Network Token Policy Enforcement via Control Plane Signaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for enforcing service access policies in packet data networks incur substantial overhead and latency due to the need for deep packet inspection and traffic flow template processing, which becomes unscalable with an increase in the number of sponsored services.
Innovation Solution
The use of cryptographic network tokens derived by a gateway device to supplement or replace traditional packet inspection methods, allowing for efficient validation and steering of packets without the need for extensive table entries or processing delays.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional packet inspection and TFT processing are used for policy enforcement, then validation accuracy is improved, but processing latency increases and system scalability deteriorates
Solution Approach 1:
The patent applies preliminary action by pre-computing and caching validation results in a validation cache before packets arrive. When a packet needs validation, the system first checks the cache for pre-computed results, avoiding the need to perform expensive real-time packet inspection and TFT matching. This pre-computation approach maintains high validation accuracy while dramatically reducing processing latency.
Solution Approach 2:
The patent uses copying by creating validation rule templates and caching their evaluation results. Instead of inspecting each packet individually against all TFT rules, the system copies validation logic into reusable templates and caches their outcomes. This allows rapid validation by copying pre-evaluated results rather than re-computing them for each packet.
2Reliability
If deep packet inspection is performed for each UL packet, then policy validation reliability is improved, but processing overhead increases and productivity decreases
Solution Approach 1:
The system performs preliminary validation by pre-computing TFT matching results and caching them before actual packet processing. This allows the system to maintain high policy validation reliability through thorough initial validation while improving throughput by avoiding repeated validation of the same traffic patterns.
Solution Approach 2:
The patent extracts the computationally intensive validation logic from the fast packet processing path and places it in a separate validation cache. By separating validation functions from the main processing flow and caching results, the system maintains reliable validation while preventing it from becoming a bottleneck to processing throughput.
3Adaptability or versatility
If the number of TFT/SDF templates is increased to support more sponsored services, then service coverage is improved, but processing complexity increases and scalability deteriorates
Solution Approach 1:
The patent applies universality by creating a unified validation cache that serves multiple TFT/SDF templates and sponsored services. Instead of maintaining separate validation logic for each service, the system uses a universal caching mechanism that handles validation for all services, reducing processing complexity while maintaining broad service coverage.
Solution Approach 2:
The system uses copying by replicating validation results across multiple service contexts. When a validation rule is cached for one service, the result can be copied and applied to similar traffic patterns for other services, reducing the need to maintain separate complex validation logic for each sponsored service.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A device establishes flows associated with one or more applications using control plane signaling. A gateway device obtains a request for a network token during the control plane signaling. The gateway device derives the network token and sends it to the device and/or an access node during the control plane signaling. The device and/or access node obtain the network token, where the network token is associated with a first flow of the one or more flows, a first application of the one or more applications, and provisioned to the device or access node via the control plane signaling. The network token may be included in a packet sent in the user plane from the device. The network token may be verified at the access node and/or the gateway device using a cryptographic function and sent to its destination based on the results of the verification.