Communications services, such as Internet, telephone, and television services, are becoming increasingly popular among consumers, businesses, and other subscribers. Networks form the basis for such communications services. Some networks provide instrumentation of the network to customers. This gives customers the ability to troubleshoot network-related problems but poses a great security risk since customers are able to locate and identify network components. Furthermore, these networks generally do not have a way to deal with high traffic volume from user-generated packets or signals without new equipment or aggressive filtering techniques. Other networks seek to provide protection against hackers and other security offenses by hiding network topology from customers. However, these networks lack the ability to allow customer troubleshooting. Therefore, as communications services reach more and more customers, it may be important to provide a system and method for providing a sensor overlay network that comprehensively and effectively allows customers the ability to troubleshoot or perform other network functions without sacrificing security, as well as efficiently manage high user-generated traffic.
In order to facilitate a fuller understanding of the exemplary embodiments, reference is now made to the appended drawings. These drawings should not be construed as limiting, but are intended to be exemplary only.
Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings. It should be appreciated that the same reference numbers will be used throughout the drawings to refer to the same or like parts. It should be appreciated that the following detailed description are exemplary and explanatory only and are not restrictive.
Exemplary embodiments may provide a system and method for providing a sensor overlay network. That is, exemplary embodiments may, among other things, manage and optimize user-generated packet traffic and troubleshooting by comprehensively and effectively providing a sensor overlay network.
Networks form the basis for communications services, such as Internet, telephone, and television services. “Open” networks may allow a user or customer to view instrumentation of the network. In an open network, user-generated packets for troubleshooting may be received by all devices in the network, each of which may reply to these user-generated packets. This allows customers the ability to troubleshoot network-related problems or determine whether enough local system resources are available. However, such openness may pose a great security risk since customers are able to locate and identify each and every network component.
Larger networks may be more complex. For example, in larger networks, traceroutes of fifteen (15) or more router hops may result from user-generated packets. In an open network, all hops may be visible to the end-user. Because the network is open, an end-user or customer may not be limited by the volume of user-generated packets sent to gain insight into the performance, design, or connectivity of the network. As a result, all network components (e.g., routers) within the network may be impacted with excessive amounts of user-generated forwarding plane measurement traffic. Thus, any insight gained by a user during such high traffic conditions may be distorted by the low priority of this measurement traffic on a central processing unit (“CPU”) of a network component (e.g., router). Accordingly, while an open network provides a user-friendly network model, security and efficient traffic controls may be lacking. Moreover, end-users or customers who measure network performance using these instrumented packets may have a relatively skewed view or perception of network performance due to variance in measurement traffic of an open network.
“Closed” networks may provide greater protection from user-generated, infrastructure-target packets by hiding topology from end-users or customers. A closed network may create what appears to be a “black box” to end-users and customers. These black boxes may still allow a customer to interface with the network (e.g., the network components may still respond to user-generated packets), but nothing inside the network may be visible to the customer. It should be appreciated that allowing any access may nevertheless still publicly expose systems and components of a network.
In addition, even though security may be improved with closed networks, problems associated with efficient traffic control may still be present. Furthermore, a customer may have difficulty troubleshooting issues occurring locally, off-net, or with his or her provider's network in a closed architecture. Not having data associated with infrastructure may result in costly support calls or other inefficiencies. In addition, lack of network visibility may also prevent a customer's ability to independently verify performance service level agreements, which may result in lack of trust in the integrity of the network.
As a result, it may be important to provide a system and method for providing a sensor overlay network to comprehensively and effectively allow customers the ability to troubleshoot or perform other network functions in a secure and traffic-efficient environment.
Network 102 or network 104 may be a wireless network, a wired network, or any combination of wireless network and wired network. For example, network 102 or network 104 may include one or more of a fiber optics network, a passive optical network, a cable network, an Internet network, a satellite network (e.g., operating in Band C, Band Ku or Band Ka), a wireless LAN, a Global System for Mobile Communication (“GSM”), a Personal Communication Service (“PCS”), a Personal Area Network (“PAN”), D-AMPS, Wi-Fi, Fixed Wireless Data, IEEE 802.11a, 802.11b, 802.15.1, 802.11n and 802.11g or any other wired or wireless network for transmitting or receiving a data signal. In addition, network 102 or network 104 may include, without limitation, telephone line, fiber optics, IEEE Ethernet 802.3, a wide area network (“WAN”), a local area network (“LAN”), or a global network such as the Internet. Also, network 102 or network 104 may support, an Internet network, a wireless communication network, a cellular network, or the like, or any combination thereof. Network 102 or network 104 may further include one, or any number of the exemplary types of networks mentioned above operating as a stand-alone network or in cooperation with each other. Network 102 or network 104 may utilize one or more protocols of one or more network elements to which it is communicatively coupled. Network 102 or network 104 may translate to or from other protocols to one or more protocols of network devices.
Although network 102 or network 104 is depicted as one network, it should be appreciated that according to one or more embodiments, network 102 or network 104 may comprise a plurality of interconnected networks, such as, for example, service provider network, the Internets, a broadcasting networks, cable television networks, corporate networks, or home networks.
Network elements 106a, 106b, 106c, 106d, and 106e may transmit and receive data to and from network 102 or network 104 representing broadcast content, user request content, mobile communications data, or other data. The data may be transmitted and received utilizing a standard telecommunications protocol or a standard networking protocol. For example, one embodiment may utilize Session Initiation Protocol (“SIP”). In other embodiments, the data may be transmitted or received utilizing other Voice Over IP (“VOIP”) or messaging protocols. For example, data may also be transmitted or received using Wireless Application Protocol (“WAP”), Multimedia Messaging Service (“MMS”), Enhanced Messaging Service (“EMS”), Short Message Service (“SMS”), Global System for Mobile Communications (“GSM”) based systems, Code Division Multiple Access (“CDMA”) based systems, Transmission Control Protocol/Internet (“TCP/IP”) Protocols, or other protocols and systems suitable for transmitting and receiving data. Data may be transmitted and received wirelessly or may utilize cabled network or telecom connections such as an Ethernet RJ45/Category 5 Ethernet connection, a fiber connection, a traditional phone wireline connection, a cable connection or other wired network connection. Network 102 network 104 may use standard wireless protocols including IEEE 802.11a, 802.11b and 802.11g. Network 102 network 104 may also use protocols for a wired connection, such as an IEEE Ethernet 802.3.
In some embodiments, network elements 106a, 106b, 106c, 106d, and 106e may be provider-owned routers used to forward customer data. These routers may run various routing protocols between them to communicate reachability information.
Other network elements (e.g., intermediary devices) may be included in or near network 102 and network 104. An intermediary device may include a repeater, microwave antenna, amplifier, cellular tower, or another network access device capable of providing connectivity between to different network mediums. These intermediary devices may be capable of sending or receiving signals via a mobile network, a paging network, a cellular network, a satellite network or a radio network. These network elements may provide connectivity to one or more wired networks and may be capable of receiving signals on one medium such as a wired network and transmitting the received signals on a second medium, such as a wireless network.
Network boxes 108a, 108b, 108c, and 108d may include dedicated machinery (e.g., sensor CPUs) for providing an sensor overlay network at network 102. For example, network boxes 108a, 108b, 108c, and 108d may be out-of-band sensor CPUs and may be communicatively coupled to network elements 106a, 106b, 106c, and 106d, as depicted in
The network boxes 108a, 108b, 108c, and 108d may emulate network elements and respond to queries from end-user or customer-side network element 110. Network boxes 108a, 108b, 108c, and 108d may use a variety of overlay mechanisms. These may include, but not limited to, Generic Routing Encapsulation (“GRE”) tunnels, Internet Protocol Security (“IPSec”) tunnels, Internet Protocol to Internet Protocol (“IP-IP”) tunneling, Reservation Protocol or Resource Reservation Protocol (“RSVP”) or Label Distribution Protocol (“LDP”) signaled Multiprotocol Label Switching (“MPLS”) Label Switch Paths (“LSPs”).
Network elements 106a, 106b, 106c, 106d, and 106e and network boxes 108a, 108b, 108c, and 108d may be one or more servers (or server-like devices), such as a Session Initiation Protocol (“SIP”) server. Network elements 106a, 106b, 106c, 106d, and 106e and network boxes 108a, 108b, 108c, and 108d may include one or more processors (not shown) for transmitting, receiving, processing, or storing data. According to one or more embodiments, network elements 106a, 106b, 106c, 106d, and 106e may be servers providing network service and network boxes 108a, 108b, 108c, and 108d may emulate their respective network elements to provide a sensor overlay network. In other embodiments, network elements 106a, 106b, 106c, 106d, and 106e and network boxes 108a, 108b, 108c, and 108d may be servers that provide network connection, such as the Internet, public broadcast data, a cable television network, or another media.
It should be appreciated that each of the components of system 100 may include one or more processors for recording, transmitting, receiving, or storing data. Although each of the components of system 100 are depicted as individual elements, it should be appreciated that the components of system 100 may be combined into fewer or greater numbers of devices and may be connected to additional devices not depicted in
Data storage may also be provided to each of the components of system 100. Data storage may be network accessible storage and may be local, remote, or a combination thereof to the components of system 100. Data storage may utilize a redundant array of inexpensive disks (“RAID”), tape, disk, a storage area network (“SAN”), an internet small computer systems interface (“iSCSI”) SAN, a Fibre Channel SAN, a common Internet File System (“CIFS”), network attached storage (“NAS”), a network file system (“NFS”), or other computer accessible storage. In one or more embodiments, data storage may be a database, such as an Oracle database, a Microsoft SQL Server database, a DB2 database, a MySQL database, a Sybase database, an object oriented database, a hierarchical database, or other database. Data storage 108 may utilize flat file structures for storage of data. It should also be appreciated that network-based or GPS-based timing (e.g., Network Time Protocol (“NTP”)) between the measurement boxes for synchronization may be provided as well. Other various embodiments may also be realized.
The end-user or customer-side network element 110 may be another network, a residential gateway, such as a router, an optical network terminal, or a piece of Customer Premises Equipment (“CPE”) providing access to one or more other equipment. For example, in some embodiments, the end-user or customer-side network element 110 element 110 may be another network that provides connectivity to a service provider at network 102 or network 104.
The end-user or customer-side network element 110 may be, or may be communicatively coupled to, a desktop computer, a laptop computer, a server, a server-like device, a mobile communications device, a wireline phone, a cellular phone, a mobile phone, a satellite phone, a personal digital assistant (“PDA”), a computer, a handheld MP3 player, a handheld multimedia device, a personal media player, a gaming device, or other devices capable of communicating with network 102 or network 104 (e.g., CPE, television, radio, phone, or appliance). The end-user or customer-side network element 110 may include wired or wireless connectivity. User-generated, infrastructure-targeted packets may originate from the end-user or customer-side network element 110. For example, basic performance measurements may rely on Internet Control Message Protocol (“ICMP”) ping, ICMP traceroute, User Datagram Protocol (“UDP”) traceroute, or other protocol.
System 100 may be used for communications between two or more components of the system 100. System 100 may also be used for transmitting or receiving data associated with a variety of content, such multimedia content. The various components of system 100 as shown in
Referring to
By providing one or more network boxes, an out-of-band sensor network may be provided at network 102. This overlay may be separate from any other overlay networks that may exist in a providers domain, e.g., network 104. A sensor overlay network may therefore provide an excellent solution where the network remains closed and protected while allowing the end-users to ascertain useful performance and connectivity information about the network. In fact, the information provided may be more accurate when compared to the open network because of the dedicated sensors and the separation of the traffic. Further refinements may be available in that the hardware of the network boxes 108a, 108b, 108c, and 108d (e.g., sensor CPUs) may be customized and optimized to respond to various sensor traffic. Additionally, the network elements 106a, 106b, 106c, and 106d be configured in a way that they may not be required to respond to sensor traffic.
In the out-of-band sensor network or sensor overlay network, dedicated paths for user-generated sensor packets may be provided to mitigate issues associated with hidden network topology. Furthermore, the sensor network may experience higher infrastructure security since network instrumentation or internal network elements may be walled off from customer reachability. Furthermore, with the exception of traffic that is required for routing, other traffic destined to network elements 106a, 106b, 106c, and 106d may be shunted to the sensor overlay network at the first network 102. Not only does this eliminate or reduce load on the network elements 106a, 106b, 106c, and 106d, use of network boxes 108a, 108b, 108c, and 108d also removes attack vectors and allows the overlay sensor network to provide a more accurate monitoring of the network itself.
In some embodiments, network boxes 108a, 108b, 108c, and 108d (e.g., sensor CPUs) may be leveraged as a platform to source diagnostic traffic from without jeopardizing health or security of the network. End-user greater visibility and more targeted information for troubleshooting may be provided as a result. Increased visibility may also increase customer comfort with network performance and reduce expensive customer service calls and other disadvantages.
The sensor plane architecture 200 may include a forwarding plane 202 that forwards data 212a (e.g., an ICMP request) to the control plane 204. It should be appreciated that routing protocols may typically be communicated between the control plane of one network element to another. However, in a sensor overlay network, the control plane 204 may be shielded from such activity when a sensor plane 206 is provided. When a sensor plane 206 is used, the data 212a is forwarded to the sensor plane 206 instead of the control plane 204. In this example, the sensor plane 206 may emulate the control plane 204 and respond with response data 212b (e.g., an ICMP reply) via the forwarding plane 202.
In addition, the sensor plane 206 may obtain routing/forwarding information from the control plane 204 and recreate a representative network based on routing protocol information. In other words, using the sensor plane architecture 200, a network emulation layer may build a virtual topology that mimics the actual network. Accordingly, the network emulation layer of each of the network elements 106a, 106b, 106c, and 106d or network boxes 108a, 108b, 108c, and 108d may be connected with a tunnel overlay that is transparent to the sensor plane 206 and the network emulation layer. Here, the overlay tunnels may be constructed to appear as physical circuits to the sensor plane.
Various filtering may allow the sensor plane 206 to shunt traffic from the control plane 204. For example, separate and distinct instances of the control plane 204 may be created so that the sensor plane 206 may function within the routing platform identically or similarly as the control plane 204 would function.
This additional level of separation may enable end-users to exchange routing protocol information with this sensor plane CPU further reducing attacks on the routing infrastructure. Use of a sensor layer network may also mitigate control plane attacks, including well-crafted packet attacks, since the control plane 204 may be completely isolated to external routing communications.
A higher level of security to segments of end-users or communities of interest by separating them across sets of sensor plane CPUs may also be provided. For example, a small number of highly critical customers may share a sensor plane CPU while a majority of less critical customers and peers may be aggregated on other sensor CPUs. Such security segmentation may further reduce routing attacks between communities of interest or segments of customers (e.g., from the majority of customers or peers to those few highly critical customers).
In this example, routing traffic 216a and 216b may traverse the forwarding plane 202 to or from the control plane 204 and sensor traffic 212a and 212b may traverse the forwarding plane 202 to or from the sensor plane 206.
In some embodiments, decision engines 242, 244, and 246 may be provided in the forwarding plane 202, the control plane 204, or the sensor plane 206, respectively. These decision engines 242, 244, and 246 may determine how to handle various types of traffic at each of the forwarding plane 202, the control plane 204, or the sensor plane 206. For example, the forwarding plane decision engine 242 may determine whether or not traffic is transiting traffic 214, routing traffic 216a and 216b, or sensor traffic 212a and 212b. In the case of transiting traffic 214, the forwarding plane decision engine 242 may keep the traffic on the forwarding plane 202 and traverses the device 200B. In the case of routing traffic 216a and 216b, the forwarding plane decision engine 242 may deliver the traffic to or from the control plane. In the case of sensor traffic 212a and 212b, the forwarding plane decision engine 242 may deliver the traffic to or from the sensor plane 206. It should be appreciated that the forwarding plane decision engine 242 may perform other various functions optionally filter, rate limit, log, syslog, or forward to the control plane any or all sensor traffic 212a and 212b that meets one or more profiles, such as a five-tuple criteria. Although described with reference to the forwarding plane decision engine 242, it should be appreciated that the above features and functions may be implemented in one or more additional decision engines as well (e.g., decision engines 244 and 246).
Through routing traffic, the control plane 204 may acquire information from itself and the other network components to form a Routing Information Base (“RIB”) 224a that may has path information. The control plane 204 may optionally synchronize the RIB 224a with the sensor plane 206 to form a RIB copy 224b, for example, thus enabling the sensor plane 206 to simulate forwarding and routing behavior of the control plane 204. Accordingly, any atomic update to the RIB 224a may result in synchronization with the RIB copy 224b.
The control plane 204 may also use the RIB 224a to select Forwarding Information Base (“FIB”) 222a on the control plane 204. The FIB 222a may be pushed 232 (or otherwise transmitted) to other instances of the forwarding plane 202. This may create a local FIB 222b, 222c . . . 222n, as necessary, for each instantiation of the forwarding plane 202.
One or more connections 252 may exist between the forwarding plane 202 and control plane 204. These one or more connections 252 may facilitate communications for routing traffic 216a and 216b, FIB push 232, or other related feature or functionality.
One or more connections 254 may exist between the forwarding plane 202 and the sensor plane 206 to facilitate communications of sensor traffic 212a and 212b. One or more connections 256 may exist between the control plane 204 and the sensor plane 206 to facilitate communications for RIB synchronization 234. Other various embodiments may also be provided to facilitate communications, synchronization, or other related features or functionalities.
It should be appreciated that the sensor plane architecture 200A of
It should be appreciated that while embodiments are primarily directed to user-generated packets, other data may also be handled by the components of system 100. While depicted as various servers, components, elements, or devices, it should be appreciated that embodiments may be constructed in software or hardware, as a separate or stand-alone device, or as part of an integrated transmission or switching device.
Additionally, it should also be appreciated that system support and updating the various components of the system 100 may be easily achieved. For example, a system administrator may have access to one or more of the components of the system, network, components, elements, or device. It should also be appreciated that the one or more servers, components, elements, or devices of the system may not be limited to physical components. These components may be software-based, virtual, etc. Moreover, the various servers, components, elements, or devices may be customized to perform one or more additional features and functionalities. Such features and functionalities may be provided via deployment, transmitting or installing software or hardware.
At block 310, the control module 204 of
At block 320, the forwarding module 202 of
At block 330, the sensor module 206 of
At block 410, the control module 204 of
At block 420, the control module 204 may optionally synchronize the RIB 224a with the sensor module 206 to form a RIB copy 224b, for example, thus enabling the sensor module 206 to simulate forwarding and routing behavior of the control module 204. Accordingly, any atomic update to the RIB 224a may result in synchronization with the RIB copy 224b.
At block 430, the control module 204 may use the RIB 224a to select a Forwarding Information Base (“FIB”) 222a on the control module 204. In this example, the FIB 222a may be pushed 232 (or otherwise transmitted) to other instances of the forwarding module 202. This may create a local FIB 222b, 222c . . . 222n, as necessary, for each instantiation of the forwarding module 202.
In summary, embodiments may provide a system and method for providing a sensor overlay network. It should be appreciated that although embodiments are described primarily with basic measurement data and communications between various network components, the systems and methods discussed above are provided as merely exemplary and may have other various applications and implementations.
In the preceding specification, various embodiments have been described with reference to the accompanying drawings. It will, however, be evident that various modifications and changes may be made thereto, and additional embodiments may be implemented, without departing from the broader scope of the disclosure as set forth in the claims that follow. The specification and drawings are accordingly to be regarded in an illustrative rather than restrictive sense.