Method, system and apparatus for filtering packets

[0001] This application is a continuation application of PCT/CN2007/070179, filed Jun. 26, 2007, which claims priority to the Chinese Patent Application No. 200610090562.5, filed with the Chinese Patent Office on Jun. 28, 2006 and entitled “Method for Filtering Packets”, the contents of which are incorporated herein by reference in their entirety.

[0002] The present disclosure relates to network communication security technology, and in particular, to a method, system, and apparatus for filtering packets in a next generation network (NGN) packet switched (PS) network based on the Internet Protocol version 6 (IPv6).

[0003] FIG. 1 is a networking diagram of a single network of an NGN. As shown in FIG. 1, the media gateway controller (MGC) and the media gateway (MG) are two key components of the NGN. The MGC is responsible for the call control function, and the MG is responsible for the service bearer function so as to separate the call control plane from the service bearer plane. Thus the network resources can be shared fully, equipment upgrade processes and service extensions may be simplified, and development and maintenance costs may be reduced greatly. Under the control of the MGC, a Real-time Transfer Protocol (RTP) media stream is established for communication between different MGs.

[0004] A control protocol needs to be applied between the MGC and the MG for interworking between them. The media gateway control protocol is a main protocol for communication between the MG and the MGC. The currently prevalent protocols are H.248/MeGaCo Protocol and Media Gateway Control Protocol (MGCP).

[0005] Taking the H.248 Protocol as an example, various resources on the MG are abstractly represented by terminations. Terminations are categorized into physical terminations and ephemeral terminations. Physical terminations are physical entities which exist semi-permanently, for example, time division multiplex (TDM) paths. Ephemeral terminations refer to the public resources which are requested for an ephemeral purpose and will be released after being used, for example, RTP streams. Specially, a root termination refers to the whole MG. The combinations between terminations are abstractly represented by contexts. Because a context may include multiple terminations, a topology is used to describe the interrelations between terminations.

[0006] Based on the abstract model of MGCP, a call connection is actually an operation on the termination and the context. Such operations are performed through Commands, Requests, and Replies between the MGC and the MG. Commands include Add, Modify, Subtract, Move, AuditValue, AuditCapabilities, Notify, ServiceChange and etc. Parameters of Commands, also known as descriptors, are categorized into property, signal, event, and statistic categories. The parameters with service relevance are logically aggregated into a package.

[0007] Under the control of an MGC, the MG is responsible for converting and transferring media streams between a user and a PS network and between PS networks in different IP domains. FIG. 2 is a networking diagram for IP cross-domain interworking in an NGN. As shown in FIG. 2, the system includes two network domains: IPa and IPb. MGCa are media gateway controllers in the IPa network domain, and MGCb are media gateway controllers in the IPb network domain. MGCa and MGCb are designed to control the MG of the IPa network domain and the MG of the IPb network domain, respectively. MGia and MGib are edge MGs designed to implement communication between MGs of adjacent network domains. The MGa can perform media conversion and transfer between a Plain Old Telephone Service (POTS) user and an RTP media stream. The MGb can perform media conversion and transfer between a TDM trunk and an RTP media stream. The MGia and MGib can perform media conversion and transfer between RTP media streams.

[0008] To ensure the quality of service (QoS) and communication security, the MGC should perform packet filtering for the media streams transferred (e.g., received and transmitted) by the MG, i.e., permitting or forbidding the media streams of certain characteristics to be input or output through the MG.

[0009] Currently, in an IPv4-based PS network, a media stream can be uniquely identified by the basic characteristics of a quintuplet (e.g., source address, source port, destination address, destination port, and protocol type) thus filtering the packets for a specific media stream by the elements in the quintuplet. However, all elements in the quintuplet are not available from the IP packet header and some elements such as source port or destination port need to be obtained by resolving the IP packet body. The IP packet body involves upper-layer protocols or segments or involves other factors such as encryption so the resolution is difficult and the packet filtering is more complex.

[0010] An embodiment of the present disclosure provides a method, system, and apparatus for filtering packets to simplify the packet filtering process for media streams in a PS network.

[0011] A method for filtering packets provided in an embodiment of the present disclosure includes setting packet filtering information that uniquely identifies basic characteristics of a media stream in an IPv6-based packet header and using the packet filtering information to filter packets for the media stream when transferring the media stream.

[0012] A system for filtering packets provided in an embodiment of the present disclosure includes a media gateway controller (MGC) and at least one media gateway (MG). The MGC is adapted to send preset packet filtering information to each MG, in which the packet filtering information uniquely identifies basic characteristics of a media stream in an IPv6-based packet header and the MG is adapted to filter packets for the media streams to be transferred according to the packet filtering information sent by the MGC.

[0013] An apparatus for filtering packets provided in an embodiment of the present disclosure includes a first unit and a second unit, wherein the first unit is adapted to receive packet filtering information, in which the packet filtering information uniquely identifies the basic characteristics of a media stream in an IPv6-based packet header and the second unit is adapted to filter packets for the media streams according to the received packet filtering information.

[0014] As seen from the above technical solution, the technical solution of the present disclosure provides at least the following technical effect: the MGC sets the packet filtering information that uniquely identifies the basic characteristics of a media stream in an IPv6-based packet header. The MG uses the packet filtering information sent by the MGC to filter packets for the media streams when transferring the media streams. The technical solution of the present disclosure enables packet filtering for media streams in an IPv6-based PS network. The filtering conditions in the packet filtering information in the present disclosure are triplet information that uniquely identifies the basic characteristics of a media stream and can be obtained from the IPv6 packet header, thus reducing the complexity of the packet filtering process.

[0018] In an embodiment of the present disclosure, a media gateway controller (MGC) sets the packet filtering information that uniquely identifies the basic characteristics of a media stream in an IPv6-based packet header. The MG uses the packet filtering information sent by the MGC to filter packets for the media streams when transferring the media streams.

[0019] For better understanding of the technical solution, objectives, and merits of the present disclosure, the present disclosure is hereinafter described in detail with reference to accompanying drawings and preferred embodiments.

[0020] FIG. 3 is a flowchart of the method for filtering packets according to an embodiment of the present disclosure. The method includes the following steps:

[0021] Step 300: The MGC sets the packet filtering information that uniquely identifies the basic characteristics of a media stream in an IPv6-based packet header.

[0022] The packet filtering information in this embodiment is used for packet filtering for a specified media stream based on the elements in a triplet. The packet filtering information may be specific to a specified termination on an MG or specific to the whole MG. The packet filtering information includes filtering condition information and filtering control information.

[0023] The filtering condition information includes the elements in a characteristic triplet of an IP packet in an IPv6-based PS network (e.g., source address, destination address, and flow label). A range or a set can be represented by the wildcard mode or partial wildcard mode. For example, the source address in partial wildcard mode “1.1.1.*” represents any address from 1.1.1.0 to 1.1.1.255, in which “*” represents any valid value.

[0024] The filtering control information is a mode of filtering packets for the media streams that meet the filtering conditions in the packet filtering information. Filtering control information includes:

[0025] source address filtering on-off: indicates whether to use the source address to participate in filtering packets for media streams;

[0026] destination address filtering on-off: indicates whether to use the destination address to participate in filtering packets for media streams;

[0027] flow label filtering on-off: indicates whether to use the flow label to participate in filtering packets for media streams;

[0028] combined relation: indicates whether the filtering condition information participates in filtering packets for the media streams separately (i.e., an OR relation exists between different entries of the filtering condition information) or participates in filtering packets for the media streams jointly (i.e., an AND relation exists between different entries of filtering condition information); and

[0029] combined effect: indicates whether to permit or prohibit transfer of the media streams that meet the filtering conditions.

[0030] It should be noted that the filtering condition information may include all elements of a triplet without being affected by the corresponding elements in the filtering control information or may include any combination of the elements of the triplet, depending on whether the control on-off of the corresponding element in the filtering control information is turned on.

[0031] The method for representing packet filtering information is described below, supposing the foregoing packet filtering information is set through the properties extended in the H.248 protocol. The extended properties include:

[0032] Flow Label Mask (FLM) property: indicates the flow label information. The FLM property is a string, and the value of the FLM property is consistent with the value of the flow label field in the IPv6 packet header. The FLM property may occupy 20 bits and may be expressed in wildcard mode or partial wildcard mode.

[0033] Source Address Mask (SAM) property: indicates the source address information. The SAM property is a string, and the value of the SAM property is consistent with the value of the source address field in the IPv6 packet header. The SAM property may occupy 128 bits and may be expressed in hexadecimal segments in wildcard mode or partial wildcard mode.

[0034] Destination Address Mask (DAM) property: indicates the destination address information. The DAM property is a string, and the value of the DAM property is consistent with the value of the destination address field in the IPv6 packet header. The DAM property may occupy 128 bits and may be expressed in hexadecimal segments in wildcard mode or partial wildcard mode.

[0035] Flow Label Filtering (FLF) property: indicates the flow label filtering on-off information. The type of the FLF property is Boolean. The value of the FLF property is “Off” or “On” and the default value is “Off”.

[0036] Source Address Filtering (SAF) property: indicates the source address filtering on-off information. The type of the SAF property is Boolean. and The value of the SAF property is “Off” or “On” and the default value is “Off”.

[0037] Destination Address Filtering (DAF) property: indicates the destination address filtering on-off information. The type of the DAF property is Boolean. The value of the DAF property is “Off” or “On” the default value is “Off”.

[0038] Combined Relation (CR) property: indicates the combined relation information. The type of the CR property is Boolean. The value of the CR property is “AND” or “OR” and the default value is “AND”.

[0039] Combined Effect (CE) property: indicates the combined effect information. The type of the CE property is Boolean. The value of the CE property is “Permit” or “Prohibit”, and the default value is “Permit”.

[0040] Step 301: The MG performs packet filtering for the media stream by the packet filtering information sent from the MGC when transferring the media stream. The properties corresponding to the foregoing packet filtering information may be set in an existing package in the H.248 protocol, i.e., Gate Management Package or set in a newly defined package for packet filtering information that uniquely identifies the basic characteristics of a media stream in an IPv6 packet header, i.e., a newly defined package may be an FL-based Ingoing Packet Filtering (FLIPF) Package that performs packet filtering for the media streams received by the MG or an FL-based Outgoing Packet Filtering (FLOPF) Package that performs packet filtering for the media streams sent by the MG.

[0041] The detailed manner for filtering packets for media streams is as follows:

[0042] When the MGC needs to perform packet filtering for media streams to ensure security or QoS, the MGC decides the filtering condition information and filtering control information to be used for the media streams received and/or sent by the MG respectively according to certain security or QoS policies and sends them to the MG through the property items in the FLIPF package and FLOPF package. According to the relevant properties in the packet filtering information sent by the MGC, the MG performs packet filtering for the media streams that meet the filtering conditions according to the filtering control information. The filtering conditions are met if the information displayed by the filtering conditions contains the corresponding information of the media streams.

[0043] If the values of the three properties FLF, SAF, and DAF are “On”, the corresponding filtering conditions are applied to comparison with the characteristics of the media streams to be filtered. If the value of the CR property is “And”, the comparison result is “True” only if the characteristics of the media streams to be filtered meet the all filtering conditions applied. If the value of the CR property is “Or”, the comparison result is “True” if the characteristics of the media streams to be filtered meet one of the filtering conditions applied. If the value of the CE property is “Permit”, it is permitted to receive or send the media streams to be filtered only if the foregoing comparison result is “True”. If the value of the CE property is “Prohibit”, it is prohibited to receive or send the media streams to be filtered if the foregoing comparison result is “True”.

[0044] It should be noted that if the MGC has not sent any property related to packet filtering for the media streams received or sent by the MG, no packet filtering needs to be performed by the MG for the received or sent media streams. The MGC can send the filtering condition information and the filtering control information to the MG concurrently or first send the filtering condition information and then send the filtering control information to the MG.

[0045] If any problem occurs in the process of sending the packet filtering information and makes the MG unable to apply the packet filtering information sent by the MGC, the MG returns a corresponding error code to the MGC.

[0046] A typical application of the method of the present disclosure is described below, supposing the H.248 protocol is adopted between the MGC and the MG. The filtering condition information and the filtering control information for filtering packets for the media streams received and/or sent by the MG is set through the properties of the FLIPF package and the FLOPF package in the H.248 protocol. When the MGC does not intend to perform packet filtering for the media streams on the MG, the MGC sends no FLIPF or FLOPF package to the MG, and the MG may not perform packet filtering for the media streams received or sent by the MG according to the default value and permit any media stream to access the MG freely. When the MGC decides to only permit the media streams received by the MG which come from the address “1.1.1.*” or the flow label of which is “9999” and prohibits the media streams of any flow label that are sent by the MG to the address “12.34.56.78”, in the properties of the FLIPF package sent by the MGC to the MG: FLM=9999, SAM=1.1.1.*, FLF=On, SAF=On, CR=Or, and CE=Permit; in the properties of the FLOPF package: FLM=*, DAM=12.34.56.78, FLF=On, DAF=On, CR=And, and CE=Prohibit. After the MG receives the properties of the FLIPF package and the FLOPF package, the MG permits only the media streams with the source address “1.1.1.*” or the flow label “9999” to flow in the MG according to the foregoing filtering information and forbids other media streams to flow in the MG and forbids only the media streams of any flow label with the destination address “12.34.56.78” to leave the MG and permits other media streams to flow out the MG.

[0047] Based on the foregoing method, a system for filtering packets provided in an embodiment of the present disclosure includes an MGC and at least one MG, wherein the MGC is adapted to send preset packet filtering information to each MG, in which the packet filtering information uniquely identifies the basic characteristics of a media stream in an IPv6-based packet header.

[0048] In one embodiment of the disclosure, the packet filtering information in the present disclosure is used for packet filtering for a specified media stream based on the elements in a triplet. The packet filtering information may be specific to a specified termination on an MG or specific to the whole MG. The packet filtering information includes filtering condition information and filtering control information.

[0049] The filtering condition information includes the elements in a characteristic triplet of an IP packet in an IPv6-based PS network—source address, destination address, and flow label. A range or a set can be represented by the wildcard mode or partial wildcard mode. For example, the source address in partial wildcard mode “1.1.1.*” represents any address from 1.1.1.0 to 1.1.1.255, in which “*” represents any valid value.

[0050] The filtering control information is a mode of filtering packets for the media streams that meet the filtering conditions in the packet filtering information. The filtering control information includes:

[0051] source address filtering on-off: indicates whether to use the source address to participate in filtering packets for media streams;

[0052] destination address filtering on-off: indicates whether to use the destination address to participate in filtering packets for media streams;

[0053] flow label filtering on-off: indicates whether to use the flow label to participate in filtering packets for media streams;

[0054] combined relation: indicates whether the filtering condition information participates in filtering packets for the media streams separately (i.e., an OR relation exists between different entries of the filtering condition information) or participates in filtering packets for the media streams jointly (i.e., an AND relation exists between different entries of filtering condition information); and

[0055] combined effect: indicates whether to permit or prohibit transfer of the media streams that meet the filtering conditions.

[0056] It should be noted that the filtering condition information may include all elements of a triplet without being affected by the corresponding elements in the filtering control information or may include any combination of the elements of the triplet, depending on whether the control on-off of the corresponding element in the filtering control information is turned on.

[0057] The method for representing packet filtering information is described below. Supposing the foregoing packet filtering information is set through the properties extended in the extended H.248 protocol, the extended properties include:

[0058] Flow Label Mask (FLM) property: indicates the flow label information. The FLM property is a string, and the value of the FLM property is consistent with the value of the flow label field in the IPv6 packet header. The FLM property may occupy 20 bits and may be expressed in the wildcard mode or partial wildcard mode.

[0059] Source Address Mask (SAM) property: indicates the source address information. The SAM property is a string, and the value of the SAM property is consistent with the value of the source address field in the IPv6 packet header. The SAM property may occupy 128 bits and may be expressed in hexadecimal segments in the wildcard mode or partial wildcard mode.

[0060] Destination Address Mask (DAM) property: indicates the destination address information. The DAM property is a string, and the value of the DAM property is consistent with the value of the destination address field in the IPv6 packet header. The DAM property may occupy 128 bits and may be expressed in hexadecimal segments in the wildcard mode or partial wildcard mode.

[0061] Flow Label Filtering (FLF) property: indicates the flow label filtering on-off information. The type of the FLF property is Boolean and the value is “Off” or “On” the default value is “Off”.

[0062] Source Address Filtering (SAF) property: indicates the source address filtering on-off information. The type of the SAF property is Boolean, and the value of the SAF property is “Off” or “On” the default value is “Off”.

[0063] Destination Address Filtering (DAF) property: indicates the destination address filtering on-off information. The type of the DAF property is Boolean, and the value of the DAF property is “Off” or “On” the default value is “Off”.

[0064] Combined Relation (CR) property: indicates the combined relation information. The type of the CR property is Boolean, and the value of the CR property is “AND” or “OR” the default value is “AND”.

[0065] Combined Effect (CE) property: indicates the combined effect information. The type of the CE property is Boolean, and the value of the CE property is “Permit” or “Prohibit” the default value is “Permit”.

[0066] The MG is adapted to filter packets for the media streams to be transferred according to the packet filtering information sent from the MGC.

[0067] The properties corresponding to the foregoing packet filtering information may be set in an existing package in the H.248 protocol, i.e., Gate Management Package or set in a newly defined package for packet filtering information that uniquely identifies the basic characteristics of a media stream in an IPv6 packet header, i.e., a newly defined package may be an FL-based Ingoing Packet Filtering (FLIPF) Package that performs packet filtering for the media streams received by the MG or an FL-based Outgoing Packet Filtering (FLOPF) Package that performs packet filtering for the media streams sent by the MG.

[0068] In the practical application, when the MGC needs to perform packet filtering for media streams to ensure security or QoS, the MGC decides the filtering condition information and filtering control information to be used for the media streams received and/or sent by the MG respectively according to certain security or QoS policies, and sends them to the MG through the property items in the FLIPF package and FLOPF package. According to the relevant properties in the packet filtering information sent by the MGC, the MG performs packet filtering for the media streams that meet the filtering conditions according to the filtering control information. The filtering conditions are met if the information displayed by the filtering conditions contains the corresponding information of the media streams.

[0069] If the values of the three properties FLF, SAF, and DAF are “On”, the corresponding filtering conditions are applied to comparison with the characteristics of the media streams to be filtered. If the value of the CR property is “And”, the comparison result is “True” only if the characteristics of the media streams to be filtered meet the all filtering conditions applied. If the value of the CR property is “Or”, the comparison result is “True” if the characteristics of the media streams to be filtered meet one of the filtering conditions applied. If the value of the CE property is “Permit”, it is permitted to receive or send the media streams to be filtered only if the foregoing comparison result is “True”. If the value of the CE property is “Prohibit”, it is prohibited to receive or send the media streams to be filtered if the foregoing comparison result is “True”.

[0070] It should be noted that if the MGC has not sent any property related to packet filtering for the media streams received or sent by the MG, no packet filtering needs to be performed by the MG for the received or sent media streams. The MGC can send the filtering condition information and the filtering control information to the MG concurrently or first send the filtering condition information first and then send the filtering control information to the MG.

[0071] If any problem occurs in the process of sending the packet filtering information and makes the MG unable to apply the packet filtering information sent by the MGC, the MG returns a corresponding error code to the MGC.

[0072] A typical application of the method of the present disclosure is described below, supposing the H.248 protocol is adopted between the MGC and the MG. The filtering condition information and the filtering control information for filtering packets for the media streams received and/or sent by the MG is set through the properties of the FLIPF package and the FLOPF package in the H.248 protocol. When the MGC does not intend to perform packet filtering for the media streams on the MG, the MGC sends no FLIPF or FLOPF package to the MG, and the MG may not perform packet filtering for the media streams received or sent by the MG according to the default value and permit any media stream to access the MG freely. When the MGC decides to only permit the media streams received by the MG which come from the address “1.1.1.*” or the flow label of which is “9999” and prohibits the media streams of any flow label that are sent by the MG to the address “12.34.56.78”, in the properties of the FLIPF package sent by the MGC to the MG: FLM=9999, SAM=1.1.1.*, FLF=On, SAF=On, CR=Or, and CE=Permit; in the properties of the FLOPF package: FLM=*, DAM=12.34.56.78, FLF=On, DAF=On, CR=And, and CE=Prohibit. After the MG receives the properties of the FLIPF package and the FLOPF package, the MG permits only the media streams with the source address “1.1.1.*” or have the flow label “9999” to flow in the MG according to the foregoing filtering information and forbids other media streams to flow in the MG and forbids only the media streams of any flow label with the destination address “12.34.56.78” to leave the MG and permits other media streams to flow out the MG.

[0073] More particularly, the MGC may include a storing unit adapted to store the foregoing preset packet filtering information and a function unit adapted to send packet filtering information. As an apparatus for filtering packets in the embodiments of the present disclosure, the MG may include a function unit for receiving packet filtering information and a function unit for performing packet filtering for the media streams according to the packet filtering information.

[0074] As seen from the foregoing technical solution of the present disclosure, the MGC sets the packet filtering information that uniquely identifies the basic characteristics of a media stream in an IPv6-based packet header for the media stream. The MG uses the packet filtering information sent by the MGC to filter packets for the media streams when transferring the media streams. Moreover, the filtering conditions in the packet filtering information in the embodiments of the present disclosure are triplet information that uniquely identifies the basic characteristics of a media stream and can be obtained from the IPv6 packet header, thus reduce the complexity of the packet filtering process.

[0075] Although the disclosure has been described through some exemplary embodiments, the disclosure is not limited to such embodiments. Any modifications, equivalent substitutions and improvements made to the disclosure without departing from the spirit and scope of the disclosure shall fall within the scope of protection of the present disclosure.