Method and system for secure distribution of mobile data traffic to closer network endpoints
When a user equipment (UE) provides a new request to a serving gateway (S GW), the S GW augments domain name system (DNS) requests and provides them to a public DNS, with the augmentation providing indications of the requested function. The public DNS responds by providing the IP address of a simplified packet data network (PDN) gateway (P GW) close to the UE location. The P GW forwards communications to the nearest instance of an endpoint providing the requested service or function. In embodiments, some of the functions of the P GW are shifted to other devices in the mobile core, devices that are already local. The simplification of the P GW allows the P GW to be virtualized and moved to a general-purpose server location. Existing information present in the data path is used to provide encryption of portions of the General Packet Radio Services (GPRS) Tunneling Protocol (GTP) connection, allowing the location of the P GW to be optimized in a virtual server data center, as the data path is now secure.
1. A method of operating a mobile communication network, comprising:
receiving, at a serving gateway (S-GW), a request from a user equipment (UE) to access a network resource;
preparing, at the S-GW, in response to the received request, an augmented domain name server (DNS) request, the augmentation indicating a predefined function of the request;
providing, by the S-GW, the augmented DNS request to a public DNS located on a public network;
receiving, at the S-GW, from the public DNS an Internet Protocol (IP) address of a closest packet data network (PDN) gateway (P-GW) to the UE based on the augmented DNS request; and
connecting, by the S-GW, to the P-GW at the received IP address, to develop a flow path from the UE to the S-GW to the closest P-GW.
2. The method of claim 1 , wherein the S-GW and the P-GW are in a same network.
3. The method of claim 1 , further comprising:
performing, by the S-GW, at least one of a charging function, a policy enforcement function and a lawful intercept function on behalf of the P-GW.
4. The method of claim 1 , wherein the step of connecting to the P-GW at the received IP address uses a secure GPRS Tunneling Protocol (GTP) format.
5. The method of claim 4 , wherein the secure GTP format comprises:
an encrypted message packet with added ESP header and ESP trailer which is encapsulated in a GTP header, a UDP header and an IP header.
6. The method of claim 1 , wherein the augmented DNS request is in the form of an augmented function concatenated with a fully qualified domain name (FQDN).
7. The method of claim 6 , wherein the augmented function includes a predefined resource and network type.
8. A serving gateway (S-GW) of a mobile communication network, comprising:
a processor;
a plurality of network ports coupled to the processor;
a packet routing mechanism connected to the plurality of network ports and coupled to the processor; and
a memory coupled to the processor and storing programs for execution on the process to cause the processor to:
prepare an augmented domain name server (DNS) request, the augmentation indicating a predefined function of the request in response to receiving a request from a user equipment (UE) to access a network resource;
provide the augmented DNS request to a public DNS located on a public network; and
connect to a packet data network (PDN) gateway (P-GW) at an IP address provided by the public DNS in response to the provided augmented DNS request, the IP address being of a closest P-GW to the UE, to develop a flow path from the UE to the S-GW to the closest P-GW.
9. The S-GW of claim 8 , wherein the S-GW and the P-GW are in a same network.
10. The S-GW of claim 8 , further comprising:
perform at least one of a charging function, a policy enforcement function and a lawful intercept function on behalf of the P-GW.
11. The S-GW of claim 8 , wherein the step of connecting to the P-GW at the received IP address uses a secure GPRS Tunneling Protocol (GTP) format.
12. The S-GW of claim 11 , wherein the secure GTP format comprises:
an encrypted message packet with added ESP header and ESP trailer which is encapsulated in a GTP header, a UDP header and an IP header.
13. The S-GW of claim 8 , wherein the augmented DNS request is in the form of an augmented function concatenated with a fully qualified domain name (FQDN).
14. The S-GW of claim 13 , wherein the augmented function includes a predefined resource and network type.
15. A mobile communication network comprising:
a serving gateway (S-GW) for communicating with a user equipment (UE) including:
a processor;
a plurality of network ports coupled to the processor;
a packet routing mechanism connected to the plurality of network ports and coupled to the processor; and
a memory coupled to the processor and storing programs for execution on the process to cause the processor to perform various methods; and
a plurality of packet data network (PDN) gateways (P-GWs), the P-GWs being varying distances from the UE,
wherein various methods performed by the S-GW processor include:
preparing an augmented domain name server (DNS) request, the augmentation indicating a predefined function of the request, in response to receiving a request from the (UE) to access a network resource;
providing the augmented DNS request to a public DNS located on a public network; and
connecting to one of the plurality of P-GWs at an IP address provided by the public DNS in response to the provided augmented DNS request, the IP address being of a closest P-GW to the UE, to develop a flow path from the UE to the S-GW to the closest P-GW.
16. The network of claim 15 , wherein the S-GW and the P-GW are in a same network.
17. The network of claim 15 , the various methods further including:
performing at least one of a charging function, a policy enforcement function and a lawful intercept function on behalf of the P-GW.
18. The network of claim 15 , wherein connecting to the P-GW at the received IP address uses a secure GPRS Tunneling Protocol (GTP) format.
19. The network of claim 18 , wherein the secure GTP format comprises:
an encrypted message packet with added ESP header and ESP trailer which is encapsulated in a GTP header, a UDP header and an IP header.
20. The network of claim 15 , wherein the augmented DNS request is in the form of an augmented function concatenated with a fully qualified domain name (FQDN).
21. The network of claim 20 , wherein the augmented function includes a predefined resource and network type.
22. The network of claim 15 , wherein at least one of the plurality of P-GWs is a virtual P-GW.
23. The network of claim 22 , wherein at least one of the plurality of virtual P-GWs is located in the public network.
24. The network of claim 15 , wherein the P-GW includes:
a processor;
a plurality of network ports coupled to the processor;
a packet routing mechanism connected to the plurality of network ports and coupled to the processor; and
a memory coupled to the processor and storing programs for execution on the process to cause the processor to communicate with a closest of a plurality of servers or a plurality of access point networks (APNs) located in the public network, with at least one server being closer to and one server being farther from the P-GW or with at least one APN being closer to and one APN being farther from the P-GW.