Mechanisms for Diameter service performance enhancement

Transcription

1 Mechanisms for service performance enhancement D. Matijašević, I. Gizdić and D. Huljenić Ericsson Nikola Tesla d.d., Zagreb, Croatia {dinko.matijasevic, igor.gizdic, Abstract: One of the basic requirements of service providers is to deliver fast processing, highly available, scalable, redundant and unobtrusive AAA services. In this paper we present incorporation of service into a legacy ing system. Our approach is based on a component architecture and the use of open source software to speed-up the development cycle. The main idea is to multiply critical nodes/interfaces with optional state replication thus avoiding single point of failure in the system and providing full redundancy of the service. We specifically discuss mechanisms that lead to performance improvements and present results proving the concept. Keywords: protocol, balancing, Agent 1. INTRODUCTION 1 is an extensive Authentication, Authorization & Accounting (AAA) protocol enabling AAA functions [1] in IP and multimedia networks (e.g. IP Multimedia Subsystem, IMS [2]) for a range of access technologies. Most typically is used to provide a framework for network access, IP mobility etc. was developed by the Internet Engineering Task Force (IETF) and is loosely based on the RADIUS (Remote Authentication Dial-In User Service) protocol which was not extensible and was not able to fulfill modern demands for an AAA protocol such as dynamic failover, transmission-level security, reliable transport, agent support, capability negotiation, peer discovery etc. Modern network access control methods are generally based on protocol nowadays [3]. The protocol is split into two parts: the Base Protocol and the Applications. Base Protocol [4], as the core protocol, provides the minimum requirements needed for an AAA protocol, as required by [5]. Base protocol takes care of establishment and teardown of transport connections, capability negotiation, error notification, message format, exchange and routing, handling of user sessions, accounting, etc. Also, it provides extensibility in a way that any application built on top of Base Protocol can define its own extensions. The base protocol may be used by itself for accounting applications. For authentication and authorization, it is always extended for a particular application. These applications can provide additional functionalities to the Base Protocol, such as This work was partially funded in the context of the Q-ImPrESS research project (FP ) by the European Union under the Information and Communication Technologies priority of the Seventh Research Framework Programme. additional charging methods, additional security mechanisms etc. A message is the base unit to send a command or deliver a notification to another node. It consists of a binary header followed by a certain number of AVPs (Attribute-Value Pairs). All user data delivered by the protocol is in the form of an AVP. Some of these AVP values are used by the protocol itself, while others deliver data associated with particular applications that employ. protocol RFC [4] defines three different types of network nodes: clients, servers and agents. s are devices at the edge of the network that perform access control. s handle AAA requests for a particular realm. A Agent is a node that provides relay, proxy, redirect or translation services. is one of the cornerstone protocols of IMS and the main AAA protocol in standard IMS architecture [6][7]. Among many standardized application and interfaces, this paper considers the Gq interface, defined between the Service-based Policy Decision Function (SPDF) and the Application Function (AF) entities [8] because of its applicability to the legacy system of interest. The Gq interface is used for the service-based policy setup information exchange between the SPDF and the AF. It is used for requesting transport plane resources and admission control. The Gq signaling is triggered on a session (call) basis in order (1) to authorize usage of possibly required maximal bandwidth before ephemeral termination in Media Gateway is seized, (2) to possibly update bandwidth requirements after the actual codec for the session has been negotiated and (3) to cancel bandwidth reservation once the application session is terminated. Market interest for the introduction of such functionality in 2 exchange was the main reason for the development of Gq interface on top of Base Protocol. has very important role in user experience aspect. In an authorization process, service providers are generally confronted with the fact that users do not like waiting to be authorized for the service they requested. Longer waiting period or service unavailability could even drag users away. Therefore, when providing service to the legacy system, it must be highly available and able to process as many requests per second as possible. 2 telephone exchange is product line of circuit ed digital telephone exchanges manufactured by Ericsson.

2 The starting idea of this work, as previously stated, was inspired by market and evolution interest of based telecom nodes in introduction of protocol as well as global initiative for open source and component based design. We investigated a way to incorporate signaling in based node for policy and/or charging functions using the component architecture and open source software. More precisely, our initial prototype provides -based AAA functionality to existing telephone exchange system as a call control node (i.e. functionality needed when an incoming SIP (Session Initiation Protocol) or H.323 call needs to be authorized, or when an Internet user needs to be authorized). This paper considers only solutions based on open source software. Therefore, commercial solutions developed by Traffix [9] (OpenBLOX in its commercial version), Radware [10] (AppDirector and AppXcel) etc. are not applicable. The rest of the paper is organized as follows. In the second section we describe a way of implementing protocol on a legacy system (telephone exchange based on proprietary technology). In the third section possibilities to improve performance of service with the purpose of making them telecom grade are analyzed. Fourth section compares measured scenario execution durations on different network architectures. Final section states conclusion of the paper. 2. CONCEPTUAL ARCHITECTURE There are several available open source implementations of protocol. Some of them (most widely used) are Open, OpenBloX [9] (commercial version and open source version with limited functionality), Wire, Charging SDK and INRIA s. After comparing each implementation s advantages and drawbacks, Open was selected as most appropriate for our implementation. OpenBLOX (as probably the most popular implementation nowadays) was discarded because of its significant distinction between open source and commercial version. There is number of limitations in open source versions such as limited stack lifetime and overall number of messages, lack of support for multi-threading, diameter agents, routing table etc. Open [11] is an open source implementation of Base Protocol developed in C++ programming language relying heavily on well-known ACE C++ framework (Adaptive Communication Environment) for system level abstraction. Although Open was intended to be platform independent, there were many problems when we tried to install it on Microsoft Windows OS (XP and Vista). Moreover, Microsoft VC (.NET) solutions for Open were as of version h declared Out of date [11]. Since Open was selected as the implementation of choice, there were some incompatibilities which had to be dealt with. Most important is that current s regional processors (GARP) [12] are running on OSE DELTA 3 operating system which is not natively supported by ACE framework (and hence Open). GARPs are used to off-load the Central Processor with IP related functionality. They typically handle the TCP/IP protocol suite as well as a range of application layer protocols (SIP, H.323, DNS). To comply with this design practice, we proposed a solution of using a GARP to connect the to the externally placed engine running on Linux OS, as presented on Figure 1. Analogously, same solution is applicable to any system that needs engine, but is not natively supported by Open. In such a setup, does not need to have any implementation. Instead, is running on a separate machine (with Linux operating system) where Open is natively supported. is connected to s GARP board node, from which it receives AAA requests, and to whom it sends corresponding responses. Those two nodes ( and s GARP board) are communicating via proprietary TCP-based AAA protocol (noted as control signaling on Figure 1). Proprietary AAA control protocol is designed with intention to be as simple as possible so that it produces lowest performance degradation while carrying all the relevant information at the same time. This protocol is a binary request-reply protocol, and its messages typically contain 10 to 30 bytes, depending on message type. Call generator SWITCH GARP Control H.323 or SIP signaling Control Control signaling Network DIAMETER signaling Figure 1. Prototype setup engine as an external node to the in this setup has multiple roles. It must act as a server for control signaling messages and as a client for messages. is also responsible for information conversion from control protocol to standard protocol and vice versa, as well as for session management. Isolation of outside the node has another good side it provides the possibility of performance boost by addition of more nodes. More details about this will be provided later in this paper. For testing purposes, a custom traffic generator has been developed. It generates the same requests as they would came 3 Operating System Embedded (OSE) is a real-time embedded operating system created by Swedish company ENEA.

3 from 's regional processor. Furthermore, it can send requests synchronously or asynchronously. In these conditions, we have measured typical processing times on nodes for a single authorization request. Such authorization consumes about 1 millisecond of processing time on a for translation from control protocol to protocol, session creation and message sending. On the other hand, 10 milliseconds of s processing time are spent for the same authorization. Higher authorization requests rate and higher number of active sessions would clearly result in performance degradation. 3. IMPROVING DIAMETER PERFORMANCE CASE STUDY Our way to deal with recognized bottlenecks and to improve performance statistic is to unburden and from heavy load by their multiplication. Such multiplication requires additional nodes to the architecture presented on Figure 1, with their main task to balance the load between active nodes with same functionality - one node for balancing the load among s, and one node for balancing the load among s. For load balancing among s (proprietary control messages) custom load balancer needs to be made (based on existing open source load balancing solutions and with respect to the recent work in the area [13][14]), while for load balancing among s ( messages) we can use agents with load balancing as one of their core functionalities. Pen load balancer [15] is simple open source load balancer initially designed for TCP-based protocols such as HTTP or SMTP. It allows several servers to appear as one to the outside, and automatically detects servers that are down and distributes clients across the available servers. It provides both load balancing and failover capabilities. The load balancing algorithm keeps track of clients and will try to send them back to server they visited the last time. However, many significant changes had to be made to Pen so that it balances the load properly. Pen is a layer-3 load balancer and it does not analyze message content, but because is a session based protocol, that had to be changed load balancing had to be moved from network layer to application layer. Among other data, each proprietary protocol s message carries an identification pair: a unique request ID that distinguishes requests from the same client, and process ID that distinguishes between different clients. With knowledge of these two identifiers Pen can always send messages that belong to same session (call) to the same. By protocol s definition [4], any host that implements the protocol can act as a, or Agent. Performance improvements on and can be made only by implementing complex software changes to Open source code. Keeping in mind Open s code complexity and quantity, and lack of any support from developers, this solution was inappropriate. On the other hand, introduction of Agents improves overall performance and provides hardware redundancy. Typical tasks that Agent performs are load balancing, centralizing request dispatching and value-added pre-processing of messages. Reference [4] defines 3 types of agents 4 : Agent, Redirect Agent and Proxy Agent. Agents are used to forward messages to the appropriate host, depending on information contained in message. Also, they can aggregate requests from different realms (regions) to a specific realm which eliminates additional configurations of Network Access s (NASs) for every change. s do modify messages by inserting and removing routing information, but they do not modify any other portion of the message. In other words, s do not perform any application level processing, but they are providing routing (relaying) services to all applications. The routing decision is performed using a list of supported realms and known peers known as Realm Routing Table. Proxy Agents can modify the message content and provide value-added services and enforce different policy rules for different messages. Thus, they are required to maintain session-state (unlike s). Redirect Agents are useful in scenarios where the routing configuration needs to be centralized. They do not relay messages, and only return an answer with the information necessary for nodes to communicate directly. According to each agent type s features and initial support in Open, Agent appears to be most appropriate for implementation. However, investigation showed that Open library had no support for load balancing of client requests hence we had to modify the source code to support both round-robin and static weightbased load balancing. Additionally, client library also had to be improved in a way to start a session without asking the service from a particular host (no Destination-Host AVP, just Destination-Realm) therefore letting the s loadbalancing algorithm to select the that will service the. Upon next requests pertaining to existing session, Destination-Host AVP is present thus bypassing the s load-balancing algorithm. With these modifications, stateless Agent could be used as a load-balancing node in our network. Various approaches to extending initial network 4 In addition, there is also Translation Agent defined. Its responsability is conversion from different AAA protocols (e.g from RADIUS authentication/authorization requests to and vice versa).

4 architecture (that include presented load balancer and Agent) are presented on Figure 2. node is responsible for call control functionalities, and upon receipt of incoming SIP or H.323 call it generates proper proprietary control protocol authorization message. a) n b) c) m proper routing decision-making without reading and parsing entire message but only few starting AVPs, and thus results in faster message processing on Agent. 4. MEASUREMENTS All the testing presented in this paper was made on identical desktop PCs: HP dc 7800p equipped with Intel Core 2 Duo E6400 CPUs (2.13 GHz) and 2 GB DDR2 memory on 800 MHz. PCs were all running on a CentOS Linux operating system, and they were connected in LAN with declared 100 Mbps throughput. Presented solutions for increasing service s performance were verified with same test scenario execution on different network setups according to Figure 2. Test scenario consisted of 150 asynchronously sent authorization requests, and 150 asynchronously sent termination requests. Durations of test scenario execution 5 on network setups with different number of s and s (from 1 to 4) included are presented on Figure 3. On Figure 3 it can be noticed that additional s (according to Figure 2b) result in approximately 20-25% faster scenario execution time, while additional s (according to Figure 2c) result in approximately 50-55% time saving. However, load balancing between additional s as well as s (according to Figure 2d) gives the best result scenario execution time is decreased to approximately one third of original (12.5 seconds to 4.1 seconds). n m d) Figure 2. Different Network architectures: a) Single authorization path, b) balancing on a side, c) balancing on a side, d) balancing on both and sides As depicted on Figure 2, there are two branching points in an authorization message path towards : and. Although they have similar functionality, there are significant differences between them. First of all, they are operating with totally different messages (20-30 bytes long proprietary protocol s messages, and typically bytes long messages). Nevertheless, protocol s definition [2] mandates all the routing-related AVPs (i.e. Destination-Host and Destination-Realm AVPs) to be positioned as close to the start of the message as possible. This enables Figure 3. Duration of test scenario execution depending on number of clients and servers included (see Figure 2, marked with n and m, respectively). Test scenario included 150 asynchronously sent authorizations and 150 terminations. 5 For each network setup measurement was conducted 5 times, and mean of 3 most acceptable values (without highest and lowest) was selected as tests execution duration.

5 Furthermore, measurements have confirmed that neither the load balancer, neither Agent have caused considerable delay. 5. CONCLUSION In this paper we presented our research work on improving the performance of the service. A performance analysis of a simple client-server network architecture has indicated that such an architecture is not able to provide telecom grade service. To overcome service limitations arising mainly from processing time requirements of nodes, we proposed a new network architecture which consists of multiplied critical nodes ( s and s) as well as nodes for balancing load between them. All of the prototype components developed as part of this prototype are based on open source software. In order to verify the benefits of proposed solutions, processing time analysis was conducted. The results of analysis indicated that total processing time for same scenario was shortened for approximately 66% (12.5 sec 4.1 sec) in case where 4 s and 4 s are used. Analysis also confirmed that neither the, neither the Agent are generating significant time delay. REFERENCES [1] C. de Laat et al., Generic AAA Architecture, IETF, RFC 2903, August [2] G. Camarillo, M. Garcia-Martin, The 3G IP Multimedia Subsystem (IMS): Merging the Internet and the Cellular Worlds, Wiley, [3] Li-chuan Gu, Shao-wen Li, Zhu Cheng, You-hua Zhang, "A New Network Access Control Method Based on Protocol," cmc, vol. 3, pp , 2009 WRI International Conference on Communications and Mobile Computing, 2009 [4] P. Calhoun et al., Base Protocol, IETF, RFC 3588, September [5] B. Aboba, P. Calhoun et al., Criteria for Evaluating AAA Protocols for Network access, IETF, RFC 2989, November [6] Mamdouh Gouda, Mohamed Haggag, "Enhanced Authentication Mechanism for Next Generation Networks," cicsyn, pp , 2009 First International Conference on Computational Intelligence, Communication Systems and Networks, 2009 [7] Do van Thanh, Ivar Jørstad, Paal Engelstad, Tore Jønvik, Boning Feng, Do van Thuan, "Authentication in a Multiaccess IMS Environment," wimob, pp , 2008 IEEE International Conference on Wireless & Mobile Computing, Networking & Communication, 2008 [8] European Telecommunications Standards Institute (ETSI), DIAMETER protocol for session based policy set-up information exchange between the Application Function (AF) and the Service Policy Decision Function (SPDF), ETSI TS V1.1.1, [9] OpenBloX, available at: accessed on 27 th May, [10] Radware: Fault-tolerant AAA HSS/DIAMETER Services across IMS Framework, available at: accessed on 27 th May, [11] Open, available at: accessed on 27 th May, [12] P. Holmgren, MIB design of Regional Processors, Master s Thesis, Ericsson Utveclings, [13] Wei Hantian, Xiong Xiaomei, "The Research and Implement of an Efficient Balancing Algorithm," ssme, pp , 2009 IITA International Conference on Services Science, Management and Engineering, 2009 [14] V. Sugavanan, V. Prasanna Venkatesh, "High Performance Grid Computing and Security through Balancing," iccet, vol. 1, pp.68-72, 2009 International Conference on Computer Engineering and Technology, 2009 [15] Pen, available at: accessed on 27 th May, 2009.