Network Token Policy Enforcement Reducing Forwarding Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network policy enforcement methods, such as packet inspection and TFT/SDF templates, incur substantial overhead and add forwarding latency due to processing delays, making them inefficient and not scalable for enforcing uplink and downlink network policies, especially with an increase in the number of sponsored services.
Innovation Solution
The derivation and use of uplink and downlink network tokens, which are embedded in packets and verified using cryptographic functions, allowing for efficient policy enforcement and traffic steering without the need for extensive table lookups and packet filtering, thereby reducing latency and conserving resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packet inspection and TFT/SDF templates are used for policy enforcement, then network policies can be verified and enforced, but substantial overhead and forwarding latency are incurred due to processing delays
Solution Approach 1:
The patent applies preliminary action by pre-computing and caching packet classification results in flow information tables before packets arrive. The P-GW pre-processes traffic flow templates and service data flow templates to create pre-computed flow information that can be quickly matched against incoming packets, eliminating the need for real-time deep packet inspection and reducing forwarding latency while maintaining policy enforcement reliability
Solution Approach 2:
The patent uses copying by creating simplified copies of packet flow characteristics in flow information tables that can be rapidly matched without copying and analyzing entire packet contents. The system creates condensed representations of traffic flows including source/destination addresses, port ranges, and protocol information that enable fast matching while maintaining accurate policy enforcement
2Reliability
If packet inspection and TFT/SDF templates are used for policy enforcement, then network policies can be verified, but substantial processing overhead is incurred
Solution Approach 1:
The patent applies segmentation by dividing packet inspection into multiple stages: initial matching against pre-computed flow information tables for quick classification, followed by more detailed policy checking only for packets that require it. This segmented approach processes the majority of packets through efficient table lookups rather than full inspection, reducing overall processing overhead while maintaining enforcement reliability
Solution Approach 2:
The system performs preliminary action by pre-computing flow information tables containing classification rules and packet matching criteria before traffic arrives. This pre-processing converts complex packet inspection tasks into simple table lookup operations, dramatically reducing real-time processing overhead while ensuring accurate policy enforcement
3Reliability
If extensive table lookups and packet filtering are performed, then policy enforcement can be achieved, but resource consumption increases and scalability decreases
Solution Approach 1:
The patent uses copying by creating condensed flow information table entries that capture essential packet characteristics without storing complete packet data. These copied flow representations enable efficient matching and filtering operations with minimal memory resources, reducing device complexity while maintaining enforcement reliability
Solution Approach 2:
The system employs cheap short-living objects by using ephemeral flow information table entries that are created, used for matching, and discarded efficiently. These lightweight flow representations consume minimal resources and can be rapidly updated or removed as traffic patterns change, enabling scalable policy enforcement without substantial resource consumption
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach enhances network policy enforcement by reducing latency and resource usage, improving scalability, and providing flexible and resilient network management, including resistance to DDoS attacks, while eliminating the need for complex filtering rule transfers during handovers.
Implementation Method 1
A gateway device may derive a network token based on a cryptographic function, an unshared secret key of the gateway device, and parameters associated with the packet
Data Source
Figure 1
Figure 2
Figure 3
AI summary
One aspect relates to initiating, by a device, a connection with an application server associated with one or more application services. A gateway derives an uplink network token and/or a downlink network token. The tokens are provisioned to the device and/or an application server over the user-plane. The tokens are included with uplink and/or downlink packets, respectively. Another aspect relates to receiving a data packet at a gateway. The gateway determines a requirement for a network token from the packet. The gateway derives the network token based on a device subscription profile maintained by a network. The network token may be sent with the packet to a destination address associated with the packet. A packet including a network token may be received at a gateway. The gateway may verify the network token and send the data packet to an application server or a device if the verifying is successful.