Method and device for managing a communication

Abstract

The invention relates to a method for managing a communication applied to at least one software application (MSI) of a cellular network, the at least one software application (MSI) being deployed in a cloud computing environment, the method being implemented by an agent (Agt) external to the software application (MSI) and comprising: - associating an instantiated observation program with an environment of the at least one software application, - selecting a datum associated with the communication by means of a context parameter relating to the environment, from a set of data examined by means of the observation program associated with the at least one software application.

Description

Method and device for managing communication

[0001] This disclosure falls within the general field of communications, where data flows are routed through a virtualized architecture. For example, such an invention can be implemented in a cloud computing context. More specifically, the invention aims to implement an end-to-end data flow observability solution, thus providing enhanced monitoring capabilities, in order to enrich network management metrics without impacting the services offered by the cloud infrastructure.

[0002] Communication network architectures increasingly rely on cloud infrastructures in which network services and functions are instantiated on virtual machines and, even more commonly, in containers. Network services and functions are thus structured as microservices in a cloud-native architecture. This cloud-native architecture, in which a microservice contributing to an application service or network function is instantiated in a container, enables faster service deployment, easier infrastructure scalability, and simplified enhancement, modification, or reconfiguration of an existing service or function.

[0003] In the specific case of deploying an xG system (e.g., 5G) to provide an xG service, the functions (e.g., addressing, routing, security) contributing to the implementation of this xG service are increasingly instantiated in a cloud-native architecture. These functions, also called Cloud Native Network Functions (CNFs), deployed in this type of architecture must be manageable and monitorable. This observability, which involves collecting data to deduce the state or behavior of an xG system, must be based on data specific to the cloud technologies used, as well as data from the protocols used by the xG system's network functions.

[0004] Prior art techniques used in these cloud-native infrastructures involve the use of observability solutions for cloud-native applications, which focus on collecting three types of data: metrics, logs, and distributed traces. These solutions can be intrusive, requiring instrumentation of the observed object (e.g., the application or infrastructure) and modification of the code of the observed functions, or non-intrusive, requiring no modification of the code of the observed network functions. Furthermore, traditional solutions used for managing telecommunications networks, such as traffic / port mirroring solutions that replicate application data, are also not suitable for a cloud-native architecture designed to enable more dynamic and denser services.

[0005] These techniques, used independently of the application or applications for which the microservices are instantiated in the containers, have some limitations in the context of a deployment of an xG network based on these technologies.

[0006] In particular, these techniques do not specifically address the protocols used for the operation of the xG core network, including but not limited to NGAP (Next Generation Application Protocol), PFCP (Packet Forwarding Control Protocol), GTP-U (User Plane GPRS Tunneling Protocol), and generically the protocols related to NAS (Non Access Stratum) access. Even when these protocols are possibly observable, as described in the document https: / / ieeexplore.ieee.org / document / 10154433, for example, this solution does not allow the observation of encrypted protocols or the correlation of observed information on each of the observed protocols, and for example, the observation of end-to-end traffic, whether that traffic is encrypted or unencrypted.

[0007] Implementing microservices in xG system architectures can lead to increased susceptibility to performance unpredictability due to the interdependence of network functions instantiated in containers. Existing solutions can also introduce additional latency and processing overhead, which can degrade the user experience.

[0008] The high density and dynamism of services in a cloud-native xG infrastructure make manual examination of system interactions both time-consuming and error-prone, as well as correlation between analyses performed on different functions, difficult. Effective observability of the network, associated protocols, and deeper insights into interactions between protocol data are necessary to manage this complexity.

[0009] The present invention aims to provide improvements over the prior art.

[0010] The purpose of this disclosure is to address some or all of the limitations of prior art solutions, including those described above, by proposing a solution that enables non-intrusive observation of data related to communication protocols on an xG network, including encrypted protocols, based on a cloud computing infrastructure, in addition to data specific to that infrastructure. This solution aims to generate distributed traces, logs, and metrics, including for encrypted protocols, to provide comprehensive visibility into the operation of the network and the underlying infrastructure, and in particular to enable end-to-end observation of a service or application.

[0011] To this end, a method is proposed for managing instantiated communication using at least one software application of a cellular network, said at least one software application being deployed in a cloud computing environment, said method being implemented by an agent external to the at least one software application and comprising: Activating an observation program instantiated on an environment of the at least one software application, Selecting data associated with a protocol used for implementing communication via the cellular network by means of a context parameter relating to the environment, from a set of data examined by means of the observation program activated on the at least one software application, the selected data being suitable for an analysis of the operation of the cellular network.

[0012] The management process thus allows for the selection of data and potentially the propagation of the context of exchanges in the form of identifiers within messages exchanged between software applications or obtained from user libraries of those applications in order to generate traces. These traces make it possible, in particular, to observe the dependencies between incoming and outgoing communications at the level of each software application and to have end-to-end visibility of a service, an application, or a user communication by selecting only the data specific to the context for which the selection is made. The information in a library can correspond to files, functions, scripts, and routines that can be referenced and executed by software applications to implement a specific function for a particular need or in a specific context.Obtaining such data, for example in addition to communication protocol data, allows for enhanced monitoring of an application, service, or user communication, thereby enabling troubleshooting, the anticipation of future problems, and system administration, such as adding, removing, or replacing system software applications. A context parameter can therefore be associated with these files, functions, scripts, and routines of the software application.

[0013] The management process thus allows for the specific selection of packets, messages, or datagrams from one or more protocols of a cellular network, such as a 5G network. The use of an external agent, for example, composed of a core agent and a user agent, separate from the software application and specifically designed for trace analysis, preserves the software application's capabilities for the service for which it was deployed. This process enables the retrieval of data transmitted over a communication interface of the software application and / or within a user library of the software application, allowing for the selection of context-specific data to observe end-to-end communication.Current state-of-the-art solutions allow for the observation of data specific to a software application, but they do not allow for the aggregation or correlation of data potentially originating from distinct software applications based on an application and / or user context and / or an operator's routing context (for example, a network slice). The software application may be a microservice contributing to the implementation of a network function, or it may be the network function itself. The computing, transmission, or management capabilities of the software application are therefore not used to identify and select data specific to a communication context within a cellular network.This method allows for the distribution of an observation program, for example, in one or more containers, its activation on demand, and its ability to correlate data from different software applications without degrading their performance. Furthermore, because the agent is external to the software application, it is application-agnostic and can be used with software applications from different manufacturers or vendors. In addition, since the observation program is associated with the software application's environment—that is, activated (i.e., launched or executed) within the application—it can obtain data exchanged by the application as well as data stored by the application, for example, in user libraries, thus enabling the retrieval of this data prior to encryption.The program instantiation can, for example, take place within the kernel agent, while the association is handled by the user agent of the external agent. The monitoring program is thus installed within an agent in the software application's environment, such as a container. This program identifies and copies data exchanged by a software application, filtering this data by protocol, protocol family, or communication type. The monitoring program is installed on the agent to collect protocol data transmitted and received by one or more software applications within the container or the node hosting the container, depending on the environment, without modifying the software application or its code. The program is therefore installed within the environment but is external to the software application; it can be used to collect data from multiple software applications within the container or node.

[0014] The process allows for the analysis of selected network communications to extract relevant information and generate metrics and logs that track the behavior and proper functioning of the cellular network, such as a 5G network, and its components. For example, it is possible to correlate different data points from a protocol used to implement a cellular network and / or to correlate different data points from several protocols used to implement a cellular network. This enables monitoring of the cellular network's operation, and even the detection of potential anomalies or problems by analyzing variations in one or more protocol data points over time. It also allows for analyzing the impact of these anomalies on communications implemented via the cellular network.Thus, it is possible to analyze the functioning of the cellular network for the implementation of a communication. For example, it is possible to analyze the data of one or more cellular network protocols and determine whether these protocols and their instantiation within the cellular network guarantee the needs or constraints of one or more communications. By collecting and analyzing various selected data along a path within a cellular network, it is possible to determine whether this path, or a software application on the path, instantiates, as expected or required, an implementation of one or more protocols for a communication established via the cellular network.

[0015] There are no limits to the cellular network protocols that can be analyzed or observed, provided the data can be effectively identified and selected by the external agent. Specifically, the external agent, through the observation program, can select data, for example, to generate monitoring data. This includes telemetry data related to the NGAP, PFCP, and GTP-U protocols, HTTP / 2, and more broadly, NAS link protocols, as well as data from the software application library that is crucial for session management, signaling, and user data transport in a 5G network. This monitoring data can be distributed metrics, logs, or traces.

[0016] As an example, the management process may, for instance, select data from an environment that includes a session management protocol for a terminal connected to the cellular network, or a signaling or data transport protocol associated with a terminal connected to the cellular network.

[0017] According to one aspect of the invention, the management process observation program is an extended Berkeley Packet Filter program.

[0018] Preferably, extended Berkeley Packet Filter (eBPF) technology can be used as an observation program. This widely used observability technology does not require modifying the source code of the software application to be observed and analyzed.

[0019] According to another aspect, the external agent of the management process is previously instantiated in the cloud computing environment which also includes the software application.

[0020] The external agent, for example, consisting of a kernel agent and a user agent, can be advantageously installed in a container within the cloud computing environment. For instance, in a Kubernetes environment, the external agent can be distributed across one or more containers within a cluster, facilitating interaction with the software application also installed in the container and thus enabling a wider distribution of external agents within the environment. The external agent hosting the monitoring program is therefore located close to the software application without degrading its performance. The external agent can be specific to the need, for example, to obtain context-specific data and potentially modify the data by adding a context identifier to facilitate subsequent correlation of the different data points.

[0021] According to another aspect of the management process, the dataset being examined is encrypted and the observation program is adapted to select data from the encrypted set.

[0022] The management process can advantageously select encrypted data, particularly by leveraging access to user libraries. This eliminates the need for the agent to hold encryption keys, as the data is retrieved from the libraries before encryption and / or after decryption. Another option for selecting encrypted data is to monitor encrypted traffic at the software application interfaces using a decryption key associated with the key used to encrypt the data.

[0023] According to another aspect of the management process, the context parameter is configured by the external agent based on information relating to an application and / or a user and / or routing information present in a message relating to the environment of said software application.

[0024] The management process can advantageously include configuring the context parameter based on information it has determined from the activated program. Thus, if the objective is to have an end-to-end view of an application, a user communication, or message routing, the external agent can configure the context parameter based on information transmitted in a communication protocol. For example, it can identify information such as the PID (process identifier), thread ID (thread identifier), socket ID (socket identifier), and transport layer information (IP address pair and port number pair).From one or more of these identifiers, and other potentially usable information, a context parameter can be generated and possibly propagated in messages, for example, in specific fields of the protocols implemented in the network. For HTTP / 2, standardized fields called "headers" are used, for instance. For other 5G protocols (particularly PFCP and NGAP), the context parameter is propagated in standardized fields called "Information Elements" (IE), allowing an entity to then correlate different messages and information based on this context parameter. Specifically, the context parameter can consist of information relating to an application.

[0025] According to another aspect, the environment includes a communication interface for at least one software application and / or a library associated with the software application.

[0026] The messages exchanged on a communication interface alone may not be sufficient to observe an application or end-to-end communication. In particular, when communication protocols are encrypted, it is advantageous to be able to obtain information from user libraries and thus access data before or after encryption. If only the exchanged messages were used, the external agent would, for example, need to possess a decryption key associated with the encryption key used to encrypt the message, which is difficult to implement. Even if possible, this solution poses a security problem related to the dissemination of such decryption keys. Furthermore, obtaining data from libraries can enrich the analysis of end-to-end communication.

[0027] According to another aspect, the management process further includes a selection of at least one second piece of data associated with the communication by means of a context parameter relating to an environment of at least one second software application, from a set of data examined by means of the activation program associated with at least one second software application.

[0028] The method can advantageously include the selection of multiple data points, possibly associated with distinct software applications and obtained from communication protocols on distinct communication interfaces and / or libraries. This makes it possible to select and correlate distinct data points from different protocols and software applications, but sharing the same context (user, application, network slice), allowing for end-to-end traffic observation by selecting data from software applications contributing to the routing and processing of data sharing this context.

[0029] According to another aspect of the management process, the software application of the management process is a microservice of a piece of equipment in the cellular network.

[0030] The software application can be a component of a network function, such as a microservice, or the network function itself. The software application can therefore be any function or component of a function instantiated in software form and interfacing with other components using a cellular network protocol.

[0031] According to another aspect of the management process, the selected data is transmitted to a cellular network observability entity communicating with the external agent for aggregation by the observability entity with other data associated with the communication and its use for cellular network management.

[0032] The selection of data specific to a user, application, or operator context can advantageously be transmitted, for example via a specific protocol or by inserting it into an existing protocol, to an observability entity that will be able to aggregate the context-specific data and thus use it to administer, control, and possibly modify the cellular communication network.

[0033] According to another aspect, the management process may also include the generation of a control message based on the selected data and sent to the observability entity.

[0034] To monitor end-to-end communication or services, an external agent can generate a control message that it transmits to a tracing or observability entity. This allows the entity to be specifically informed of events related to the communication or service, based on information selected from various protocols and software applications. The control message can thus be specific to trace analysis and include data selected by the agent for use by an analysis and / or correlation entity.

[0035] According to another aspect of the management process, the context parameter is extracted from a header or data of a cellular network communication protocol.

[0036] In particular, when the environment includes a communication interface, the context parameter can be extracted from a communication protocol carried over the communication interface. This can be information from a protocol header or information from a data field of the protocol.

[0037] According to another aspect, the management process further includes a selection of data representative of the consumption of a resource of the software application and of the hosting entity in which the software application is instantiated in the cloud computing environment.

[0038] Data specific to cellular network protocols may not be sufficient to identify a malfunction in an IT environment used to deploy a cellular network. Selecting data related to the operation of the software application, regardless of the service it contributes to, and the entity hosting the software application (for example, a container), can complement the selected protocol-specific data, particularly to improve the understanding of a cause of cellular network malfunction. Data representative of the hosting entity includes, in particular, data specific to the virtual machines hosting the containers, as well as the physical server hosting the virtual machine hosting the containers. Indeed, hosting-specific data can be used to analyze an anomaly, both reactively and proactively.

[0039] The various aspects of the management process that have just been described can be implemented independently of each other or in combination with each other.

[0040] The invention further relates to a device for managing communication instantiated by means of at least one software application of a cellular network, said at least one software application being deployed in a cloud computing environment, said device comprising a processor coupled to a memory in which are stored program instructions intended to be executed by the processor to activate an observation program instantiated on an environment of at least one software application, and to select a data associated with the communication by means of a context parameter relating to the environment, from a set of data examined by means of the observation program activated on at least one software application.

[0041] In one respect, the management system is also adapted to send a message, developed from the selected data, to an observability entity.

[0042] In another respect, the device is suitable for configuring the context parameter to be added to a message transmitted to a software application.

[0043] This management system is suitable for implementing the management process just described in all its modes of realization.

[0044] The invention also relates to a computer program product comprising a set of program code instructions which, when executed by at least one processor, configure said at least one processor to implement the management process according to any one of the implementation modes of this disclosure.

[0045] The invention also relates to a computer-readable recording medium on which is recorded a set of program code instructions which, when executed by at least one processor, configure said at least one processor to implement the management process according to any one of the implementation modes of this disclosure.

[0046] The invention will be better understood upon reading the following description, given by way of non-limiting example, and made with reference to the figures which represent: Figure 1 illustrates a schematic representation of a 5G communication network (also called a system) deployed in a Kubernetes-type cloud computing environment according to a particular embodiment; Figure 2 illustrates a schematic representation of a 5G communication network (also called a system) deployed in a Kubernetes-type cloud computing environment according to another particular embodiment; Figure 3 illustrates a representation of a management device according to an example; Figure 4 illustrates the main steps of a management process applied to a communication interface of a software application, according to a particular embodiment of the proposed technique.

[0047] In these figures, identical references from one figure to another designate identical or analogous elements. For clarity, the elements shown are not to scale unless otherwise indicated.

[0048] More generally, it should be noted that the implementation and realization methods considered above have been described as non-limiting examples, and that other variants are therefore conceivable.

[0049] The following description presents embodiments relating to the deployment of a 5G type cellular network or system, but these embodiments are completely transposable to communication networks of different types.

[0050] We first refer to the example that presents a Kubernetes-type cloud infrastructure from which a 5G cellular network is deployed. This 5G cellular network is instantiated by a set of MS1, MS2, MS3, MS4, MS5, and MS6 microservices implemented in a container cluster. In this embodiment, the cluster comprises two containers identified by the execution environments Env Exec Cont 1 of the first container and Env Exec Cont 2 of the second container, both sharing the same operating system. The cluster could consist of a single container or multiple containers without any limit on the number.

[0051] This environment includes a centralized CTRL controller for the cluster, responsible for discovering the microservices involved in instantiating the 5G cellular network functions and collecting metadata related to these functions. The 5G cellular network functions are those that ensure the network's proper operation, including AMF (Access and Mobility Management Function), SMF (Session Management Function), UPF (User Plane Function), and PCF (Policy Control Function). This CTRL controller interacts with the API server function, which represents a cluster management interface and a server responsible for interaction between the cluster and external entities.

[0052] The system consists of a centralized CTRL controller and an external Agt agent (comprising a Kernel agent and a Util (user) agent). The centralized CTRL controller is responsible for discovering MS1, MS2, and MS3 software applications and collecting their metadata. For discovery, the CTRL controller collects metadata related to the deployment environment, including information about component names, the IP addresses of network interfaces INT1, ..., INT4, details about the communication protocols used, information about the LIB1 libraries (or other libraries related to MS2 and MS3 applications not shown) used for encrypting or encoding / decoding network messages, and information about the replica sets that manage multiple instances of the same application.This metadata is essential for properly configuring distributed Agt agents and for ensuring accurate and detailed monitoring of M1, MS2, MS3 network functions.

[0053] The operation of the 5G cellular network relies on the microservices MS1, MS2, MS3, MS4, MS5, and MS6. A network function is characterized by the instantiation of one or more microservices and the interaction of these microservices through communication interfaces on which communication protocols are activated. For example, the PCF network function is instantiated from the MS1 microservice associated with an INT1 communication interface. This PCF interacts, for instance, with an SMF function, represented by a set of MS2 and MS3 microservices, using the HTTP / 2 protocol, whose data streams are carried over the INT1 interface. By activating an observation program on the INT1 interface, where data is exchanged between an MS1 ​​software application and an MS2 software application, it is possible to identify and process data specific to the HTTP / 2 protocol.This identification is based on a selection of the different data conveyed on the communication interfaces, and in particular in the example given, on the INT1 interface.

[0054] The centralized controller (CTRL) transmits discovered information to the external Agt agent. This management process relies on communication between the external agent and the centralized controller, based on declarative and persistent APIs. For example, in a Kubernetes environment, communication between the CTRL and the external Agt agent can be based on the Kubernetes API. In this case, the API is extended to include Custom Resources (CRs), allowing the CTRL to declaratively store and transmit discovered information as key-value pairs. This management process ensures the robustness and resilience of the solution.For example, if a component of the solution (whether it is the centralized controller or the external agent) restarts, the data needed to ensure the proper functioning of the solution will be persisted in a Kubernetes-native way, without requiring an additional database.

[0055] The external Agt agent uses information transmitted by the controller to generate distributed metrics, logs, and traces related to the 5G system.

[0056] The environment presented here comprises an external agent, Agt, structured with two elements: a Util Agent (for user agent) and a Kernel Agent. The Util Agent listens for information transmitted by the CTRL controller and attaches an observation program, such as an eBPF program, to the network interfaces and libraries discovered by the CTRL controller. This attachment can correspond to an instantiation of the observation protocol in the Kernel Agent and its association with the discovered communication interface or a library used by the MS1 software application, for example. The Util Agent is also responsible for processing events filtered by the Kernel Agent and reporting telemetry data in three forms: labeled metrics in Prometheus format, JSON-style logs, and distributed traces according to the OpenTelemetry specification.The Kernel Agent is designed to instantiate the observation protocol, such as the eBPF protocol, which is executed for each network packet or datagram carried within an environment, for example, on a communication interface or a library to which the observation protocol has been associated. This allows for packet filtering to select only those protocol packets specific to the implementation of a cellular network, or even a cellular core network, such as a 5G network, and corresponding to a particular context. This context could be related to an application, a service, one or more users, or an infrastructure deployment context, such as a network slice or a virtual private network.The information identifying the context in observed protocols can correspond to a source IP address, a destination IP address, a port number, data from the observed protocol's data field, a combination of these, or any other information from the observed protocol that identifies the context. The fields used to identify and potentially propagate the context of traces can thus be HTTP headers for HTTP / 2 exchanges. For 3GPP protocols (such as NGAP and PFCP), the tracing information can be Information Elements (IEs). These IEs are used to exchange information via the protocols standardized by 3GPP.Several types of IEs already exist (such as those for user equipment identifiers (UEs), SUPI (Subscription Permanent Identifier), IMSI (International Mobile Subscriber Identity), slice identifiers like SD (Service Differentiator) and SST (Slice / Service Type), or QoS Flow Identifiers (QFI), 5QI (5G QoS Identifier), etc., or components thereof). It is also possible to use context information, specified for each observed protocol, and transmit it in a field defined within the observed protocols.

[0057] Thus, only packets using the NGAP, PFCP, GTP-U, and HTTP / 2 protocols for a specific context or used on a NAS interface are selected. This list of protocols is not exhaustive and may evolve over time, depending on the protocols used and monitored by the external agent, which consists of the Core Agent and the Util Agent. It is important to note that the agent is called external because it operates outside the MS1, ..., MS6 software applications and allows the retrieval of network protocol data without impacting the service provided by the software application being monitored through one or more INT1, ..., INT8 interfaces of these software applications.

[0058] The external agent includes a management system, an example of which is presented in the [document / section]. The architecture of a Sel system adapted to implement the management process in a computer environment, according to a specific embodiment.

[0059] The Sel device includes a data processing module comprising a storage space 201, for example a memory (MEM), a processing unit 202, equipped for example with a microprocessor (PROC), and controlled by a computer program (PGR) 203 whose instructions are configured to implement the management process as described in relation to the.

[0060] At initialization, the code instructions of computer program 203 are, for example, loaded into memory 201 before being executed by the processor of the processing unit 202. The microprocessor of the processing unit 202 implements, according to the instructions of computer program 203, the steps of the management process described below with reference to the.

[0061] To this end, in addition to memory 301 and processor 302, the device includes communication means Comm 204, enabling it to exchange messages with other devices. These communication means include, for example, a wired communication bus. The communication means 204 allow the Sel device, in particular, to exchange data with the CTRL controller and entities in the computing environment, such as the Stock TD-CS entity and software application interfaces. The Sel device includes an Inst 205 acquisition module configured to instantiate the observation program in the external agent. The program can be pre-configured or loaded into the external agent, or it can be loaded when the activation program for a software application needs to be instantiated.

[0062] The Sel device also includes an Assoc 206 module adapted to activate (or associate) the program instantiated on the communication interface and / or a library of the software application for which a selection of protocol data is to be implemented.

[0063] The Sel system also includes a Select 207 module adapted to select data associated with the communication using a context parameter, possibly configured by another software application, related to the environment—that is, the communication interface and / or a library—associated with the software application, from a set of data examined using the observation program associated with at least one software application. In the case where a packet passes through several software applications, a first software application can thus configure a context parameter to be added to the transmitted data. This context parameter is then used by the external agents of the other software applications to select only the data containing this context parameter, or a context parameter value if multiple context parameters are present.

[0064] The environment presented here also includes an Infra Export module, or infrastructure data export module, distributed within the Env Exec Cont 1 and Env Exec Cont 2 containers of the cluster. This module communicates with the operating system to retrieve resource consumption data for the MS1, ..., MS6 software applications and the infrastructure hosting these applications. The Infra Export module then transmits this data to the Stock TD-CDS entity.

[0065] The Infra Export module, like the external agent, software applications and interfaces, and the CTRL controller, are positioned in a GEN TD-G telemetry data generation entity.

[0066] This entity transmits telemetry data to a Stock TD-CS entity responsible for collecting and storing the generated telemetry data. This Stock TD-CS entity comprises three servers: Metr, Journ, and Trac, responsible respectively for storing, exposing, and correlating the generated telemetry data, and for recording the data in logs made available for data visualization and analysis. Specifically, the Trac server is responsible for aggregating and correlating the various data observed by external agents on different software applications that share the same contextual information—that is, data specific to the same application, service, user or group of users (company, residence, customers with the same contract), or network segment.This Trac entity can thus obtain data from various external agents regarding communication interfaces and / or software application libraries. This data is transmitted over various protocols (NGAP, PFCP, HTTP / 2, etc.). Context data can be propagated to the Trac entity using a control protocol, for example, or by transmitting data from the observed protocol, including context information such as those mentioned above (UE ID, Slice ID, QoS ID). Based on the collected data sharing the same context, the Trac entity can analyze and resolve potential malfunctions or audit a service related to that context.

[0067] This data, particularly the data collected by the Trac entity, is then analyzed and made available to an administrator via a Proc TD-P entity for data processing, analysis, and anomaly detection. This entity comprises two modules: Anomal for anomaly analysis and Int for interface, such as a GUI, allowing a system administrator and / or operator to view the data. Specifically, the 5G protocol data collected by the external agent is gathered, processed, and logged before being used to identify potential malfunctions in one or more cellular network protocols.

[0068] The Proc TD-P entity can also include other advanced processing modules, notably the forecasting of future trends and the proactive identification of operational irregularities, enabling more informed and faster decision-making in the face of unforeseen events. Data on cellular network protocols allows for the improvement of forecasting techniques, particularly through the use of models and potentially artificial intelligence techniques.

[0069] Figure 1 illustrates a schematic representation of a 5G communication network (also called a system) deployed in a Kubernetes cloud computing environment using a different, specific embodiment. This representation differs from Figure 2's representation in that the external agent used to select data associated with a communication based on contextual information, and thus to monitor end-to-end communication, is instantiated within a specific external agent. Therefore, an external agent can be instantiated to perform protocol data analysis of a 5G system, and a specific external agent can also be instantiated to select context-specific data from the software application environment, including communication interfaces between software applications and user libraries associated with those applications.This external agent is particularly well-suited for determining contextual information for the various observed protocols, and for communicating selected data from the different protocols and software applications of the 5G system to a Trac observability entity, either through a specific control protocol or by relaying the selected data via the observed protocols. The characteristics of the entities and exchanges specific to the las 5G system are also valid for the las 5G system.

[0070] We then refer to the diagram which illustrates the main steps of a management process applied to a communication interface and a library of a software application, according to a particular embodiment of the proposed technique.

[0071] This embodiment is, for example, instantiated in a computer environment such as the one described in the [reference]. The entities described in [reference] are used to describe the management process of the [reference].

[0072] During a 100 Dec discovery step, the CTRL controller, through an analysis of the software applications deployed in the environment, discovers a software application, represented by a microservice contributing to a cloud-native network function (CNF). In a specific case, the software application may correspond to the CNF itself. This discovery can be initiated by the CTRL controller, which can probe the IT environment and its constituent clusters at regular intervals, or the software applications can register with the CTRL controller, or the CTRL controller can be configured with information about the software applications.Regardless of the discovery method used, the CTRL controller obtains information about the software application, including the IP address used by the application to communicate or a loopback address, its name, its communication interfaces, the identification of the server hosting it, and possibly the identification of the cellular network function it supports or contributes to. This discovery step is optional, as the IT environment may be stable for a period of time and not require prior discovery. This discovery step can be repeated at various intervals to maintain the CTRL controller's up-to-date knowledge of the IT environment.

[0073] During an optional step (101 Inst), an external agent composed of a Kernel agent and a User agent is instantiated in a container within a cluster of the IT environment. This instantiation can occur during the initial installation of a software application in the corresponding container, or upon an administrator's action to initiate the process of analyzing a cellular network protocol on one or more interfaces and / or a user library of an already installed software application. The Inst instantiation can also be linked to the deployment of a new container, for example, if each container in the infrastructure environment requires such an agent.

[0074] In step 102 Assoc, an observation program is associated with a communication interface of a software application. For example, this is the software application discovered in step 100. To simplify the description of the process, the software application is considered to be application MS1, corresponding to a microservice of a cellular network function, and it is assumed here that the microservice contributes to a UPF function. The process would be identical if the microservice were the UPF function itself, or if the network function were another function of the cellular network, whether that function contributes to the user plane and / or the control plane of the cellular network.The association involves, in one alternative scenario, instantiating the observation program within the external agent's Core agent and associating the program with an environment, such as a communication interface and / or a user library, of the MS1 application via the external agent's user agent. The observation program analyzes all packets or datagrams passing through the interface and performs filtering to extract packets or datagrams relevant to a specific protocol and context within a cellular network of the MS1 microservice. Depending on the function performed by the method, the protocols analyzed may vary. A non-exhaustive list of cellular network protocols includes, but is not limited to, NGAP, PFCP, GTP-U, HTTP / 2, and the protocols of a cellular network's NAS interface.

[0075] Filtering can be performed, firstly, based on the headers of packets exchanged on the interface, specifically a field indicating the protocol in a transport protocol header used to convey the protocol data to be identified by the external agent, and secondly, based on context information that is either uniquely encoded in the observed protocols or encoded differently in the various observed protocols, as previously mentioned. One advantage of using an external agent is that it avoids impacting the service provided by the software application by not modifying it, for example, by adding an observation function that would affect the service provided by that application. Using the eBPF program as an observation program offers high-performance monitoring with minimal impact on cellular network performance, which is essential for maintaining a high-quality user experience.Furthermore, distributing the observation program at the container level enables efficient management of observability in large-scale cellular network environments. Moreover, network traffic monitoring is performed without modifying the MS1 application, which is crucial for production environments where access to source code may be restricted or where modifications may be risky. The solution is therefore agnostic to vendor-provided software applications and can be deployed alongside any software application.

[0076] During step 103 Select 1, the associated observation program analyzes the packets or datagrams carried on the communication interface or obtained from the MS1 user library and selects the packets or datagrams associated with a network protocol of the cellular network to which the MS1 software application contributes and which also correspond to a specific context. Thus, the program selects the data from the aforementioned protocols specific to the context identified by a UE, QoS, or slice identifier, for example, potentially enabling their processing and improved network management for context-specific data. This allows it to determine whether a slice is operating satisfactorily, whether a user's data is being correctly routed, or whether traffic sharing the same quality of service has routing characteristics that verify this quality of service.The protocol in question can be either a control or session management protocol for a terminal connected to the cellular network, or a signaling or data transport protocol associated with a terminal. The data associated with a selected communication can correspond to all the protocol data, or only a part of it (header, payload data, context information).

[0077] During a Select 2 step, a second data point, and possibly other context-specific data points related to the data selected in Select 1, are further selected from the same software application or from a different software application. The second selected data point can be obtained from the same protocol or a different protocol from the one used in Select 1. This selection of multiple data points in Select 1 and Select 2 thus allows for the aggregation and correlation of different data points from the same context selected from a communication interface or a software application library of a cellular system.

[0078] Some network exchanges between software applications within a cellular system, such as 5G (for example, those based on the HTTP / 2 protocol), must be encrypted and are further encoded dynamically, for instance, when adaptive compression techniques are used to minimize the size of transmitted data. These techniques often involve encoding information according to schemes that vary depending on the data, making interpretation difficult without detailed analysis. For this reason, the management process, and more specifically data selection, is advantageously applied to a user library within a cellular system software application.This method allows monitoring of calls from the software application to the user library used for encoding and decoding and / or encrypting and decrypting network communications, and efficiently capturing events related to the execution of critical functionalities without directly interfering with the data flow. A significant advantage of this method lies in its ability to observe encrypted and / or encoded communications dynamically. Specifically, this management method allows observation of calls to the primitives provided by the user library for encoding and decoding and / or encrypting and decrypting communications, with access to the inputs and outputs of these functions. The inputs or outputs of these primitives include relevant information about the network communications before their encoding / encryption or after their decoding / decryption, respectively.This observation of the libraries of a software application environment proves to be sufficient or complementary to the observations of the communication interfaces, allowing the selected data to be enriched and thus improving the knowledge of the data specific to a particular context.

[0079] During an optional step 105 Select 3, the associated monitoring program analyzes and selects representative data from the consumption of a resource by the MS1 software application and / or the container, specifically within the Env Exec Cont 1 environment where the MS1 software application is instantiated. This collection and selection of data, particularly metrics related to the hosting infrastructure, complements the data selection from the cellular network protocols and, consequently, improves their processing and troubleshooting. This selection is also performed non-intrusively and is particularly beneficial because it enriches the selected data without degrading the operation of the MS1 microservice.

[0080] The data selected, in accordance with the Select 1 operation and possibly Select 2 and Select 3, in the Gen TD-G entity of the, can be transmitted during a 106 Trans step and stored in the Stock TD-CS entity.

[0081] Specifically, the data selected during Select 1 and possibly Select 2 steps are transmitted to a Trac observation entity in Stock TD-CS. This transmission can involve sending the data as selected, using the protocols from which the data was selected, possibly adding context information specific to these various protocols (NGAP, PFCP, HTTP / 2, etc.), or using a specific control protocol. This control protocol conveys the selected data and its association with the context from which the data was selected. The protocol may include all the protocol data or a portion of the protocol data, specifically the selected data.

[0082] The management process thus makes it possible to generate distributed traces linked to the observation of exchanges between software applications (i.e., microservices) and user libraries. These distributed traces make it possible to track the path of data through the cellular network and potentially identify bottlenecks and diagnose performance problems.

[0083] The Trac entity can then format, aggregate, correlate this data, select and detect anomalies and malfunctions itself or through the Proc TD-P entity.

[0084] During step 107, the Proc-TD P entity, notably through the Anomal entity, analyzes selected and transmitted data to detect malfunctions or normal operation of the protocols used to implement the cellular network. Data relating to the infrastructure, which may also be selected, can enrich the analysis and improve the detection of anomalies and malfunctions, both reactively and proactively. Thus, the selected data can be used to monitor and analyze the performance of cellular network functions, such as the 5G network, including traffic management, Quality of Service (QoS), and anomaly detection. This is particularly important for telecommunications operators seeking to optimize the user experience and maintain high network availability.

[0085] The management process is thus advantageously used to monitor the operation of microservices for a specific context in cloud environments, such as platforms as a service (PaaS) or infrastructures as a service (IaaS).

[0086] Thus, by selecting data related to cellular network protocols specific to a given context and potentially the infrastructure, it is possible to monitor network traffic and, by detecting anomalies, to identify suspicious behavior that could indicate cyberattack attempts or security vulnerabilities. The method can be used to proactively detect anomalies, analyze root causes, and improve network resilience. While the embodiments described have been related to 5G system protocols and interfaces, these embodiments are applicable to any communication system, whether prior to or subsequent to 5G, or by adopting its characteristics.

Claims

Method for managing communication instantiated by means of at least one software application (MS1) of a cellular network, said at least one software application (MS1) being deployed in a cloud computing environment, said method being implemented by an external agent (Agt) to the at least one software application (MS1) and comprising: Activating (Assoc) an observation program instantiated on an environment of the at least one software application, Selecting data associated with a protocol used for implementing communication via the cellular network by means of a context parameter relating to the environment, from a set of data examined by means of the activated observation program, the selected data being suitable for an analysis of the operation of the cellular network. Management method, according to claim 1, wherein the observation program is an extended Berkeley Packet Filter program. Management method, according to claim 1 or 2, wherein the external agent (Agt) is previously instantiated in the cloud computing environment further comprising the software application. A management method, according to any one of the preceding claims, wherein the dataset being examined is encrypted and the observation program is adapted to select a data point from the encrypted dataset. Management method, according to any one of the preceding claims, wherein the context parameter is configured by the external agent based on information relating to an application and / or a user and / or routing information present in a message relating to the environment of said software application. Management method, according to any one of the preceding claims, wherein the environment includes a communication interface for at least one software application and / or a library associated with the software application. Management method, according to any one of the preceding claims, further comprising a selection of at least one second data associated with the communication by means of a context parameter relating to an environment of at least one second software application, from a set of data examined by means of the activation program associated with at least one second software application. A management method, according to one of the preceding claims, in which the selected data is transmitted to a cellular network observability entity (Trac) communicating with the external agent for aggregation by the observability entity with other data associated with the communication and its use for cellular network management. Management method, according to claim 8, wherein the selected data is transmitted in a control message issued to the observability entity. A management method, according to one of the preceding claims, wherein the software application is a microservice of a cellular network device. A management method, according to any one of the preceding claims, wherein the context parameter is extracted from a header or data of a cellular network communication protocol. Device for managing communication instantiated by means of at least one software application (MS1) of a cellular network, said at least one software application (MS1) being deployed in a cloud computing environment, said device for managing an external agent (Agt) to the at least one software application (MS1) comprising a processor (PROC 202) coupled to a memory (MEM 201) in which program instructions (PGR 03) are stored for execution by the processor to: Activate (Assoc) an observation program instantiated on an environment of the at least one software application; Select data associated with a protocol used for implementing communication via the cellular network by means of an environment-related context parameter, from a set of data examined by means of the observation program activated on the at least one software application;The selected data is suitable for an analysis of the functioning of the cellular network. Management device, according to claim 12, wherein the processor is further configured to send to an observability entity a message elaborated from the selected data. Product program comprising program code instructions for implementing a management method according to any one of claims 1 to 11 when executed by a processor. Recording medium readable by a management device on which the program according to claim 14 is recorded.

Images