October 26, 2016 at 11:24DPI Introduction: System Composition and Connection Diagrams
Hello, Habr! We at VAS Experts specialize in the creation and implementation of services in the field of control and analysis of Internet traffic. In our blog, we will share our own work experience and talk about how certain technologies related to our field of work are arranged. / Flickr / Andrew Hart / CC The
global market for deep traffic analysis (DPI) in 2013 was estimated at almost 742 million US dollars. According to analysts, by 2020 it will grow by more than 6 times and will be estimated at 4.7 billion. DPI systems are mainly used by Internet service providers and telecom operators who seek to protect their subscribers and optimize the bandwidth to the client through filters, priorities and caches.
DPI analyzes all packets passing through it up to the 7th level of the OSI model and recognizes applications that do not use previously known headers and structures for data exchange. However, the DPI system alone does not solve the problems and tasks described above. It interacts with other devices and services of the operator's data network. We’ll talk about this today.
Standards and specifications for mobile networks are not developed separately by each operator; 3GPP (3rd Generation Partnership Project), created in 1998, deals with this .
The central concept of 3GPP-based networks is PCC (Policy and Charging Control). Solutions of this class allow you to personalize services, actively manage traffic and quality of service, using PCC rules for making PCC decisions. The PCEF (Policy and Charging Enforcement Function) function applies these PCC rules to traffic. DPI systems are part of PCEF, scanning all traffic passing through and applying the required policies to it.
However, there are otherelements, such as PCRF (Policy Control and Charging Rules Function), is a solution for applying subscriber service policies to establish QoS parameters and charging rules depending on various conditions. There is also OCS (Online Charging System), which provides tariffication of services and controls the balance of the subscriber.
It should be noted the billing system, which stores the database of the balance of subscribers and provides it to the OCS server, and the UDR repository (User Data Repository), which stores user data (services available to the subscriber, QoS parameters and others). You can find a complete list of the components involved in our blog .
There are two main schemes for connecting a deep traffic analysis device to the operator’s equipment here - the so-called “break” installation (active circuit) and traffic mirroring (passive circuit).
Installation scheme “in the gap”
This type of connection is used to implement the functionality of any DPI system. In this case, the traffic analysis system is connected after the border router to the uplink gap.
The advantage of this scheme is that absolutely all traffic passes through DPI. This allows you to prioritize, as well as configure notifications, caching, and other functions. However, this type of connection has a significant drawback: the DPI device becomes a point of failure - if it fails, the connection is completely disconnected.
But there are ways to solve this problem:
Traffic mirroring scheme Traffic
mirroring is carried out through SPAN ports or optical splitters. With this scheme, it is possible to analyze the history of visits in real time, forward call blocking requests, caching and work with bonus programs.
The advantages of this connection option are minimal changes in the structure of the existing network and no need to use a bypass card. In this case, it is possible to remove analytics from the traffic, connect the cache server and “mirror” the traffic to the SORM equipment, but all the DPI system functionality cannot be implemented.
Note that both of the connection options are supported by our SKAT DPI solution, which allows limiting the size of the occupied band by protocol groups, controlling the priority of packets passing through it, blocking advertising content, etc. You can find more detailed information about the system here .
DPI-systems, which are the result of combining several younger packet filtering systems (if you're wondering, the birth of the history of DPI and information on precursor solutions you can find here and here ), will simplify support and administration of networks and sites, to increase the security of the latter on various kinds of attacks and expanded the scope of application of traffic analysis technologies.
We will talk more about how DPI is applied in our next article. We welcome your suggestions on topics for further consideration on the blog.
DPI analyzes all packets passing through it up to the 7th level of the OSI model and recognizes applications that do not use previously known headers and structures for data exchange. However, the DPI system alone does not solve the problems and tasks described above. It interacts with other devices and services of the operator's data network. We’ll talk about this today.
Interaction with other systems
Standards and specifications for mobile networks are not developed separately by each operator; 3GPP (3rd Generation Partnership Project), created in 1998, deals with this .
The central concept of 3GPP-based networks is PCC (Policy and Charging Control). Solutions of this class allow you to personalize services, actively manage traffic and quality of service, using PCC rules for making PCC decisions. The PCEF (Policy and Charging Enforcement Function) function applies these PCC rules to traffic. DPI systems are part of PCEF, scanning all traffic passing through and applying the required policies to it.
However, there are otherelements, such as PCRF (Policy Control and Charging Rules Function), is a solution for applying subscriber service policies to establish QoS parameters and charging rules depending on various conditions. There is also OCS (Online Charging System), which provides tariffication of services and controls the balance of the subscriber.
It should be noted the billing system, which stores the database of the balance of subscribers and provides it to the OCS server, and the UDR repository (User Data Repository), which stores user data (services available to the subscriber, QoS parameters and others). You can find a complete list of the components involved in our blog .
DPI Connection Diagrams
There are two main schemes for connecting a deep traffic analysis device to the operator’s equipment here - the so-called “break” installation (active circuit) and traffic mirroring (passive circuit).
Installation scheme “in the gap”
This type of connection is used to implement the functionality of any DPI system. In this case, the traffic analysis system is connected after the border router to the uplink gap.
The advantage of this scheme is that absolutely all traffic passes through DPI. This allows you to prioritize, as well as configure notifications, caching, and other functions. However, this type of connection has a significant drawback: the DPI device becomes a point of failure - if it fails, the connection is completely disconnected.
But there are ways to solve this problem:
- Use a bypass device as part of the DPI system, which, in the event of a failure of the main frontend, will “drive” traffic through itself (traffic analysis will not be carried out).
- Use a backup DPI platform, which would filter traffic in case of failure of the main one.
Traffic mirroring scheme Traffic
mirroring is carried out through SPAN ports or optical splitters. With this scheme, it is possible to analyze the history of visits in real time, forward call blocking requests, caching and work with bonus programs.
The advantages of this connection option are minimal changes in the structure of the existing network and no need to use a bypass card. In this case, it is possible to remove analytics from the traffic, connect the cache server and “mirror” the traffic to the SORM equipment, but all the DPI system functionality cannot be implemented.
Note that both of the connection options are supported by our SKAT DPI solution, which allows limiting the size of the occupied band by protocol groups, controlling the priority of packets passing through it, blocking advertising content, etc. You can find more detailed information about the system here .
Instead of a conclusion
DPI-systems, which are the result of combining several younger packet filtering systems (if you're wondering, the birth of the history of DPI and information on precursor solutions you can find here and here ), will simplify support and administration of networks and sites, to increase the security of the latter on various kinds of attacks and expanded the scope of application of traffic analysis technologies.
We will talk more about how DPI is applied in our next article. We welcome your suggestions on topics for further consideration on the blog.
