Method and system for transporting service flow securely in an IP network

• US 20070086340A1
• Filed: 10/06/2006
• Published: 04/19/2007
• Est. Priority Date: 06/18/2004
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Li, Hejun
• Granted Patent: US 8,542,580 B2
• Time in Patent Office: Days
• US Class Current: 370/230
• CPC Class Codes: H04L 45/502 Frame based
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/783 Distributed allocation of resources, e.g. bandwidth brokers
• CPC Class Codes: H04L 47/801 Real time traffic
• CPC Class Codes: H04L 47/808 User-type aware
• CPC Class Codes: H04L 47/822 Collecting or measuring resource availability data
• CPC Class Codes: H04L 47/825 Involving tunnels, e.g. MPLS
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/80 Responding to QoS

Abstract

The present invention provides a method for transporting a service flow securely in an Internet Protocol (IP) network, which includes the following steps: a service server sends a first request to a resource manager, requesting to build a service flow path between a calling user and a called user in a logical bearing network; the resource manager chooses a service flow path between a first Provider Edge Router (PE) that the calling user belongs to and a second PE that the called user belongs to in the logical bearing network; the resource manage sends a configuration request message to the first and second PEs; the first and second PEs build flow classification table items including the service flow path according to the configuration request message, respectively, and forward only the service flow matching one of the flow classification table items to corresponding service flow path in the logical bearing network.

Claims

1. A method for transporting a service flow securely in an Internet Protocol (IP) network, comprising the following steps:

a service server sending a first request to a resource manager, requesting to build a service flow path between a calling user and a called user in a logical bearing network;

the resource manager receiving the first request, choosing in the logical bearing network a service flow path between a first Provider Edge Router (PE) that the calling user belongs to and a second PE that the called user belongs to;

the resource manager sending a configuration request message to the first PE and the second PE according to the service flow path;

the first PE and the second PE building flow classification table items comprising the service flow path according to the configuration request message, respectively, and forwarding only the service flow matching one of the flow classification table items to the corresponding service flow path in the logical bearing network.

2. The method according to claim 1, further comprising:

after receiving the first request,

the resource manager determining whether the logical bearing network has enough resources for the service flow path, if the logical bearing network has enough resources for the service flow path, continuing with the current step;

otherwise, rejecting the first request.

3. The method according to claim 2, wherein the first request comprises:

bandwidth that the service call needs, location information of the calling user and the called user, information of level of quality of service(QoS) and security level;

the step of determining whether the logical bearing network has enough resources for the service flow path comprises;

determining whether there are enough resources for the service flow path by comparing the current resource status of the logical bearing network with the information in the first request.

4. The method according to claim 3, further comprising:

before the step of sending the first request by the service server,

upon receiving a service call request sent by the calling user, the service server determining the bandwidth that the service call needs through negotiation with the calling user and the called user; and

analyzing the service call to determine the QoS level and the security level.

5. The method according to claim 1, wherein the configuration request message sent by the resource manager to the first PE and the second PE comprises:

a parameter of the service flow, a parameter of the security level, a parameter of the QoS and routing information, which are used for the PE to build the flow classification table items according to the parameters and the routing information.

6. The method according to claim 1, wherein the flow classification table items built by the first PE and the second PE comprises:

an attribute of an IP packet and the corresponding service flow path;

the attribute of IP packet comprises at least one of the following;

a protocol, a source address, a local port number, a remote address, and a remote port number;

the service flow matching one of the flow classification table items is the service flow matching the attribute of the IP packet.

7. The method according to claim 1, further comprising:

the service server sending a service ending notice to the resource manager when the service between the calling user and the called user is over;

the resource manager updating the resource status of the logical bearing network upon receiving the service ending notice, and sending a command instructing the PE to cancel the service flow path in the flow classification table items.

8. The method according to claim 1, wherein the service server is a soft-switching device.

9. The method according to claim 1, wherein the service flow path is a label switching path.

10. A system for transporting a service flow securely in an Internet Protocol (IP) network, comprising:

a service server, a resource manager, and a logical bearing network comprising a Provider Edge Router (PE), wherein

the service server is used for processing a received service call, and based on the result of the processing, requesting the resource manager to build a service flow path between the calling user and the called user in the logical bearing network;

the resource manager is used for choosing in the logical bearing network a service flow path between the PE that the calling user belongs to and the PE that the called user belongs to according to the request from the service server, and sending a configuration request message to each of the two PEs according to the service flow path;

the logical bearing network, which comprises routers in the IP network and label switching paths that connect the routers, is used as a bearer of the service flow;

the PE is used for building flow classification table items according to the received configuration request message, and forwarding the service flow matching one of the flow classification table items in the logical bearing network.

11. The system according to claim 10, wherein the logical bearing network is a network of Internet Protocol Version 4 (IPv4) or Internet Protocol Version 6 (IPv6).