Patent Application
20100309786
The invention relates to computer networks and, more particularly, to techniques for managing network flows within computer networks.
Service providers provide a variety of network-based services to subscribing customers. For example, an Internet Service Provider (ISP) provides access to the Internet, thereby allowing a customer to browse the World Wide Web (WWW), communicate via electronic mail (email), exchange electronic documents, and access remote network resources. Some service providers provide other types of services, such as Internet Protocol (IP) telephony, video conferencing, multimedia streaming, Voice on Demand (VoD), Video-Surveillance, Voice over Internet Protocol (VoIP) communications, IP-TV, and gaming networks.
Some service providers execute service contracts with customers and guarantee a certain level of Quality of Service (QoS). One manner in which service providers currently provide different QoS guarantees is by monitoring network traffic and applying policies based characteristics of the traffic, e.g., packet header information. For example, a service provider may select and apply specific QoS policies to network traffic based on the particular port numbers specified in packet header information of the traffic. Because port numbers are generally associated with certain types of services, this scheme allows the service providers to distinguish between certain types of traffic. For example, a service provider may prioritize Hyper Text Transfer Protocol (HTTP) traffic, which is associated with port 80, higher than File Transfer Protocol (FTP) traffic, which is associated with port 20.
However, this type of prioritization scheme is relatively inflexible, and is generally inapplicable to many types of services due to the fact that many services dynamically assign port numbers. For example, many services that are established by a signaling protocol or other “real-time” media delivery protocols, e.g. Session Initiated Protocol (SiP), Real Time Streaming Protocol (RTSP), Real-time Transport Protocol (RTP), H.323, and Media Gateway Control Protocol (MGCP), dynamically assign port numbers for communication of the media application.
In general, the invention is directed to techniques for classifying and managing individual network flows using application classification information. A network device, such as an edge router or broadband remote access server (BRAS), may utilize the techniques to apply application-specific policies to the individual network flows, authenticate customers associated with the network flows, provide proper accounting for the individual network flows, or perform other application-specific operations. As examples, the network device may select and apply application-specific policies to control and perform traffic classification, packet queuing, rate-limiting operations, Type of Service (TOS) stamping, or other management operations.
In practice, the network device monitors application service requests from a customer, and forwards the application service request to an application server. Moreover, the network device generates application classification information based on the monitored application service requests and any further signaling communication between the application server and the customer.
Using the application classification information, the network device manages one or more network flows, i.e., the network service, between the customer and the application server. In this manner, the network device actively monitors the delivery of services between service providers and their customers, and is able to individually control the specific flows associated with the provided network services. For example, the network device may select and apply an appropriate flow-specific policy to a given network flow based on the application classification information associated with that network flow. The network device may, for example, apply a QoS policy in order to provide a QoS guarantee to the customer in accordance with terms of the particular customer's service contract with the service provider.
The invention may provide additional control over the traffic flows by using active signaling relay techniques. In this case, the network device or an application server injects data into signaling communications that flow between the subscriber and the application server. In particular, the network device may inject data into upstream signaling communications or the application server may inject data into downstream signaling communications. The injected data, which could include resource availability information, may allow the application service provider to make better decisions about denying or accepting application service requests. Moreover, the injected data may include encrypted tokens, which may provide further control over network flow management.
In this manner, the techniques allow a network device and a service provider to provide end-to-end QoS guarantees for different types of network flows associated with network services, including those network services that utilize dynamic port assignments. For example, the network device and the service provider may apply the techniques to provide QoS guarantees for a variety of services, such as Internet Protocol (IP) telephony, video conferencing, multimedia, Voice on Demand (VoD), Video-Surveillance, Voice over Internet Protocol (VoIP), IP-TV, gaming networks, and other network services.
In one embodiment, a method comprises monitoring a communication between a customer device and an application server with an intermediate network device, wherein the communication is associated with a network service provided by the application server. The method further comprises identifying with the intermediate device a network flow associated with the network service, and applying a policy to the identified network flow with the intermediate network device.
In another embodiment, a method comprises receiving with an application server a communication from a customer device requesting a network service provided by the application server. The method further comprises extracting from the communication data that was injected by an intermediate network device, and controlling the delivery of the network service from the application server to the customer device based on the extracted data.
In another embodiment, a network device comprises a signaling interceptor to monitor a communication between a customer device and an application server, and identify a network flow associated with a network service provided to the customer device by the application server. The network device further comprises a network flow interface that applies a policy to the identified network flow.
In another embodiment, a computer-readable medium comprises instructions that cause a programmable processor to forward signaling communications between a customer and an application service provider, wherein the communication is associated with a network service provided by the application service provider. The instructions further cause the processor to communicate with the application service provider using data injected within the signaling communications, and apply a policy to network flows associated with the delivery of the network service to the customer by the application service provider.
In another embodiment, a computer-readable medium comprises instructions that cause a processor of a network device to exchange signaling communications with a customer device to establish the delivery of a network service to the customer device, and communicate with an edge device associated with the customer device using data injected within the signaling communications.
The details of one or more embodiments of the invention are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the invention will be apparent from the description and drawings, and from the claims.
In the exemplary embodiment of
Customer 4A communicates with a network device 6A of NSP 8 via link 18A, which may be a broadband connection such as a digital subscriber line (DSL), cable or fiber optic connection. Other example connections include broadband access, circuit aggregation, Code-Division Multiple Access (CDMA), General Packet Radio Service (GPRS), Passive Optical Network (PON), Metro-Ethernet or other network connections.
Network device 6A may be an edge router, a Broadband Remote Access Server (BRAS), or other device that controls the delivery of network services to customer 4A. Although not illustrated in
In some embodiments, communication between network layer device 6A, the data link layer device, and the subscriber device may be via Asynchronous Transfer Mode (ATM) Virtual Circuits (VCs), or a combination of ATM VCs and Virtual Local Area Networks (VLANs). In other embodiments, the data link layer device may be an Ethernet Bridge, and communication between network layer device 6A, the data link layer device, and the subscriber device may be via Ethernet frames in accordance with the IEEE 802.3 family of standards.
NSP 8 provides customer 4A with connectivity to one or more core networks of the Internet, represented generally as Internet Protocol (IP) backbone 10. In similar fashion, ASP 12 is coupled to IP backbone 10, e.g., via network device 6B and link 18B, for communication of network services to and from the IP backbone.
In accordance with the principles of the invention, a network device, such as network device 6A or network device 6B, applies the techniques described herein for classifying and managing individual network flows associated with network service 16 using application classification information. Network device 6A, for example, may utilize the techniques to apply application-specific policies to the individual network flows associated with network service 16, authenticate customer 4A associated with the network flows, provide proper accounting for the individual network flows, or perform other “application-specific” operations (i.e., operations specific to a particular type of service, ASP, and/or customer) to individual network flows. As examples, network device 6A may select and apply application-specific policies to control and perform traffic classification, packet queuing, rate-limiting operations, Type of Service (TOS) stamping, or other management operations. Although described herein with reference to network device 6A, the techniques may be applied by other network devices within system 2, such as network device 6B or other devices within NSP 8, IP backbone 10 or ASP 12.
As described in further detail below, network device 6A monitors signaling communications 17 between customer 4A and ASP 12 used in establishing the delivery of network service 16. Like network service 16, signaling communications 17 are physically communicated through system 2, but are illustrated as logical communications directly between customer 4A and ASP 12 for purposes of illustration. In particular, network device 6A monitors application service requests from customer 4A to ASP 12, as well as any further signaling communications 17 between ASP 12 and customer 4A. Based on the signaling communications 17, network device 6A generates application classification information that uniquely identifies network service 16. Exemplary signaling protocols used by customer 4A and ASP 12 to establish delivery of network service 16 include the Session Initiated Protocol (SiP), Real Time Streaming Protocol (RTSP), Real-time Transport Protocol (RTP), H.323, and Media Gateway Control Protocol (MGCP).
In this sense, network device 6A may be viewed as having a certain degree of “application-level awareness,” and monitors signaling communications 17 to classify and manage individual network flows in view of the associated network service being provided. For example, network device 6A may utilize the application classification information to identify traffic associated with network service 16, and may select and apply one or more appropriate application-specific policies to the identified traffic. The network device may, for example, apply QoS policies in order to provide a QoS guarantee to customer 4A in accordance with terms of a service contract between customer 4A and ASP 12. In this manner, network device 6A actively monitors the delivery of network services, (e.g., network service 16), between ASP 12 and its customers (e.g., customer 4A), and is able to individually control the specific flows associated with the provided network services.
In further embodiments described below, network device 6A operates as an “active signaling relay” to provide additional control over network service 16. In particular, transparently to customer 4A, network device 6A may inject data within upstream flows of signaling communications 17 to actively communicate with ASP 12. In addition, ASP 12 injects data into downstream flows of signaling communications 17 to communicate with network device 6A. As described in further detail, this mechanism allows network device 6A and ASP 12 to share information related to customer 4A and the particular network service 16 being provided, thereby allowing the network device and the ASP to better control delivery of the network service.
For exemplary purposes, ASP 12 and NSP 8 have been illustrated as separate entities. The techniques described herein, however, may readily be applied in environments in which ASP 12 and NSP 8 are co-located and/or operate as a common entity.
Signaling interceptor 22 of network device 6A monitors signaling communications 17 (
Similar to the illustration of network service 16 and signaling communications 17 in
Signaling interceptor 22 maintains application classification information 24 based on the intercepted upstream and downstream signaling communications 17A, 17B. In particular, signaling interceptor 22 maintains application classification information 24 to uniquely identify the network services delivered by ASP 12 and, in particular, the specific network flows associated with those services. In the example of
Signaling interceptor 22 updates application classification information 24 upon intercepting a network service request from customer 4A. Signaling interceptor 22 may update application classification information 24 based on, for example, IP address information and/or port information contained with the intercepted request and any subsequent signaling communications between customer 4A and application server 14. By intercepting and monitoring upstream and downstream signaling communications 17A and 17B, signaling interceptor 22 tracks the specific flows associated with the delivery of network services despite the fact that the flows may utilize dynamically-assigned port numbers. In one embodiment, signaling interceptor 22 generates application classification information for customers, such as customer 4A, that have a pre-existing contractual relationship with ASP 12 for delivery of network services.
Upon detecting the delivery of a new network service, control unit 20 updates application classification information 24 to identify the associated network flows, e.g., upstream and downstream network flows 16A and 16B, and maps one or more policies 26 to the network flows. Network flow interface 28 communicates upstream and downstream network flows 16A and 16B between customer 4A and application server 14. Moreover, network flow interface 28 selects and applies one or more policies 26 to upstream and downstream network flows 16A and 16B based on the application classification information 24 associated with that network flow. In this manner, network flow interface 28 may apply one or more of policies 26 based on a variety of factors, such as the type of network service being provided, the particular customer 4A receiving the network service, the particular ASP 12 providing the service, or combinations thereof.
As examples, network device 6A may select and apply policies 26 to control and perform traffic classification, packet queuing, rate-limiting operations, Type of Service (TOS) stamping, or other management operations for network services provided by ASP 12. As another example, network device 6A can apply one or more of policies 26 in order to provide a QoS guarantee to customer 4A in accordance with terms of the customer's service contract with ASP 12.
Network flow information 30 describes flow characteristics of an individual network flow and uniquely identifies the flow. For example, network flow information 30 may include information such as a source address, destination address, source port, destination port, protocol or other information. As shown, application classification information 24 maps network flow information 30 to a corresponding customer identifier 32, and to one or more of policy identifiers 34. Customer identifier 32 specifies an identification code for a customer, e.g., customer 4A, associated with the particular network flow. Policy identifiers 34 specify one or more identifiers for policies to be applied to the respective network flow. Each of the policy identifiers 34 corresponds to a respective one of policies 26 (
As shown in the example of
With active signaling relay module 40, as with embodiments described above, customer 4A issues an application service request to application server 14 via network device 6A. As described above, signaling interceptor 22 of network device 6A transparently intercepts upstream and downstream signaling communications 17A and 17B, and generates application classification information 24 based on the intercepted communications.
In the embodiment shown in
As another example, active signaling relay module 40 may inject data 42A that specifies information related to the physical resources available to customer 4A. In one example, data 42A may specify the characteristics related to the connection by which customer 4A connects to network device 6A. This information may include the type of connection (e.g., cable, DSL, T1), connection speed or bandwidth. The information may also describe current loading conditions experienced by network device 6A with respect to one or more customers of application server 14. With this information, application server 14, which is typically remote from network device 6A and customer 4A, may make improved decisions, such as decisions related to accepting or denying requests, bandwidth allocation, scheduling, or other decisions related to delivery of network service 16.
In addition, application server 14 may inject downstream data for communication with network device 6A. In one embodiment, signaling module 44 of application server 14 injects data, i.e. data 42B, into downstream signaling communication 17B. Data 42B may take the form of one or more tokens, which may include information that is encrypted and/or digitally signed. The information, which may be encrypted in such a way that it is unknown to customer 4A, is targeted for network device 6A.
Active signaling relay module 40 of network device 6A receives the tokens from application server 14, and verifies that the sender of the network flow, i.e. application server 14, is a trusted source. Active signaling relay module 40 receives the tokens and performs an appropriate action based on the received data, such as updating application classification information 24 and, in particular, the policies 26 to be applied to the particular network flows.
As one example, signaling module 44 of application server 14 may inject data 42B that specifies characteristics of a service contract between customer 4A and ASP 12. For example, the injected data 42B may specify a level of QoS guaranteed by ASP 12, the types of network services available to the customer, or other characteristics of the service contract. Based on the characteristics, active signaling relay module 40 selects the appropriate policies 26 for application to upstream and downstream network flows 16A and 16B by network flow interface 28 in order to best meet the QoS guarantees agreed upon by application service provider 10 and customer 4A.
As another example, signaling module 44 may inject data 42B into downstream signaling communication 17B specifying the lawful interception of network services, such as VoIP, provided to customer 4A. Upon receiving this information, network device 6A may enable lawful interception of network service 16, which may include initiating a mirroring process. In this case, network flow interface 28 of network device 6A applies policies 26 to mirror upstream and/or downstream network flows 16A and 16B.
As yet another example, signaling module 44 injects data 42B within downstream signaling communication 17B that designates upstream and downstream network flows 16A, 16B as associated with a high priority voice call, or even an emergency call. If application server 14 detects that a call is a priority call, signaling module 44 can send a token to network device 6A that identifies upstream and downstream network flows as a priority call. In response, network device 6A can process the call in an appropriate manner. Network flow interface 28 may, for example, process a high-priority call, such as a 911 call, to reduce delay in accepting and connecting the call, and to ensure that the call is not dropped.
Although the embodiments described inject data from stored data 42A and 42B, in other embodiments the injected data may be calculated or otherwise developed by active signaling relay module 40 or signaling module 44. Alternatively, the injected data may be a combination of calculated data and data stored in either data 42A or data 42B.
Initially, business relationships are typically established between customer 4A, NSP 8, and/or ASP 12. For example, service contracts may be executed between customer 4A and NSP 8A for Internet access, between customer 4A and ASP 12 for one or more network services, such as VoIP, and possibly between NSP 8 and APS 12 (50).
Next, customer 4A and ASP 12 engage in signaling communications 17 to establish the delivery of network service 16. Network device 6A, or more specifically, a signaling interceptor 22 (
Based on signaling communications 17, network device 6A generates application classification information that uniquely identifies network service 16 (54). In one embodiment, the application classification information may include network flow information, and corresponding QoS policies and customer 4A identifiers. Network device 6A maintains application classification information 24 based on the intercepted signaling communications. In particular, network device 6A maintains application classification information 24 to uniquely identify the network services delivered by ASP 12 and, in particular, the specific network flows associated with those services.
Network device 6A updates application classification information 24 (55) within network device 6A upon intercepting a network service request from customer 4A. In particular, network device 6A may update application classification information 24 based on, for example, IP address information and/or port information contained with the intercepted request and any subsequent signaling communications between customer 4A and application server 14. By intercepting and monitoring signaling communications, network device 6A tracks the specific flows associated with the delivery of network services despite the fact that the flows may utilize dynamically-assigned port numbers.
In some embodiments, the network device operates as an “active relay” to provide an additional control over network service 16. In particular, transparently to customer 4A, network device 6A may inject data (56) within upstream signaling communications 17A to actively communicate with ASP 12. In addition, ASP 12 may inject data into downstream signaling communications 17B to communicate with network device 6A. In this manner, network device 6A and ASP 12 share information related to customer 4A and the particular network service 16 being provided, thereby allowing the network device and the ASP to better control delivery of the network service.
After establishing application classification information 24 based on signaling communications 17 between the customer 4A and application server 14, network flow interface 28 monitors network traffic and identifies those network flows having traffic characteristics that match the application classification information (57). Network device 6A manages the identified network flows (58), which may include selecting and/or applying application-specific policies 26 to control and perform traffic classification, packet queuing, rate-limiting operations, accounting operations, Type of Service (TOS) stamping, or other management operations. For example, network device 6A can apply one or more of policies 26 in order to provide a QoS guarantee to customer 4A in accordance with terms of the customer's service contract with ASP 12. In this manner, network device 6A may apply one or more application-specific policies based on a variety of factors, such as the type of network service being provided, the particular customer 4A receiving the network service, the particular ASP 12 providing the service, or combinations thereof.
Various embodiments of the invention have been described. The techniques and embodiments described herein may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the techniques may be directed to a computer-readable medium in a network device that comprises program code that, when executed, causes the device to perform one or more of the techniques described herein. A network device, for example, may include one or more processors which access the instructions stored on the computer-readable medium, and execute the instructions in order to perform one or more the techniques described herein. In addition, although the techniques have been described as elements embodied within a single device, the described elements may be distributed to multiple devices. These and other embodiments are within the scope of the following claims.
This application is a Continuation of U.S. application Ser. No. 10/910,484, filed Aug. 3, 2004, the entire contents of which is incorporated herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 10910484 | Aug 2004 | US |
| Child | 12846205 | US |
