Providing services to packet flows in a network

• US 7,855,982 B2
• Filed: 11/19/2007
• Issued: 12/21/2010
• Est. Priority Date: 11/19/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Mortsolf, Timothy G., Ramankutty, Rajesh, Harper, Matthew H., Puthiyandyil, Sanil Kumar
• Primary Examiner(s): LEVITAN, DMITRY
• Application Number:
  US11/942,446
• Publication Number:
  US 20090129271A1
• Time in Patent Office: 1,128 Days
• Field of Search: 370/259, 370/310, 370351-356, 455405-409, 709/220, 709227-229, 709/249
• US Class Current: 370/259
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways

Abstract

A system and method for providing services to packet flows in a communication network. The services include enhanced charging, stateful firewalls, traffic performance optimization (TPO) and advanced services such as content differentiated charging, per-subscriber stateful firewalls, and VPNs, for example. A gateway can be used to route each packet flow through the services on a per-subscriber basis by inspecting accounting messages and checking subscriber profiles prior to setting up a new packet flow session. By directing the packet flow through the services requested latency can be reduced as well as the need to have equipment for each session regardless of whether the service is provided to the packet flow. The services can be provided in-line as well.

Claims

1. A communications apparatus providing services comprising:

at least one network processing unit configured to receive an accounting message for signaling session initiation, and to receive a packet,

the network processing unit directing the accounting message to an IP services gateway (IPSG) manager,

the IPSG manager receiving the accounting message, extracting information from the accounting message, and sending the information to a session manager,

the network processing unit directing the received packet to the session manager,

the session manager using the information received from the IPSG manager to obtain a subscriber profile wherein the subscriber profile includes an access control list describing which services are to be performed on a subscriber'"'"'s packets; and

a content service steering interface (CSS API),

the CSS API using information obtained from the subscriber profile to select a service provider, and to cause the received packet to be routed to the selected service provider, wherein the selection of a service provider includes selecting between in-line services or external servers.

2. The communications apparatus of claim 1, wherein the information extracted by the IPSG manager from the accounting message is an IP address and network access identifier (NAI).

3. The communications apparatus of claim 1, wherein the accounting message includes a RADIUS accounting message and the IPSG manager is implementing a RADIUS-server mode.

4. The communication apparatus of claim 1, wherein the session manager directs the packet on a per session basis with information specified in the subscriber profile.

5. The communications apparatus of claim 1, wherein the service is provided within the session packet flow, and includes at least one of header compression, a firewall performing stateful packet inspection, and cross-bearer mobility.

6. The communications apparatus of claim 5, wherein the service is provided without requiring the packet flow to be off-loaded to servers outside the communications apparatus.

7. The communications apparatus of claim 1, wherein the CSS API is configured to monitor the health of external servers, and to redirect the received packet if an external server fails.

8. The communications apparatus of claim 1, wherein the CSS API implements one or more of load balancing, network address translation (NAT), HTTP redirection, and DNS redirection.

9. The communications apparatus of claim 1, wherein the IPSG manager is configured to determine charging information from the accounting message, and wherein the communications apparatus is configured to insert the charging information into the received packet prior to directing the packet to an in-line service, and to strip the charging information from a packet received from the in-line service.

15. The method of claim 7, further comprising:

determining charging information from the accounting message;

inserting the charging information into the received packet prior to directing the packet to an in-line service; and

stripping the charging information from a packet received from the in-line service.

10. A communications networking method comprising:

receiving an accounting message at a network processing unit, the accounting message not being addressed to the network processing unit;

receiving a packet;

redirecting the accounting message for inspection;

extracting information from the accounting message;

sending the information to a session manager to setup a new session, wherein the session manager obtains a subscriber profile using the information received at the session manager;

using the information to select a service provider, wherein the selection of a service provider includes selecting between in-line services or external servers; and

causing the received packet to routed to the selected service provider.

11. The method of claim 10, further comprising extracting an IP address and network access identifier (NAI) from the accounting message.

12. The method of claim 10, wherein the accounting message includes a RADIUS accounting message.

13. The method of claim 10, wherein the at least one service is provided within the session packet flow, and comprises at least one of header compression, a firewall performing stateful packet inspection, and cross-bearer mobility.

14. The method of claim 13, wherein the at least one service is provided without requiring the packet flow to be off-loaded to servers outside the communications apparatus.

16. Logic encoded in one or more non-transient media that includes code for execution and when executed by a processor is operable to perform operations comprising:

receiving an accounting message at a network processing unit, the accounting message not being addressed to the network processing unit;

redirecting the accounting message for inspection;

extracting information from the accounting message;

sending the information to a session manager to setup a new session, wherein the session manager obtains a subscriber profile using the information received at the session manager;

using the information to select a service provider, wherein the selection of a service provider includes selecting between in-line services or external servers; and

routing the received packet to the selected service provider.

17. The logic of claim 16, wherein the accounting message includes a RADIUS accounting message.

18. The logic of claim 16, wherein the at least one service is provided within the session packet flow, and comprises at least one of header compression, a firewall performing stateful packet inspection, and cross-bearer mobility.

19. The logic of claim 18, wherein the at least one service is provided without requiring the packet flow to be off-loaded to servers outside the communications apparatus.

20. The logic of claim 16, further comprising:

determining charging information from the accounting message;

inserting the charging information into the received packet prior to directing the packet to an in-line service; and

stripping the charging information from a packet received from the in-line service.