文本案例教案sapc policy

SapcpolicyAgenda1SAPCPolicy2Q&ASummaryExampleofpolicy:IfBobismakingroaming,thenrestricthisaccesstoIPTVserviceSAPCPolicies(I)SAPCactionsareconfiguredbymeansofpoliciesActionscanbedifferentperuserand/orservicePoliciesprovidesSAPCwithahighflexibilitySAPCPolicies(II)ConceptsPolicy:

Setofrulesthatimplyadecisionaboutaresourceandthattriggercertainbehaviorinthenetwork.Rule:

Containsaconditionformulathatisevaluatedtopermitordenytheauthorizationtoaresourceortoreturnanoutputattribute.SAPCPolicyEngineOncethepoliciesareselected,theseareevaluatedbytheengineobtainingdecisionsPolicyRepositoryIfroamingthendenyaccesstointernetserviceIftimeofdaybetween12:00and16:00ThenQoSprofileBronzeIfnetworkaccesstypenotUMTSthendenyIPTVaccessPolicyEngine...DecisionsNetworkinformationUserProfileinformationTerminalinformationOtherinformationSelectingapplicablepolicies(I)Dependingonthesubject,thecontextandtheresourceandaction,theSAPCselectstheapplicablepoliciesineachcase.WhendefiningapolicyinSAPC,theoperatorhastospecifywhatiscalledthepolicytarget:Subject:Asubjectismappedintoasubscriberorsubscribergroup.Resource:data,serviceorsystemcomponent.Aresourcecanbeabearerforwhichanoperation(PDPcontextactivation/modification)isreceivedoraserviceforwhichauthorizationisrequested.Context:theenvironmentinwhichthepolicyappliesforaparticularsubject,resourceoraction.ForexampleAccessorQoS.Action:anoperationonaresource.ForexampleQualify.Context?AccessQoSChargingContentfiltering….Selectingapplicablepolicies(II)Subject?SubscriberSubscriberGroup:GoldResource?Service:P2PServiceDomainBearer….Example:ApolicytodeterminetheQoSfortheservicePeertoPeerforalltheusersingroupGold

Selectingapplicablepolicies(III)Whenpoliciesaredefinedtheymaybeassignedasfollows:GloballytoResources:GlobalpolicylocatorsForaResourceandSubjectGroup:SubjectGrouppolicylocatorsForaResourceandaSubject:SubjectpolicylocatorsWhenandecisionrequestisreceived,alookuponthepolicyrepositoryisdone,selectingthepoliciesassociatedtothesubscriber,thegroupstowhichthesubscriberbelongstoandtheglobalpoliciesfortheapplicableresourcesPolicyEvaluation(I)Togiveadecisionresult,SAPCevaluatestherulescontainedintheapplicablepolicies,bydeterminingifthedefinedBooleanconditionsarefulfilledornot.Iftheconditionevaluatestotrue,theresourceisauthorized.Otherwiseitisnotauthorizedandanerrorreasonmaybereturnedifspecifiedinthecondition.PoliciesinSAPCcanalsobeusedtoreturnoutputsubscriberorservicecategorizationdataifparticularoperatordefinedconditionsarefulfilled:bandwidthlimitationscontentfilteringchargingdataendusernotifications…..PolicyEvaluation(II)Forpolicyevaluation,SAPCcanusethefollowingsetofdata:Subscriberandserviceprofiles:Thisinformationcouldbetheservicestowhichthesubscriberissubscribedandotheroperatorspecificsubscriberinformation.TimeconditionssuchascurrenttimeanddatewhenthepolicyevaluationisrequestedDynamicinformation:informationavailablebymeansoftheincomingtrafficmessages:subscriberidentity,negotiatedqualityofservice,accesstype,subscriberlocationinformation(roaminginformation)….2.GxCCRPolicyDatabaseSPR3.GxCCAProvisioningSystem1.DefineQoSPolicyforGoldSubscriberOperatordefinesrulestoQoScontrolforGoldsubscribersQoSEvaluationinSAPCSAPCNegotiatedQoSProfileMSISDN:123456789Resultcode=SUCCESSNegotiatedQoSProfileconfirmedChargingRuleInstallIdentifytheSubscriberGroupMSISDN:123456789belongstogoldgroupLookfortheapplicablepoliciestothesubscriberPreparetheGxCCAmessageQoSControlRule:Ifsubscriber==Gold&&RAT-TYPE==UMTS&&BearerUsage==GeneralTHENBearerQoS==BearerQoSProfile1Ifsubscriber==Gold&&RAT-TYPE/=UMTS&&BearerUsage==GeneralTHENBearerQoS==BearerQoSProfile2SubscriberGoldNegotiatedQoSisconfirmedforsubscriberMSISDN=123456789GGSNPoliciesconflictsPROBLEM:Multiplepoliciesmaybefoundapplicabletoarequestandasinglepolicycancontainmultiplerules:aresolutionmechanismisneeded.•Singleresultevaluation,whenonlyoneresultofallthepoliciesisreturned.Differentresultsfromdifferentrulesbelongingtothesamepolicy.Rulesareevaluatedaccordingtheirindex.Possibleconflictsaresolvedusingtheconfiguredcombinationalgorithms:Permitoverrides:Ifanyruleevaluatestotrue,theresultistrue.Denyoverrides:Ifanyruleevaluatestofalse,theresultisfalse.Firstapplicable:Theresultofthefirstruleevaluatedisselected.Onlyoneapplicable:TheresultoftherulewithhighestpriorityisselectedIfconflictsarisebetweentheresultsofdifferentpolicylocatorsforthesameresource,theresultofthepolicywithhighestpriorityisselected(thepriorityissetwhenthepolicyisassignedtothelocator).Forpolicieshavingthesamepriorityforaresourceandacontext,SAPCconsidersthatprevailsfirsttheSubjectPolicyLocator,thentheSubjectGroupPolicyLocatorandfinallytheGlobalPolicyLocator.•Multipleresultevaluation:theresultsofallruleswithinalltheselectedpoliciesthatevaluatestotruearereturned.BeaeraccesscontrolBeaeraccesscontrolSAPCpermitsorrejectsPDPcontextcreationandmodificationoperations,accordingtooperatordefinedpolicies.BeaeraccesscontrolSAPCpermitsorrejectsPDPcontextcreationandmodificationoperations,accordingtooperatordefinedpolicies.VersionR6+R7R8R9BearerAccessControlDIAMETERAUTHORIZATIONREJECTED=5003/ASRDIAMETER_ERROR_BEARER_NOT_AUTHORIZED=5143/RARwithSession-Release-Cause=UE_SUBSCRIPTION_REASONDIAMETER_ERROR_BEARER_NOT_AUTHORIZED=5143/RARwithSession-Release-Cause=UE_SUBSCRIPTION_REASONDIAMETER_ERROR_BEARER_NOT_AUTHORIZED=5143/RARwithSession-Release-Cause=UE_SUBSCRIPTION_REASONVersion

R7+R8+

BearerAccessControl

AUTHORIZATIONREJECTED=5003DIAMETER_ERROR_BEARER_NOT_AUTHORIZED=5143/RARwithSession-Release-Cause=UE_SUBSCRIPTION_REASON

ServiceaccesscontrolServiceaccesscontrolServiceaccesscontrolServiceaccesscontrolTODAccessControlRedirections(Permanent/OTR)RuleSpaceManagementServiceaccesscontrol(TOD)Serviceaccesscontrol(otr)RulespaceRULESPACE#1ACG:AccessControlGroupACR:AccessControlRuleService&UsageConditionsRuleSpacenegotiationGWTransportRANInstallingrulesforAllowedservicesSAPC3DefaultBearer(PrimaryPDPContext)=PolicyControl=PolicyEnforcement=DeepPacketInspectionLegend:ExternalDB122.AuthorizedRuleSpace1.ProposedRuleSpaceServiceaccesscontrol(RS)SAPCPolicycontrolBearerqoscontrolQCI(Rel-7onwards)TC/THP/SI(Rel-6)GBR/MBRAPN-AMBR/ARPBearerqoscontrolBearerqoscontrolGWDPITransportRANClient/Peer

Application6DefaultBearer(PrimaryPDPContext)E2eQoSControl:DefaultbearerServiceStarts1UpgradeQoS

(Gx)2ServiceDetection(Rx)PCRF345GWTransportRANClient/Peer

ApplicationDefaultBearer(PrimaryPDPContext)E2eQoSControl:dedicatedbearers<QoSClass+BitRates>+

UL/DLPacketFilters

(Gx)2ServiceInformation(Rx)pcrf345AF1ServiceSignalingDedicatedBearer(SecondaryPDPContext)Service#1e.g.InternetService#2e.g.p2pdownloadService#3e.g.MobTV/MMTel6SubscriberqoscontrolContentfilteringcontrolContentfilteringGWSASNTransportRANClient/Peer

ADefaultBearer(PrimaryPDPContext)=PolicyControl=PolicyEnforcement=DeepPacketInspectionLegend:ExternalDB2WHITELISTBLACKLISTContentClassificationEngine414.ContentFilteringProfile1.ServiceDetectionSAPC3ContentfilteringSubscriberchargingcontrolSubscriberchargingcontrolServicechargingcontrolServicechargingcontrolServicechargingcontrolUsagereportingVisitedStateUsagereporting

HomeStateGWSAPCSASNProvisioningSMS-CSMTPServerRadioAccessSGSNROAMINGLIMITREACHED1.OperatorprovisionslimitsandconditionsforroamingaccordingwithEUregulation3.ReportsBearerEstablishment4.EURoamingSubscriberinExtDB6.DownloadQuota7.ReportUsage8.SendNotification2.AccessthenetworkfromavisitedstateintheEUROAMING80%LIMITREACHEDExternalDBDetectUsageLimitReached5.GetSubscriberprofileandassignittoEU-RoamingSubscriptionGroupEULimit80%=Subscribergroupprofile=SubscriberprofileLegend:ApplyPolicy:-StopServiceAccess-RedirecttoPage,etc.Usagereporting-GxUsagemonitoring-GyUsagemonitoring-GyUsagereportingControlR6+R7R7+R8R8+R9UsageReportingMultiple-Services-Credit-ControlAVP

Multiple-Services-Credit-ControlAVP

Multiple-Services-Credit-ControlAVPUsage-Monitoring-InformationAVPBeare