WO2013082793A1

WO2013082793A1 - Method, device and system for controlling service transmission

Info

Publication number: WO2013082793A1
Application number: PCT/CN2011/083722
Authority: WO
Inventors: 胡翔
Original assignee: 华为技术有限公司
Priority date: 2011-12-08
Filing date: 2011-12-08
Publication date: 2013-06-13
Also published as: CN102630376A; CN102630376B

Abstract

Provided in the embodiments of the present invention are a method, device and system for controlling service transmission. The method comprises: receiving the data message sent by a sending end; sending a classification request message to a server, wherein the classification request message comprises L34 layer information of the service extracted from the data message; receiving a classification response message sent by the server, wherein the classification response message comprises service control information determined by the server on the basis of the L34 layer information; controlling the service transmission according to the control information. Through the server configured external to the gateway device, the control information of the service is determined. According to the control information, the gateway device controls the service transmission. Therefore the control of all service comprising non-browser and encrypted service is able to be implemented, the influence on the gateway device performance caused by the configuration of L34 filter is reduced, the persistent data updating of the black-list and the white-list is maintained, and the workload of network maintenance is reduced.

Description

Method, device and system for controlling transmission of a service

The present invention relates to the field of communications, and more particularly to a method, apparatus and system for controlling the transmission of services. Background technique

While online services such as mobile user devices and client applications are developing rapidly, websites and applications that violate national laws such as politics, pornography, violence, and gambling have also grown, so the need to clean up the network environment has also been raised. .

Gateway Universal Wireless Packet Service Support Node (GGSN, Gateway GPRS Support

Gateway device such as Node / Packet Data Serving Network (PDSN), as the last core network device before the mobile broadband network accesses the Internet, can be based on shallow SPI (Shallow Packet Inspection) / deep text The DPI (Deep Packet Inspection) technology detects the data of the service and obtains the L34 layer information of the service. Therefore, the L34 filter can be configured on the gateway device to match the L34 layer information of the service with the service blacklist and whitelist rule to determine the processing policy for the service, control the transmission of the service, and implement the black and white list function of the service.

However, configuring the L34 filter has high performance requirements for the gateway device, and turning on the filtering function has a great impact on the performance of the gateway device. In addition, due to the limitation of the system resources of the gateway device, the specifications of the filters that the gateway device can support are very small, and the black and white list is manually maintained. Therefore, for the website change and its frequent scenes on the live network, Network maintenance personnel have a large workload, and it is difficult to maintain continuous updates of black and white list data.

Therefore, a suitable solution is needed to control the transmission of the service, to reduce the impact on the performance of the gateway device due to the configuration of the L34 filter, to maintain the continuous update of the black and white list data, and to reduce the workload of network maintenance. Summary of the invention

Embodiments of the present invention provide a method and apparatus for controlling transmission of a service, which can reduce the impact on the performance of the gateway device and maintain continuous updating of the black and white list data.

In one aspect, a method for controlling transmission of a service is provided, the method comprising: receiving a data message sent by a sender; sending a classification request message to the server, where the classification request message includes the number Receiving the L34 layer information of the service extracted in the message; receiving the classification request response message sent by the server, the classification request response message includes control information of the service determined by the server according to the L34 layer information; according to the control information, The transmission of the business is controlled.

In another aspect, a method for controlling transmission of a service is provided, the method comprising: receiving, by a gateway device, a classification request message, where the classification request message includes L34 layer information of a service extracted by the gateway device from the data packet; L34 layer information, determining control information of the service; sending a classification request response message to the gateway device, the classification request response message including the control information, so that the gateway device controls the transmission of the service according to the control information.

In a further aspect, a device for controlling transmission of a service is provided, the device comprising: a first receiving unit, configured to receive a data packet sent by a sending end, and a sending unit, configured to send a classification request message to the server, the classification request The message includes the L34 layer information of the service extracted from the data packet; the second receiving unit is configured to receive the classification request response message sent by the server, where the classification request response message includes the service determined by the server according to the L34 layer information. Control information; a control unit, configured to control transmission of the service according to the control information.

In a further aspect, an apparatus for controlling transmission of a service is provided, the apparatus comprising: a receiving unit, configured to receive, by a gateway device, a classification request message, where the classification request message includes a service L34 of the service extracted by the gateway device from the data packet a layer information, a determining unit, configured to determine, according to the L34 layer information, control information of the service, and a sending unit, configured to send, to the gateway device, a classification request response message, where the classification request response message includes the control information determined by the determining unit So that the gateway device controls the transmission of the service according to the control information.

In still another aspect, a system for controlling transmission of a service is provided, comprising: a gateway device and a server. The gateway device includes: a first receiving unit, configured to receive a data packet sent by the sending end, and a sending unit, configured to send, to the server, a classification request message, where the classification request message includes a L34 layer of the service extracted from the data packet a second receiving unit, configured to receive a classification request response message sent by the server, where the classification request response message includes control information of the service determined by the server according to the L34 layer information, and a control unit, configured to: according to the control information, Control the transmission of this service. The server includes: a receiving unit, configured to receive, by the gateway device, a classification request message, where the classification request message includes L34 layer information of the service extracted by the gateway device from the data packet, and the determining unit is configured to determine, according to the L34 layer information, And a sending unit, configured to send a classification request response message to the gateway device, where the classification request response message includes the control information determined by the determining unit, so that the gateway device uses the control information according to the control information. Transfer into Line control.

Therefore, the method and apparatus for controlling the transmission of the service according to the embodiment of the present invention determine the control information of the service by the server disposed outside the gateway device, and the gateway device controls the transmission of the service according to the control information, thereby enabling All services, including non-browsing and encrypted service types, are controlled to reduce the impact on the performance of the gateway device due to the configuration of the L34 filter, and to maintain the continuous update of the black and white list data, reducing the workload of network maintenance. DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only the present invention. For some embodiments, other drawings may be obtained from those of ordinary skill in the art without departing from the drawings.

FIG. 1 is a schematic flowchart of a method of controlling transmission of a service according to an embodiment of the present invention. 2 is a schematic flow chart of a method of controlling transmission of a service according to another embodiment of the present invention.

3 is an interaction diagram of a method of controlling transmission of a service in accordance with an embodiment of the present invention.

4 is a schematic block diagram of an apparatus for controlling transmission of a service according to an embodiment of the present invention.

FIG. 5 is a schematic block diagram of an apparatus for controlling transmission of a service according to another embodiment of the present invention. 6 is a schematic block diagram of a system for controlling transmission of traffic according to an embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without making creative labor are within the scope of the present invention.

The technical solution of the present invention can be applied to various communication systems, for example, a Global System of Mobile Communication (GSM) system, a Code Division Multiple Access (CDMA) system, and a Wideband Code Division Multiple Access ( WCDMA, Wideband Code Division Multiple Access) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE, Long Term Evolution) system, LTE Frequency Division Duplex (FDD) system, LTE time division Duplex (TDD, Time Division Duplex), Universal Mobile Telecommunications System (UMTS, Universal Mobile Telecommunication System), etc.

Users, also referred to as user equipment (UE, User Equipment), mobile terminal (Mobile Terminal), mobile user equipment, etc., may be performed by a radio access network (eg, RAN, Radio Access Network) and one or more core networks. Communication, the user equipment may be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal, for example, a mobile device that can be portable, pocket, handheld, computer built, or in-vehicle, Exchange language and/or data with the wireless access network.

1 shows a schematic flow chart of a method 100 of controlling transmission of traffic, in accordance with an embodiment of the present invention, as viewed from the perspective of a gateway device side. As shown in FIG. 1, the method 100 includes:

S110. Receive a data packet sent by the sending end.

S120. Send a classification request message to the server, where the classification request message includes L34 layer information of the service extracted from the data packet.

S130. Receive a classification request response message sent by the server, where the classification request response message includes control information of the service determined by the server according to the L34 layer information.

S140. Control, according to the control information, transmission of the service.

After receiving the data packet sent by the sending end, the gateway device may obtain the L34 layer information of the service according to the data packet, and send a classification request message including the L34 layer information to the server, where the server may determine according to the L34 layer information. The control information of the service is sent to the gateway device, and the classification request response message including the control information is sent, and after receiving the classification request response message sent by the server, the transmission of the service may be controlled according to the control information.

According to the method for controlling the transmission of the service according to the embodiment of the present invention, all services including the non-browsing type and the encrypted service type may be controlled according to the L34 layer information, for example, the interaction between the gateway device and the server, if based on The Internet Protocol (IP, Internet Procotol) address controls the transmission of the service, and can control all services transmitted through the IP address, including non-browsing and encrypted service types. If the transmission of the service is controlled based on the port, it is possible to control some software or tools that use a specific port for service transmission, and the classification control can be performed no matter what server the software is deployed on.

At the same time, for the performance of the gateway, the L34 layer information can be obtained only by performing SPI on the data packet, thereby reducing the performance requirement of the gateway and reducing the impact on the performance of the gateway.

The server can receive reports from the government or other network regulators that have their tracking confirmations. The blacklist list of the L34 layer information and classification attributes of the illegal website can also be accessed through some custom website analysis algorithms, and the traversal method is used to access the website providing services to the existing network, and the classification attribute analysis is performed based on the access data. By confirming the classification attribute of the website, by importing these L34 layer information and classification attributes into the black and white list database, the black and white list data can be continuously updated.

Therefore, according to the method for controlling the transmission of the service according to the embodiment of the present invention, the control information of the service is determined by the server disposed outside the gateway device, and the gateway device controls the transmission of the service according to the control information, thereby enabling non-browsing including All services, including classes and encrypted service types, are controlled to reduce the impact on the performance of the gateway device due to the configuration of the L34 filter, and to maintain the continuous update of the black and white list data, reducing the workload of network maintenance.

In an embodiment of the invention, the L34 layer may comprise an L3 layer, or an L4 layer, or an L3 layer and an L4 layer. The L3 layer information may include network layer Internet Protocol (IP, Internet Procotol) address information in an Open System Interconnect (OSI) network model, and the L4 layer information may include a transport layer transmission control protocol in the OSI network model. / User Datagram Protocol (TCP/UDP, Transfer Control Protocol/ User Datagram Protocol) port information. Therefore, the L34 layer information may include information such as an IP address, a port, and the like of a service server that transmits the service.

The server can also be called a content filtering server or a third-party server, which is set outside the gateway device and is independent of the gateway device.

The gateway device may include a GGSN, a PDSN, and a Wimax Access Service Network (WASN). It should be understood that the gateway device in the embodiment of the present invention may further include a centralized convergence point of the service in other networks and may implement the terminal. The network element that the user accesses the service flow for content analysis and control.

The transmission between the user equipment and the service server needs to pass through the gateway device, and the data packet of the same service (for example, the data packet of the service sent by the user equipment and the data packet of the service generated by the service server) includes The information of the L34 layer is the same. Therefore, the sender in the embodiment of the present invention may be a user equipment or a service server.

In the embodiment of the present invention, the classification request response message determined by the server according to the L34 layer information may include a classification attribute or a control policy of the service, where the classification attribute may include portal, technology, social, political, pornography, violence, gambling, and the like. Control policies can include normal access, blocking, redirection to reminders pages, and more. For portals, technology, social, etc., control strategies can correspond to normal access, etc.; for politics, pornography, violence, gambling, etc., control strategies can correspond to blocking or redirecting to Reminder page, etc. It should be understood that the above-mentioned classification attribute and the name of the control policy in the embodiment of the present invention and the description thereof are only for the reader to better understand the embodiment of the present invention, and the present invention is not limited thereto, and the above classification attribute and control strategy are The specific meanings should be understood in conjunction with the specific operations described in the embodiments of the present invention.

For a certain classification attribute, different users may have the same control policy or different control strategies. For example, for a business with pornographic attributes, all user control strategies may be blocked. For a service with a social attribute, if the user customizes the service, the control policy may be passed, and if the user does not customize the service, the control policy may be blocked. Therefore, different users may have different control policies due to different subscription information. The method for controlling the transmission of the service according to the embodiment of the present invention may further determine the classification attribute based on the user's subscription information and the user identifier. Determine the control strategy to achieve different control strategies for different users.

In this embodiment, for a certain classification attribute, if all users in the network have the same control policy (for example, for a service with pornographic attributes, all users' control policies are blocked), then the gateway device or server is only based on the service. The classification attribute enables you to determine the control strategy for the business. If different users have different control policies (for example, for a social attribute service, different users may have different control policies due to different subscription information), the gateway device and the server need to transmit the service according to the classification attribute of the service. User ID of the user equipment, and formulate a business control policy for the user.

Specifically, if the control policies of all the users in the network are the same, the classification request message sent by the gateway device to the server may include only the L34 layer information of the service, and the classification request response sent by the gateway device received by the gateway device. The message may include a classification attribute of the service, and may also include a control policy of the service.

If there are different control policies for different users, if the classification request message sent by the gateway device to the server includes only the L34 layer information of the service, the server can only determine the classification attribute of the service based on the L34 layer information, and the gateway device It is also necessary to further develop a control policy for the user according to the classification attribute and the user identifier of the user equipment transmitting the service. If the classification request message sent by the gateway device to the server includes the L34 layer information of the service and the user identifier of the user equipment that transmits the service, the server may determine the classification attribute of the service based on the L34 layer information, and further determine the classification attribute according to the user identifier. The user formulates a control strategy so that the gateway device can directly control the transmission of the service according to the control policy. Hereinafter, the description of the same or similar cases will be omitted. Therefore, in the embodiment of the present invention, the gateway device may further obtain the user identifier of the user equipment that transmits the service according to the data packet. The classification request message sent by the gateway device to the server may include the L34 layer information of the service, and may also include the L34 layer information and the user identifier, and the classification request response message sent by the server received by the gateway device may include the classification attribute of the service. It can also include control strategies for the business.

Specifically, when the classification request response message includes the classification attribute of the service, the gateway device may determine a control policy according to the classification attribute, and control transmission of the service according to the control policy. Therefore, the controlling the transmission of the service according to the control information may include: determining a control policy of the service according to the classification attribute of the service included in the control information; and controlling transmission of the service according to the control policy .

Optionally, in the embodiment of the present invention, the gateway device may further determine, according to the L34 layer information and the user identifier, a control policy of the service. Therefore, the controlling the transmission of the service according to the control information may include:

Determining a control policy of the service according to the classification attribute of the service included in the control information, and the user identifier extracted from the data packet;

According to the control strategy, the transmission of the service is controlled.

When the classification request response message includes a control policy of the service, the gateway device may control transmission of the service according to the control policy. Therefore, the controlling the transmission of the service according to the control information may include:

The transmission of the service is controlled according to the control policy of the service included in the control information. In the embodiment of the present invention, the control policy may be determined by the server according to the L34 layer information included in the classification request message, or may be determined by the server according to the L34 layer information and the user identifier included in the classification request message. Therefore, the controlling the transmission of the service according to the control information may include:

Controlling the transmission of the service according to the control policy of the service included in the service control information, where the control policy is determined by the server according to the L34 layer information and the user identifier extracted from the data packet included in the classification request message. of.

Specifically, in the embodiment of the present invention, if the control policy for the service needs to be determined according to the subscription information of the user transmitting the service, the user identifier and the service black and white list may be set in the gateway device or the content filter. The user policy database for the relationship between dynamic rules.

When the user policy database is set in the gateway device, the gateway device can send the L34 layer information. Sending to the server, the server determines the classification attribute of the service according to the L34 layer information, and sends the classification attribute to the gateway device, and the gateway device can obtain the user identifier of the user equipment that transmits the service according to the data packet, and based on the user Identifying a query user policy database, determining a control policy that the user equipment should perform for the classification attribute, and controlling (eg, blocking or passing) according to the control policy.

When the user policy database is set in the server, the gateway device may send the L34 layer information and the user identifier to the server, and the server first determines the classification attribute of the service according to the L34 layer information, and then queries the user policy database based on the user identifier to determine the user equipment. A control policy (such as blocking or passing) that should be performed for this classification attribute, and then sent to the gateway device for the gateway device to control.

Therefore, the method for controlling the transmission of the service according to the embodiment of the present invention can obtain a dynamic rule of a large number of black and white lists based on the user identification and the user policy subscription information, thereby enabling different control policies to be flexibly formulated for different users.

In the embodiment of the present invention, the user identifier (USER ID) may include a mobile subscriber number (MSISDN, Mobile Subscriber Integrated Services Digital Network), an International Mobile Station Equipment Identity (IMSI), and an international mobile station equipment identifier ( IMEI, International Mobile Subscriber Identity) and other information. It should be understood that the user identifier of the embodiment of the present invention is not limited to the above information, and other cells that can uniquely reflect the user identifier are all within the scope of the embodiments of the present invention.

Figure 2 shows a schematic flow diagram of a method 200 of controlling the transmission of traffic, as described from the server side, in accordance with an embodiment of the present invention. As shown in FIG. 2, the method 200 includes:

S210. The receiving gateway device sends a classification request message, where the classification request message includes L34 layer information of the service extracted by the gateway device from the data packet.

S220, according to the L34 layer information, determining control information of the service;

S230. Send a classification request response message to the gateway device, where the classification request response message includes the control information, so that the gateway device controls the transmission of the service according to the control information.

After receiving the data packet sent by the sending end, the gateway device may obtain the L34 layer information of the service according to the data packet, and send a classification request message including the L34 layer information to the server, where the server may determine according to the L34 layer information. The control information of the service is sent to the gateway device, and the classification request response message including the control information is sent, and after receiving the classification request response message sent by the server, the transmission of the service may be controlled according to the control information. According to the method for controlling the transmission of the service according to the embodiment of the present invention, all services including the non-browsing type and the encrypted service type may be controlled according to the L34 layer information, for example, the interaction between the gateway device and the server, if based on The Internet Protocol (IP, Internet Procotol) address controls the transmission of the service, and can control all services transmitted through the IP address, including non-browsing and encrypted service types. If the transmission of the service is controlled based on the port, it is possible to control some software or tools that use a specific port for service transmission, and the classification control can be performed no matter what server the software is deployed on.

The server may receive a black and white list of L34 layer information and classification attributes of the illegal website recorded by the government or other network supervision department, and may also adopt a customized website analysis algorithm to adopt the traversal method to the current network. The website that provides the service is accessed, the classification attribute analysis is performed based on the access data, and the classification attribute of the website is finally confirmed. By importing the L34 layer information and the classification attribute into the black and white list database, the black and white list data can be continuously updated.

In an embodiment of the invention, the L34 layer may comprise an L3 layer, or an L4 layer, or an L3 layer and an L4 layer. The L3 layer information may include IP address information of the network layer in the OSI network model, and the L4 layer information may include TCP/UDP port information in the OSI network model. Therefore, the L34 layer information may include information such as an IP address, a port, and the like of a service server that transmits the service.

Optionally, in the embodiment of the present invention, the gateway device may further obtain, according to the data packet, a user identifier of the user equipment that transmits the service. The classification request message sent by the gateway device to the server may include the L34 layer information of the service, and may also include the L34 layer information and the user identifier, and the classification request response message sent by the server received by the gateway device may include the classification attribute of the service. , can also include the control strategy of the business.

Specifically, when the classification request message sent by the gateway device received by the server includes the L34 layer information of the service, the server may determine the classification attribute of the service according to the L34 layer information. Cause Therefore, determining the control information of the service according to the L34 layer information, including:

Based on the L34 layer information, control information of the service including the classification attribute of the service is determined. Moreover, when the classification request message sent by the gateway device received by the server includes the L34 layer information of the service, the server may further determine a control policy of the service according to the L34 layer information. Therefore, determining the control information of the service according to the information of the L34 layer includes:

Based on the L34 layer information, control information of the service including the control policy of the service is determined. When the classification request message sent by the gateway device includes the L34 layer information and the user identifier of the service, the server may determine the control policy of the service according to the L34 layer information and the user identifier. Therefore, the determining the control information of the service according to the information of the L34 layer includes: determining, according to the L34 layer information, the user identifier that is extracted by the gateway device from the data packet, and determining that the service includes the service The control information of the service that controls the policy.

When the user policy database is set in the gateway device, the gateway device may send the L34 layer information to the server, and the server determines the classification attribute of the service according to the L34 layer information, and sends the classification attribute to the gateway device, and the gateway device may The data packet obtains the user identifier of the user equipment that transmits the service, and queries the user policy database based on the user identifier to determine a control policy that the user equipment should perform for the classification attribute, and controls according to the control policy (for example, blocking or passing ).

In the embodiment of the present invention, the user identifier may include information such as MSISDN, IMSI, IMEI, and the like. It should be understood that the user identifier of the embodiment of the present invention is not limited to the above information, and other cells that can uniquely represent the user identifier are all within the scope of the embodiments of the present invention. FIG. 3 illustrates an interaction diagram of a method of controlling transmission of traffic in accordance with an embodiment of the present invention. Hereinafter, the IP address is used as the L34 layer information, and the GGSN is used as the gateway device. As shown in FIG. 3, in S301, the GGSN receives a data packet sent by the UE or the service server.

In S302, after receiving the data packet of the service, the GGSN can obtain the L34 layer information of the service, for example, an IP address, based on the SPI technology. Therefore, the GGSN only needs to perform shallow layer analysis on the data packet, thereby reducing the gateway device. The requirements, and, can reduce the impact on the performance of the gateway device.

Optionally, the GGSN may also obtain the USER ID according to the data packet. Specifically, the gateway may allocate a data packet and a USER ID to the UE to uniquely identify the UE when the UE is activated, and the gateway may notify the neighboring network element to use the uplink data packet (the UE sends the message to the service server. The USER ID index of the data packet is used to establish a UE query entry based on the UE IP address, and is used for the USER ID index of the downlink data packet (the data packet sent from the service server to the UE). The uplink data packet is selected by the UE to carry the context information of the service. After the final data packet is sent to the gateway, the packet carries the ID assigned by the gateway to the UE when the UE is activated. The gateway locally saves the ID based on the ID index. Context, thus getting the USER ID. The downlink packet is obtained by the gateway device by using the UE ID address to select the context information that carries the service. It should be understood that the data packet carrying the USER ID and the data packet carrying the L34 layer information may be the same or different, and the present invention is not particularly limited.

Optionally, after receiving the data packet of the service, the GGSN may first determine whether the L34 layer information filtering is required for the service, and specifically, whether the UE that transmits the service needs to be cached in the policy server. The information about the filtering of the L34 layer information, and when the UE is activated, the policy server may notify the GGSN whether to filter the L34 layer information according to the subscription information, and if the content filtering function is enabled, the service is in the service. During the transmission, the GGSN interacts with an external server. Moreover, a global or access point name (APN) configuration may be added to the gateway device to determine whether the UE transmitting the service needs to perform filtering based on the L34 layer information, and when the UE is activated, based on The configuration determines whether the L34 layer information filtering needs to be performed on the service. If the content filtering function is enabled, the GGSN interacts with an external server during the service access process. Therefore, the control mode of the service can be determined based on the user subscription information in the initial stage of the control, so that the control can be flexibly performed, and the efficiency of the transmission of the service can be improved.

In S303, the GGSN may send a classification request message to the server, where the classification is requested. The request message may include an IP address, and may also include an IP address and a USER ID.

In S304, the server may determine the classification request response message according to the classification request message. Specifically, when the classification request message includes an IP address, the server may compare the IP address of the illegal website with the black and white list of the classification attribute, that is, the classification attribute. a database, determining a classification attribute of the service, and determining, according to the classification attribute, a control policy for the service for all UEs in the network, for example, for a portal, a technology, a social, etc., the gateway device or the server may correspond its control policy to Normal access, etc.; for politics, pornography, violence, gambling, etc., the gateway device or server can map its control policy to block or redirect to the reminder page. Moreover, when the classification request message includes an IP address and a USER ID, the server may first determine the classification attribute of the service against the list of the IP address and the classification attribute of the illegal website, and then determine the classification for the classification based on querying the user policy database by using the USER ID. The control strategy that the attribute should execute.

In S305, the server may send the classification request response message to the GGSN, where the classification request response message may include a classification attribute of the service, and may also include a control policy of the service.

In S306, the GGSN may determine a control policy for the service according to the classification request response message. Specifically, when the classification request response message includes the control policy of the service, the GGSN may directly extract the response request message from the classification request message. The control strategy. And, when the classification request response message includes the classification attribute of the service, the GGSN may determine a control policy for the service according to the classification attribute, or may perform a query on the user policy database by using the USER ID to determine that the classification attribute should be executed. Control Strategy.

In S307, the GGSN controls the transmission of the service between the UE and the service server according to the control policy.

Moreover, according to the user identifier, the dynamic rule of the black and white list is obtained based on the user policy subscription information, so that different control policies can be flexibly formulated for different user equipments.

Hereinabove, a method of controlling transmission of a service according to an embodiment of the present invention is described in detail with reference to FIGS. 1 to 3. Hereinafter, a control industry according to an embodiment of the present invention will be described in detail with reference to FIGS. 4 to 5. The device for transmission.

Figure 4 shows a schematic block diagram of an apparatus 400 for controlling the transmission of traffic in accordance with an embodiment of the present invention. As shown in Figure 4, the apparatus 400 includes:

The first receiving unit 410 is configured to receive a data packet sent by the sending end.

The sending unit 420 is configured to send, to the server, a classification request message, where the classification request message includes L34 layer information of the service extracted from the data packet;

The second receiving unit 430 is configured to receive a classification request response message sent by the server, where the classification request response message includes control information of the service determined by the server according to the L34 layer information, and a control unit 440, configured to: according to the control information, Control the transmission of this service.

Therefore, the device for controlling the transmission of the service according to the embodiment of the present invention determines the control information of the service by the server disposed outside the gateway device, and the gateway device controls the transmission of the service according to the control information, thereby enabling non-browsing All services, including classes and encrypted service types, are controlled to reduce the impact on the performance of the gateway device due to the configuration of the L34 filter, and to maintain the continuous update of the black and white list data, reducing the workload of network maintenance.

In the embodiment of the present invention, the classification request response message received by the second receiving unit 430 may include a classification attribute of the service, so as to include a control policy of the service. Therefore, when the classification request response message includes the classification attribute of the service,

The control unit 440 is further configured to determine a control policy of the service according to the classification attribute of the service included in the control information;

It is used to control the transmission of the service according to the control strategy.

Optionally, in the embodiment of the present invention, the gateway device may further determine, according to the L34 layer information and the user identifier, a control policy of the service. Therefore,

The control unit is further configured to determine a control policy of the service according to the classification attribute of the service included in the control information, and the user identifier extracted from the data text;

In the embodiment of the present invention, the control policy may be determined by the server according to the L34 layer information included in the classification request message. Therefore,

The control unit is further configured to control transmission of the service according to a control policy of the service included in the control information.

In the embodiment of the present invention, the control policy may be determined by the server according to the L34 layer information and the user identifier included in the classification request message. therefore, The control unit is further configured to control transmission of the service according to the control policy of the service included in the service control information, where the control policy is that the server includes the data packet according to the L34 layer information and the classification request message. The extracted user ID is determined.

Therefore, the device for controlling the transmission of the service according to the embodiment of the present invention can obtain a dynamic rule of a large number of black and white lists based on the user identifier and the subscription information of the user, so that different control policies can be flexibly formulated for different user devices.

Moreover, in the embodiment of the present invention, the L34 layer information may include information such as an IP address, a port, and the like of the service server that provides the service.

The user identity may include information such as MSISDN, IMSI, and IMEI.

The apparatus 400 for controlling transmission of a service according to an embodiment of the present invention may correspond to a gateway device (e.g., GGSN) in the method of the embodiment of the present invention, and the units in the apparatus 400 for controlling transmission of the service and the other operations and In order to implement the corresponding process of the method 100 in FIG. 1 , the functions are not described here.

Figure 5 shows a schematic block diagram of an apparatus 500 for controlling the transmission of traffic in accordance with an embodiment of the present invention. As shown in Figure 5, the apparatus 500 includes:

The receiving unit 510 is configured to receive, by the gateway device, a classification request message, where the classification request message includes L34 layer information of the service extracted by the gateway device from the data packet;

a determining unit 520, configured to determine control information of the service according to the L34 layer information, and a sending unit 530, configured to send, to the gateway device, a classification request response message, where the classification request response message includes the control information determined by the determining unit 520 So that the gateway device controls the transmission of the service according to the control information.

When the classification request message sent by the gateway device received by the server includes the L34 layer information of the service, the server may determine the classification attribute of the service according to the L34 layer information. Therefore,

The determining unit 520 is further configured to determine, according to the L34 layer information, control information of the service including a classification attribute of the service.

And, the classification request message sent by the gateway device received by the server includes the service When the L34 layer information is used, the server may further determine a control policy of the service according to the L34 layer information. therefore,

The determining unit 520 is further configured to determine, according to the L34 layer information, control information of the service including the control policy of the service.

When the classification request message sent by the gateway device includes the L34 layer information and the user identifier of the service, the server may determine the control policy of the service according to the L34 layer information and the user identifier. Therefore,

The determining unit 520 is further configured to determine, according to the L34 layer information, the classification request message, the user identifier extracted by the gateway device from the data packet, and the control information of the service including the control policy of the service.

Therefore, the device for controlling the transmission of the service according to the embodiment of the present invention can obtain a dynamic rule of a large number of black and white lists based on the user policy subscription information, so that different control policies can be flexibly formulated for different user equipments.

In the embodiment of the present invention, the L34 layer information of the service included in the classification request message sent by the receiving device 510 may include information such as an IP address, a port, and the like of the service server that provides the service.

The user identifier included in the classification request message sent by the gateway device received by the receiving unit 510 may include information such as MSISDN, IMSI, and IMEI.

The apparatus 500 for controlling transmission of a service according to an embodiment of the present invention may correspond to a server in the method of the embodiment of the present invention, and the units in the apparatus 500 for controlling the transmission of the service and the other operations and/or functions described above are respectively The corresponding process of the method 200 in FIG. 2 is implemented, and the details are not described herein.

Hereinabove, a method and apparatus for controlling transmission of a service according to an embodiment of the present invention are described in detail with reference to Figs. 1 through 5, and a system for controlling transmission of a service according to an embodiment of the present invention will be described in detail below with reference to Fig. 6.

Figure 6 shows a schematic block diagram of a system 600 for controlling the transmission of traffic in accordance with an embodiment of the present invention. As shown in Figure 6, the system 600 includes: a device 400 in accordance with an embodiment of the present invention and a device 500 in accordance with an embodiment of the present invention.

The device 400 includes: a first receiving unit 410, configured to receive a data packet sent by the sending end, and a sending unit 420, configured to send, to the server, a classification request message, where the classification request message includes the service extracted from the data packet L34 layer information; a second receiving unit 430, configured to receive the service The classification request response message sent by the device, the classification request response message includes control information of the service determined by the server according to the L34 layer information, and the control unit 440 is configured to control the transmission of the service according to the control information.

The apparatus 500 includes: a receiving unit 510, configured to receive, by the gateway device, a classification request message, where the classification request message includes L34 layer information of the service extracted by the gateway device from the data packet, and the determining unit 520 is configured to use, according to the L34 layer The information is used to determine the control information of the service. The sending unit 530 is configured to send a classification request response message to the gateway device, where the classification request response message includes the control information determined by the determining unit 520, so that the gateway device can use the control information according to the control information. , control the transmission of the service.

Therefore, the system for controlling the transmission of the service according to the embodiment of the present invention determines the control information of the service by the server disposed outside the gateway device, and the gateway device controls the transmission of the service according to the control information, thereby enabling non-browsing including All services, including classes and encrypted service types, are controlled to reduce the impact on the performance of the gateway device due to the configuration of the L34 filter, and to maintain the continuous update of the black and white list data, reducing the workload of network maintenance. The units in unit 400 and the other operations and/or functions described above are respectively implemented to implement the corresponding flow of method 100 in FIG. The apparatus 500 described above may correspond to a server in the method of the embodiment of the present invention, and the units in the apparatus 500 and the other operations and/or functions described above are respectively implemented to implement the method of FIG.

The corresponding process of 200 is clean and will not be repeated here.

Moreover, in various embodiments of the present invention, the size of the sequence numbers of the above processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be taken by the embodiment of the present invention. The implementation process constitutes any qualification.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in a combination of electronic hardware or computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

It will be apparent to those skilled in the art that, for the convenience of the description and the cleaning process, the specific operation of the system, the device and the unit described above may be referred to the corresponding processes in the foregoing method embodiments, and details are not described herein again.

In the several embodiments provided herein, it should be understood that the disclosed systems, devices, and The method can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential to the prior art or part of the technical solution, may be embodied in the form of a software product stored in a storage medium, including The instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. .

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Rights request

A method for controlling transmission of a service, the method comprising: receiving a data message sent by a sender;

Sending a classification request message to the server, where the classification request message includes L34 layer information of the service extracted from the data packet;

And receiving, by the server, a classification request response message, where the classification request response message includes control information of the service determined by the server according to the L34 layer information;

Controlling the transmission of the service according to the control information.

The method according to claim 1, wherein the controlling the transmission of the service according to the control information comprises:

Determining a control policy of the service according to the classification attribute of the service included in the control information;

Controlling the transmission of the service according to the control policy.

Determining a control policy of the service according to a classification attribute of the service included in the control information, and a user identifier extracted from the data packet;

Controlling the transmission of the service according to the control policy.

And controlling transmission of the service according to a control policy of the service included in the control information.

The method according to claim 1, wherein the controlling the transmission of the service according to the service control information comprises:

And controlling the transmission of the service according to the control policy of the service included in the service control information, where the control policy is that the server includes the data according to the L34 layer information and the classification request message. The user ID extracted in the message is determined.

The method according to claim 3 or 5, wherein the user identifier comprises at least one of a mobile subscriber number MSISDN, an international mobile subscriber identity IMSI, and an international mobile station equipment identity IMEI.

The method according to any one of claims 1 to 6, wherein the L34 The layer information includes at least one of a server internet protocol IP address and a server port.

A method for controlling transmission of a service, the method comprising: receiving a gateway device to send a classification request message, where the classification request message includes L34 layer information of a service extracted by the gateway device from a data packet ;

And determining, according to the L34 layer information, control information of the service;

And sending, to the gateway device, a classification request response message, where the classification request response message includes the control information, so that the gateway device controls transmission of the service according to the control information.

The method according to claim 8, wherein the determining the control information of the service according to the L34 layer information comprises:

Based on the L34 layer information, control information of the service including a classification attribute of the service is determined.

And determining, according to the L34 layer information, control information of the service including a control policy of the service.

And the control information of the service including the control policy of the service is determined according to the L34 layer information, and the user identifier that is extracted by the gateway device from the data packet.

The method according to claim 11, wherein the user identifier comprises at least one of a mobile subscriber number MSISDN, an international mobile subscriber identity IMSI, and an international mobile station equipment identity IMEI.

The method according to any one of claims 8 to 12, wherein the L34 layer information comprises at least one of a server internet protocol IP address and a server port.

A device for controlling transmission of a service, the device comprising: a first receiving unit, configured to receive a data packet sent by a sending end;

a sending unit, configured to send a classification request message to the server, where the classification request message includes L34 layer information of the service extracted from the data packet;

a second receiving unit, configured to receive a classification request response message sent by the server, where the The class request response message includes control information of the service determined by the server according to the L34 layer information;

And a control unit, configured to control transmission of the service according to the control information.

The device according to claim 14, wherein the control unit is further configured to determine a control policy of the service according to a classification attribute of the service included in the control information;

And for controlling transmission of the service according to the control policy.

The device according to claim 14, wherein the control unit is further configured to determine, according to the classification attribute of the service included in the control information, and the user identifier extracted from the data packet. The control strategy of the service;

The device according to claim 14, wherein the control unit is further configured to control transmission of the service according to a control policy of the service included in the control information.

The device according to claim 14, wherein the control unit is further configured to control transmission of the service according to a control policy of the service included in the service control information, where the control policy is And determining, by the server, the user identifier extracted from the data packet according to the L34 layer information and the classification request message.

19. The apparatus according to claim 18, wherein the user identifier comprises a mobile subscriber number MSISDN, an international mobile subscriber identity IMSI, and an international mobile station equipment identity.

At least one of the IMEIs.

The apparatus according to any one of claims 14 to 19, wherein the L34 layer information comprises at least one of a server internet protocol IP address and a server port.

An apparatus for controlling transmission of a service, the apparatus comprising: a receiving unit, configured to receive a gateway device to send a classification request message, where the classification request message includes the gateway device extracting from a data packet L34 layer information of the service;

a determining unit, configured to determine control information of the service according to the L34 layer information, and a sending unit, configured to send a classification request response message to the gateway device, where the classification request response message includes the determining unit And the control information, so that the gateway device controls the transmission of the service according to the control information.

The device according to claim 21, wherein the determining unit is further configured to: Determining, according to the L34 layer information, control information of the service including a classification attribute of the service.

The device according to claim 21, wherein the determining unit is further configured to determine, according to the L34 layer information, control information of the service including a control policy of the service.

The device according to claim 21, wherein the determining unit is further configured to: according to the L34 layer information, and the classification request message includes a user identifier extracted by the gateway device from a data packet, Determining control information for the service including the control policy of the service.

25. The apparatus according to claim 24, wherein the user identifier comprises a mobile subscriber number MSISDN, an international mobile subscriber identity IMSI, and an international mobile station equipment identity.

At least one of the IMEIs.

The apparatus according to any one of claims 21 to 25, wherein the L34 layer information comprises at least one of a server internet protocol IP address and a server port.

27. A system for controlling the transmission of a service, the system comprising: the apparatus for controlling transmission of a service according to any one of claims 14 to 20; and the method of any one of claims 21 to 26. The device for controlling the transmission of a service.