PGW / GGSN - PICS

PART - 03

Mustafa Golam
 Table of Contents

PISC/SACC Over View

Traffic
Inspection, Analysis
Authorization and QoS
Configuration
Rating Group, Service Set
 Header Rule Set , Header Rule
 HTTP/WSP Rule
Rating Group Mapping
 GPRS Charging
Background
GPRS was originally standardised for Internet access with charging based on traffic
volume. APN used to describe the destination to which a connection should be
established. Both offline and online charging options were supported.
 CDRs for offline charging
 CAMEL phase 3 for online charging

GPRS

WEB
browser

APN 1
Internet
 GPRS Charging
Background
CDRs are generated by both SGSN and GGSN and there is one set of CDRs per
PDP Context. CAPv3 support introduced in SGSN for Real-time charging of GPRS.

Billing
system

S-CDRs Offline G-CDRs

SCP Mediation

CAPv3
APN
SGSN GGSN Internet
 Expansion of Services
Background
APN 4 Operator
services
GPRS
MMS
client APN 3
or
MMS
WEB
Services
browser

or Streaming
WAP Services
APN 1
browser APN 2
Internet

 Many profiles has to be defined in the terminal to charge for the different services.
 Services are be identified by using different APNs.
 Only one service category is allowed at a time.
 CAMEL vs. Flow Based Charging
Background

Only few operators are using CAMEL for GPRS today because:
 3GPP introduced IP Flow Based Charging (FBC) based on DIAMETER.
 The leading trend is to provide multi-service APN (single APN).
 CAMEL support in VPLMN required for charging of roaming subscribers.

V-SGSN
Prepaid
MMS-C
BGW Diameter (Gy)

Gi Internet
SGSN GGSN
Service Aware
Function
 Service Aware Charging & Control
Background
 Multi service APNs (Single APN)
 Service Aware Charging
 Flexible Bearer Charging
 Event and Content Charging
 Online/Offline
 Service Control
 Service Authorization
 Context sensitive (roaming, access, QoS …)
 Redirect, enabling a user to for example be:
 Redirected to a top-up or subscription page
 Redirected for Advice of Charge
 Dynamic and immediate use of activated services
 Operator QoS Control
 Service Aware Bearer Control
 Service Aware Bandwidth Management
 SACC Overview
• Handles configuration, • Handles subscription
Other Hot billing Application
fault and performance Billing Self-care and service life cycle
Prepaid or (non real-time Server
management Statistics
• Real-time charging mediation Server mgmt of the EPC
Policy Server prepaid) (IMS, Streaming)
towards external charging systems
Vendor- • Optionally offers rating as well as CAI
OSS- RC specific account & balance mgr Multi Activation
interfaces (E// -MA)
LDAP
Charging System Multi Mediation
ERE Policy Rx
Prepaid (Postpaid) ABM
Online File & Event Controller (E// -PC)

• Includes the user prepaid • Subscriber access control

(and/or postpaid) accounts Gy Gy Gz Gx
(preconfigured & dynamic)
• Handles rating, (CDRs)
•Packet
Mediation (pre rating) Operator
accumulators, etc.
of CDRs for offline Service
Core
charging towards external Network
billing systems • Inspects and classifies the IP flows
Radio GGSN or SASN • Enforcement point for Internet
policies
SGSN
Access (charging & access control)
Corporate
Intranet
 Traffic Inspection

Service Class
 To simplify the provisioning of Service Filters and tariff plans, the grouping
of services into Service Classes is supported
 On a per-user basis, the same volume rate will be applied for all services
that are grouped into a certain Service Class
 The Service Class concept also allows for Service Authorization
(sometimes called Service Selection).

Service Identifier
 Identifies a specific IP flow destination
 Grouped into Service Classes
 Enables 3rd party revenue sharing
 Traffic Inspection

GGSN/ SASN / SACC

Heuristic Protocol Classification Rules

Patterns Analyzers Output
...01101011... WSP.URL startsWith http://x & ... traffic
RTSP.URI contains ericsson & ...

...

Control
Analysis Classification Control
Engines
Engine Engine Engines

analysis service
undifferentiated parameters differentiated
incoming packets obtained sessions
Levels of Traffic Analysis

...

Shallow Packet Inspection

Layer 3 IP header +
Layer 4 UDP/TCP ports

Deep Packet Inspection

Headers in Layer 4, Layer 7

Heuristic Analysis
Empirical patterns obtained in packets L3-L7
headers + payload + IP flow metrics
 Service Authorization

• Access Control Lists with allowed Service

Classes down loaded at PDP context
activation
Policy Server – No external authorisation signalling
necessary while traffic flows
• Blocking of traffic based on the User
Access Control Lists Service Class after Packet Inspection and
Service Classification

GGSN/
Gi Gi
Service Aware
Support Node
Gives Us
Access Control
Lists (ACLs)
100,200,1000 etc • Low Latency
• A per subscriber service access
firewall
 Personalized QoS Profile

PCRF/SAPC

Gx/Gx+
Packet Operator
Core Service
Network
Radio SGSN GGSN Gi
Access Internet

Corporate
Intranet
Service A Service B Service C ... default
SRAP
No limit 10 Kbps 1 Mbps ... No limit

Bandwidth limit per service class obtained from PCRF/SAPC as part of ACL
Traffic Inspection - Flow
 Traffic Inspection GGSN

GGSN-U
NDPI

Packet UL or DL Inspect packet

Classify(pdpID, packet, …)

Classify packet

NDPI_MSG_SYNCH (... packet,

SI, Volume)

Virtual Session/SI

Packet Inspection
 Traffic Inspection
Analyzers extract protocol parameters to be used later in the classification stage.
Analyzers are created at init time.
Analyzers are “plugged” to each other according to protocol stack.

Packet Analysis
 Traffic Inspection GGSN

APN-A

1
Rule-Space

2
9
RG=a Service Set

3
Header Rule Set Heuristic Rule Set 7
Si=Z Si=Y
5
Protocol inspection
4 Rule Set
6 8

L3/L4 Header Rule L7 Protocol Rule Heuristic Rule

SI=Z SI=Y SI=Y

Service Classification Tree

 PISC Configuration -APN

In APN definition, allowed rule spaces (if received from OCS) and default rule
spaces are defined.

apn {
apn001 {
...
Allow-rule-space [rs_01 rs_02 rs_03];
User category default rule-space default rs_01;
}
}
 PISC Configuration –Service Set
A service set defines the default Service Identifier (SIs) to use for traffic over a PDP
context.
The service set may optionally point out a number of Header Rule Sets (max 10)
used for assigning SIs based on packet inspection.
The SI is a number between 1 and 4294967295.

Service-set ss_01 {
service-identification {
default payload xxxx;
}
header-rule-sets {
hrs_01;
hrs_02;
...
hrs_10;
}
}
 Traffic Inspection –Header Rule Set
Each Header Rule Set should be the defined.
A header rule set may contain one or several header rules.
The header rules are evaluated in the order they are configured.

header-rule-set hrs_01 {
rule {
rule_01;
rule_02;
...
rule_0n;
}
}
 PISC Configuration – Header Rules
A header rule consists of one or several terms. The terms are evaluated in the order
they are configured.
To configure a term in a header rule, the following actions are mandatory:
 Configure the match conditions.
 If several conditions are configured in a term,
all conditions must be fulfilled for the term to match.
 Configure the unique resulting SI.
The following match conditions can be configured for a term in a header rule.

•MS prefix
•MS address
•MS port
•Network prefix
•Network address
•Network port
•Protocol
 PISC Configuration – Header Rules

In case Packet Inspection is needed, the ACTION of the

related term (“then” section) should refer to one
“protocol-rule-set”. Packet Inspection Rule Set protocol
category may be one of the following or others:
DNS
FTP
HTTP WSP and MMS
MSN Messenger
POP3
RTSP
SIP
SMTP
TFTP
 PISC Configuration – Header Rules
header-rule rule_01 {
term term1 {
from {
ms-prefix x.x.x.x/x;
network-address y.y.y.y/y;
}
then {
service-id payload zzz;
}
}
term term2 {
...
}
...
term termt {
from {
ms-prefix x.x.x.x/x;
}
then {
protocol-inspection http-wsp-rule-set hwr_01 ;
}
}
 PISC Configuration
As an example an HTTP/WSP Rule Set and its related rules is shown here:

http-wsp-rule-set hwr_01 {
rule {
rule_01;
rule_02;
...
rule_0n;
}
}

http-wsp-rule rule_01 {
term term1 {
from {
uri {
starts-with http://airtel.com:;
contains //recharge/;
}
}
then {
payload zzz;
}
}
 PISC Configuration

Once the Service Identifier has been set, back to Rule Space configuration, the
mapping between SI and related rating group, which defines how the service is to be
authorized and charged.

rule-space rs_01 {
rating-group {
map {
1 service-id [100 200 1000];
2 service-id [150 250 2200];
...
}
}
}

Service-ID to Rating Group Mapping

 Further Study

3GPP Documentation
kb.juniper.net/
https://www.youtube.com/watch?v=YQRSa0JgmWQ
https://www.youtube.com/watch?v=R-6sgxD4KQo
https://www.youtube.com/watch?v=Riicg93L9eQ
https://www.youtube.com/watch?v=drdI6ylciW4
Google
When you’re confused

Q??