Performing deep packet inspection for a communication session

• US 8,160,579 B1
• Filed: 03/06/2007
• Issued: 04/17/2012
• Est. Priority Date: 03/06/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Rosenberg, Jonathan D.
• Primary Examiner(s): KIM, WESLEY LEO
• Application Number:
  US11/715,073
• Time in Patent Office: 1,869 Days
• Field of Search: 455/432.1, 455/432.2, 455/432.3, 455/435.1, 455/433, 709220-229, 342/386, 342/417, 342/419, 342/350, 342/457, 342/463, 370/331, 370/338, 370/401, 370/466
• US Class Current: 455/432.3
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/5029 Service quality level-based billing, e.g. dependent on measured service level customer is charged more or less
• CPC Class Codes: H04L 41/5061 characterised by the interaction between service providers and their network customers, e.g. customer relationship management
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/15 in relation to multipoint traffic arrangements for broadcast or multicast in data networks H04L12/18
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/724 at intermediate nodes, e.g. resource reservation protocol [RSVP]
• CPC Class Codes: H04L 47/805 QOS or priority aware
• CPC Class Codes: H04L 47/824 Applicable to portable or mobile terminals
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/1104 : Session initiation protocol [SIP]
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 69/14 : Multichannel or multilink protocols
• CPC Class Codes: H04L 69/24 : Negotiation of communication capabilities
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 28/18 : Negotiating wireless communication parameters
• CPC Class Codes: H04W 36/0033 : with transfer of context information
• CPC Class Codes: H04W 36/12 : Reselecting a serving backbone network switching or routing node
• CPC Class Codes: H04W 36/14 : Reselecting a network or an air interface
• CPC Class Codes: H04W 48/14 : using user query or user detection
• CPC Class Codes: H04W 60/00 : Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 8/04 : Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 8/26 : Network addressing or numbering for mobility support
• CPC Class Codes: H04W 80/04 : Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 80/10 : adapted for application session management, e.g. SIP [Session Initiation Protocol] connection management H04W76/00; arrangements for session management H04L67/14
• CPC Class Codes: H04W 92/02 : Inter-networking arrangements

Abstract

Performing deep packet inspection (DPI) includes facilitating a communication session for an access terminal. The access terminal is associated with a home network. A DPI policy is installed at an edge router. The DPI policy includes one or more DPI facets, where a DPI facet comprises a packet classifier. Packets that match the packet classifier are detected and inspected in accordance with the DPI facets.

Claims

1. A method for performing deep packet inspection (DPI) for a communication session, comprising:

receiving a registration request from an access terminal, the registration request indicating that the access terminal has requested an application;

receiving one or more DPI facets from an application manager in a home network, the application manager configured to select the DPI facets based on the requested application, a DPI facet of the one or more DPI facets comprising a packet classifier;

authorizing the DPI facets at a home policy server;

communicating the DPI facets to a visited policy server, the visited policy server configured to;

determine whether the DPI facets are acceptable;

if the DPI facets are not acceptable to the visited policy server, communicate a notification to the home policy server that identifies an adjustment of the DPI facets and the home policy server determines whether the adjusted DPI facets are acceptable; and

if the DPI facets are acceptable to the visited policy server, selectively push the DPI facets from the visited policy server to an edge router of a visited network, the edge router configured to;

perform deep packet inspection of the plurality of packets in accordance with the one or more DPI facets; and

select an action to perform in response to detecting whether the packets include content that the packets are supposed to include according to the requested application;

wherein the visited network manages a bearer path of the communication session and the home network provides the application independently of the visited network.

2. The method of claim 1, wherein inspecting the plurality of packets in accordance with the one or more DPI facets further comprises:

inspecting a packet feature of the plurality of packets.

3. The method of claim 1, wherein inspecting the plurality of packets in accordance with the one or more DPI facets further comprises:

detecting a packet feature in the plurality of packets; and

identifying an application used by the communication session in accordance with the detected packet feature.

4. The method of claim 1, wherein inspecting the plurality of packets in accordance with the one or more DPI facets further comprises:

detecting a packet feature in the plurality of packets; and

performing an action specified by at least one DPI facet of the one or more DPI facets.

5. The method of claim 1, wherein inspecting the plurality of packets in accordance with the one or more DPI facets further comprises:

performing an action in response to detecting use on an application, the action comprising at least one of;

terminating the application;

allowing the application; and

notifying a policy server of the application.

6. The method of claim 1, wherein the packet classifier comprises one or more Internet Protocol (IP) addresses and one or more port ranges.

7. An edge router, comprising:

a memory operable to;

store one or more deep packet inspection (DPI) facets associated with an access terminal, a DPI facet of the one or more DPI facets comprising a packet classifier; and

a processor in communication with the memory and operable to;

receive a registration request from an access terminal, the registration request indicating that the access terminal has requested an application;

receive one or more DPI facets, the DPI facets selected by an application manger in a home network, the application manager configured to select the DPI facets based on the requested application, the one or more DPI facets selectively pushed to the edge router by a visited policy server configured to;

receive the DPI facets from a home policy server;

determine whether the DPI facets are acceptable;

if the DPI facets are not acceptable to the visited policy server, communicate a notification to the home policy server that identifies an adjustment of the DPI facets and the home policy server determines whether the adjusted DPI facets are acceptable; and

if the DPI facets are acceptable to the visited policy server, selectively push the DPI facets from the visited policy server to the edge router;

the processor further operable to;

install the DPI facets at the edge router;

perform deep packet inspection of the plurality of packets in accordance with the one or more DPI facets; and

select an action to perform in response to detecting whether the packets include content that the packets are supposed to include according to the requested application;

wherein the edge router manages a bearer path of the communication session in a visited network and the home network provides the application independently of the visited network.

8. The edge router of claim 7, the processor further operable to inspect the plurality of packets in accordance with the one or more DPI facets by:

inspecting a packet feature of the plurality of packets.

9. The edge router of claim 7, the processor further operable to inspect the plurality of packets in accordance with the one or more DPI facets by:

detecting a packet feature in the plurality of packets; and

identifying an application used by the communication session in accordance with the detected packet feature.

10. The edge router of claim 7, the processor further operable to inspect the plurality of packets in accordance with the one or more DPI facets by:

detecting a packet feature in the plurality of packets; and

performing an action specified by at least one DPI facet of the one or more DPI facets.

11. The edge router of claim 7, the processor further operable to inspect the plurality of packets in accordance with the one or more DPI facets by:

performing an action in response to detecting use on an application, the action comprising at least one of;

terminating the application;

allowing the application; and

notifying a policy server of the application.

12. The edge router of claim 7, wherein the packet classifier comprises one or more Internet Protocol (IP) addresses and one or more port ranges.

13. A non-transitory computer readable medium encoded with logic for performing deep packet inspection (DPI) for a communication session, the logic embodied in the computer-readable medium and operable to:

receive a registration request from an access terminal, the registration request indicating that the access terminal has requested an application;

receive one or more DPI facets from an application manager in a home network, the application manager configured to select the DPI facets based on the requested application, a DPI facet of the one or more DPI facets comprising a packet classifier;

authorize the DPI facets; and

communicate the DPI facets to a visited policy server, the visited policy server configured to;

determine whether the DPI facets are acceptable;

if the DPI facets are not acceptable to the visited policy server, communicate a notification to the logic that identifies an adjustment of the DPI facets and the logic determines whether the adjusted DPI facets are acceptable; and

if the DPI facets are acceptable to the visited policy server, selectively push the DPI facets from the visited policy server to an edge router of a visited network, the edge router configured to;

perform deep packet inspection of the plurality of packets in accordance with the one or more DPI facets; and

select an action to perform in response to detecting whether the packets include content that the packets are supposed to include according to the requested application;

wherein the visited network manages a bearer path of the communication session and the home network provides the application independently of the visited network.

14. The computer-readable medium encoded with logic of claim 13, further operable to inspect the plurality of packets in accordance with the one or more DPI facets by:

inspecting a packet feature of the plurality of packets.

15. The computer-readable medium encoded with logic of claim 13, further operable to inspect the plurality of packets in accordance with the one or more DPI facets by:

detecting a packet feature in the plurality of packets; and

identifying an application used by the communication session in accordance with the detected packet feature.

16. The computer-readable medium encoded with logic of claim 13, further operable to inspect the plurality of packets in accordance with the one or more DPI facets by:

detecting a packet feature in the plurality of packets; and

performing an action specified by at least one DPI facet of the one or more DPI facets.

17. The computer-readable medium encoded with logic of claim 13, further operable to inspect the plurality of packets in accordance with the one or more DPI facets by:

performing an action in response to detecting use on an application, the action comprising at least one of;

terminating the application;

allowing the application; and

notifying a policy server of the application.

18. The computer-readable medium encoded with logic of claim 13, wherein the packet classifier comprises one or more Internet Protocol (IP) addresses.

19. The computer-readable medium encoded with logic of claim 13, wherein the packet classifier comprises and one or more port ranges.

20. A system for performing deep packet inspection (DPI) for a communication session, comprising:

means for receiving a registration request from an access terminal, the registration request indicating that the access terminal has requested an application;

means for receiving one or more DPI facets from an application manager in a home network, the application manager configured to select the DPI facets based on the requested application, a DPI facet of the one or more DPI facets comprising a packet classifier;

means for authorizing the DPI facets at a home policy server;

means for communicating the DPI facets to a visited policy server, the visited policy server configured to;

determine whether the DPI facets are acceptable;

if the DPI facets are not acceptable to the visited policy server, communicate a notification to the home policy server that identifies an adjustment of the DPI facets and the home policy server determines whether the adjusted DPI facets are acceptable; and

if the DPI facets are acceptable to the visited policy server, selectively push the DPI facets from the visited policy server to an edge router of a visited network;

means for performing deep packet inspection of the plurality of packets in accordance with the one or more DPI facets; and

means for selecting an action to perform in response to detecting whether the packets include content that the packets are supposed to include according to the requested application;

wherein the visited network manages a bearer path of the communication session and the home network provides the application independently of the visited network.