LTE and PS Core): DPI output from S1-U, S5/S8 and Gn user plane interfaces.
In an example embodiment, the output 142 may be provided as three CSV format CDRs: LTE control plane CDRs enriched with data volumes, PS Core control plane CDRs enriched with data volumes, and user plane usage CDRs enriched with subscriber and network information from signalling.
In an example embodiment, XDR files are produced in batches (the period of each batch may be configurable, from 5 to 15 minutes, for example) with one file produced per protocol and probe 104, 120. There may be several files for the same protocol in case there are several probes 104, 120 capturing the same interfaces. Output data is provided in batches with one file type produced per output format.
Table 1 illustrates an example embodiment of the control plane and session record CP-XDR 138: the first column gives a name for an attribute and the second column gives a short description for the attribute.
Table 2 lists possible session values for the S11_phase attribute of the CP-XDR 138.
Table 3 illustrates an example embodiment of a user plane flow record containing information from a single, unidirectional flow.
Table 4 illustrates an example embodiment of a user plane aggregated flow record containing aggregated information from all flows captured during the monitoring period, record per Src/Dst/TEID/application (http, SIP, DNS etc.).
CDR may be an aggregated record per IMSI containing the selected information from CP XDRs from selected telecom interfaces and from aggregated UP flow records.
The control plane files 300A, 300B are processed by blocks 302A, 302B, which perform the IMSI-IP&TEID-mapping and loadsharing by IMSI.
Blocks 304A, 304B perform aggregation by IMSI and IP&TEID for the control plane data 300A, 300B. In an example embodiment, the control plane call data records CP-CDR are aggregated such that control plane call and session records including the same subscriber identifier are aggregated together.
The user plane files 310A, 310B are processed by blocks 312A, 312B, which perform the loadsharing by IP&TEID. Next, blocks 314A, 314B perform aggregation by the IP&TEID and application. In an example embodiment, the user plane call and session records UP-XDR are aggregated such that user plane call and session records including the same protocol address are aggregated together. In an example embodiment, if there is more than one subscriber identifier-protocol address pair with the same subscriber identifier (a single IP&TEID may have multiple IMSIs, for example), an aggregated user plane call and session record is created for each subscriber identifier, each such aggregated user plane call and session record further comprising a mobile Internet protocol layer address. Blocks 316A, 316B provide IMSI enrichment with the IMSI-IP&TEID-map 320 obtained from the control plane blocks 302A, 302B. Blocks 318A, 318B perform loadsharing by IMSI.
Finally, blocks 322 and 326 perform correlation and aggregation using IMSI, in order to produce control plane call data records CP-CDR 324 and user plane call data records UP-CDR 328.
In
In
In
In an example embodiment of
In an example embodiment, the processing is performed in two parallel computing pipelines such, that the plurality of the control plane call and session records CP-XDR 138 is obtained in a first batch file for the first computing pipeline and the aggregation of the control plane call data records CP-CDR and the creation of the control plane data structure is performed in the first computing pipeline, and that the plurality of the user plane call and session records UP-XDR 140 is obtained in a second batch file for the second computing pipeline and the aggregation of the user plane call and session records UP-XDR is performed in the second computing pipeline, whereupon the results of the aggregations are stored in a result file, and, finally, the computing pipelines obtain the next first and second batch files for the processing. Each pipeline is a set of data processing elements connected in series. The elements of a pipeline may be executed in parallel or in a time-sliced fashion, for example. In
The mobility management entity 114 communicates 1000, 1002, 1004, 1006 with the serving gateway 116 in order to create a communication session with its bearer(s) as defined by the attributes 1008, 1010 including the subscriber identifier (IMSI), protocol addresses (Fully Qualified TEID F-TEID) and other relevant information such as Access Point Name APN, PDN (Packet Data Network) Address and Bearer context. The user plane traffic 1022 is performed in an S1-U tunnel 1020 between the mobile terminal 110 and the services 118 utilizing S1-U ENB-SGW GTP-U tunnelled data.
Next, let us study
The method starts in 1100 as the computing resource(s) is switched on and it starts to process data.
In 1102, a plurality of control plane call and session records produced by analysing communication in a monitored telecommunications network are obtained.
In 1104, control plane call data records are aggregated from control plane call and session records on the basis of a subscriber identifier. Each control plane call data record comprises a subscriber identifier as a key and further comprising one or more protocol addresses.
In 1106, a control plane data structure comprising subscriber identifier-protocol address-pairs gathered from the control plane call data records is created.
In 1108, a plurality of user plane call and session records produced by analysing communication in the monitored telecommunications network are obtained.
In 1110, the user plane call and session records are aggregated on the basis of the control plane data structure.
The method ends in 1112 if the computing resource(s) is switched off, or the method may also be suspended after all data is processed until the next not yet processed data is obtained.
The already described example embodiments of the arrangement 100 may be utilized to enhance the method with various further example embodiments. For example: the operations 1102, 1104 and 1106 may be performed by the processor instances 520 and the operations 1108 and 1110 by the further processor instances 522.
It will be obvious to a person skilled in the art that, as technology advances, the inventive concept can be implemented in various ways. The invention and its embodiments are not limited to the example embodiments described above but may vary within the scope of the claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 15169084.9 | May 2015 | EP | regional |
