1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T Y.2772 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (04/2016) SERIES Y: GLOBAL INFORMATION INFRASTRUCTURE, INTERNET PROTOCOL ASPECTS AND NEXT-GENERATION NETWORKS, INTERNET OF THINGS AND SMART CITIES Next Generation Netwo
2、rks Security Mechanisms for the network elements with support of deep packet inspection Recommendation ITU-T Y.2772 ITU-T Y-SERIES RECOMMENDATIONS GLOBAL INFORMATION INFRASTRUCTURE, INTERNET PROTOCOL ASPECTS AND NEXT-GENERATION NETWORKS, INTERNET OF THINGS AND SMART CITIES GLOBAL INFORMATION INFRAST
3、RUCTURE General Y.100Y.199 Services, applications and middleware Y.200Y.299 Network aspects Y.300Y.399 Interfaces and protocols Y.400Y.499 Numbering, addressing and naming Y.500Y.599 Operation, administration and maintenance Y.600Y.699 Security Y.700Y.799 Performances Y.800Y.899 INTERNET PROTOCOL AS
4、PECTS General Y.1000Y.1099 Services and applications Y.1100Y.1199 Architecture, access, network capabilities and resource management Y.1200Y.1299 Transport Y.1300Y.1399 Interworking Y.1400Y.1499 Quality of service and network performance Y.1500Y.1599 Signalling Y.1600Y.1699 Operation, administration
5、 and maintenance Y.1700Y.1799 Charging Y.1800Y.1899 IPTV over NGN Y.1900Y.1999 NEXT GENERATION NETWORKS Frameworks and functional architecture models Y.2000Y.2099 Quality of Service and performance Y.2100Y.2199 Service aspects: Service capabilities and service architecture Y.2200Y.2249 Service aspec
6、ts: Interoperability of services and networks in NGN Y.2250Y.2299 Enhancements to NGN Y.2300Y.2399 Network management Y.2400Y.2499 Network control architectures and protocols Y.2500Y.2599 Packet-based Networks Y.2600Y.2699 Security Y.2700Y.2799 Generalized mobility Y.2800Y.2899 Carrier grade open en
7、vironment Y.2900Y.2999 FUTURE NETWORKS Y.3000Y.3499 CLOUD COMPUTING Y.3500Y.3999 INTERNET OF THINGS AND SMART CITIES AND COMMUNITIES General Y.4000Y.4049 Definitions and terminologies Y.4050Y.4099 Requirements and use cases Y.4100Y.4249 Infrastructure, connectivity and networks Y.4250Y.4399 Framewor
8、ks, architectures and protocols Y.4400Y.4549 Services, applications, computation and data processing Y.4550Y.4699 Management, control and performance Y.4700Y.4799 Identification and security Y.4800Y.4899 For further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T Y.2772 (04/20
9、16) i Recommendation ITU-T Y.2772 Mechanisms for the network elements with support of deep packet inspection Summary Recommendation ITU-T Y.2772 provides mechanisms for the network elements supporting deep packet inspection (DPI), including the procedures and methods aspects of deep packet inspectio
10、n (DPI) with respect to packet based networks. This Recommendation serves to assist in the understanding of DPI related methods, interfaces, protocols, procedures aspects and process aspects of DPI-related products. History Edition Recommendation Approval Study Group Unique ID* 1.0 ITU-T Y.2772 2016
11、-04-29 13 11.1002/1000/12709 * To access the Recommendation, type the URL http:/handle.itu.int/ in the address field of your web browser, followed by the Recommendations unique ID. For example, http:/handle.itu.int/11.1002/1000/11830-en. ii Rec. ITU-T Y.2772 (04/2016) FOREWORD The International Tele
12、communication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and t
13、ariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Reco
14、mmendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recomm
15、endation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interopera
16、bility or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that co
17、mpliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTSITU draws attention to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validi
18、ty or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had received notice of intellectual property, protected by patents, which may be required t
19、o implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2016 All rights reserved. No part of this publication may be reproduced, by
20、 any means whatsoever, without the prior written permission of ITU. Rec. ITU-T Y.2772 (04/2016) iii Table of Contents Page 1 Scope . 1 2 References . 1 3 Definitions 2 3.1 Terms defined elsewhere 2 3.2 Terms defined in this Recommendation . 3 4 Abbreviations and acronyms 3 5 Conventions 3 6 Definiti
21、on of DPI mechanism . 4 7 Overview of DPI mechanisms in support of application identification . 4 7.1 General aspect of DPI mechanisms. . 4 7.2 Basic structure of a DPI node . 4 7.3 Typical network supporting DPI functions. . 4 7.4 DPI mechanism related to the DPI node 5 7.5 The mechanism of a netwo
22、rk deployed with DPI nodes 6 8 Representation methods of the DPI Policy rule of DPI-PIB . 6 8.1 Overview 6 8.2 Data and mask representation method for DPI policy rule conditions . 6 8.3 Regular expression representation method for DPI policy rule conditions 6 8.4 Hybrid representation method for DPI
23、 policy rule conditions . 7 9 Information flows, processing procedures and methods for a DPI entity 7 9.1 Overview 7 9.2 Interface realization 8 9.3 Information flow . 9 9.4 Process procedure . 12 9.5 Protection method . 13 9.6 Data synchronization method . 13 10 Operational mechanism specification
24、. 14 10.1 Overview 14 10.2 Objectives of the operation mechanism . 15 10.3 Performance aspect or DPI nodes deployment . 15 10.4 Analysis of current networks 15 10.5 Confirming the DPI requirement of the network . 15 10.6 Choosing proper DPI entities or systems . 16 10.7 Reconstructing the current ne
25、twork using DPI 16 10.8 Monitoring and managing the network with DPI . 16 10.9 Rebuilding the network with DPI based on performance monitor . 16 iv Rec. ITU-T Y.2772 (04/2016) Page 11 Specification of management mechanism 16 11.1 Overview of DPI network management . 16 11.2 Management interface 18 1
26、1.3 Management protocol and functions 20 12 Security consideration 20 Bibliography. 20 Rec. ITU-T Y.2772 (04/2016) 1 Recommendation ITU-T Y.2772 Mechanisms for the network elements with support of deep packet inspection 1 Scope This Recommendation provides the implementation mechanisms for deep pack
27、et inspection (DPI) in packet based networks. The primary purpose of this Recommendation is to describe the application models, related protocols, interface, methods procedure and process of DPI that can be used to identify information flows between DPI functions and other network functions. The sco
28、pe of this Recommendation includes: definition of DPI mechanism; overview of DPI mechanisms in support of application identification; procedures and information flows in operational aspect; procedures and information flows in management aspect, such as DPI policy management; other procedures and inf
29、ormation flows for possible DPI functional entity (FE) interfaces. The following are out of the scope of this Recommendation: operational and management aspects that are not specific to DPI entities; common network element related management functions, as already specified by the ITU-T M-series and
30、ITU-T X-series Recommendations. Implementers and users of this Recommendation shall comply with all applicable national and regional laws, regulations and policies. The mechanism described in this Recommendation may not be applicable to international correspondence in order to ensure the secrecy and
31、 sovereign national legal requirements placed upon telecommunications providers, as well as the ITU Constitution and Convention. 2 References The following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendatio
32、n. At the time of publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references lis
33、ted below. A list of the currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. ITU-T Y.2111 Recommendation ITU-T Y.2111 (2011), Resource and admission control f
34、unctions in next generation networks. ITU-T Y.2704 Recommendation ITU-T Y.2704 (2010), Security mechanisms and procedures for NGN. ITU-T Y.2770 Recommendation ITU-T Y.2770 (2012), Requirements for deep packet inspection in next generation networks. ITU-T Y.2771 Recommendation ITU-T Y.2771 (2014), Fr
35、amework for deep packet inspection. 2 Rec. ITU-T Y.2772 (04/2016) 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 deep packet inspection (DPI) ITU-T Y.2770: Analysis, according to the layered protocol architecture OSI-BRM b-ITU-T X.200,
36、 of: payload and/or packet properties (see list of potential properties in clause 3.2.11 of ITU-T Y.2770 deeper than protocol layers 2, 3 or 4 (L2/L3/L4) header information, and other packet properties in order to identify the application unambiguously. NOTE The output of the DPI function, along wit
37、h some extra information such as the flow information, is typically used in subsequent functions such as reporting or actions on the packet. 3.1.2 DPI analyser ITU-T Y.2771: A subsequent entity in the DPI processing path (within a DPI policy enforcement function) with focus on comparison functions b
38、etween the particular packet headers and payloads of preselected packet flows. The primary scope of the DPI analyser is related to the evaluation of DPI policy conditions against preselected incoming packets. NOTE The DPI analyser may be located after a DPI scanner (see clause 3.2.5 of ITU-T Y.2771)
39、. The DPI analyser may provide the functionality of an intrusion detection system (IDS) analyser. 3.1.3 DPI engine ITU-T Y.2770: A subcomponent and central part of the DPI functional entity which performs all packet path processing functions (e.g., packet identification and other packet processing f
40、unctions in Figure 6-1 of ITU-T Y.2770). 3.1.4 DPI node ITU-T Y.2771: A network element or device that realizes the DPI related functions. It is thus a generic term used to designate the realization of a DPI physical entity. NOTE Functional perspective: the DPI node function (DPI-NF) comprises the D
41、PI policy enforcement function (DPI-PEF) and the (optional) local policy decision function (L-PDF); the DPI-NF is functionally equal to the DPI functional entity. 3.1.5 DPI policy action (action in short) ITU-T Y.2771: Definition of what is to be done to enforce a policy rule, when the conditions of
42、 the rule are met. Policy actions may result in the execution of one or more operations to affect and/or configure network traffic and network resources (see also b-IETF RFC 3198). 3.1.6 DPI policy condition (also known as DPI signature) ITU-T Y.2770: A representation of the necessary state and/or p
43、rerequisites that identifies an application and define whether a policy rules actions should be performed. The set of DPI policy conditions associated with a policy rule specifies when the policy rule is applicable (see also b-IETF RFC 3198). A DPI policy condition must contain application level con
44、ditions and may contain other options such as state conditions and/or flow level conditions: 1) State condition (optional): a) network grade of service conditions (e.g., experienced congestion in packet paths); or b) network element status (e.g., local overload condition of the DPI-FE). 2) Flow desc
45、riptor/flow level conditions (optional): a) packet content (header fields); b) characteristics of a packet (e.g., number of MPLS labels); c) packet treatment (e.g., output interface of the DPI-FE); 3) Application descriptor/application level conditions: a) packet content (application header fields a
46、nd application payload). Rec. ITU-T Y.2772 (04/2016) 3 NOTE The condition relates to the “simple condition“ in the formal descriptions of flow level conditions and application level conditions. 3.1.7 DPI scanner (also used as “DPI scan function“) ITU-T Y.2771: The first entity in the DPI processing
47、path (within a DPI policy enforcement function) which provides a pre-selection (related to the subsequent DPI analyser, see clause 3.2.1 of ITU-T Y.2771) by checking all DPI policy conditions against all incoming packets. 3.2 Terms defined in this Recommendation None. 4 Abbreviations and acronyms Th
48、is Recommendation uses the following abbreviations and acronyms: BRAS Broadband Remote Access Server CLI Command Line Interface CMIP Common Management Information Protocol DPI Deep Packet Inspection DPI-PDFE DPI Policy Decision Functional Entity DPI-PIB DPI Policy Information Base EMS Element Manage
49、ment System GUI Graphical User Interface IP Internet Protocol IPFIX IP Flow Information Export LAN Local Area Network L-PDF Local PDF NMS Network Management System OAM Operation, Administration and Management PDF Policy Decision Function PIB Policy Information Base SNMP Simple Network Management Protocol SR Service Router TCAM Ternary Content-Addressable Memory TCP Transmission Control Protocol UDP User Datagram Protocol VLAN Virtual Local Area Network 5 Conventi
