Method for effective overload protection in 5G core network

Abstract

A method for providing efficient overload protection in a 5G core network, a non-transitory computer-readable medium, a network traffic management apparatus, and a network traffic management system are shown. With this technique, a load at a producer network function (NF) is monitored, and in response to determining that the producer NF is overloaded, multiple types of network traffic to the overloaded producer NF are monitored. An overloaded network traffic type is identified, the overloaded network traffic type being a type of network traffic flowing to a producer NF, the amount of the overloaded network traffic type exceeding a first threshold amount above a first baseline amount of network traffic. An overload session is identified that is a session that overloads an amount of network traffic type that exceeds a second threshold amount above a second baseline amount of network traffic. A mitigation action is performed to reduce network traffic from the overload session.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Application No. 63 / 531,669, filed on August 9, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present technology relates to methods and systems for providing effective overload protection within a 5G core network. Background Art

[0004] 5G is a global wireless standard representing the fifth generation of cellular network technology. Compared to 4G technology, 5G introduces the use of high-band (i.e., millimeter wave) frequencies, which, although more limited in range than low-band and mid-band frequencies, can provide faster data transmission speeds, thereby enabling new service levels and new technology applications. Another advantage of 5G is that it provides network function virtualization (NFV), which decouples network functions from proprietary hardware so that network functions can run as software on standardized hardware, which makes the network more flexible by minimizing the reliance on specific hardware.

[0005] Like previous generations of mobile networks, the 5G core network provides service access to devices while providing service providers with the functionality required to authenticate, authorize and manage their customers. However, the architecture of the 5G core network provides expanded capabilities that are more advantageous than previous generations. Defined and built in software through a service-based architecture (SBA), the architecture allows the 5G core to be decomposed, cloud-native and distributed. One of the many advantages of the 5G core is that the location of network functions (NFs) can be optimized to ensure the highest efficiency, highest performance and lowest latency.

[0006] 5G core NF elements are typically sized for a specific capacity. Due to network conditions, NFs may become overloaded and exert back pressure on peers to throttle requests, which may result in a degraded quality of experience for end users. This throttling typically occurs at the message level without a holistic view of traffic patterns and is agnostic to end-device behavior patterns. Therefore, traditional approaches to throttling traffic typically affect many users, most of whom may not be the cause of the overload, and are therefore essentially penalizing some users for overusing the network by others. 3GPP defines a 5G Network Data Analysis Function (NWDAF) node for analysis, which can analyze user equipment (UE) behavior patterns and propose some actions based on UE behavior, however, this approach is disadvantageous because although NWDAF provides a classification of abnormal UE and network behavior patterns, it does not specify how to identify / derive these patterns. For example, 3GPP specifies a possible DDoS attack as a pattern, but does not specify how to detect such a pattern. The NWDAF node described by 3GPP is even more disadvantageous because it involves mitigation at different nodes (NFs), so additional implementation and processing is required on these nodes / NFs, and since the NWDAF is an external node, data needs to be fed to the NWDAF node for analysis, and subscriptions need to be created to be notified by the NWDAF, which adds more signaling overhead to the 5G core network.

[0007] Therefore, it is desirable to create a system for providing effective overload protection within a 5G core network that is able to specifically target UE devices and related sessions that are the primary cause of overload, while avoiding restricting UE devices / sessions that do not cause overload. Summary of the invention

[0008] A method implemented by a network traffic management system, the method comprising monitoring a load of a producer network function (NF). In response to determining that the producer NF is overloaded, multiple types of network traffic flowing to the overloaded producer NF are monitored. Each of the multiple types of network traffic corresponds to network traffic associated with a different event type of multiple event types. An overloaded network traffic type is identified, the overloaded network traffic type being a type of network traffic among the multiple types of network traffic flowing to the producer NF, which includes a first threshold amount of traffic exceeding a first baseline amount of network traffic. An overloaded session is identified, the overloaded session being a session in which an amount of network traffic of the overloaded network traffic type exceeds a second threshold amount of network traffic above a second baseline amount of network traffic. Mitigation actions are performed to reduce network traffic from the identified overloaded sessions.

[0009] A network traffic management device includes a memory and one or more processors, the memory including programming instructions stored thereon, the one or more processors being configured to be able to execute the stored programming instructions to monitor the load of a producer network function (NF). In response to determining that the producer NF is overloaded, multiple types of network traffic flowing to the overloaded producer NF are monitored. Each of the multiple types of network traffic corresponds to network traffic associated with a different event type of multiple event types. An overloaded network traffic type is identified, which is a type of network traffic among the multiple types of network traffic flowing to the producer NF, which includes a first threshold amount of traffic exceeding a first baseline amount of network traffic. An overloaded session is identified, which is a session in which the amount of network traffic of the overloaded network traffic type exceeds a second threshold amount of network traffic above a second baseline amount of network traffic. Mitigation actions are performed to reduce network traffic from the identified overloaded session.

[0010] A non-transitory computer-readable medium having stored thereon instructions including executable code, which, when executed by one or more processors, causes the processor to monitor a load of a producer network function (NF). In response to determining that the producer NF is overloaded, multiple types of network traffic flowing to the overloaded producer NF are monitored. Each of the multiple types of network traffic corresponds to network traffic associated with a different event type of multiple event types. An overloaded network traffic type is identified, which is a type of network traffic among the multiple types of network traffic flowing to the producer NF, which includes a first threshold amount of traffic exceeding a first baseline amount of network traffic. An overloaded session is identified, which is a session in which the amount of network traffic of the overloaded network traffic type exceeds a second threshold amount of network traffic above a second baseline amount of network traffic. Mitigation actions are performed to reduce network traffic from the identified overloaded session.

[0011] A network traffic management system having a memory and one or more processors, the memory including programming instructions stored thereon, the one or more processors being configured to be able to execute the stored programming instructions to monitor the load of a producer network function (NF). In response to determining that the producer NF is overloaded, multiple types of network traffic flowing to the overloaded producer NF are monitored. Each of the multiple types of network traffic corresponds to network traffic associated with a different event type of multiple event types. An overloaded network traffic type is identified, which is a type of network traffic among the multiple types of network traffic flowing to the producer NF, which includes a first threshold amount of traffic exceeding a first baseline amount of network traffic. An overloaded session is identified, which is a session in which the amount of network traffic of the overloaded network traffic type exceeds a second threshold amount of network traffic above a second baseline amount of network traffic. Mitigation actions are performed to reduce network traffic from the identified overloaded session.

[0012] The technology provides numerous advantages, including providing methods, non-transitory computer-readable media, network traffic management devices, and network traffic management systems that can provide effective overload protection within a 5G core network by targeting mitigation actions to reduce network traffic for specific sessions identified as sources of overload. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1A is a block diagram of a reference point representation of an exemplary 5G system architecture;

[0014] Figure 1B is a block diagram of a service-based representation of an exemplary 5G system architecture;

[0015] Figure 2A is a block diagram of a reference point representation of an exemplary 5G system architecture with a network traffic management device (NTMD) for providing effective overload protection within a 5G core network;

[0016] Figure 2B is a service-based representation block diagram of an exemplary 5G system architecture with NTMD for providing effective overload protection within a 5G core network;

[0017] Figure 3 is a block diagram of an exemplary network traffic management device;

[0018] Figure 4A and Figure 4B are two parts of a network traffic event type table according to an embodiment of the present disclosure; and

[0019] Figure 5 is a flow chart of an exemplary method for providing effective overload protection within a 5G core network. DETAILED DESCRIPTION

[0020] In the following description, for the purpose of explanation, many specific details are set forth in order to provide a comprehensive understanding of the present invention. However, it is apparent that the present invention can be implemented without these specific details. In other cases, in order to avoid unnecessarily obscuring the present invention, well-known structures and devices are shown in block diagram form.

[0021] It should also be understood that the term "or" can be inclusive or exclusive, unless expressly stated otherwise; the term "group" can include zero, one, or two or more elements; the terms "first", "second", "some" and "particular" are used as naming conventions to distinguish elements from each other, and do not imply the order, time or any characteristics of the referenced items, unless otherwise stated; the terms "such as", "eg", "for example" and the like describe one or more examples, but are not limited to the examples described; the terms "comprises" and / or "comprising" specify the presence of the stated features, but do not exclude the presence or addition of one or more other features.

[0022] A "computer system" refers to one or more computers, such as one or more physical computers, virtual computers, and / or computing devices. For example, a computer system may be or may include one or more server computers, cloud-based computers, cloud-based computer clusters, virtual machine instances, or virtual machine computer elements (such as virtual processors, storage and memory, data centers, storage devices, desktop computers, laptop computers, mobile devices, or any other special-purpose computing devices). Unless otherwise expressly stated, any reference to a "computer system" herein may refer to one or more computers. When a computer system performs an action, the action is performed by one or more computers of the computer system.

[0023] "Client," "client device," "user equipment," and / or "user equipment device" refers to a combination of integrated software components and an allocation of computing resources, such as memory, computing devices, and processes on the computing devices for executing the integrated software components. The combination of software and computing resources is configured to interact with one or more servers over a network, such as the Internet. A client may refer to a combination of components on one or more computers or one or more computers. A user equipment may be any device used directly by an end user to communicate with a network, and may include devices such as a handheld phone, a smart phone, a laptop equipped with a mobile broadband adapter, or any other such device capable of connecting to a radio access network (RAN), a Wi-Fi network, or any other such network.

[0024] A "server" (also referred to as a "server system" or "server computer system") refers to a combination of integrated software components and an allocation of computing resources, such as memory, computing devices, and processes on the computing devices for executing the integrated software components. The combination of software and computing resources provides a particular type of functionality on behalf of the server's clients. A server may refer to a combination of components on one or more computers or to one or more computers. A server may include multiple servers; that is, a server may include a first server computing device and a second server computing device, which may provide the same or different functionality to the same or different groups of clients.

[0025] As used herein, the term "network function" (NF) may refer to a component of a network infrastructure that provides well-defined functional behaviors (e.g., routing, switching, etc.). NF may be a functional component in a network infrastructure that has a well-defined external interface and well-defined functional behaviors. NF may be a network node, a physical device, or a software implementation of a previously physically implemented network function. As used herein, NF may refer to a physical network function (PNF), a virtualized network function (VNF), and / or a cloud-native network function (CNF).

[0026] This document generally describes systems, methods, devices, and other techniques for providing effective overload protection within a 5G core network. The 5G core network consists of various NFs that provide different functions. Each NF is typically sized to a specific capacity. In other words, each NF is typically designed to handle the expected amount of network traffic without overloading. However, there may be situations where one or more UEs or other devices operate outside of normal or expected parameters. Some such behaviors may indicate defects in the design of the device or system, in which case the examples of the present disclosure may provide important functionality for identifying such problems and notifying system administrators of the problem. For example, a particular cellular tower may have an unoptimized design such that handovers from UEs at that particular cellular tower / location tend to cause overloads, and the systems and methods described herein may be used to identify the problem so that it can be corrected. In some cases, the UE may engage in undesirable behavior that causes overload, for example, a faulty UE transitions from active to idle state at a much higher rate than expected, the UE creates and deletes sessions very frequently, or the UE has both Wi-Fi and 5G RAN available in the same location and switches RAN connections unnecessarily without mobility or other such undesirable behavior, in which case embodiments of the present disclosure are able to identify the specific UEs / sessions that are causing the problem and specifically limit their network traffic without limiting innocent UEs / sessions.

[0027] The technology of the present disclosure may involve using an NTMD (such as a service communication proxy (SCP) device located between a consumer NF (e.g., AMF) and a producer NF (e.g., SMF)) and monitoring the load of the producer NF to determine when an overload occurs. Once it is determined that an overload exists, the NTMD may classify the monitored network traffic into multiple traffic types, each of which is associated with a specific event type (e.g., creating a session, releasing a session, Xn switching, etc.), and identify one or more traffic types that cause the overload. As will be appreciated by those of ordinary skill in the art, designers of 5G systems may establish a baseline of a "normal" network traffic pattern for each type of traffic. For example, at a certain time of day, at a certain location, there is a "normal" range of switching that typically occurs between a given minimum and maximum expected value, which can be determined using historical data. Therefore, according to an example embodiment, the system of the present disclosure may be able to determine that a particular type of network traffic is the cause of the overload because the amount of the particular type of traffic exceeds a predetermined threshold level of the baseline traffic of the type of network traffic. Each type of network traffic may have its own associated baseline (e.g., average traffic or maximum expected traffic) and a threshold for determining that the traffic type is overloaded. After identifying a particular type of network traffic that is overloaded ("overloaded network traffic type"), the system of the present disclosure may then examine all sessions that include the overloaded network traffic type, and identify one or more sessions that exceed the expected amount of that traffic type on a per UE / session basis. In other words, all UE / sessions may have an expected baseline amount of that particular type of network traffic, and upon determining that for a given UE / session, the amount of network traffic of the overloaded network traffic type exceeds a predetermined threshold, the system may identify that UE / session as the cause of the overload ("overloaded session"). The system may identify one or more such overloaded sessions, and then take mitigation actions for each session to reduce the network traffic from these particular overloaded sessions, thereby alleviating the overload at the producer NF. Mitigation actions may include rate limiting individual requests for a session, rate limiting all requests for a session, or rejecting all requests from a session, depending on the severity of the overload created by the UE / session. In some embodiments, an error code and new problem details may be sent upstream to a consumer NF (e.g., simultaneously to a rate limit or reject message) so that the consumer AF may take further action on these UE / sessions to optimize signaling on the consumer AF.

[0028] In this way, embodiments of the present invention can provide effective overload protection within the 5G core network that targets specific UEs / sessions that are the primary cause of overload, while not penalizing UEs / sessions that are not causing overload. As described herein, in addition to providing overload protection, the systems and methods of the present disclosure can also be used to diagnose problems with system design or specific equipment issues that may be causing overload problems without knowing it, so that these problems can be identified and fixed. In contrast to other approaches, such as NWDAF-based approaches, the techniques of the present disclosure advantageously provide a lightweight and centralized approach that allows detection and identification of traffic types that cause overload, making it possible to take mitigation actions only for those traffic patterns.

[0029] refer to Figure 1A and 1B , shows an exemplary reference point representation and an exemplary service-based representation of the 5G Core (5GC) network architecture defined by the 3GPP standard. As will be understood by those skilled in the art, the reference point representation focuses on the interaction between network function pairs defined by a point-to-point reference point (e.g., N7) between any two network functions (e.g., SMF and PCF), and is used when there is some interaction between any two network functions. In addition, while the service-based representation also includes point-to-point reference points between NFs when necessary (e.g., see Figure 1A The lower part of the diagram), but the upper part of the diagram (i.e., the 5GC control plane) has a "bus" and service-based interfaces exposed by individual functions. This creates a so-called service-based architecture (SBA), where one CP network function (e.g., SMF) allows any other authorized NF to access its services. According to 3GPP standards, NFs within the 5GC control plane should only use service-based interfaces to execute their instructions.

[0030] The 5G core consists of the following network functions: Access and Mobility Management Function (AMF), Session Management Function (SMF), User Plane Function (UPF), Policy Control Function (PCF), Authentication Server Function (AUSF), Unified Data Management (UDM), Application Function (AF), Network Exposure Function (NEF), NF Repository Function (NRF) and Network Slice Selection Function (NSSF). As will be appreciated by those of ordinary skill in the art, all of these NFs are well known and defined by the standards body 3GPP. Nevertheless, a brief overview of some of the functions of each is provided herein for reference:

[0031] AMF can support NAS signaling termination, NAS encryption and integrity protection, registration management, connection management, mobility management, access authentication and authorization, and security content management.

[0032] The SMF can support session management (e.g., session establishment, modification, and release), UE IP address allocation and management, DHCP functionality, termination of NAS signaling related to session management, DL data notification, and traffic steering configuration of the UPF for appropriate traffic routing.

[0033] The UPF may support packet routing and forwarding, packet inspection, QoS processing, act as an external PDU session point interconnecting with the data network (DN), and is the anchor point for intra-RAT and inter-RAT mobility.

[0034] The PCF can support the unified policy framework, provide policy rules to the CP function, and access subscription information for policy decisions in the UDR.

[0035] AUSF can act as an authentication server.

[0036] UDM can support the generation of authentication and key agreement (AKA) certificates, user identification processing, access authorization and subscription management.

[0037] AF can support applications to influence traffic routing, access NEF, and interact with the policy framework for policy control.

[0038] NEF can support the exposure of capabilities and events, the secure provision of information from external applications to the 3GPP network, and the conversion of internal / external information.

[0039] NRF can support service discovery functions and maintain NF profiles and available NF instances.

[0040] NSSF can support the selection of network slice instances to serve UEs, determine the allowed NSSAIs, and determine the AMF set to serve the UEs.

[0041] As will be appreciated by those skilled in the art, Figure 1A and 1B As further shown, a user equipment (UE) device (e.g., a smartphone) can access the 5G core by connecting to a radio access network (R(AN)) (e.g., a cellular network) and can ultimately access an external data network (DN). The 5G architecture may also include other network devices, such as routers or switches, which are known in the art and are therefore not described here.

[0042] and Figure 1A and 1B similar, Figure 2A and 2B Reference point representation and service-based representation of an exemplary 5G system architecture are also depicted separately. Figure 2A and 2BAlso included are NTMDs according to the exemplary embodiments described herein. Although NTMDs are labeled as devices, it should be understood that in some embodiments, NTMDs may exist as software modules on another device (e.g., a device that stores and executes multiple different software-based NFs). According to some embodiments, NTMDs may be service communication proxy (SCP) devices as described by the 3GPP standards organization. For example, in some embodiments, the functionality described herein may be embodied in a software update provided to the SCP that enhances the functionality provided by the SCP. In addition, although Figure 2A and 2B In this example, the NTMD is depicted as being located between the AMF and SMF, but it should be understood that in other embodiments, the NTMD can be placed between any two service-based interface (SBI) NFs and perform functions similar to those described herein. The NTMD can utilize different reference points or interfaces based on which NFs it is located between. For example, Figure 2A As shown, in this example, NTMD is located between AMF and SMF, so although Figure 2B Not shown, the NTMD will utilize the Nsmf and Namf reference points as it is a proxy between the AMF and SMF.

[0043] As described above, in some embodiments, the NTMD may be an SCP. Traditionally, an SCP may provide various functions, such as indirect communication, delegated discovery, message forwarding and routing to a destination NF / NF service, message forwarding and routing to a next-hop SCP, communication security (e.g., authorization of NF service consumers to access NF service producer APIs), load balancing, monitoring, overload control, and other such functions. The SCP may optionally interact with the UDR to resolve the UDM Group ID / UDR Group ID / AUSF Group ID / PSF Group ID / CHF Group ID / HSS Group ID based on the UE identity (e.g., SUPI or IMPI / IMPU). The SCP may be deployed in a distributed manner. There may be more than one SCP in the communication path between NF services. The SCP may be deployed at the PLMN level, the shared slice level, and the specific slice level. In order to enable the SCP to route messages through several SCPs (i.e., next SCP hop discovery), the SCP may register its profile in the NRF. Alternatively, a local configuration may be used. The load balancing, monitoring, and overload control functions provided by the SCP remain to be implemented. Therefore, the examples of the present disclosure may include novel enhancements to the functions provided by traditional SCPs.

[0044] refer to Figure 2A-2B, the NTMD can perform any number of functions, such as providing effective overload protection within the 5G core network described herein. The NTMD in this example includes a processor 202, a memory 204, and a communication interface 206 coupled together by a bus, although in other configurations, the NTMD may include other types or numbers of elements. In addition, although the NTMD is described herein as a device, it should be understood that in some embodiments, the NTMD may be virtualized and some or all of the functions of the NTMD described herein may be embodied in the form of software.

[0045] The processor 202 of the NTMD may execute programmed instructions stored in the memory 204 of the NTMD to implement any number of the functions described and illustrated herein. For example, the processor 202 of the NTMD may include one or more central processing units (CPUs) or a general purpose processor having one or more processing cores, although other types of processors may also be used.

[0046] The memory 204 of the NTMD stores these programming instructions for one or more aspects of the present technology described and shown herein, but some or all of the programming instructions may be stored elsewhere. Various different types of memory storage devices (e.g., RAM, ROM, hard disk, solid state drive, flash memory, or other computer readable media that is read and written by a magnetic, optical or other read-write system coupled to a processor) may be used for the memory.

[0047] Thus, the memory of the NTMD may store one or more modules, which may include computer executable instructions that, when executed by the NTMD, cause the NTMD to perform actions such as sending, receiving, or otherwise processing network messages, and to perform the following references: Figure 3-5 Other actions described and shown. These modules can be implemented as components of other modules. In addition, modules can be implemented as applications, software programs, operating system extensions, plug-ins, etc.

[0048] Further, the modules may be run in a cloud-based computing environment. These modules may be executed within or as a virtual machine or virtual server managed in a cloud-based computing environment. In addition, these modules, and even the NTMD itself, may be located in a virtual server running in a cloud-based computing environment, rather than being bound to one or more specific physical network computing devices. In addition, these modules may be run in one or more virtual machines executed on a secure server device. In addition, in one or more examples of the technology, the virtual machines running on the NTMD may be managed or supervised by a hypervisor.

[0049] In this particular example, the memory of the NTMD includes a load monitoring module 210. According to some examples, the load monitoring module 210 can monitor the load at the producer NF. According to some embodiments, the load monitoring module 210 can monitor the load by receiving a message from the producer NF reporting its load. In some embodiments, the load monitoring module can monitor the load at the producer NF by parsing the SBA response from the producer NF. For example, as will be understood by one of ordinary skill in the art, the SBI response from the producer NF has 3gPP-specific HTTP2 headers, "3gpp-sbi-lci" and "3gpp-sbi-oci", which provide a measure of the load / overload at the producer NF.

[0050] In some embodiments, the NTMD may be located between the consumer NF and the producer NF, so that messages transmitted between the two can be received or intercepted. According to some embodiments, the NTMD may be connected to one or more consumer NFs and one or more producer NFs. Therefore, in some embodiments, the load monitoring module 210 may be configured to simultaneously monitor the loads of multiple producer NFs connected thereto.

[0051] The memory 204 of the NTMD may also include an overload identification module 212. The overload identification module 212 may be configured to identify when an overload occurs on one or more producer NFs to which it is connected. According to some embodiments, the overload identification module may determine that a particular consumer NF is overloaded when the network message queue capacity of the particular consumer NF is filled beyond a predetermined threshold (e.g., 90%).

[0052] In some embodiments, the overload identification module 212 may also be configured to monitor multiple types of network traffic flowing to one or more producer NFs. The type of network traffic may be network traffic associated with a specific event type or event category. For example, Figure 4A and 4BA table showing various exemplary event types is shown, including, for example, a create session event type, a release session event type, an Xn handover event type, an N2 handover event type, a 4G to 5G handover event type, a WLAN to 5G handover event type, a UE requested session modification event type, a UE requested idle to active event type, and a radio access network (RAN) requested active to idle event type. Thus, for example, all network messages associated with a handover event from 4G to 5G may be associated with a 4G to 5G handover event type. According to some embodiments, the overload identification module may be configured to classify network messages into their respective event types based on headers and / or metadata associated with the network messages. As will be appreciated by those of ordinary skill in the art, the 3GPP standard defines specific message types for different types of events, and similarly, based on the message type, the overload identification module may be configured to determine which type of event, and therefore which type of network traffic a particular message / request involves, which may allow separate monitoring of different types of network traffic. It will be appreciated that the multiple pieces of information provided in the network message may be used to identify the message and / or event type to which the network message involves. For example, the API name in the HTTP2 URI header can be used together with some specific properties in the Json payload to help identify whether the message belongs to a specific event, such as 4G to 5G handover or other event types.

[0053] In some embodiments, the overload identification module can be configured to separate network traffic by event type and monitor the traffic flowing to the overloaded producer NF by event type. For example, the overload identification module can determine the amount of network traffic of the create session type flowing to a given producer NF, the amount of network traffic of the publish session type flowing to the producer NF, the amount of network traffic of the Xn switch type flowing to the producer NF, etc. In addition, the overload identification module can be configured to identify one or more types of overloaded network traffic. In other words, the overload identification module can be configured to identify which (which) traffic types are experiencing higher than normal traffic, which may cause overload at the producer NF. In order to determine what is higher than normal, the overload identification module can be configured to compare the amount of each type of network traffic flowing to the producer NF with the corresponding first baseline amount, and determine whether it exceeds the first predetermined threshold above the first baseline amount. As will be understood by those of ordinary skill in the art, the baseline amount of traffic can be the range of expected traffic of a specific type that can be determined using historical data. To determine if a particular type of traffic is abnormally high, the overload identification module may take the maximum value of the expected traffic range (i.e., the baseline amount) and add it to a predetermined threshold and determine if the traffic exceeds the sum of the two. If so, the overload identification module may identify the particular type of network traffic as an "overloaded network traffic type," meaning that the network traffic of this type is significantly more than the typical traffic flowing to the producer NF, and therefore this traffic type is likely to be the culprit for the overload condition at the producer NF. Each type of network traffic may have its own baseline level of traffic and its own predetermined threshold for determining if the traffic type is overloaded.

[0054] According to some embodiments, the overload identification module may also be configured to identify overloaded sessions. An overloaded session may be an active session that provides a network request / message flow to an overloaded producer NF, the network request / message flow including traffic of an overloaded traffic type, and whose amount exceeds a second threshold amount above a second baseline amount of network traffic. In other words, as will be appreciated by those skilled in the art, for a particular session, there may be a baseline level of a particular traffic type that is considered to be within a normal range (e.g., based on historical data), and the overload identification module may be configured to identify sessions that are generating abnormally high levels of a particular type of traffic (i.e., an overloaded network traffic type) for a single session, which may be determined by comparing the amount of that type of traffic generated by the session to determine whether it exceeds the second baseline amount of network traffic plus a second threshold amount. According to some embodiments, there may be different baseline amounts of network traffic and / or different threshold amounts for each type of traffic generated in association with a particular session. If the overload identification module determines that a particular session includes network traffic with an overloaded producer NF, the overloaded producer NF being an overloaded network traffic type, whose amount exceeds the second baseline amount plus the second threshold amount, the NTMD may identify the session as an overloaded session. This way, NTMD can identify sessions that may cause the overloaded producer NF to experience overload.

[0055] The memory 204 of NTMD may also include an overload mitigation module 214, which may perform mitigation actions to reduce the network traffic of the identified overloaded sessions. For example, in some embodiments, NTMD may determine a list of overloaded sessions, and then, based on the degree of abnormally high traffic presented by each session, each session may be placed in one of a plurality of mitigation categories with associated mitigation actions. For example, for sessions placed in the first mitigation category, NTMD may rate limit requests associated with / derived from the session. For sessions placed in the second mitigation category, NTMD may reject all requests associated with / derived from the session. For sessions placed in the third mitigation category, NTMD may reject all messages / requests associated with / derived from the session, and send an error code to the consumer NF (for example, in the case where the producer NF is an SMF, NTMD may send an error message to AMF), so that the consumer NF may take further mitigation actions, for example, blocking the registration of the UE for a specified duration, or sending a backoff indication to the UE to force it to delay sending the next message. Additionally, in some embodiments, the NTMD can identify UE devices associated with an overloaded session (e.g., based on a subscription permanent identifier (SUPI) and / or IP address contained in network traffic associated with the session) so that network traffic from specific UE devices causing the overload at an overload producer NF can be specifically targeted for mitigation.

[0056] although Figure 2A-2B Only a single NTMD and a single NF (e.g., AMF, SMF, etc.) are depicted, and it should be understood that the expected system architecture may include many of each. For example, there may be many NTMDs communicating with various producer NFs and consumer NFs. In some embodiments, in addition to the NTMDs that communicate with various producer NFs, a given producer NF may communicate with multiple NTMDs. Therefore, according to some embodiments, multiple NTMDs may monitor the load of the same producer NF simultaneously, and each NTMD may independently perform the functions described herein. Therefore, in some cases, different NTMDs may simultaneously perform mitigation actions on different sessions interacting with the same overloaded producer NF.

[0057] The communication interface 206 of the NTMD is operable to couple and communicate between the NTMD and various other NFs, such as AMF, SMF, UDM, AF, PCF, NRF, AUSF, and NEF, and further allows communication with UE, R (AN), UPF, and DN, such as Figure 2B As shown. According to some embodiments, some or all of the NFs may be executed as software on a single device that may be configured to allow communication between the NFs. According to some embodiments, the communication interface 206 may be coupled to a communication network that allows communication with the NFs, and the NFs may be located on a separate device that is different from the NTMD and other external devices such as UE, R(AN), and DN devices. According to some embodiments, the NTMD may be a separate physical device. However, in some embodiments, the enhancements disclosed herein may alternatively be embodied in a software component that may be uploaded to a device such as an SCP. In some embodiments, similar software modules may work in conjunction with other devices similar to the SCP that may act as a load balancer agent.

[0058] As an example only, the communication network may include a local area network (LAN) or a wide area network (WAN), and may use Ethernet and TCP / IP on industry standard protocols, but other types or numbers of protocols or communication networks may also be used. The communication network in this example may use any suitable interface mechanism and network communication technology, including, for example, any suitable form of telecommunication (e.g., voice, modem, etc.), a public switched telephone network (PSTN), an Ethernet-based packet data network (PDN), combinations thereof, and the like.

[0059] Although the NTMD shown in this example includes a single device, the NTMD in other examples may include multiple devices or blade servers, each of which has one or more processors (each processor has one or more processing cores) that implement one or more steps of the present technology. In these examples, one or more devices may have a dedicated communication interface or memory. Alternatively, one or more devices may utilize other hardware or software components of one or more other devices included in the memory, communication interface, or network traffic management.

[0060] In addition, in other examples, one or more devices that together constitute the network traffic management can be independent devices, or integrated with one or more other devices or apparatuses, such as one or more server devices. In addition, one or more devices of the NTMD in these examples can be located in the same or different communication networks, such as including one or more public, private or cloud networks.

[0061] Although the NTMD is shown as a single device, one or more actions of each NTMD may be distributed across one or more different network computing devices that together constitute one or more NTMDs. Furthermore, the NTMD is not limited to a particular configuration. Thus, the NTMD may include network computing devices that operate using a master / slave approach, whereby one operation of the NTMD's network computing devices manages or coordinates the operations of other network computing devices. For example, the NTMD may operate as multiple network computing devices within a cluster architecture, a peer-to-peer architecture, a virtual machine, or a cloud architecture.

[0062] Therefore, the techniques disclosed herein should not be construed as limited to a single environment, and other configurations and architectures may also be envisioned. For example, in some embodiments, one or more modules of NTMD may be an integrated software component of a device such as NTMD or SCP. In some embodiments, one or more modules of NTMD may run as a standalone container in a cloud-based deployment and may interact with NTMD, SCP, or any other agent. In some embodiments, one or more modules of NTMD may be implemented in a separate device located before NTMD / SCP / other agents in the network. In some embodiments, one or more NTMD modules described herein may be part of a non-standard NF load balancer / agent.

[0063] The user equipment (UE) devices of the 5G network architecture in this example include any type of computing device that can exchange network data, such as mobile, desktop, laptop or tablet computing devices, virtual machines (including cloud-based computers), etc. Each UE device includes a processor, memory, and communication interface coupled together by a bus or other communication link (not shown), although other numbers or types of components may also be used.

[0064] The UE device may run an interface application, such as a standard web browser or a standalone client application. The interface application may provide an interface to request one or more server devices as part of a data network (DN) and receive content stored thereon. The UE device may also include a display device (e.g., a display screen or a touch screen) or an input device (e.g., a keyboard (not shown)).

[0065] Although an exemplary 5G system architecture with NTMD, UE devices, R(AN), DN and various NFs is described and shown herein, other types or numbers of systems, devices, components or elements in other topologies may be used. It should be understood that the example systems described herein are for example purposes, and as will be understood by those skilled in the relevant art, many variations of specific hardware and software for implementing the examples are possible.

[0066] For example, one or more components in the 5G system architecture (e.g., NTMD and various NFs) can be configured to run as virtual instances on the same physical machine. In other words, one or more NTMDs and various NFs can run on the same physical device instead of as separate devices that communicate through a communication network. Figure 2A-2B More or fewer NTMDs or various NF instances are shown.

[0067] In addition, two or more computing systems or devices may replace any one of the systems or devices in any of the examples. Therefore, the principles and advantages of distributed processing, such as redundancy and replication, may also be implemented as needed to increase the robustness and performance of the devices and systems of the examples. These examples may also be implemented on a computer system extended to any suitable network using any suitable interface mechanism and traffic technology, including, by way of example only, wireless traffic networks, cellular traffic networks, packet data networks (PDNs), the Internet, intranets, and combinations thereof.

[0068] As described and illustrated by examples herein, for one or more aspects of the present technology, the examples may also be embodied as one or more non-transitory computer-readable media having instructions stored thereon, such as in a memory of the NTMD. The instructions in some examples include executable code that, when executed by one or more processors (e.g., a processor of the NTMD), may cause the processor to perform the steps necessary to implement the methods of the examples of the present technology described and illustrated herein.

[0069] An exemplary method for providing effective overload protection in a 5G core network will be described with reference to FIGS. 1-5. Figure 5 , a flow chart of an example method 500 for providing effective overload protection in a 5G core network is shown. In step 502 of this example, the NTMD may monitor the load at the producer network function (NF). For example, as described above with reference to Figure 3 As described, the NTMD may include a load monitoring module that allows it to monitor the load on one or more producer NFs (e.g., by parsing SBA responses from the producer NFs). According to some embodiments, the NTMD may be a service communication proxy (SCP) device that has been modified to perform the functions described herein.

[0070] In step 504, in response to determining that the producer NF is overloaded, multiple types of network traffic flowing to the overloaded producer NF are monitored (e.g., using the above reference Figure 3 Each of the plurality of types of network traffic may correspond to network traffic associated with a different event type of the plurality of event types.

[0071] According to some embodiments, the method may include determining that the producer NF is overloaded in response to determining that the load on the producer NF exceeds a predetermined threshold load.

[0072] According to some embodiments, the multiple event types may include two or more of the following: a create session event type; a publish session event type; an Xn switching event type; an N2 switching event type; a 4G to 5G switching event type; a WLAN to 5G switching event type; a UE-requested session modification event type; a UE-requested idle to active event type; or a RAN-requested active to idle event type.

[0073] In step 506, the NTMD may identify an overloaded network traffic type. The overloaded network traffic type may be one type of network traffic among multiple types of network traffic flowing to the producer NF, including an amount of network traffic exceeding a first threshold amount above a first baseline amount of network traffic.

[0074] According to some embodiments, the first baseline amount of network traffic may be a maximum total amount of network traffic of an overloaded network traffic type that is expected to flow to the producer NF under normal operation during a first specified time period. In other embodiments, the first baseline amount may be an average of a range of network traffic of an overloaded network traffic type that is expected to flow to the producer NF under normal operation during the first specified time period. According to some embodiments, the range of normal or expected traffic for a given type of traffic may be determined using historical data or by modeling the system.

[0075] In step 508, the NTMD may identify an overloaded session. An overloaded session may be one of a plurality of sessions active on / connected to the producer NF. An overloaded session may be a session for which an amount of network traffic including an overloaded network traffic type exceeds a second threshold amount above a second baseline amount of network traffic.

[0076] According to some embodiments, the second baseline amount of network traffic may be a maximum amount of network traffic of an overloaded network traffic type expected to flow to the producer NF under normal operation associated with a single session during a second specified time period. According to some embodiments, the first and second specified time periods may be the same.

[0077] In step 510, the NTMD may perform mitigation actions to reduce network traffic for the identified overloaded session. For example, as described above, the identified overloaded session may be placed in one of a plurality of predefined mitigation categories based on the degree of excess network traffic caused by the identified overloaded session. Each of the predefined mitigation categories may have associated mitigation actions, such as, but not limited to, limiting the rate of session requests, rejecting requests and / or messages for the session, and providing an error code to an upstream consumer NF to allow the consumer NF to take further mitigation actions for the identified overloaded session.

[0078] According to some embodiments, the method may further include obtaining a user equipment (UE) identifier from data associated with the identified overloaded session and identifying a user equipment device associated with the session. In some embodiments, the UE identifier may include a subscription permanent identifier (SUPI) and / or an IP address associated with the UE. By identifying UE devices associated with one or more overloaded sessions, the system may take mitigation actions for specific devices that cause the producer NF to be overloaded. Thus, in some embodiments, performing mitigation actions may include reducing network traffic from the identified UE devices.

[0079] Utilizing this technique, effective overload protection can be provided within the 5G core network. The system can advantageously identify specific sessions / UEs that are the primary cause of network traffic overload at the producer NF and take mitigation actions only for those identified sessions / UEs. In this way, the system can provide an effective way to prevent overload by targeting only faulty / bad actors, which can provide a quick resolution to the overload condition. Additionally, restrictions on sessions / UEs that are not the cause of the overload can be avoided, allowing innocent (i.e., non-overload cause) users to avoid being penalized (e.g., restricted) for the actions of others. Furthermore, the system can also be advantageously used to diagnose system design errors and issues with specific nodes or devices that may be causing overloads without knowing it, so that these issues can be addressed and fixed.

[0080] Having described the basic concepts of the present invention, it will be readily apparent to those skilled in the art that the above detailed disclosure is intended to be illustrative only and not limiting. Although not expressly described herein, various changes, improvements, and modifications will occur to those skilled in the art. These changes, improvements, and modifications are intended to be suggested and are within the spirit and scope of the present invention. Furthermore, the described order of processing elements or sequences, or the use of numbers, letters, or other names, is not intended to limit the claimed process to any order unless otherwise specified in the claims. Therefore, the present invention is limited only by the following claims and their equivalents.

Claims

1. A method implemented by a network traffic management system including one or more network traffic management devices and a network function (NF), the method comprising: Monitor the load at the producer NF; In response to determining that the producer NF is overloaded, monitoring a plurality of types of network traffic flowing to the overloaded producer NF, wherein each of the plurality of types of network traffic corresponds to network traffic associated with a different event type of a plurality of event types; identifying an overloaded network traffic type, wherein the overloaded network traffic type includes a type of network traffic among the plurality of types of network traffic flowing to the producer NF, the type of network traffic including an amount of network traffic exceeding a first threshold amount above a first baseline amount of network traffic; identifying overloaded sessions, wherein the overloaded sessions include sessions that include an amount of network traffic of the overloaded network traffic type that exceeds a second threshold amount above a second baseline amount of network traffic; and Mitigation actions are performed to reduce network traffic from identified overloaded sessions.

2. The method according to claim 1, further comprising: obtaining a user equipment (UE) identifier from data associated with the identified overloaded session; as well as identifying a user equipment device associated with the session based on the user equipment identifier; Wherein performing the mitigation action to reduce network traffic from the identified overloaded session includes reducing network traffic from the identified user equipment device.

3. The method according to claim 1, wherein: The multiple event types include two or more of the following: Create a session event type; Publish session event type; Xn switch event type; N2 switching event type; 4G to 5G handover event type; WLAN to 5G handover event type; The type of session modification event requested by the UE; Idle to active event type requested by the UE; or Active to idle event type requested by the RAN.

4. The method according to claim 1, wherein: The first baseline amount of network traffic includes a maximum total amount of network traffic of the overloaded network traffic type that is expected to flow to the producer NF under normal operation during a first specified time period, and the second baseline amount of network traffic includes a maximum amount of network traffic of the overloaded network traffic type that is expected to flow to the producer NF under normal operation associated with a single session during a second specified time period.

5. The method according to claim 1, further comprising: In response to determining that the load on the producer NF exceeds a predetermined threshold load, determining that the producer NF is overloaded; Wherein, monitoring the load at the producer NF includes parsing an SBA response from the producer NF.

6. A network traffic management device comprising a memory and one or more processors, the memory including programming instructions stored thereon, the one or more processors being configured to execute the stored programming instructions to: Monitor the load at the producer network function (NF); In response to determining that the producer NF is overloaded, multiple types of network traffic flowing to the overloaded producer NF are monitored, wherein: Each of the plurality of types of network traffic corresponds to network traffic associated with a different event type of the plurality of event types; identifying an overloaded network traffic type, wherein the overloaded network traffic type includes one type of network traffic among a plurality of types of network traffic flowing to the producer NF, the type of network traffic including an amount of network traffic exceeding a first threshold amount above a first baseline amount of network traffic; identifying overloaded sessions, wherein the overloaded sessions include sessions having an amount of network traffic of the overloaded network traffic type exceeding a second threshold amount above a second baseline amount of network traffic; and Mitigation actions are performed to reduce network traffic from identified overloaded sessions.

7. The device according to claim 6, wherein: The one or more processors are further configured to execute stored programming instructions to: obtaining a user equipment (UE) identifier from data associated with the identified overloaded session; and identifying a user equipment device associated with the session based on the user equipment identifier; Wherein performing the mitigation action to reduce network traffic from the identified overloaded session includes reducing network traffic from the identified user device.

8. The device according to claim 6, wherein: The multiple event types include two or more of the following: Create a session event type; Publish session event type; Xn switch event type; N2 switching event type; 4G to 5G handover event type; WLAN to 5G handover event type; The type of session modification event requested by the UE; Idle to active event type requested by the UE; or Active to idle event type requested by the RAN.

9. The device according to claim 6, wherein: The first baseline amount of network traffic includes a maximum total amount of network traffic of the overloaded network traffic type that is expected to flow to the producer NF under normal operation during a first specified time period, and the second baseline amount of network traffic includes a maximum amount of network traffic of the overloaded network traffic type that is expected to flow to the producer NF under normal operation associated with a single session during a second specified time period.

10. The device according to claim 6, wherein: The one or more processors are further configured to execute stored programming instructions to: In response to determining that the load on the producer NF exceeds a predetermined threshold load, determining that the producer NF is overloaded; Wherein, monitoring the load at the producer NF includes parsing an SBA response from the producer NF.

11. A non-transitory computer readable medium having stored thereon instructions, the instructions comprising executable code which, when executed by one or more processors, causes the one or more processors to: Monitor the load at the producer network function (NF); In response to determining that the producer NF is overloaded, multiple types of network traffic flowing to the overloaded producer NF are monitored, wherein: Each of the plurality of types of network traffic corresponds to network traffic associated with a different event type of the plurality of event types; identifying an overloaded network traffic type, wherein the overloaded network traffic type includes one type of network traffic among a plurality of types of network traffic flowing to the producer NF, the type of network traffic including an amount of network traffic exceeding a first threshold amount above a first baseline amount of network traffic; identifying overloaded sessions, wherein the overloaded sessions include sessions that include an amount of network traffic of the overloaded network traffic type that exceeds a second threshold amount above a second baseline amount of network traffic; and Mitigation actions are performed to reduce network traffic from identified overloaded sessions.

12. The non-transitory computer readable medium of claim 11, comprising further instructions which, when executed by the one or more processors, cause the one or more processors to: obtaining a user equipment (UE) identifier from data associated with the identified overloaded session; and identifying a user equipment device associated with the session based on the user equipment identifier; in, Performing the mitigation action to reduce network traffic from the identified overloaded session includes reducing network traffic from the identified user equipment device.

13. The non-transitory computer readable medium of claim 11, wherein: The multiple event types include two or more of the following: Create a session event type; Publish session event type; Xn switch event type; N2 switching event type; 4G to 5G handover event type; WLAN to 5G handover event type; The type of session modification event requested by the UE; Idle to active event type requested by the UE; or Active to idle event type requested by the RAN.

14. The non-transitory computer readable medium of claim 11, wherein: The first baseline amount of network traffic includes a maximum total amount of network traffic of the overloaded network traffic type that is expected to flow to the producer NF under normal operation during a first specified time period, and the second baseline amount of network traffic includes a maximum amount of network traffic of the overloaded network traffic type that is expected to flow to the producer NF under normal operation associated with a single session during a second specified time period.

15. The non-transitory computer readable medium of claim 11, comprising further instructions that, when executed by the one or more processors, cause the one or more processors to: In response to determining that the load on the producer NF exceeds a predetermined threshold load, determining that the producer NF is overloaded; in, Monitoring the load at the producer NF includes parsing the SBA response from the producer NF.

16. A network traffic management system comprising one or more network traffic management devices and network functions (NFs) having a memory and one or more processors, the memory including programming instructions stored thereon, the one or more processors being configured to be able to execute the stored programming instructions to: Monitor the load at the producer NF; In response to determining that the producer is overloaded, multiple types of network traffic flowing to the overloaded producer NF are monitored, wherein: Each of the plurality of types of network traffic corresponds to network traffic associated with a different event type of the plurality of event types; identifying an overloaded network traffic type, wherein the overloaded network traffic type includes one type of network traffic among a plurality of types of network traffic flowing to the producer NF, the type of network traffic including an amount of network traffic exceeding a first threshold amount above a first baseline amount of network traffic; identifying overloaded sessions, wherein the overloaded sessions include sessions that include an amount of network traffic of the overloaded network traffic type that exceeds a second threshold amount above a second baseline amount of network traffic; and Mitigation actions are performed to reduce network traffic from identified overloaded sessions.

17. The system of claim 16, wherein: The one or more processors are further configured to execute stored programming instructions to: obtaining a user equipment (UE) identifier from data associated with the identified overloaded session; and identifying a user equipment device associated with the session based on the user equipment identifier; Wherein performing the mitigation action to reduce network traffic from the identified overloaded session includes reducing network traffic from the identified user equipment device.

18. The system of claim 17, wherein: The multiple event types include two or more of the following: Create a session event type; Publish session event type; Xn switch event type; N2 switching event type; 4G to 5G handover event type; WLAN to 5G handover event type; The type of session modification event requested by the UE; Idle to active event type requested by the UE; or Active to idle event type requested by the RAN.

19. The system of claim 18, wherein: The first baseline amount of network traffic includes a maximum total amount of network traffic of the overloaded network traffic type that is expected to flow to the producer NF under normal operation during a first specified time period, and the second baseline amount of network traffic includes a maximum amount of network traffic of the overloaded network traffic type that is expected to flow to the producer NF under normal operation associated with a single session during a second specified time period.

20. The system of claim 16, wherein: The one or more processors are further configured to execute stored programming instructions to: In response to determining that the load on the producer NF exceeds a predetermined threshold load, determining that the producer NF is overloaded; Wherein, monitoring the load at the producer NF includes parsing an SBA response from the producer NF.

Images