Dynamic classification and grouping of network traffic for service application across multiple nodes

• US 8,352,630 B2
• Filed: 09/01/2010
• Issued: 01/08/2013
• Est. Priority Date: 09/01/2010
• Status: Active Grant

• Current Assignee: Ribbon Communications Operating Company, Inc. (Ribbon Communications, Inc.)
• Original Assignee: Sonus Networks Incorporated (Ribbon Communications, Inc.)
• Inventors: Hart, Justin Scott
• Primary Examiner(s): Chan, Wing F
• Assistant Examiner(s): KATSIKIS, KOSTAS J
• Application Number:
  US12/873,941
• Publication Number:
  US 20120054363A1
• Time in Patent Office: 860 Days
• Field of Search: 709/205, 709/232, 370/230, 370/230.1, 370/231, 370/395.21
• US Class Current: 709/232
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways

Abstract

Methods and apparatuses, including computer program products, are described for applying service based on classification and grouping of traffic flows. The method includes receiving a traffic flow, and matching the traffic flow to classification groups. The matching includes determining a first event associated with the traffic flow, comparing attributes of the first event with entry criteria of the classification groups, and assigning the first event to one or more classification groups where the first event meets the entry criteria of the one or more classification groups. The method includes identifying one or more service definitions for the traffic flow based on the classification groups assigned to the traffic flow, reconciling the one or more service definitions for the traffic flow, and providing a service to the traffic flow based on the reconciled service definitions.

Claims

1. A method for applying service based on classification and grouping of traffic flows in a communication path between a first device and a second device said communication path including a first network server and a second network server, the method comprising:

receiving, at a first network server, a traffic flow containing packets from the first device;

matching, at the first network server, the traffic flow to classification groups, wherein the matching comprises;

comparing attributes of the traffic flow with entry criteria of the classification groups;

assigning the traffic flow to one or more classification groups where the attributes of the traffic flow meet the entry criteria of the one or more classification groups;

applying an indication of membership in the one or more classification groups to the traffic flow;

transmitting, by the first network server, the traffic flow to a second network server, wherein the traffic flow includes the indication of membership;

identifying, at the second network server, one or more service definitions for the traffic flow based on the indication of membership applied to the traffic flow by the first network server;

providing, at the second network server, a service to the traffic flow based on the one or more identified service definitions; and

transmitting, by the second network server, the traffic flow to the second device.

2. The method of claim 1, wherein the indication of membership includes a list of indicia associated with the one or more classification groups assigned to the traffic flow.

3. The method of claim 2, wherein the list of indicia is in at least one of:

an XML body, a plain text body, native SIP headers, or native SIP fields.

4. The method of claim 2, wherein the list of indicia is in an XML body.

5. The method of claim 1, further comprising:

reconciling, at the second network server, the identified service definitions for the traffic flow.

6. The method of claim 5, wherein reconciling the identified service definitions for the traffic flow comprises:

configuring logic of the identified service definitions for the traffic flow to manage interactions between the identified service definitions for the traffic flow.

7. The method of claim 1, wherein providing a service to the traffic flow comprises:

executing logic associated with the service definitions identified for the traffic flow.

8. The method of claim 1, further comprising:

automatically assigning, at the second network server, the traffic flow to one or more additional classification groups based on the indication of membership.

9. The method of claim 8, wherein automatically assigning the traffic flow to one or more additional classification groups is based on instructions in the one or more classification groups associated with the indication of membership.

10. The method of claim 1, further comprising:

automatically excluding, at the second network server, the traffic flow from one or more additional classification groups based on the indication of membership.

11. The method of claim 10, wherein automatically excluding the first event from one or more additional classification groups is based on instructions in the one or more classification groups associated with the indication of membership.

12. The method of claim 1, further comprising:

comparing, at the second network server, attributes of the traffic flow with entry criteria of one or more additional classification groups;

assigning, at the second network server, the traffic flow to the one or more additional classification groups where the attributes of the traffic flow meet the entry criteria of the one or more additional classification groups; and

modifying, at the second network server, the indication of membership based on assigning the traffic flow to the one or more additional classification groups.

13. The method of claim 1, wherein the first network server and the second network server each include a user interface, the user interface receiving configuration instructions for the classification groups.

14. The method of claim 1, wherein the traffic flow includes a first event and wherein the first event is assigned to said one or more classification groups as part of assigning the traffic flow to one or more classification groups.

15. The method of claim 14, wherein the first event is the start of a sequence of events, the matching further comprising:

analyzing a second event associated with the traffic flow to determine whether the second event is related to the first event; and

assigning the second event to the one or more classification groups assigned to the first event.

16. The method of claim 1, wherein the classification groups are independent of the service definitions.

17. The method of claim 15, further comprising:

comparing attributes of the second event with entry criteria of one or more additional classification groups; and

assigning the second event to the one or more additional classification groups where the second event meets the entry criteria of the one or more additional classification groups.

18. The method of claim 17, wherein, for processing of the second event, the one or more additional classification groups override the classification groups previously assigned to the second event.

19. The method of claim 17, further comprising:

excluding the second event from one or more of the classification groups assigned to the first event based on assignment of the second event to the one or more additional classification groups.

20. The method of claim 14, wherein the first event is the start of a sequence of events, the matching further comprising:

binding the sequence of events to the one or more classification groups assigned to the first event; and

assigning subsequent events in the sequence of events to the one or more classification groups assigned to the first event.

21. The method of claim 20, wherein binding the sequence of events to the one or more classification groups further comprises:

generating a data structure in each classification group of the one or more classification groups, wherein the data structure includes a reference to the sequence of events.

22. The method of claim 14, wherein the first event is the start of a sequence of events, the matching further comprising:

instantiating a context control block upon determining the first event;

storing indicia associated with the classification groups assigned to the first event in the context control block;

analyzing, based on the stored indicia, subsequent events in the sequence of events associated with the traffic flow to determine whether the subsequent events are related to the first event;

assigning the subsequent events to the one or more classification groups assigned to the first event and stored in the context control block; and

applying an indication of membership in the one or more classification groups to the subsequent events.

23. The method of claim 22, further comprising:

assigning the subsequent events to one or more additional classification groups where attributes of the first event and attributes of the subsequent events are combined to meet entry criteria of the one or more additional classification groups; and

applying an indication of membership in the one or more additional classification groups to the subsequent events.

24. The method of claim 16, wherein the user interface includes a display for viewing the classification groups and related configuration.

25. The method of claim 22, further comprising:

modifying the stored indicia based on the analysis of the subsequent events; and

modifying the classification group assignment of the subsequent events based on the analysis of the subsequent events.

26. The method of claim 25, wherein modifying the classification group assignment of the subsequent events includes adding the subsequent events to one or more additional classification groups, removing the subsequent events from one or more of the classification groups previously assigned to the subsequent events, or both.

27. The method of claim 26, wherein modifying the classification group assignment of the subsequent events includes modifying the indication of membership applied to the subsequent events.

28. The method of claim 22, wherein the context control block includes a finite state machine and a context.

29. The method of claim 1, wherein comparing attributes of the traffic flow with entry criteria of the classification groups comprises:

identifying one or more characteristics associated with the traffic flow;

comparing the identified characteristics to the entry criteria; and

determining whether the identified characteristics match the entry criteria.

30. The method of claim 1, wherein the first network server and the second network server receive data associated with the classification groups and service definitions from a policy configuration server.

31. The method of claim 1, wherein the entry criteria of the classification groups include one or more of:

rules for determining membership in the classification groups, parameters for determining membership in the classification groups, policies for determining membership in the classification groups, and patterns for determining membership in the classification groups.

32. The method of claim 1, wherein the attributes of the traffic flow include signaling data, media type data, media content data, state data, or any combination thereof.

33. The method of claim 1, wherein applying the indication of membership includes inserting, at the first network server, data associated with the indication of membership into the signaling content of the traffic flow.

34. The method of claim 1, wherein the classification groups are independent of each other.

35. The method of claim 1, further comprising:

matching, at the second network server, the traffic flow to one or more additional classification groups based on the indication of membership; and

identifying, at the second network server, one or more additional service definitions for the traffic flow based on the one or more additional classification groups assigned to the traffic flow at the second network server.

36. The method of claim 35, wherein one or more packets of the traffic flow include media content;

and

wherein the matching, at the second network server, further comprises deep packet inspection of the media content of the one or more packets of the traffic flow.

37. A system for applying service based on classification and grouping of traffic flows in a communication path between a first device and a second device, said communication path including a first network server and a second network server, the system comprising:

a first network server comprising a processor coupled to a memory configured to;

receive a traffic flow containing packets from the first device;

match, the traffic flow to classification groups, wherein the matching comprises;

comparing attributes of the traffic flow with entry criteria of the classification groups;

assigning the traffic flow to one or more classification groups where the attributes of the traffic flow meet the entry criteria of the one or more classification groups;

applying an indication of membership in the one or more classification groups to the traffic flow;

a second network server comprising a processor coupled to a memory configured to;

receive the traffic flow from the first network server;

identify one or more service definitions for the traffic flow based on the indication of membership applied to the traffic flow at the first network server;

provide a service to the traffic flow based on the one or more identified service definitions; and

transmit the traffic flow to the second device.

38. The system of claim 37, wherein the second network server is further configured to reconcile the identified service definitions for the traffic flow.