Providing services to packet flows in a network

• US 8,582,473 B2
• Filed: 11/11/2010
• Issued: 11/12/2013
• Est. Priority Date: 11/19/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Ramankutty, Rajesh, Puthiyandyil, Sanil Kumar, Harper, Matthew H., Mortsolf, Timothy G.
• Primary Examiner(s): LEVITAN, DMITRY
• Application Number:
  US12/944,594
• Publication Number:
  US 20110116378A1
• Time in Patent Office: 1,097 Days
• Field of Search: 370/259, 370/310, 370351-356, 455405-409, 709/220, 709227-229, 709/249
• US Class Current: 370/259
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways

Abstract

A system and method for providing services to packet flows in a communication network. The services include enhanced charging, stateful firewalls, traffic performance optimization (TPO) and advanced services such as content differentiated charging, per-subscriber stateful firewalls, and VPNs, for example. A gateway can be used to route each packet flow through the services on a per-subscriber basis by inspecting accounting messages and checking subscriber profiles prior to setting up a new packet flow session. By directing the packet flow through the services requested latency can be reduced as well as the need to have equipment for each session regardless of whether the service is provided to the packet flow. The services can be provided in-line as well.

Claims

1. A gateway comprising:

an interface configured to transmit and receive data;

a memory configured to store subscriber profile information and software for providing services to mobile nodes;

an IP services gateway (IPSG) manager that is configured to activate sessions for mobile nodes based on incoming packets received at the interface, and to obtain information from the received packets in order to link the received packets to a subscriber profile associated with a mobile node and to set up provision of at least one service to the received packets;

a session manager that is configured to obtain the subscriber profile information based on information received from the IPSG, to recognize the received packets on a subscriber session basis, and to direct the received packets to corresponding functions or servers for processing the packets in accordance with services specified in the subscriber profile information, the session manager configured to manage the provision of a single service and configured to manage the provision of multiple services to packets; and

a network processing unit (NPU) that is configured to direct the received packets to the session manager so services can be provided to the received packets.

2. The gateway of claim 1, wherein the IPSG manager is configured to inspect signaling protocol messages received from the mobile node that meet certain criteria and extract mobile node identifying information to obtain the subscriber profile.

3. The gateway of claim 1, wherein the subscriber profile information includes configuration information regarding services to be applied for the mobile node and a subscriber access control list (ACL), wherein the information regarding service includes information to route the packet flow through selected services.

4. The gateway of claim 1, wherein the IPSG manager obtains at least identification information that is used to authenticate a session for the mobile node, set up the session, and link the session to the subscriber profile.

5. The gateway of claim 1, further comprising an enhanced charging in-line service that is configured to process packets for a particular subscriber based on the subscriber profile.

6. The gateway of claim 1, wherein the IPSG manager is configured to receive packets from the NPU based on information in the packets and the IPSG manager inspects the packets received from the NPU.

7. The gateway of claim 1, wherein the session manager is configured to manage policy communication with a policy server to receive policy information and a charging server to report charging information for accounting purposes.

8. The gateway of claim 1, wherein the gateway includes a serving general packet radio service support node (SGSN).

9. A method comprising:

receiving packets at an IP services gateway (IPSG) manager;

inspecting the packets and determining from the packets whether to activate a new session for a mobile node at the IPSG manager;

extracting information from the packets in order to link the packets to a subscriber profile associated with a mobile node and set up provision of at least one service to the packets;

obtaining information from the subscriber profile based on information received from the IPSG to set up a network processing unit (NPU) to direct incoming packets to a session manager for processing;

directing the packets received at the gateway to corresponding functions or servers for processing the packets in accordance with services specified in the subscriber profile;

managing the provision of multiple services to packets; and

directing the packets received at the NPU to the session manager to provide services to the packet flow.

10. The method of claim 9, wherein the inspecting of the packets includes inspecting signaling protocol messages received from the mobile node that meet certain criteria and extracting mobile node identifying information to obtain the subscriber profile.

11. The method of claim 9, wherein the information from the subscriber profile includes configuration information regarding services to be applied for the mobile node and a subscriber access control list (ACL), wherein the information regarding service includes information to route the packet flow through selected services.

12. The method of claim 9, further comprising obtaining at least identification information at the IPSG manager that is used to authenticate a session for the mobile node, set up the session, and link the session to the subscriber profile.

13. The method of claim 9, further comprising providing an enhanced charging in-line service and processing packets in accordance with the enhanced charging in-line service for a particular subscriber based on the subscriber profile.

14. The method of claim 9, wherein the IPSG manager is configured to receive packets from the NPU based on information in the packets and the IPSG manager inspects the packets received from the NPU.

15. The method of claim 9, further comprising managing policy communication at the session manager with a policy server to receive policy information and a charging server to report charging information for accounting purposes.

16. The method of claim 9, further comprising providing a serving general packet radio service support node (SGSN) functionality to the mobile node.

17. Logic encoded on one or more non-transitory tangible computer readable media for execution and when executed operable to:

receive packets at an IP services gateway (IPSG) manager;

inspect the packets and determine from the packets whether to activate a new session for a mobile node at the IPSG manager;

extract information from the packets in order to link the packets to a subscriber profile associated with a mobile node and set up provision of at least one service to the packets;

obtain information from the subscriber profile based on information received from the IPSG to set up a network processing unit (NPU) to direct incoming packets to a session manager for processing;

direct the packets received at the gateway to corresponding functions or servers for processing the packets in accordance with services specified in the subscriber profile;

manage the provision of multiple services to packets; and

direct the packets received at the NPU the session manager to provide services to the packet flow.

18. The logic of claim 17, wherein the inspecting of the packets includes inspecting signaling protocol messages that meet certain criteria and extracting mobile node identifying information to obtain the subscriber profile.

19. The logic of claim 17, wherein the information from the subscriber profile includes configuration information regarding services to be applied for the mobile node and a subscriber access control list (ACL), wherein the information regarding service includes information to route the packet flow through selected services.

20. The logic of claim 17, wherein the logic is further configured to receive the packet flow at an enhanced charging in-line service and process the packet flow in accordance with the enhanced charging in-line service for a particular subscriber based on the subscriber profile.