Deep Packet Inspection

Source: http://www.developingsolutions.com/use-cases/use-case-testing-dpi-within-an-existing-pdn/

Increasingly sophisticated DPI technology is being deployed in the evolved packet core network, particularly in conjunction with policy management.  This technology gives operators more insight into traffic usage patterns, allowing them to formulate policy enforcement rules that will improve and optimize network performance.  These new policy rules help the operators maintain their networks at peak efficiency, and reduce outages caused by periodic signaling storms.

The Traffic Detection Function (TDF) provides traffic detection and reports information regarding the detected application traffic to the Policy and Charging Control Function (PCRF) over the Sd interface.  The Sd reference point allows a PCRF to have dynamic control over the application detection and control (ADC) rules at a TDF.  DPI applications within the TDF provide policy enforcement information to the PCRF so that more effective application identification and control is provided.  New policy enforcement rules then extend policy intelligence and control to new traffic management capabilities.

In a test environment, existing and updated DPI applications can be evaluated to insure that they still perform correctly with the latest PCC implementations.  Information generated by new DPI applications can be incorporated into policy management.

Use Case: Testing TDF/DPI Applications within an existing PDN test environment

In order to test the TDF within an existing PDN environment, the gateway node can obtain an IP address via the external DHCP server during the packet bearer establishment procedures, such as PDP Context activation or default bearer establishment.  The GGSN, or other PDN gateway, acts as a DHCP client towards the DHCP server or uses a DHCP relay agent to request the information.  The DHCP Server offers a set of IP addresses from a pool maintained by the SPR.

Within the PDN, a DHCP client or relay agent function allows routing of DHCP requests and replies between the nodes and the DHCP server.  The DHCP agent relays the requests received from the DHCP client to the DHCP  server, and the replies received from the server to the corresponding client.

When the IP address has been negotiated, the PCRF emulator sends the IP address as part of the policy rules to the TDF via the Sd interface.  A TDF-Session-Request (TSR) command is sent by the PCRF to the TDF in order to establish the TDF session and to provision the ADC rules.  The TDF acknowledges the TSR with a TDF-Session-Answer (TSA) message.

A media bearer session is established between the PDN gateway node (GGSN in this example, but could be any media gateway type node).  Data then flows between the PDN and the TDF.  At this point, DPI applications within the TDF can be evaluated.

When the media session is complete, the DHCP client releases the IP address, and the TDF session closes via the Sd interface.  The Re-Auth-Request (RAR) command is sent by the PCRF to request the TDF session termination, and the Re-Auth-Answer (RAA) is sent by the TDF to the PCRF in response.

References:

  • 3GPP TS 29.212
  • 3GPP TS 29.061
Jan D.
Jan D.

"The only real security that a man will have in this world is a reserve of knowledge, experience, and ability."

Articles: 673

Leave a Reply

Vaše e-mailová adresa nebude zveřejněna. Vyžadované informace jsou označeny *