DPI System Components

Let’s now figure out which device is responsible for what, and how we achieve the declared functions — as a reminder, these are:

• Analysis of internet traffic (application protocol level)
• Imposing restrictions on subscribers’ use of specific network protocols
• Restricting subscriber access to web resources
• Personalization of services provided by the network

Standards and specifications for mobile networks are not developed by each operator separately — this is handled by the 3GPP (3rd Generation Partnership Project), established in 1998.

Open 3GPP standards describe network nodes, the interfaces between them, and provide recommendations on which protocols to use for those interfaces. This logic allows protocol recommendations to evolve over time while keeping the network architecture unchanged.

The central concept in networks built to 3GPP standards is PCC (Policy and Charging Control). Solutions of this class enable service personalization, active traffic management, and quality of service management using PCC rules to make PCC decisions. The core of such a solution is the PCRF (Policy Control and Charging Rules Function). If PCRF is the brain that knows the rules and how to apply them, then PCEF (Policy and Charging Enforcement Function) carries out the application of those PCC rules to traffic passing through it. DPI systems are part of PCEF, scanning all passing traffic and applying the required policies.

However, there are other elements in the architecture — let’s look at them in more detail.

DPI Platform Components

PCEF (Policy and Charging Enforcement Function) — applies PCC rules received from PCRF and charges for that traffic within the operator’s billing system OCS/OFCS. It communicates with PCRF via the Gx interface, which is used to send event notifications (subscriber identification, channel parameters, location, etc.) from PCEF to PCRF, and to manage PCC rules on the PCEF.

PCRF (Policy Control and Charging Rules Function) — makes decisions on subscriber service policies: use of additional services (turbo buttons, access to specific resources, etc.), setting QoS (Quality of Service) parameters, and billing rules based on various conditions.

OCS (Online Charging System) — handles service billing, monitors subscriber balances, processes charge and deduction information, applies discounts, and tracks service volumes. It communicates with PCRF via the Sy interface (used to track consumed service volumes and notify PCRF when counter thresholds are reached). In addition to PCRF, OCS interacts with PCEF via the Gy interface, through which service billing is performed.

Billing — stores the subscriber balance database and provides it to the OCS server.

UDR (User Data Repository) — stores user data (services available to the subscriber, QoS parameters, etc.). Communicates with PCRF via the Ud interface (used to retrieve/modify user profiles).

BBERF (Bearer Binding and Event Reporting Function) — notifies PCRF of session establishment by sending the subscriber identifier and additional parameters for correct QoS rule determination. Can be combined with the S-GW (Serving Gateway) — the network’s serving gateway, which is responsible for processing and routing packet data coming from the base station subsystem.

AAA Server (Authentication, Authorization, and Accounting) — handles subscriber authentication and service authorization. The AAA server uses a database to obtain connection parameters and performs accounting of used resources. Access control device requests and equipment management are handled via the RADIUS protocol.

Transcoding / Optimization Server — performs data caching to optimize bandwidth and speed up data access.

Access Network — the network connecting the subscriber to the service provider, containing all subscriber devices (phones, smartphones, tablets, PCs).

Internet — the global network built on TCP/IP protocol stacks. For subscribers, this is where websites, video, chats, photos, music, and other content reside.

PCC and QoS Rules — divide the physical data stream (IP-CAN) into logical SDF (Service Data Flow) sessions, determine which applications and services the traffic belongs to, and provide QoS parameters and billing information. Rules can be dynamic (transmitted from PCRF to PCEF via the Gx interface) or predefined on PCEF.

Interaction Scheme: Mobile Data Network Example

1. The subscriber initiates a data session. BBERF authorizes the user on the AAA Server and sends a session creation request to PCEF to pass traffic (IP-CAN).
2. PCEF generates a request with subscriber and service information (Diameter CCR — Credit-Control-Request) via the Gx interface and sends it to PCRF.
3. PCRF requests the subscriber profile via the Ud interface from the UDR server.
4. It receives the profile with the subscriber’s service parameters (available services, QoS parameters, etc.).
5. It subscribes to notifications about profile changes (e.g., if the subscriber activates an additional service).
6. PCRF makes a PCC decision on whether and under what quality parameters to provide services to the subscriber (whether to grant access, at what speed, to which resources, etc.). It forms PCC rules and sends them to PCEF via the Gx interface in the form of a Diameter CCA (Credit-Control-Answer) response containing the set of PCC rules.
7. Upon receiving the response, PCEF establishes a credit control session with OCS via the Gy interface through Diameter CCR/CCA message exchange.
8. PCEF authorizes the establishment of the IP-CAN session (the subscriber gains internet access).
9. The traffic flow (Service Data Flow) begins passing between the subscriber’s device and external networks.
10. After some time, the subscriber ends the data session, and GGSN sends a request to PCEF to terminate the IP-CAN session.
11. PCEF terminates the Diameter sessions with PCRF via the Gx interface, also through CCR/CCA message exchange.
12. PCEF terminates the Diameter sessions with OCS via the Gy interface.

Practical DPI Usage Example

The subscriber has launched a torrent download on their mobile device, significantly increasing p2p traffic and creating additional load on the channel.

1. The DPI system transmits information about the subscriber’s increased p2p traffic. PCRF requests permission for this traffic type from UDR via the Ud interface, and PCRF receives the notification.
2. PCRF analyzes the incoming parameters and makes a PCC decision to reduce the subscriber’s p2p protocol access speed. PCRF forms a PCC rule and sends it to PCEF via the Gx interface as a Diameter RAR (Re-Auth-Request).
3. PCEF sends back a Diameter RAA (Re-Auth-Answer).
4. Via the Gy interface, PCEF and OCS exchange Diameter CCR/CCA messages, resulting in the termination of the old credit control session and the creation of a new one with restricted billing parameters.
5. PCEF then instructs BBERF to create a Service Data Flow with a limited p2p speed.

Open standards and specifications allow different vendors, following the recommendations, to create their own PCRF and DPI solutions. The primary challenge becomes providing the solution with a high-performance, fault-tolerant hardware platform and flexible, configurable software.

Which platforms and software different vendors use will be covered in future articles.