(19)
(11)EP 3 051 866 B1

(12)EUROPEAN PATENT SPECIFICATION

(45)Mention of the grant of the patent:
29.04.2020 Bulletin 2020/18

(21)Application number: 14845484.6

(22)Date of filing:  23.06.2014
(51)International Patent Classification (IPC): 
H04L 12/24(2006.01)
H04W 24/02(2009.01)
(86)International application number:
PCT/CN2014/080552
(87)International publication number:
WO 2015/039474 (26.03.2015 Gazette  2015/12)

(54)

METHOD, DEVICE, AND STORAGE MEDIUM FOR DEEP PACKET INSPECTION CONTROL

VERFAHREN, VORRICHTUNG UND SPEICHERMEDIUM ZUR STEUERUNG VON TIEFER PAKETINSPEKTION

PROCÉDÉ, DISPOSITIF ET SUPPORT D'INFORMATIONS POUR UNE COMMANDE D'INSPECTION APPROFONDIE DE PAQUETS


(84)Designated Contracting States:
AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

(30)Priority: 23.09.2013 CN 201310437064

(43)Date of publication of application:
03.08.2016 Bulletin 2016/31

(73)Proprietor: ZTE Corporation
Shenzhen, Guangdong 518057 (CN)

(72)Inventors:
  • HUANG, Sunliang
    Shenzhen Guangdong 518057 (CN)
  • FENG, Jun
    Shenzhen Guangdong 518057 (CN)
  • FAN, Liang
    Shenzhen Guangdong 518057 (CN)

(74)Representative: Baudler, Ron et al
Canzler & Bergmeier Patentanwälte Partnerschaft mbB Friedrich-Ebert-Straße 84
85055 Ingolstadt
85055 Ingolstadt (DE)


(56)References cited: : 
EP-A1- 2 829 039
CN-A- 101 505 236
CN-A- 102 420 701
CA-A1- 2 661 398
CN-A- 102 045 363
CN-A- 102 946 500
  
  • XIE HUAWEI & USTC T TSOU HUAWEI (USA) D LOPEZ TELEFONICA I+D H YIN HUAWEI (USA) H: "Use Cases for ALTO with Software Defined Networks; draft-xie-alto-sdn-extension-use-cases-01. txt", USE CASES FOR ALTO WITH SOFTWARE DEFINED NETWORKS; DRAFT-XIE-ALTO-SDN-EXTENSION-USE-CASES-01. TXT, INTERNET ENGINEERING TASK FORCE, IETF; STANDARDWORKINGDRAFT, INTERNET SOCIETY (ISOC) 4, RUE DES FALAISES CH- 1205 GENEVA, SWITZERLAND, 9 January 2013 (2013-01-09), pages 1-29, XP015089409, [retrieved on 2013-01-09]
  • FOSTER N ET AL: "Languages for software-defined networks", IEEE COMMUNICATIONS MAGAZINE, IEEE SERVICE CENTER, PISCATAWAY, US, vol. 51, no. 2, 1 February 2013 (2013-02-01), pages 128-134, XP011505038, ISSN: 0163-6804, DOI: 10.1109/MCOM.2013.6461197
  • KOK-KIONG YAP TE-YUAN HUANG BEN DODSON MONICA S LAM NICK MCKEOWN STANFORD UNIVERSITY {YAPKKE ET AL: "Towards Software-Friendly Networks", USENIX,, 25 August 2010 (2010-08-25), pages 1-5, XP061013198, [retrieved on 2010-08-25]
  • ANDREW D FERGUSON ET AL: "Participatory networking", SIGCOMM, ACM, 2 PENN PLAZA, SUITE 701 NEW YORK NY 10121-0701 USA, 27 August 2013 (2013-08-27), pages 327-338, XP058030620, DOI: 10.1145/2486001.2486003 ISBN: 978-1-4503-2056-6
  • Big Switch Networks: "The Open SDN Architecture |", , 31 July 2013 (2013-07-31), XP055296004, Retrieved from the Internet: URL:https://www.bigswitch.com/sites/defaul t/files/sdn_overview.pdf [retrieved on 2016-08-17]
  
Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention).


Description

TECHNICAL FIELD



[0001] The present disclosure relates to communications and more particularly to a method, a device, and a storage medium for Deep Packet Inspection (DPI) control.

BACKGROUND



[0002] With the rapid development of the Internet, Internet services emerge continuously. In terms of a service type, the services include voices, texts, videos or the like. In terms of a network link mode of a service, the services include services of a Client/Server (C/S) type, a Browser/Server (B/S) type, a Peer to Peer (P2P) type, a Peer to Server & Peer (P2SP) type and other types. In terms of a service interaction mode, the services include static web pages, interactive web pages, instant communications or the like. Implementation protocols for different services are very different.

[0003] The emergence of a great number of services provides rich Internet service for users and also brings difficulties in supervision and control. In order to meet requirements for national network safety monitoring and refined operation of telecom operators, a Deep Packet Inspection (DPI) technology emerges. The DPI technology can be applied to traffic management, safety, network analysis and other aspects, and can be used to analyse a network data packet.

[0004] Most of conventional DPI devices acquire packets using port mirroring or an optical splitter. After perceptual analysis is performed, a corresponding control policy is formed, and is directly transmitted to a corresponding network device to carry out network control. In this way, there is lack of uniform control over the whole network. The transmission and execution of the control policy are only limited to end-to-end control and thus one end-to-multiple ends control is difficult to realize, which is limited for an application range of the DPI devices.

[0005] In the draft entitled "Use Cases for ALTO with Software Defined Networks," coherent coexistence of Application Layer Traffic Optimization (ALTO) and Software defined networking (SDN) is introduced, in which SDN nodes and ALTO nodes are integrated within a network and thus the ALTO nodes receive aggregated and filtered network information from the SDN nodes, calculate a plurality of traffic optimization decisions and forward the traffic-optimization decisions to the SDN nodes.

SUMMARY



[0006] The embodiments of the present disclosure provide a method, a device, and a storage medium for DPI control, which are intended to realize data collection and transmission of a control policy for one end-to-multiple ends.

[0007] In a first aspect, an embodiment of the present disclosure provides a method for DPI control as claimed in claim 1.

[0008] Preferably, the step that the traffic collection request is sent to the network controller via the northbound interface of the network controller according to the pre-set collection policy may include that:
the traffic collection request is sent to the network controller via a network capacity control device according to the pre-set collection policy.

[0009] Preferably, the step that the network control policies are sent to the network controller may include that:
the network control policies are sent to the network controller via the network capacity control device to allow the network controller to send each of the received network control policies to the corresponding network device.

[0010] In a second aspect, an embodiment of the present disclosure also provides a system comprising a device for DPI control, a network capacity control device and a network controller as claimed in claim 4.

[0011] Preferably, the traffic collection module may be further configured to send the traffic collection request to the network controller via a network capacity control device according to the pre-set collection policy.

[0012] Preferably, the control policy sending module may be further configured to send the network control policies to the network controller via the network capacity control device to allow the network controller to send each of the received network control policies to the corresponding network device.

[0013] In a third aspect, an embodiment of the present disclosure provides a readable storage medium as claimed in claim 7.

[0014] According to the method, the device and the storage medium for DPI control in the embodiments of the present disclosure, the network controller interacts with each of the network devices, and thus the traffic collection request and the network control policy are sent to each of the network devices. Therefore, data collection and transmission of the control policy for one end-to-multiple ends are realized.

BRIEF DESCRIPTION OF THE DRAWINGS



[0015] 

Fig. 1 is a flowchart illustrating a method for DPI control according to a first embodiment of the present disclosure;

Fig. 2 is a flowchart illustrating a method for DPI control according to a second embodiment of the present disclosure;

Fig. 3 is a structure block diagram showing a device for DPI control according to a first embodiment of the present disclosure; and

Fig. 4 is a structure block diagram showing a device for DPI control according to a second embodiment of the present disclosure.



[0016] The objectives, functional characteristics and advantages of the present disclosure will be further described with reference to the embodiments and the accompanying drawings.

DETAILED DESCRIPTION



[0017] It should be understood that the embodiments described herein are only intended to explain the present disclosure and are not intended to limit the present disclosure.

[0018] In this embodiment, a Software Defined Network (SDN) controller is taken as an example to describe the network controller. In other embodiments of the present disclosure, any one of applicable controller at a network side is also used. Fig. 1 is a flowchart illustrating a method for DPI control according to a first embodiment of the present disclosure. As shown in Fig. 1, the method includes the following steps.

[0019] At S10, a traffic collection request is sent to an SDN controller according to a pre-set collection policy.

[0020] Here, the traffic collection request is used for allowing the network controller to send a request for traffic collection to one or more corresponding network devices.

[0021] Here, the traffic collection request is sent to the network controller according to the pre-set collection policy to allow the network controller to send the traffic collection request to one or more network devices in response to the traffic collection request.

[0022] In Step S10, the traffic collection request is sent to the SDN controller according to the pre-set collection policy. The traffic collection request contains some parameters for assigning contents to be collected, such as service flows from regular users, interconnection Internet Protocol (IP) flows between regular networks and traffics from regular ports. After the SDN controller receives the traffic collection request, the SDN controller parses and processes the same to determine one or more network devices which need the traffic collection request. The traffic collection request is converted into an instruction capable of being transmitted via a southbound interface of the SDN controller, and the converted traffic collection request is further sent to the one or more network devices via the southbound interface of the SDN controller.

[0023] The SDN controller adopts a uniform control mode, and all of the network devices can be globally managed and controlled.

[0024] At S11, traffic data collected by the one or more network devices are received.

[0025] In Step S11, the traffic data collected by each of the network devices are received. Each of the network devices performs traffic collection according to the traffic collection request transmitted by the SDN controller, and returns the collected traffic data. Preferably, in the method for DPI control, the traffic data collected from the network devices are directly received without the need of the SDN controller.

[0026] At S12, the received traffic data from the one or more network devices are analyzed and processed to generate a network control policy corresponding to each of the network devices.

[0027] In Step S12, the received traffic data are analyzed and processed to generate the corresponding network control policies. If the received traffic data of a network device A are analyzed and processed to determine that the traffic of a regular port of the network device A is too much, a network control policy for restricting traffic is generated for the network device A.

[0028] At S13, the network control policies are sent to the SDN controller to allow the SDN controller to send each of the network control policies to the corresponding network device.

[0029] In Step S13, each of the network control policies is sent to the SDN controller. After the SDN controller receives the network control policies, parsing and processing are performed to determine one or more network devices which need the network control policies. Each of the network control policies is converted into an instruction capable of being transmitted via the southbound interface of the SDN controller, and the converted network control policy is further sent to the corresponding network device via the southbound interface of the SDN controller.

[0030] By means of the embodiment, the SDN controller interacts with each of the network devices, the traffic collection request and the network control policy are sent to each of the network devices, and therefore the data collection and transmission of the control policy for one end-to-multiple ends are realized.

[0031] Furthermore, after Step S13, the method further includes the following step.

[0032] At S14, each of feedback messages reported by the SDN controller is received, each of feedback messages being used for indicating that the corresponding network device has successfully executed the corresponding network control policy.

[0033] After each of the network devices receives the corresponding network control policy transmitted by the SDN controller, a relevant network control policy is deployed on this network device, and a feedback message indicating that the network control policy is successfully executed is sent to the SDN controller after the deployment is completed. The SDN controller collects the feedback messages which are fed back by all of the network devices and indicate that the network control policies are successfully executed, performs uniform processing, and then returns the uniformly-processed feedback messages indicating that the network control policies are successfully executed.

[0034] Furthermore, before Step S11, the method further includes the following step.

[0035] At S15, the feedback messages which are reported by the SDN controller and indicate that the collection policies of the one or more network devices are successfully executed are received.

[0036] After the one or more network devices receive the traffic collection request transmitted by the SDN controller, a relevant traffic collection policy is deployed on each of the network devices, and each of feedback messages indicating that the corresponding collection policy is successfully executed is sent to the SDN controller after the deployment is completed. The SDN controller collects the feedback messages which are sent by all of the network devices and indicate that the collection policies are successfully executed, performs uniform processing, and then returns the uniformly-processed feedback messages indicating that the collection policies are successfully executed.

[0037] In this embodiment, the SDN controller is taken as an example to describe the network controller. In the other embodiments of the present disclosure, any one of applicable controller at the network side is applicable. Fig. 2 is a flowchart illustrating a method for DPI control according to a second embodiment of the present disclosure. As shown in Fig. 2, the method includes the following steps.

[0038] At S20, a traffic collection request is sent to an SDN controller via a network capacity control device according to a pre-set collection policy.

[0039] Here, the traffic collection request is sent to the SDN controller via the network capacity control device according to the pre-set collection policy to allow the SDN controller to send the traffic collection request to one or more network devices according to the received traffic collection request.

[0040] In Step S20, the traffic collection request is sent to the network capacity control device according to the pre-set collection policy. The traffic collection request focuses on describing the application layer requirements, and the level of abstraction is relatively high. The traffic collection request contains some parameters for assigning contents to be collected, such as specific service flows of specific users, specific IP flows and traffics of specific ports. After the network capacity control device receives the traffic collection request, parsing and processing are performed to form a traffic collection request which can be recognized by the SDN controller, and the traffic collection request which is parsed and processed is transmitted to the SDN controller via a northbound interface of the SDN controller.

[0041] After the SDN controller receives the traffic collection request transmitted by the network capacity control device, parsing and processing are performed to determine one or more network devices which need the traffic collection request, the traffic collection request is converted into an instruction capable of being transmitted via the southbound interface of the SDN controller, and the converted traffic collection request is further sent to the one or more network devices via the southbound interface of the SDN controller.

[0042] The SDN controller adopts a uniform control mode, and all of the network devices can be globally managed and controlled.

[0043] At S21, traffic data collected by the one or more network devices are received.

[0044] In Step S21, the traffic data collected by each of the network devices are received. Each of the network devices performs traffic collection according to the traffic collection request transmitted by the SDN controller, and returns the collected traffic data. Preferably, in the method for DPI control, the traffic data collected from the network devices are directly received without the need of the SDN controller and the network capacity control device.

[0045] At S22, the received traffic data from the one or more network devices are analyzed and processed to generate a network control policy corresponding to each of the network devices.

[0046] In Step S22, the received traffic data are analyzed and processed to generate the corresponding network control policies. The network control policies focus on describing the application layer requirements, such as diamond-level service guarantee and end-to-end service guarantee, and the level of abstraction is relatively high. For example, P2P traffic data of a specific region, received from a network device A, are analyzed. If it is determined that the P2P traffic data of the current specific region of the network device A are over-sized, a network control policy for restricting the traffic is generated.

[0047] At S23, the network control policies are sent to the SDN controller via the network capacity control device correspondingly to allow the SDN controller to send each of the received network control policies to the corresponding network device.

[0048] In Step S23, each of the generated network control policies is sent to the network capacity control device. After the network control policies are received, parsing and processing are performed, the received network control policies are converted into network control policies which can be recognized by the SDN controller, and the converted network control policies are transmitted to the SDN controller via a northbound interface of the SDN controller.

[0049] After the SDN controller receives the network control policies transmitted by the network capacity control device, parsing and processing are performed to determine one or more network devices which need the network control policies, each of the network control policies is converted into an instruction capable of being transmitted via the southbound interface of the SDN controller, and each of the converted network control policies is further sent to the corresponding network device via the southbound interface of the SDN controller.

[0050] Furthermore, after Step S23, the method further includes the following step.

[0051] At S24, each of feedback messages reported by the SDN controller via the network capacity control device is received, each of the feedback messages being used for indicating that the corresponding network device has successfully executed the corresponding network control policy.

[0052] After each of the network devices receives the corresponding network control policy transmitted by the SDN controller, a relevant network control policy is deployed on this network device, and each of the feedback messages indicating that the network control policy is successfully executed is sent to the SDN controller after the deployment is completed. The SDN controller collects the feedback messages which are fed back by all of the network devices and indicate that the network control policies are successfully executed, performs uniform processing, and then sends the uniformly-processed feedback messages indicating that the network control policies are successfully executed to the network capacity control device. The network capacity control device returns the feedback messages.

[0053] Furthermore, before Step S21, the method further includes the following step.

[0054] At S25, the feedback messages which are reported by the SDN controller via the network capacity control device and indicate that the collection policies of the one or more network devices are successfully executed are received.

[0055] After the one or more network devices receive the traffic collection request transmitted by the SDN controller, a relevant traffic collection policy is deployed on this network device, and each of the feedback messages indicating that the collection policy is successfully executed is sent to the SDN controller after the deployment is completed. The SDN controller collects the feedback messages which are sent by all of the network devices and indicate that the collection policies are successfully executed, performs uniform processing, and then sends the uniformly-processed feedback messages indicating that the collection policies are successfully executed to the network capacity control device. The network capacity control device returns the feedback messages.

[0056] In this embodiment, the SDN controller is taken as an example to describe. In the other embodiments of the present disclosure, any one of applicable network controllers may be used. Fig. 3 is a structure block diagram showing a device for DPI control according to a first embodiment of the present disclosure. As shown in Fig. 3, the device 301 includes a traffic collection module 310, a receiving module 311, a generation module 312 and a control policy sending module 313.

[0057] The traffic collection module 310 is configured to send a traffic collection request to an SDN controller 200 according to a pre-set collection policy, the traffic collection request being used for allowing the SDN controller 200 to send a request for traffic collection to one or more network devices 300.

[0058] The receiving module 311 is configured to receive traffic data collected by the one or more network devices 300.

[0059] The generation module 312 is configured to analyze and process the received traffic data from the one or more network devices to generate a network control policy corresponding to each of the network devices.

[0060] The control policy sending module 313 is configured to send the network control policies to the SDN controller 200 to allow the SDN controller 200 to send each of the network control policies to the corresponding network device 300.

[0061] The traffic collection module 310 sends the traffic collection request to the SDN controller 200 according to the pre-set collection policy. The traffic collection request contains some parameters for assigning contents to be collected, such as service flows from regular users, regular IP flows and traffics from regular ports. After the SDN controller 200 receives the traffic collection request, parsing and processing are performed to determine one or more network devices 300 which need the traffic collection request. The traffic collection request is converted into an instruction capable of being transmitted via a southbound interface of the SDN controller 200, and the converted traffic collection request is further sent to the one or more network devices via the southbound interface of the SDN controller 200. The SDN controller 200 adopts a uniform control mode, and all of the network devices 300 can be globally managed and controlled.

[0062] The receiving module 311 receives traffic data collected from each of the network devices 300. Each of the network devices 300 performs traffic collection according to the traffic collection request transmitted by the SDN controller 200, and sends the collected traffic data to the device for DPI control 301. The traffic data collected from each of the network devices 300 are directly received via the receiving module 311 without the need of the SDN controller 200.

[0063] The generation module 312 analyzes and processes the received traffic data to generate the network control policies. If the received traffic data of a network device A are analyzed and processed to determine that the traffic from a regular port of the network device A is too much, a network control policy for restricting traffic is generated for the network device A.

[0064] The control policy sending module 313 sends each of the generated network control policies to the SDN controller 200. After the SDN controller 200 receives the network control policies, parsing and processing are performed to determine one or more network devices 300 which need the network control policies. Each of the network control policies is converted into an instruction capable of being transmitted via the southbound interface of the SDN controller 200, and the converted network control policy is further sent to the corresponding network device 300 via the southbound interface of the SDN controller 200.

[0065] Furthermore, the receiving module 311 is further configured to receive each of feedback messages reported by the SDN controller 200, each of the feedback messages being used for indicating that the corresponding network device has successfully executed the corresponding network control policy.

[0066] After each of the network devices receives the corresponding network control policy transmitted by the SDN controller 200, a relevant network control policy is deployed on this network device, and each of the feedback messages indicating that the network control policy is successfully executed is sent to the SDN controller 200 after the deployment is completed. The SDN controller 200 collects the feedback messages which are fed back by all of the network devices and indicate that the network control policies are successfully executed, performs uniform processing, and then sends the uniformly-processed feedback messages indicating that the network control policies are successfully executed to the receiving module 311 of the device for DPI control 301.

[0067] Furthermore, the receiving module 311 is further configured to receive the feedback messages which are reported by the SDN controller 200 and indicate that the collection policies of the one or more network devices are successfully executed.

[0068] After each of the one or more network devices receives the traffic collection request transmitted by the SDN controller 200, a relevant traffic collection policy is deployed on this network device, and each of feedback messages indicating that the collection policy is successfully executed is sent to the SDN controller 200 after the deployment is completed. The SDN controller 200 collects the feedback messages which are sent by all of the network devices and indicate that the collection policies are successfully executed, performs uniform processing, and then sends the uniformly-processed feedback messages indicating that the collection policies are successfully executed to the receiving module 311 of the device for DPI control 301.

[0069] In this embodiment, the SDN controller is taken as an example to describe. In the other embodiments of the present disclosure, any one of applicable network controllers is also used. Fig. 4 is a structure block diagram showing a device for DPI control according to a second embodiment of the present disclosure. As shown in Fig. 4, the device 401 includes a traffic collection module 420, a receiving module 421, a generation module 422 and a control policy sending module 423.

[0070] The traffic collection module 420 is configured to send a traffic collection request to an SDN controller 200 via a network capacity control device 400 according to a pre-set collection policy, the traffic collection request being used for allowing the SDN controller 200 to send a request for traffic collection to one or more corresponding network devices.

[0071] The receiving module 421 is configured to receive traffic data collected by the one or more network devices 300.

[0072] The generation module 422 is configured to analyze and process the received traffic data of each of the one or more network devices 300 to generate a network control policy corresponding to each of the network devices.

[0073] The control policy sending module 423 is configured to send all of the generated network control policies to the SDN controller 200 via the network capacity control device 400 to allow the SDN controller to send each of the received network control policies to the corresponding network device.

[0074] The traffic collection module 420 sends the traffic collection request to the network capacity control device 400 according to the pre-set collection policy. The traffic collection request focuses on describing application layer requirements, and the level of abstraction is relatively high. The traffic collection request contains some parameters for assigning contents to be collected, such as specific service flows from specific users, specific IP flows and traffics from specific ports. After the network capacity control device 400 receives the traffic collection request, parsing and processing are performed to form a traffic collection request which can be recognized by the SDN controller 200, and the parsed and processed traffic collection request is transmitted to the SDN controller 200 via a northbound interface of the SDN controller 200.

[0075] After the SDN controller 200 receives the traffic collection request transmitted by the network capacity control device 400, parsing and processing are performed to determine one or more network devices which need the traffic collection request, the traffic collection request is converted into an instruction capable of being transmitted via the southbound interface of the SDN controller 200, and the converted traffic collection request is further sent to the one or more network devices via the southbound interface of the SDN controller 200. The SDN controller adopts a uniform control mode, and all of the network devices can be globally managed and controlled.

[0076] The receiving module 421 receives the traffic data collected by each of the network devices 300. Each of the network devices 300 performs traffic collection according to the traffic collection request transmitted by the SDN controller 200, and sends the collected traffic data to the receiving module 421 of the device for DPI control 401. The traffic data collected from each of the network devices 300 are directly received via the receiving module 421 without the need of the SDN controller 200 and the network capacity control device 400.

[0077] The generation module 422 analyzes and processes the received traffic data to generate the network control policies. The network control policies focus on describing application layer requirements such as diamond-level service guarantee and end-to-end service guarantee, and the level of abstraction is relatively high. For example, P2P traffic data from a specific region, received from a network device A, are analysed. If it is determined that the P2P traffic data from the current specific region of the network device A are over-sized, a network control policy for restricting traffic is generated.

[0078] The control policy sending module 423 sends each of the generated network control policies to the network capacity control device 400. After the network capacity control device 400 receives the network control policies, parsing and processing are performed, the received network control policies are converted into network control policies which can be recognized by the SDN controller 200, and the converted network control policies are transmitted to the SDN controller 200 via a northbound interface of the SDN controller 200.

[0079] After the SDN controller 200 receives the network control policies transmitted by the network capacity control device 400, parsing and processing are performed to determine one or more network devices which need the network control policies, each of the network control policies is converted into an instruction capable of being transmitted via the southbound interface of the SDN controller 200, and each of the converted network control policies is further sent to the corresponding network device 300 via the southbound interface of the SDN controller 200.

[0080] Furthermore, the receiving module 421 is further configured to receive each of feedback messages reported by the SDN controller 200 via the network capacity control device 400, each of the feedback messages being used for indicating that the corresponding network device 300 has successfully executed the corresponding network control policy.

[0081] After each of the network devices 300 receives the corresponding network control policy transmitted by the SDN controller 200, a relevant network control policy is deployed on the network device 300, and a feedback message indicating that the network control policy is successfully executed is sent to the SDN controller 200 after the deployment is completed. The SDN controller 200 collects the feedback messages which are fed back by all of the network devices 300 and indicate that the network control policies are successfully executed, performs uniform processing, and then sends the uniformly-processed feedback messages indicating that the network control policies are successfully executed to the network capacity control device 400. The network capacity control device 400 sends the feedback messages to the receiving module 421 of the device for DPI control 401.

[0082] Furthermore, the receiving module 421 is further configured to receive the feedback messages which are reported by the SDN controller 200 via the network capacity control device 400 and indicate that the collection policies of the one or more network devices 300 are successfully executed.

[0083] After each of the one or more network devices 300 receives the traffic collection request transmitted by the SDN controller 200, a relevant traffic collection policy is deployed on this network device 300, and each of feedback messages indicating that the collection policy is successfully executed is sent to the SDN controller 200 after the deployment is completed. The SDN controller 200 collects the feedback messages which are sent by all of the network devices 300 and indicate that the collection policies are successfully executed, performs uniform processing, and then sends the uniformly-processed feedback messages indicating that the collection policies are successfully executed to the network capacity control device 400. The network capacity control device 400 sends the feedback messages to the receiving module 421 of the device for DPI control 401.

[0084] The traffic collection module, the receiving module, the generation module and the control policy sending module in the device for DPI control provided by the embodiments of the present disclosure can be realized by a processor in a network device, and can also be realized by a specific logic circuit, wherein the network device can be an independent server, and can also be a server used for realizing a network controller. In an embodiment, the processor can be a Central Processing Unit (CPU), a Micro-Processor Unit (MPU), a Digital Signal Processor (DSP), a Field Programmable Gate Array (FPGA) or the like.

[0085] In the embodiments of the present disclosure, if the method for DPI control is realized in a form of software function modules and is sold or used as an independent product, the product can also be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present disclosure can be substantially embodied in a form of a software product or parts contributing to the conventional art can be embodied in a form of a software product, and a computer software product is stored in a storage medium, which includes a plurality of instructions enabling a computer device which can be a personal computer, a server or a network device to execute all or part of the method according to each embodiment of the present disclosure. The storage medium includes various media capable of storing program codes, such as a USB disk, a mobile hard disk, a Read Only Memory (ROM), a disk or an optical disc. Thus, the embodiments of the present disclosure are not limited to a combination of any specific hardware and software.

[0086] Accordingly, an embodiment of the present disclosure further provides a readable storage medium. Executable instructions are stored in the readable storage medium and are used for executing the method for DPI control provided by each embodiment of the present disclosure.

INDUSTRIAL APPLICABILITY



[0087] In the embodiments of the present disclosure, the traffic collection request is sent to the network controller according to the pre-set collection policy, wherein the traffic collection request is used for allowing the network controller to send the request for traffic collection to the one or more corresponding network devices; the traffic data collected by the one or more network devices are received; and the received traffic data from the one or more network devices are analyzed and processed to generate a network control policy corresponding to each of the network devices, and the network control policies are sent to the network controller to allow the network controller to send each of the network control policies to the corresponding network device. Thus, the network controller interacts with each of the network devices, and therefore data collection and transmission of the control policy for one end-to-multiple ends are implemented.


Claims

1. A method for Deep Packet Inspection, DPI, control, comprising:

sending (S10, S20), by a device for DPI control, a traffic collection request to a network controller via a northbound interface of the network controller according to a pre-set collection policy, wherein the traffic collection request is configured to allow the network controller to parse and process to determine one or more network devices which need the traffic collection request and to send a request for traffic collection to the determined one or more network devices which need the traffic collection request, and wherein the traffic collection request is configured to specify traffic data to be collected via parameters that assign specific service flows from specific users and specific IP flows and traffics from specific ports that are to be collected;

directly receiving (S11, S21), by the device for DPI control, the traffic data collected by the determined one or more network devices which need the traffic collection request without using the network controller;

analyzing and processing (S12, S22), by the device for DPI control, the received traffic data from the determined one or more network devices which need the traffic collection request to generate each of network control policies corresponding to each of the determined one or more network devices which need the traffic collection request, wherein the network control policies describe application layer requirements;

sending (S23), by the device for DPI control, the network control policies to a network capacity control device;

analyzing and processing (S23), by the network capacity control device, the received network control policies, and converting the received network control policies into first network control policies that are recognizable by the network controller;

sending (S23), by the network capacity control device, the first network control policies to the network controller via the northbound interface of the network controller;

analyzing and processing (S13, S23), by the network controller, the received first network control policies to determine one or more network devices which need the network control policies, and converting, by the network controller, the received first network control policies into second network control policies;

sending (S13, S23), by the network controller, each of the second network control policies via the southbound interface of the network controller to a corresponding network device which is comprised in the determined one or more network devices which need the network control policies so as to implement the DPI control; and

receiving (S14, S24), by the device for DPI control, feedback messages reported by the network controller, wherein the feedback messages are configured to indicate that the network devices have successfully executed the network control policies.


 
2. The method according to claim 1, wherein the step of sending (S10, S20), by the device for DPI control, the traffic collection request to the network controller via the northbound interface of the network controller according to the pre-set collection policy comprises:
sending (S20) the traffic collection request to the network controller via a network capacity control device according to the pre-set collection policy.
 
3. The method according to claim 2, wherein the step of sending (S13, S23) the network control policies to the network controller comprises:
sending (S23), by the device for DPI control, the network control policies to the network controller via the network capacity control device to allow the network controller to send each of the received network control policies to the corresponding network device.
 
4. A system comprising a device (301, 401) for Deep Packet Inspection, DPI, control, a network capacity control device (400) and a network controller (200), the device (301, 401) for DPI control comprising a traffic collection module (310, 420), a receiving module (311, 421), a generation module (312, 422) and a control policy sending module (313, 423), wherein
the traffic collection module (310, 420) is configured to send a traffic collection request to the network controller (200) via a northbound interface of the network controller (200) according to a pre-set collection policy, the traffic collection request being configured to allow the network controller (200) to parse and process to determine one or more network devices which need the traffic collection request and to send a request for traffic collection to the determined one or more network devices which need the traffic collection request (300), and wherein the traffic collection request is configured to specify traffic data to be collected via parameters that assign specific service flows from specific users and specific IP flows and traffics from specific ports that are to be collected;
the receiving module (311, 421) is configured to directly receive the traffic data collected by the determined one or more network devices which need the traffic collection request (300) without using the network controller (200);
the generation module (312, 422) is configured to analyze and process the received traffic data from the determined one or more network devices which need the traffic collection request (300) to generate each of network control policies corresponding to each of the determined one or more network devices which need the traffic collection request (300), wherein the network control policies describe application layer requirements; and
the control policy sending module (313, 423) is configured to send the network control policies to the network capacity control device (400);
the network capacity control device (400) is configured to: analyze and process the received network control policies and convert the received network control policies into first network control policies that are recognizable by the network controller (200); send the first network control policies to the network controller (200) via the northbound interface of the network controller (200);
the network controller (200) is configured to: analyze and process the received first network control policies, convert the received first network control policies into second network control policies, and send the second network control policies via the southbound interface of the network controller (200) to a corresponding network device which is comprised in the determined one or more network devices which need the network control policies (300) so as to implement the DPI control,
wherein the receiving module (311, 421) is further configured to receive feedback messages reported by the network controller (200), the feedback messages being configured to indicate that the network devices (300) have successfully executed the network control policies.
 
5. The system according to claim 4, wherein the traffic collection module (420) is further configured to send the traffic collection request to the network controller (200) via the network capacity control device (400) according to the pre-set collection policy.
 
6. The system according to claim 5, wherein the control policy sending module (423) is further configured to send the network control policies to the network controller (200) via the network capacity control device (400) to allow the network controller (200) to send each of the received network control policies to the corresponding network device (300).
 
7. A readable storage medium storing executable instructions which, when executed on a processor, cause the processor to execute all the steps of the method for the DPI control according to any one of claims 1 to 3.
 


Ansprüche

1. Verfahren zur DPI- (Deep Packet Inspection) Steuerung umfassend:

Senden (S10, S20) einer Verkehrserfassungsanfrage, durch ein DPI-Steuerungsgerät, an eine Netzwerksteuerung über eine nordgebundene Schnittstelle der Netzwerksteuerung gemäß einer voreingestellten Erfassungsrichtlinie, wobei die Verkehrserfassungsanfrage so konfiguriert ist, dass die Netzwerksteuerung ein oder mehrere Netzwerkgeräte, die die Verkehrserfassungsanfrage benötigen, analysieren und verarbeiten und eine Verkehrserfassungsanfrage an ein oder mehrere bestimmte Netzwerkgeräte senden kann, die die Verkehrserfassungsanfrage benötigen, und wobei die Verkehrserfassungsanfrage konfiguriert ist, um Verkehrsdaten zu spezifizieren die, über Parameter die spezielle Serviceströme von speziellen Benutzern und spezielle IP-Ströme und -Verkehr von speziellen Anschlüssen zuweisen, erfasst werden sollen;

direktes Empfangen (S11, S21) der, von einem oder mehreren bestimmten Netzwerkgeräten, die die Verkehrserfassungsanfrage benötigen, gesammelten Verkehrsdaten, durch das DPI-Steuerungsgerät, ohne die Netzwerksteuerung zu verwenden;

Analysieren und Verarbeiten (S12, S22), durch das DPI-Steuerungsgerät, der, von einem oder mehreren bestimmten Netzwerkgeräten, die die Verkehrserfassungsanfrage benötigen, empfangenen Verkehrsdaten, um jede der Netzwerksteuerungsrichtlinien zu erzeugen, die jedem der bestimmten einen oder mehreren Netzwerkgeräte entsprechen, die die Verkehrserfassungsanfrage benötigen, wobei die Netzwerksteuerungsrichtlinien Anwendungsschichtanforderungen beschreiben;

Senden (S23) der Netzwerksteuerungsrichtlinien an ein Netzwerkkapazitätssteuerungsgerät durch das DPI-Steuerungsgerät;

Analysieren und Verarbeiten (S23) der empfangenen Netzwerksteuerungsrichtlinien, durch das Netzwerkkapazitätssteuerungsgerät, und Umwandeln der empfangenen Netzwerksteuerungsrichtlinien in erste Netzwerksteuerungsrichtlinien, die von der Netzwerksteuerung erkannt werden können;

Senden (S23) der ersten Netzwerksteuerungsrichtlinien, durch das Netzwerkkapazitätssteuerungsgerät, an die Netzwerksteuerung über die nordgebundene Schnittstelle der Netzwerksteuerung;

Analysieren und Verarbeiten (S13, S23) der empfangenen ersten Netzwerksteuerungsrichtlinien, durch die Netzwerksteuerung, um ein oder mehrere Netzwerkgeräte zu bestimmen, die die Netzwerksteuerungsrichtlinien benötigen, und Umwandeln der empfangenen ersten Netzwerksteuerungsrichtlinien in zweite Netzwerksteuerungsrichtlinien durch die Netzwerksteuerung;

Senden (S13, S23) jeder der zweiten Netzwerksteuerungsrichtlinien, durch die Netzwerksteuerung, über die südgebundene Schnittstelle der Netzwerksteuerung an ein entsprechendes Netzwerkgerät, das in dem oder den ermittelten Netzwerkgeräten enthalten ist, die die Netzwerksteuerungsrichtlinien benötigen, um die DPI-Steuerung zu implementieren; und

Empfangen (S14, S24), durch das DPI-Steuerungsgerät, von Rückmeldungsnachrichten, die von der Netzwerksteuerung berichtet werden, wobei die Rückmeldungsnachrichten konfiguriert sind, um anzuzeigen, dass die Netzwerkgeräte die Netzwerksteuerungsrichtlinien erfolgreich ausgeführt haben.


 
2. Verfahren nach Anspruch 1, wobei der Schritt des Sendens (S10, S20) der Verkehrserfassungsanfrage an die Netzwerksteuerung, durch das DPI-Steuerungsgerät, über die nordgebundene Schnittstelle der Netzwerksteuerung gemäß der voreingestellten Erfassungsrichtlinie umfasst:
Senden (S20) der Verkehrserfassungsanfrage an die Netzwerksteuerung über ein Netzwerkkapazitätssteuerungsgerät gemäß der voreingestellten Erfassungsrichtlinie.
 
3. Verfahren nach Anspruch 2, wobei der Schritt des Sendens (S13, S23) der Netzwerksteuerungsrichtlinien an die Netzwerksteuerung umfasst:
Senden (S23), durch das DPI-Steuerungsgerät, der Netzwerksteuerungsrichtlinien über das Netzwerkkapazitätssteuerungsgerät an die Netzwerksteuerung, um es der Netzwerksteuerung zu ermöglichen, jede der empfangenen Netzwerksteuerungsrichtlinien an das entsprechende Netzwerkgerät zu senden.
 
4. System mit einem DPI- (Deep Packet Inspection) Steuerungsgerät (301, 401), einem Netzwerkkapazitätssteuergerät (400) und einer Netzwerksteuerung (200), wobei das DPI-Steuerungsgerät (301, 401) ein Verkehrserfassungsmodul (310, 420), ein Empfangsmodul (311, 421), ein Erzeugungsmodul (312, 422) und ein Steuerrichtlinien-Sendemodul (313, 423) umfasst, wobei

das Verkehrserfassungsmodul (310, 420) konfiguriert ist, um eine Verkehrserfassungsanfrage über eine nordgebundene Schnittstelle der Netzwerksteuerung (200) an die Netzwerksteuerung (200) gemäß einer voreingestellten Erfassungsrichtlinie zu senden, wobei die Verkehrserfassungsanfrage konfiguriert ist, um es der Netzwerksteuerung (200) zu ermöglichen, ein oder mehrere Netzwerkgeräte, die die Verkehrserfassungsanfrage benötigen, zu analysieren und zu verarbeiten, um ein oder mehrere Netzwerkgeräte zu bestimmen, die die Verkehrserfassungsanfrage benötigen, und eine Verkehrserfassungsanfrage an die bestimmten ein oder mehreren Netzwerkgeräte (300) zu senden, die die Verkehrserfassungsanfrage benötigen, und wobei die Verkehrserfassungsanfrage konfiguriert ist, um Verkehrsdaten zu spezifizieren, die, über Parameter, die spezielle Serviceströme von speziellen Benutzern und spezielle IP-Ströme und -Verkehr von speziellen Anschlüssen zuordnen, gesammelt werden sollen;

das Empfangsmodul (311, 421) konfiguriert ist, um die von den ermittelten einen oder mehreren Netzwerkgeräten (300), die die Verkehrserfassungsanfrage benötigen, gesammelten Verkehrsdaten direkt zu empfangen, ohne die Netzwerksteuerung (200) zu benutzen;

das Erzeugungsmodul (312, 422) konfiguriert ist, um die empfangenen Verkehrsdaten von den ermittelten einen oder mehreren Netzwerkgeräten (300), die die Verkehrserfassungsanfrage benötigen, zu analysieren und zu verarbeiten, um jede der Netzwerksteuerungsrichtlinien zu erzeugen, die jeder der ermittelten einen oder mehreren Netzwerkgeräte(300) entsprechen, die die Verkehrserfassungsanfrage benötigen, wobei die Netzwerksteuerungsrichtlinien Anwendungsschichtanforderungen beschreiben; und

das Steuerungsrichtlinien-Sendemodul (313, 423) konfiguriert ist, um die Netzwerksteuerungsrichtlinien an das Netzwerkkapazitätssteuerungsgerät (400) zu senden;

das Netzwerkkapazitätssteuerungsgerät (400) konfiguriert ist: um die empfangenen Netzwerksteuerungsrichtlinien zu analysieren und zu verarbeiten und die empfangenen Netzwerksteuerungsrichtlinien in erste Netzwerksteuerungsrichtlinien umzuwandeln, die für die Netzwerksteuerung (200) erkennbar sind; die ersten Netzwerksteuerungsrichtlinien über die nordgebundene Schnittstelle der Netzwerksteuerung (200) an die Netzwerksteuerung (200) zu senden;

die Netzwerksteuerung (200) konfiguriert ist: um die empfangenen ersten Netzwerksteuerungsrichtlinien zu analysieren und zu verarbeiten, die empfangenen ersten Netzwerksteuerungsrichtlinien in zweite Netzwerksteuerungsrichtlinien umzuwandeln, und die zweiten Netzwerksteuerungsrichtlinien über die südgehende Schnittstelle der Netzwerksteuerung (200) an ein entsprechendes Netzwerkgerät zu senden, das in einem oder mehreren der ermittelten Netzwerkgeräte (300) enthalten ist, die die Netzwerksteuerungsrichtlinien benötigen, um die DPI-Steuerung zu implementieren,

wobei das Empfangsmodul (311, 421) ferner konfiguriert ist, um Rückmeldungsnachrichten zu empfangen, die von der Netzwerksteuerung (200) berichtet werden, wobei die Rückmeldungsnachrichten konfiguriert sind, um anzuzeigen, dass die Netzwerkgeräte (300) die Netzwerksteuerungsrichtlinien erfolgreich ausgeführt haben.


 
5. System nach Anspruch 4, wobei das Verkehrserfassungsmodul (420) ferner konfiguriert ist, um die Verkehrserfassungsanfrage über das Netzwerkkapazitätssteuerungsgerät (400) an die Netzwerksteuerung (200) gemäß der voreingestellten Erfassungsrichtlinie zu senden.
 
6. System nach Anspruch 5, wobei das Steuerungsrichtlinien-Sendemodul (423) ferner konfiguriert ist, um die Netzwerksteuerungsrichtlinien über das Netzwerkkapazitätssteuerungsgerät (400) an die Netzwerksteuerung (200) zu senden, um der Netzwerksteuerung (200) zu ermöglichen, jede der empfangenen Netzwerksteuerungsrichtlinien an das entsprechende Netzwerkgerät (300) zu senden.
 
7. Lesbares Speichermedium, das ausführbare Befehle speichert, die, wenn sie auf einem Prozessor ausgeführt werden, den Prozessor veranlassen, alle Schritte des Verfahrens zur DPI-Steuerung gemäß einem der Ansprüche 1 bis 3 auszuführen.
 


Revendications

1. Procédé de contrôle DPI (Deep Packet Inspection), comprenant :

la transmission (S10, S20), par un dispositif de contrôle DPI, d'une demande de collecte de trafic à un contrôleur de réseau via une interface nord du contrôleur de réseau selon une politique de collecte prédéfinie, dans laquelle la demande de collecte de trafic est configurée pour permettre au contrôleur de réseau d'analyser et de procéder à la détermination d'un ou plusieurs dispositifs de réseau qui ont besoin de la demande de collecte de trafic et d'envoyer une demande de collecte de trafic à un ou plusieurs dispositifs de réseau déterminés, qui ont besoin de la demande de collecte de trafic, et dans laquelle la demande de collecte de trafic est configurée pour spécifier les données de trafic à collecter via des paramètres qui attribuent des flux de services spécifiques provenant d'utilisateurs spécifiques et des flux et trafics IP spécifiques provenant de ports spécifiques qui doivent être collectés ;

la réception directe (S11, S21), par le dispositif de contrôle DPI, des données de trafic collectées par un ou plusieurs dispositifs de réseau déterminés, qui ont besoin de la demande de collecte de trafic sans utiliser le contrôleur de réseau ;

l'analyse et le traitement (S12, S22), par le dispositif de contrôle DPI, des données de trafic reçues d'un ou des dispositifs de réseau déterminés, qui ont besoin de la demande de collecte de trafic pour générer chacune des politiques de contrôle de réseau correspondant à chacun d'un ou des dispositifs de réseau déterminés, qui ont besoin de la demande de collecte de trafic, dans lequel les politiques de contrôle de réseau décrivent les exigences d'une couche application ;

la transmission (S23), par le dispositif de contrôle DPI, des politiques de contrôle du réseau à un dispositif de contrôle de la capacité du réseau ;

l'analyse et le traitement (S23), par le dispositif de contrôle de la capacité du réseau, des politiques de contrôle du réseau reçues, et la conversion des politiques de contrôle du réseau reçues en premières politiques de contrôle du réseau qui sont reconnaissables par le contrôleur du réseau ;

la transmission (S23), par le dispositif de contrôle de la capacité du réseau, des premières politiques de contrôle du réseau au contrôleur du réseau via l'interface nord du contrôleur du réseau ;

l'analyse et le traitement (S13, S23), par le contrôleur de réseau, des premières politiques de contrôle de réseau reçues pour déterminer un ou plusieurs dispositifs de réseau, qui ont besoin des politiques de contrôle de réseau et la conversion, par le contrôleur de réseau, des premières politiques de contrôle de réseau reçues en secondes politiques de contrôle de réseau ;

la transmission (S13, S23), par le contrôleur de réseau, de chacune des secondes politiques de contrôle de réseau via l'interface sud du contrôleur de réseau à un dispositif de réseau correspondant qui est compris dans un ou plusieurs dispositifs de réseau déterminés qui ont besoin des politiques de contrôle de réseau afin de réaliser le contrôle DPI ; et

la réception (S14, S24), par le dispositif de contrôle DPI, des messages de retour d'information communiqués par le contrôleur du réseau, dans laquelle les messages de retour d'information sont configurés pour indiquer que les dispositifs du réseau ont exécuté avec succès les politiques de contrôle du réseau.


 
2. Procédé selon la revendication 1, dans lequel l'étape de transmission (S10, S20), par le dispositif de contrôle DPI, de la demande de collecte de trafic au contrôleur de réseau via l'interface nord du contrôleur de réseau selon la politique de collecte prédéfinie comprend :
la transmission (S20) de la demande de collecte du trafic au contrôleur du réseau via un dispositif de contrôle de la capacité du réseau selon la politique de collecte prédéfinie.
 
3. Procédé selon la revendication 2, dans lequel l'étape consistant à envoyer (S13, S23) les politiques de contrôle du réseau au contrôleur du réseau comprend :
la transmission (S23), par le dispositif de contrôle DPI, des politiques de contrôle du réseau au contrôleur du réseau via le dispositif de contrôle de la capacité du réseau afin de permettre au contrôleur du réseau d'envoyer chacune des politiques de contrôle du réseau reçues au dispositif du réseau correspondant.
 
4. Système comprenant un dispositif (301, 401) pour le contrôle DPI (Deep Packet Inspection), un dispositif de contrôle de la capacité du réseau (400) et un contrôleur de réseau (200), le dispositif (301, 401) pour le contrôle DPI comprenant un module de collecte de trafic (310, 420), un module de réception (311, 421), un module de génération (312, 422) et un module de transmission de politique de contrôle (313, 423), dans lequel

le module de collecte de trafic (310, 420) est configuré pour envoyer une demande de collecte de trafic au contrôleur de réseau (200) via une interface nord du contrôleur de réseau (200) selon une politique de collecte prédéfinie, la demande de collecte de trafic étant configurée pour permettre au contrôleur de réseau (200) d'analyser et de procéder à la détermination d'un ou plusieurs dispositifs de réseau, qui ont besoin de la demande de collecte de trafic et d'envoyer une demande de collecte de trafic à un ou plusieurs dispositifs de réseau déterminés, qui ont besoin de la demande de collecte de trafic (300), et dans lequel la demande de collecte de trafic est configurée pour spécifier les données de trafic à collecter via des paramètres qui attribuent des flux de services spécifiques provenant d'utilisateurs spécifiques et des flux et trafics IP spécifiques provenant de ports spécifiques qui doivent être collectés ;

le module de réception (311, 421) est configuré pour recevoir directement les données de trafic collectées par un ou plusieurs dispositifs de réseau déterminés, qui ont besoin de la demande de collecte de trafic (300) sans utiliser le contrôleur de réseau (200) ;

le module de génération (312, 422) est configuré pour analyser et procéder les données de trafic reçues du ou des dispositifs de réseau déterminés, qui ont besoin de la demande de collecte de trafic (300) pour générer chacune des politiques de contrôle de réseau correspondant à chacun d'un ou des dispositifs de réseau déterminés, qui ont besoin de la demande de collecte de trafic (300), dans lequel les politiques de contrôle de réseau décrivent les exigences de une couche application ; et

le module de transmission des politiques de contrôle (313, 423) est configuré pour envoyer les politiques de contrôle du réseau au dispositif de contrôle de la capacité du réseau (400) ;

le dispositif de contrôle de la capacité du réseau (400) est configuré pour : analyser et procéder les politiques de contrôle du réseau reçues et convertir les politiques de contrôle du réseau reçues en premières politiques de contrôle du réseau qui sont reconnaissables par le contrôleur du réseau (200) ; envoyer les premières politiques de contrôle du réseau au contrôleur du réseau (200) via l'interface nord du contrôleur du réseau (200) ;

le contrôleur de réseau (200) est configuré pour : analyser et procéder les premières politiques de contrôle de réseau reçues, convertir les premières politiques de contrôle de réseau reçues en secondes politiques de contrôle de réseau, et envoyer les secondes politiques de contrôle de réseau via l'interface sud du contrôleur de réseau (200) à un dispositif de réseau correspondant, qui est compris dans un ou plusieurs dispositifs de réseau déterminés, qui ont besoin des politiques de contrôle de réseau (300) afin de réaliser le contrôle DPI,

dans lequel le module de réception (311, 421) est en outre configuré pour recevoir des messages de retour d'information communiqués par le contrôleur de réseau (200), les messages de retour d'information étant configurés pour indiquer que les dispositifs de réseau (300) ont exécuté avec succès les politiques de contrôle du réseau.


 
5. Système selon la revendication 4, dans lequel le module de collecte du trafic (420) est en outre configuré pour envoyer la demande de collecte du trafic au contrôleur du réseau (200) via le dispositif de contrôle de la capacité du réseau (400) selon la politique de collecte prédéfinie.
 
6. Système selon la revendication 5, dans lequel le module de transmission des politiques de contrôle (423) est en outre configuré pour envoyer les politiques de contrôle du réseau au contrôleur du réseau (200) via le dispositif de contrôle de la capacité du réseau (400) pour permettre au contrôleur du réseau (200) d'envoyer chacune des politiques de contrôle du réseau reçues au dispositif du réseau correspondant (300).
 
7. Médium de stockage lisible stockant des instructions exécutables qui, lorsqu'elles sont exécutées sur un processeur, amènent ce dernier à exécuter toutes les étapes du procédé de contrôle DPI selon l'une quelconque des revendications 1 à 3.
 




Drawing