In other words, each cell site represents one fat pipe that all active local users are sharing. Therefore, simply impacting traffic rates in the core of the mobile network using a fixed-line DPI approach leaves out the key aspect of cell-site loading. For instance, if there's a cell site that currently isn't very loaded, but the DPI system is unaware of it, it may impact a lower-level-SLA user's traffic unnecessarily.

Article Tools

• 

Conversely, in high-load conditions, a RAN-unaware DPI system could rate-limit the traffic destined to a different cell site altogether and not take adequate action at the appropriate cell site, leaving higher-SLA users without the guaranteed QoS for which they are paying. (Fig. 2).

The final important difference is security. The security methodology in existing mobile networks is very different than that used by fixed-line broadband service providers. In the context of mobile DPI, existing security methods present a challenge in extracting the appropriate information to provide enhanced services without creating vulnerability.

All traffic from the mobile user to the edge of the core network (i.e., the radio network controller or RNC in WCDMA) is encrypted including the data and signaling information. This encryption is provided to protect the privacy of the individual user as well as to protect the network itself from attacks.

However, key information is embedded in the encrypted signaling traffic in the RAN that is critical to delivering the general and specific SLA services identified in this article. Innovative solutions are necessary to truly provide enhanced services without requiring substantial changes in existing mobile infrastructure.

Architecting Mobile DPI Solutions
How can network equipment providers (NEPs) take advantage of the emerging revenue opportunities presented by mobile DPI applications? A couple of key architectural aspects must be taken into account when putting together a solution that targets DPI in mobile networks to specifically solve these challenges.

Currently, mobile operators are deploying solutions that mirror fixed-line DPI systems in their networks to tackle the challenges of security and traffic management. This solution is sub-optimal as it does not tackle or take advantage of the unique aspects of the mobile network‹namely mobility, shared pipe delivery, and security.

The first enhancement requires gathering information specifically about the RAN for use by the DPI system. Information needs to be extracted from the signaling messages within the RAN in real time and presented in an aggregated fashion so the DPI system can combine the mobile-unique aspects with the data already extracted from the packets themselves (e.g., application type). The information added by the RAN includes cell-site, user-ID, and location updates that are critical to delivering tiered-SLA services. (Fig. 3).

The next critical decision is whether to build a standalone DPI solution or to integrate the DPI solution into existing wireless infrastructure. Both approaches are being applied today, including enhanced gateway GPRS support nodes (GGSNs) that include DPI-enabled traffic management and security enforcement capabilities, in addition to the deployment of specialized DPI equipment from pure-play DPI solution providers.

Standalone DPI systems are mostly "bump-in-the-wire," whereby a DPI appliance is put inline in the data traffic path and the box inspects traffic and thus enables traffic management and security applications. While effective, the "bump-in-the-wire" deployment scenario requires additional boxes that inherently increase complexity and associated operational and capital expenditures.

Wireless network operators that have already deployed 3G HSPA networks have no choice but to adopt the "bump-in-the-wire" deployment schemes. However, "Greenfield" HSPA deployments can have DPI capabilities embedded inside wireless gateways, like SGSN, GGSN, and femtocells. DPI-enabled gateways allow network operators to reduce their network complexity while achieving the desired functionality.

Each approach has both positive and negative aspects. Integrating the DPI capabilities with a wireless network node simplifies the gathering and integration of critical RAN information. In some cases it also allows for the extraction of RAN information following decryption but prior to translation into less-specific parameters. As the signaling data traverses the network, it becomes less and less granular since each network element only gets the data required to support its functionality.

The integrated device presents challenges, though. The first is deployment strategy for the DPI capability. As referenced above, getting the integrated solution into an existing HSPA network would require investment not only in DPI applications, but new core network equipment too. Second, DPI systems aren't just about affecting traffic. They also deliver rich reporting and analytical capabilities that are often better hosted on systems that aren't mission critical.