1111111111111111 IIIIII IIIII 1111111111 11111 111111111111111 IIIII IIIII IIIII IIIIII IIII 11111111
`US 20130322242Al
`
`c19) United States
`c12) Patent Application Publication
`Swenson et al.
`
`c10) Pub. No.: US 2013/0322242 Al
`Dec. 5, 2013
`(43) Pub. Date:
`
`(54) REAL-TIME NETWORK MONITORING AND
`SUBSCRIBER IDENTIFICATION WITH AN
`ON-DEMAND APPLIANCE
`
`(71) Applicant: Skyfire Labs, Inc., Mountain View, CA
`(US)
`
`(72)
`
`Inventors: Erik R. Swenson, San Jose, CA (US);
`Nitin Bhandari, Fremont, CA (US)
`
`(21) Appl. No.: 13/907,847
`
`(22) Filed:
`
`May 31, 2013
`
`Related U.S. Application Data
`
`(60) Provisional application No. 61/654,689, filed on Jun.
`1, 2012, provisional application No. 61/754,391, filed
`on Jan. 18, 2013.
`
`Publication Classification
`
`(51)
`
`Int. Cl.
`H04W28/06
`H04W24/00
`
`(2006.01)
`(2006.01)
`
`(52) U.S. Cl.
`CPC .............. H04W 28106 (2013.01); H04W 24100
`(2013.01)
`USPC ........................................... 370/232; 370/252
`
`(57)
`
`ABSTRACT
`
`A system and a method are disclosed for selectively monitor(cid:173)
`ing traffic in a service provider network. The system receives
`a notice for a beginning of a network data flow, which
`responds to a request from a user device for content at an
`origin server. The system then determines whether to monitor
`the data flow from the origin server to the user device. If so
`determined, the system collects statistic information of the
`data flow and stores the statistic information to a flow record
`in a database. The system also maps the flow record to a
`subscriber of the service provider network by analyzing the
`statistic information of the data flow and estimates bandwidth
`provided to the data flow by the service provider's network
`based on the analysis of the statistic information of the data
`flow.
`
`/100
`
`I
`
`VIDEO
`OPTIMIZER
`150
`
`NETWORK
`CONTROLLER
`140
`
`USER
`DEVICE
`110A
`
`~
`r
`USER ~ STEERING
`
`DEVICE
`130
`
`NETWORK 120
`
`'
`.................
`
`.•"•····
`·············•··
`
`V
`
`ORIGIN
`SERVER
`160
`
`DEVICE
`110B
`
`"
`
`V
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 1 of 23
`
`

`

`Patent Application Publication
`
`Dec. 5, 2013 Sheet 1 of 8
`
`US 2013/0322242 Al
`
`z 0:: w
`(9 > §I
`0:: 0:: w
`0 CJ)
`
`j~
`
`------ .. .---·-·-- .. ..
`
`.. -··
`
`------...
`
`,l
`
`(
`
`\. __
`..
`
`-'
`
`\._
`
`.. "\
`..... ..
`
`0
`N ..--
`
`::::s::::
`0::
`0
`$
`I-w
`z
`
`-----··
`
`..
`
`·---
`
`·---- .... -._ -----····
`
`)
`
`'
`
`..
`
`\ / ..
`
`I
`
`I
`
`0 w
`0
`>
`
`0:: w
`N ~I ~
`I-a..
`0
`
`K
`
`c::
`
`~
`
`~
`
`0
`0 ..--
`
`,
`
`,
`
`(9
`z w
`0:: u ~I
`w > w w
`
`I- 0
`CJ)
`
`-
`
`-
`
`0::
`::::s:::: w
`0:: _J
`_J
`0 0
`$ 0::
`I- I-w z
`z 0 u
`
`~I
`
`w
`0:: u <( W-o
`
`CJ)>..-(cid:173)
`::::, W ..--
`0
`
`w
`0:: u aJ W-o
`CJ)>..-(cid:173)
`::::> w ..--
`0
`
`■
`
`C) -LL
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 2 of 23
`
`

`

`Patent Application Publication
`
`Dec. 5, 2013 Sheet 2 of 8
`
`US 2013/0322242 Al
`
`/200
`
`GRAPHICS
`DISPLAY
`210
`
`ALPHA-NUMERIC
`INPUT DEVICE
`212
`
`CURSOR
`CONTROL
`DEVICE
`214
`
`STORAGE UNIT
`216
`
`MACHINE(cid:173)
`READABLE
`MEDIUM
`222
`
`INSTRUCTIONS
`224
`
`PROCESSOR
`202
`
`INSTRUCTIONS
`224
`
`MAIN MEMORY
`204
`
`INSTRUCTIONS
`224
`
`STATIC
`MEMORY
`206
`
`NETWORK
`INTERFACE
`DEVICE
`220
`
`NETWORK
`110
`
`FIG. 2
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 3 of 23
`
`

`

`Patent Application Publication
`
`Dec. 5, 2013 Sheet 3 of 8
`
`US 2013/0322242 Al
`
`~I
`c:::
`w
`
`_J
`_J
`
`0
`c:::
`I--
`z
`0 u
`:::s:'.
`c:::
`0
`s
`I--
`w
`z
`
`>- w
`u ~ s;tl
`_J (9 ..---
`0 z C'0
`0.. w
`
`Cl'.'.
`w
`s N NI
`0 >- ..---
`_J _J C")
`LL <(
`z
`<(
`
`Cl'.'. ~
`0 w I--
`w ~ u col
`0 ~ w ..---
`-~C:::C'0
`> 0.. 0
`ow
`c:::
`
`w
`(9
`zwU
`- u <(
`c::: - LL '°I
`w>c:::..---
`w w w C")
`I-- 0
`I--
`z
`CJ)
`
`11)
`
`Cl'.'. w
`~ (9 '<ti
`UON
`CJ) _J C")
`11)
`::J
`CJ)
`
`w
`s I NI
`OUN
`_J <( C")
`LL U
`
`■
`
`~
`C)
`LL
`
`-
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 4 of 23
`
`

`

`Patent Application Publication
`
`Dec. 5, 2013 Sheet 4 of 8
`
`US 2013/0322242 Al
`
`NETWORK CONTROLLER
`140
`
`FLOW ANALYZER
`312
`
`*
`
`STEERING DEVICE
`INTERFACE 316
`ICAP SERVER 406 I
`
`I
`
`USER i.------4• 16
`DEVICE
`11 0
`
`_____.._A 11
`
`,__ _
`
`415 414
`
`•
`ICAP CLIENT
`404
`
`t
`t
`
`I
`I
`L - - -
`
`I
`I
`I
`__ J
`
`-
`
`---------- ~
`DATA SWITCH
`402
`
`STEERING DEVICE
`130
`
`FIG. 4A
`
`13---------1
`4
`
`A
`
`12-----
`
`ORIGIN
`SERVER
`160
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 5 of 23
`
`

`

`Patent Application Publication
`
`Dec. 5, 2013 Sheet 5 of 8
`
`US 2013/0322242 Al
`
`NETWORK CONTROLLER
`140
`
`FLOW ANALYZER
`312
`
`'
`STEERING DEVICE
`INTERFACE 316
`ICAP SERVER 406 I
`·~
`
`I
`
`426
`
`425
`
`1
`
`ICAP CLIENT
`404
`
`*
`
`USER --------£J.•24
`DEVICE
`110A 1---------4• 21
`
`----------
`
`A 23---------<
`
`A 22-------
`
`---------
`DATA SWITCH
`402
`
`STEERING DEVICE
`130
`
`ORIGIN
`SERVER
`160
`
`FIG. 4B
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 6 of 23
`
`

`

`USER
`DEVICE
`110
`
`STEERING
`DEVICE
`130
`
`NETWORK
`CONTROLLER
`140
`
`VIDEO
`OPTIMIZER
`150
`
`ORIGIN
`SERVER
`160
`
`HTTP GET 512
`
`..
`
`....
`
`.
`
`HTTP REDIRECT 520
`-
`
`ICAP REQ 516
`
`RESPONSE 518
`
`--~
`
`HTTP REDIRECT 520
`
`HTTP GET 512
`
`RESPONSE 514
`
`VIDEO 528
`
`•
`
`OPTIMIZEDIVIDEO 526
`
`~
`
`OPTIMIZED VIDEO 526 -~
`VIDEO 528
`
`FIG. 5
`
`HTTP GET 522
`
`....
`
`VIDEO 524
`
`""O
`~ .....
`
`(')
`
`~ .....
`
`('D = ..... t "e -....
`.... 0 = ""O = O" -....
`.... 0 =
`c ('D
`
`(')
`
`~ .....
`
`~
`~Ul
`N
`
`0 ....
`
`~
`
`('D
`('D
`
`rJJ =(cid:173)
`.....
`O'I
`0 ....
`
`QO
`
`c
`rJJ
`N
`0 ....
`~ ---0
`
`~
`N
`N
`N
`.i;...
`N
`
`> ....
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 7 of 23
`
`

`

`USER
`DEVICE
`110
`
`STEERING
`DEVICE
`130
`
`NETWORK
`CONTROLLER
`140
`
`VIDEO
`OPTIMIZER
`150
`
`HTTP GET 612
`
`•
`•
`
`HTTP REDIRECT 620
`
`... -
`
`ICAP REQ 616
`
`RESPONSE 618
`
`---~
`
`HTTP REDIRECT 620
`
`HTTP GET 612
`
`RESPONSE 614
`
`-
`
`OPTIMIZED VIDEO 626
`-
`
`OPTIMIZEDIVIDEO 626
`
`... -
`.
`
`ICAP REQ 628 •
`ICAP RESPONSE 630
`-
`
`ICAP COUNTING
`UPDATES 632
`
`....
`
`FIG. 6
`
`ORIGIN
`SERVER
`160
`
`--
`
`""O
`~ .....
`
`(')
`
`~ .....
`
`('D = ..... t "e -....
`.... 0 = ""O = O" -....
`.... 0 =
`c ('D
`
`(')
`
`~ .....
`
`.. -
`
`---
`
`HTTP GET 622
`
`VIDEO 624
`
`.. -
`
`~
`~Ul
`N
`
`0 ....
`
`~
`
`('D
`('D
`
`rJJ =(cid:173)
`.....
`-....J
`0 ....
`
`QO
`
`c
`rJJ
`N
`0 ....
`~ ---0
`
`~
`N
`N
`N
`.i;...
`N
`
`> ....
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 8 of 23
`
`

`

`FLOW CACHE MAP 700
`
`FLOW CACHE ENTRY
`710
`
`FLOW CACHE ENTRY
`712
`
`;
`
`FLOW CACHE ENTRY
`......
`
`FLOW CACHE BLOCK
`720
`
`SOURCE IP
`722
`
`USER FLOW BLOCK
`730
`
`DEFAULT USER
`FLOWS ill
`
`I>-----~ 1
`
`MAPPED USER
`FLOWS 726
`
`SUBSCRIBER ID
`732
`
`ESTIMATED B/W
`734
`
`LIST OF FLOWS
`736
`
`COOKIE HASHES
`738
`
`FIG. 7
`
`FLOW STATISTICS BLOCK
`740
`
`srclP, dstlP, srcPort, dstPort
`742
`
`CURRENT DOMAIN AND
`COOKIE 744
`
`TOT AL rx/tx BYTES
`746
`
`LAST rx/tx BYTES
`748
`
`■■■■■■
`
`""O
`~ .....
`
`(')
`
`~ .....
`
`('D = ..... t "e -....
`.... 0 = ""O = O" -....
`.... 0 =
`c ('D
`
`(')
`
`~ .....
`
`~
`~Ul
`N
`
`0 ....
`
`~
`
`('D
`('D
`
`rJJ =(cid:173)
`.....
`QO
`0 ....
`
`QO
`
`c
`rJJ
`N
`0 ....
`~ ---0
`
`~
`N
`N
`N
`.i;...
`N
`
`> ....
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 9 of 23
`
`

`

`US 2013/0322242 Al
`
`Dec. 5, 2013
`
`1
`
`REAL-TIME NETWORK MONITORING AND
`SUBSCRIBER IDENTIFICATION WITH AN
`ON-DEMAND APPLIANCE
`
`CROSS REFERENCE TO RELATED
`APPLICATIONS
`
`[0001] This application claims the benefit of U.S. Provi(cid:173)
`sional Application No. 61/654,689 filed on Jun. 1, 2012 and
`U.S. Provisional Application No. 61/754,391 filed on Dec.
`21, 2012, both of which are incorporated by reference in their
`entirety.
`
`BACKGROUND
`
`[0002]
`1. Field of Art
`[0003] The disclosure generally relates to improving user
`experience on a network, and more specifically, to monitoring
`bandwidth consumption of the many devices connected to a
`given node in the network.
`[0004] 2. Description of the Related Art
`[0005] Mobile devices, such as smart phones and tablets,
`have become prevalent in recent years. Given the fast advance
`in mobile computing power and far-reaching wireless Inter(cid:173)
`net access, more and more users view streamed videos on
`their mobile devices. The detection of network congestion has
`become
`increasingly
`important for network operators
`attempting to maximize user experience on the network. Even
`as network operators are ever increasing the capacity of their
`networks, the demand for bandwidth is growing at an even
`faster pace. Managing network growth and dealing with con(cid:173)
`gestion in the infrastructure is particularly important in the
`mobile space because of the high cost of radio spectrum and
`radio access network (RAN) equipment utilized by wireless
`mobile networks. These high costs prevent mobile service
`providers from engineering excess capacity into each net(cid:173)
`work access point through the purchase of additional RAN
`infrastructure. The same situation can, however, also happens
`to other types of network infrastructure.
`[0006] Existing network elements can give operators a
`view into the current state of traffic in their network, but they
`do not provide a measure of "goodness," i.e., how much
`elasticity is left or how much more data can the network
`handle. This measure is important for multimedia content
`delivery since a good user experience usually depends on the
`network's ability to deliver data in a reliable and sustainable
`fashion. A minimum data rate is required to prevent stalling
`and re-buffering during the streaming of multimedia content,
`hence ensuring sufficient bandwidth is important to quality of
`experience. Typically, multimedia content providers are suf(cid:173)
`ficiently equipped to deliver multimedia content at levels far
`beyond the capabilities of wireless infrastructure. Hence, the
`burden falls on wireless service providers to implement net(cid:173)
`work data optimization to ease the traffic burden and maxi(cid:173)
`mize the experience of each and every user on the network.
`Currently, however, mobile service providers are often forced
`to use very coarse tools that have little visibility into which
`network segments are congested and tend to apply optimiza(cid:173)
`tion to flows that may not need any optimization.
`[0007] Typically, mobile service providers use inline net(cid:173)
`work appliances that monitor every bit of subscriber traffic in
`order to make estimates of network throughput. This puts a
`huge burden on the system since it must scale to handle
`hundreds of thousands to millions of network requests per
`second through a single network access point. Furthermore,
`
`network service providers often must utilize these monitoring
`techniques on a micro-scale ( e.g., per RAN equipment instal(cid:173)
`lation) in order to react to the condition of the network, which
`results in increased cost. In addition, a large portion of web
`traffic consists of small object requests, which can obscure
`network monitoring at any level due to their short lifetime and
`bursty characteristics.
`
`BRIEF DESCRIPTION OF DRAWINGS
`
`[0008] The disclosed embodiments have other advantages
`and features which will be more readily apparent from the
`detailed description, the appended claims, and the accompa(cid:173)
`nying figures ( or drawings). A briefintroduction of the figures
`is below.
`[0009] FIG. 1 illustrates a high-level block diagram of an
`example communications environment for selective on-de(cid:173)
`mand real-time network monitoring and subscriber identifi(cid:173)
`cation.
`[0010] FIG. 2 illustrates one embodiment of components of
`an example machine able to read instructions from a machine(cid:173)
`readable medium and execute them in a processor (or con(cid:173)
`troller).
`[0011] FIG. 3 illustrates one embodiment of an example
`architecture of a network controller for providing selective
`real-time network monitoring and subscriber identification.
`[0012] FIGS. 4A-4B illustrate embodiments of example
`working modes of the network controller for providing selec(cid:173)
`tive on-demand network monitoring and subscriber identifi(cid:173)
`cation.
`[0013] FIG. 5 illustrates one example embodiment of event
`trace of an example network controller in "continue" working
`mode for selective on-demand real-time network monitoring
`and subscriber identification.
`[0014] FIG. 6 illustrates one example embodiment of event
`trace of an example network controller in "counting" working
`mode for selective on-demand real-time network monitoring
`and subscriber identification.
`[0015] FIG. 7 illustrates one embodiment of components of
`an example flow cache managed by a network controller.
`
`DETAILED DESCRIPTION
`
`[0016] The Figures (FIGS.) and the following description
`relate to preferred embodiments by way of illustration only. It
`should be noted that from the following discussion, alterna(cid:173)
`tive embodiments of the structures and methods disclosed
`herein will be readily recognized as viable alternatives that
`may be employed without departing from the principles of
`what is claimed.
`[0017] Reference will now be made in detail to several
`embodiments, examples of which are illustrated in the
`accompanying figures. It is noted that wherever practicable
`similar or like reference numbers may be used in the figures
`and may indicate similar or like functionality. The figures
`depict embodiments of the disclosed system (or method) for
`purposes ofillustration only. One skilled in the art will readily
`recognize from the following description that alternative
`embodiments of the structures and methods illustrated herein
`may be employed without departing from the principles
`described herein.
`
`Overview
`
`[0018] Embodiments disclosed include a network control(cid:173)
`ler system for real-time data gathering on the state of existing
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 10 of 23
`
`

`

`US 2013/0322242 Al
`
`Dec. 5, 2013
`
`2
`
`network traffic flows and mapping flow data to respective
`users in the network to predict available bandwidth and level
`of congestion. By gathering a history of flow statistics in the
`network, the network controller system establishes a relation(cid:173)
`ship between base stations ( or other network segments) and
`their capability to deliver the amount of data typically
`required by a particular user of the network. The very recent
`history of network flows can be used to predict the near future
`congestions in a substantially real-time fashion. Furthermore,
`the history of flow statistics can be used to build a long-term
`map of user behavior on the network, which can more effec(cid:173)
`tively predict on demand data delivery requirements for the
`collection of users utilizing a given network access point in a
`consistent manner. The network controller keeps a flow state
`database, which groups flow data in a number of ways, such
`as on per station/cell tower, per subscriber, per time-of-day, or
`per geography area basis. As new flows are presented to the
`system for inspection, database can be queried to estimate the
`network congestion level for new flows to determine whether
`existing, new or future flows require optimizations in order to
`maintain the desired level of user satisfaction.
`[0019]
`In one embodiment, an on-demand network moni(cid:173)
`toring method is adopted to gather data about network flows
`as they traverse the network. For example, network flows can
`be monitored selectively or on-demand based on the types of
`the content carried in the flows. Furthermore, the network
`monitoring can also be performed selectively at inline level,
`as well as out-of-band to improve efficiency. Both TCP and
`UDP flows are monitored to gather information about the
`state of the network, such as the average network throughput
`for each flow and end-to-end latency between, for example, a
`client device and an origin server providing multimedia con(cid:173)
`tent to the client device. For each TCP or UDP flow, the
`system tracks the number of bytes sent ( and in some embodi(cid:173)
`ments acknowledged). In TCP, the current window size may
`also be tracked. Records on network flows are stored in a flow
`statistics database, which can be indexed by subscriber iden(cid:173)
`tification (ID), cell tower (base station), and network segment
`etc. As many flow records accumulate, this database repre(cid:173)
`sents both historical and current network condition and
`capacity for delivering data. Network throughput can be mea(cid:173)
`sured by calculating an average number of bytes delivered
`over a period of time. Steps may be taken to filter out spurious
`data from small flows with size less than a certain threshold
`that, when measured, cause very noisy results in measuring
`bandwidth and/or latency. For example, any flow having
`delivery time of less than 500 ms can be filtered.
`[0020]
`In another embodiment, large objects, such as video
`files and data, traversing the network are monitored and
`paced. Rather than just measuring the bandwidth associated
`with large object delivery, estimates for future bandwidth
`needs of the network are determined based on the measure(cid:173)
`ments. In turn, large objects may be selectively optimized to
`preserve network throughput. For video objects, streaming
`bit rate of the flow provides a parameter, which can be com(cid:173)
`pared against network capacity to determine if the network is
`able to sustain the required level of throughput. It is often
`advantageous to pace the transfer speed to not exceeding a
`known cap. If a flow can be delivered at a rate between the
`minimum level needed to keep the video from stalling and the
`upper limit of the pacing limit, then the network segment on
`which the flow traverses is said to be capable of sustain the bit
`rate required for the flow. Large objects like video and images
`take a period of time to be delivered, which aids in measuring
`
`the origin server latency and detecting network congestion
`more accurately than small flows. For example, a reasonable
`size threshold for separating a large object from a small object
`can be set between 512 kB to 1 MB, and 50 kB and up for
`medium-sized objects. Other values are also possible.
`[0021]
`In some embodiments, the bandwidth attained by a
`single flow may be sufficient to determine the capacity of the
`network segment( s) the flow traverses. Therefore, with a
`fairly small deployment of network controller( s ), an accurate
`detection of key network congestion points can be derived.
`Specifically, one does not need to monitor every flow going
`through a network segment to detect congestions. Since video
`currently comprises around 50% of the traffic on a network
`but only around 5% of total flows, a relatively small number
`of flow samples of large objects can map a statistically sig(cid:173)
`nificant portion of the network.
`[0022] The unpredictable and transient nature of network
`congestion means that mitigation of the network congestion
`will be too late if not acted upon in near real-time after
`congestion is detected. In one embodiment, the network con(cid:173)
`troller selects large video or image flows through an on(cid:173)
`demand video optimizer to optimize large object delivery and
`thus available network bandwidth. With the controller and/or
`optimizer to intelligently and selectively handle the measure(cid:173)
`ment and optimization, these operations are offloaded from
`network routing appliances.
`
`Real-Time Traffic Monitoring
`
`[0023] FIG. 1 illustrates a high-level block diagram of an
`example communications environment 100 for selective on(cid:173)
`demand real-time network monitoring and subscriber identi(cid:173)
`fication. The environment 100 comprises user devices 110, an
`origin server 160, a steering device 130, a network controller
`140, a video optimizer 150, and a network 120. The network
`120 is a communication network that transmits data between
`the user devices 110, the steering device 130 and the origin
`server 160 and/or the video optimizer 150. In one embodi(cid:173)
`ment the network 120 includes wireless network and the
`Internet.
`[0024] A network efficiency strategy that aspires to keep
`capital expenditure from outpacing revenues has to be bal(cid:173)
`anced with demands from consumers for better user experi(cid:173)
`ences that rely increasingly on higher data usage. Today,
`mobile operators are employing a variety of tools to manage
`capacity including data usage caps, Wi-Fi offload and intel(cid:173)
`ligent optimization. The environment 100 demonstrates such
`a solution that provides a unified foundation with deep ses(cid:173)
`sion intelligence, integrated services management, and
`dynamic adaptability to fit any service offering. Together, the
`network controller 140 and the video optimizer 150 deliver a
`world-class media optimization solution that brings a surgical
`capacity advantage to wireless operators as well as Internet
`service providers with better peak capacity savings than alter(cid:173)
`native solutions.
`[0025]
`In one embodiment, the user devices 110 are com(cid:173)
`puting devices with network capabilities. Oftentimes, for
`example, the user devices 110 are wireless enabled mobile
`computing device with a web browser and media display
`capability. The user devices 110 as mobile computing devices
`may include laptops, netbooks, tablets, smart telephones, or
`personal digital assistants (PDAs ). While only two user
`devices HOA and HOB are illustrated in FIG. 1, the environ(cid:173)
`ment 100 may include thousands or millions of such devices.
`The web browsers may be software applications running on
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 11 of 23
`
`

`

`US 2013/0322242 Al
`
`Dec. 5, 2013
`
`3
`
`mobile devices 110 for retrieving web content from the origin
`server 160 and presenting the web content on a display
`coupled to the mobile device. Web content accessed by the
`user devices 110 include text, images, audio and video con(cid:173)
`tent. The multimedia content can be played back by the
`browsers, for example, HTML5 compatible browsers, plug(cid:173)
`in or a standalone media player. The browsers can also invoke
`the media players or plug-ins available on the user devices
`110 and passes images, audio and/or video to the media
`player or plug-in for playback.
`
`[0026] The steering device 130 may be a load balancer or a
`router located between the user device 110 and the network
`120. The steering device 130 provides the user device 110
`with access to the network and thus, provides the gateway
`through which the user device traffic flows onto the network
`and vice versa. In one embodiment, the steering device 130
`categorizes traffic routed through it to identify flows of inter(cid:173)
`est for further inspection at the network controller 140. Alter(cid:173)
`natively, the network controller 140 interfaces with the steer(cid:173)
`ing device 130
`to coordinate
`the monitoring and
`categorization of network traffic, such as identifying large
`and small objects in HTTP traffic flows. In this case, the
`steering device 130 receives instructions from the network
`controller 140 based on the desired criteria for categorizing
`flows of interest for further inspection.
`
`[0027] However, information on the wireless/cellular user
`devices 110 side is often not available at the steering device
`130 that sits between the cellular network and the wired
`Internet. For example, there is often no information about the
`identifiers of the towers associated with the mobile devices
`110. Tower association information only broadcasted when
`the mobile devices first attached to the network. In addition,
`user devices 110 do not usually report any identification
`information except their IP addresses. Therefore, monitoring
`of the network traffic and detection of the congestion is auto(cid:173)
`mated and managed by the detector 140 so that network can
`be optimized for end user's experience without the mobile
`user's knowledge.
`
`[0028]
`In contrast to conventional inline TCP throughput
`monitoring devices that monitor every single data packets
`transmitted and received, the network controller 140 is an
`"out-of-band" computer server that interfaces with the steer(cid:173)
`ing device 130 to selectively inspect user flows of interest.
`The network controller 140 may further identify user flows
`(e.g., among the flows of interest) for optimization. In one
`embodiment, the network controller 140 may be imple(cid:173)
`mented at the steering device 130 to monitor traffic. In other
`embodiments, the network controller 140 is coupled to and
`communicates with the steering device 130 for traffic moni(cid:173)
`toring and optimization. When queried by the steering device
`130, the network controller 140 determines ifa given network
`flow should be ignored, monitored further or optimized. Opti(cid:173)
`mization of a flow is often decided at the beginning of the flow
`because it is rarely possible to switch to optimized content
`mid-stream once non-optimized content delivery has begun.
`However, the network controller 140 may determine that
`existing flows associated with a particular subscriber or other
`entity should be optimized. In turn, new flows ( e.g., resulting
`from seek requests in media, new media requests, resume
`after pause, etc.) determined to be associated with the entity
`may be optimized. The network controller 140 uses the net(cid:173)
`work state as well as historical traffic data in its decision for
`
`monitoring and optimization. Knowledge on the current net(cid:173)
`work state, such as congestion, deems critical when it comes
`to data optimization.
`[0029] As a flow is sent to the network controller 140 for
`inspection, historical network traffic data stored at the net(cid:173)
`work controller 140 may be searched. The historical network
`traffic data includes information such as subscriber informa(cid:173)
`tion, the cell towers to which the user devices attached, rout(cid:173)
`ers through which the traffic is passing, geography regions,
`the backhaul segments, and time-of-day of the flows. For
`example, in a mobile network, the cell tower to which a user
`device is attached can be most useful, since it is the location
`where most congestion occurs due to limited bandwidth and
`high cost of the radio access network infrastructure. The
`network controller 140 looks into the historical traffic data for
`the average of the bandwidth per user at the particular cell
`tower. The network controller 140 can then estimate the
`amount ofbandwidth or degree of congestion for the new flow
`based on the historical record.
`[0030] The video optimizer 150 is a computer server that
`provides video and image optimization and delivers opti(cid:173)
`mized video and image content to the user devices 110 via the
`network 120. The video and image optimization is an on(cid:173)
`demand service provided through the transcoding of the
`video and image content. For example, when a user device
`attempts to retrieve video from the origin server 160, the
`network controller 140 may decide that the flow meets certain
`criteria for content optimization. The network controller 140
`then redirected the user devices 110 to the video optimizer
`150 to retrieve the optimized content. The video optimizer
`150 receives information in the redirect request from the user
`devices 110 or from the network controller 140 about the
`video or image content to be optimized and retrieve the video
`or image content from the corresponding origin server 160 for
`optimization and subsequent delivery to the user devices 110.
`[0031] The disclosed embodiments focus on the video opti(cid:173)
`mization because video is of far greater importance than all
`other traffic types when network congestion is considered.
`Video traffic makes up around half of all network traffic-and
`the percentage is growing every year. Therefore, optimizing
`video traffic massively reduces congestion in the network.
`Video flows or streams are also long lived, having large
`packet size, and demanding high bitrates, monitoring video
`streams is an effective ways of detecting congestion in the
`network. Furthermore, because video streams require steady
`and consistent bandwidth, they are among first to be impacted
`when congestion occurs and available network bandwidth
`reduces. By contrast, web page text and images are generally
`not affected under mild network congestion with unnotice(cid:173)
`able longer load times. Video optimization differs in one key
`aspect to optimizing other web content: it is long form, and
`the optimization policy decisions made at the beginning of a
`video have significant impact on the ability to deliver a con(cid:173)
`sistent experience for the length of the video.
`[0032] The video optimizer 150 and the origin server 160
`are typically formed of one or more computers. While only
`one server of each video optimizer 150 and origin server 160
`is shown in the environment 100 of FIG. 1, different embodi(cid:173)
`ments may include multiple web servers and video servers
`operated by a single entity or multiple entities. In other
`embodiments, a single server may also provide different func(cid:173)
`tionalities, such as delivering web content as a web server, as
`well as serving optimized video content.
`
`Exhibit 1007
`Cisco v. Orckit – IPR2023-00554
`Page 12 of 23
`
`

`

`US 2013/0322242 Al
`
`Dec. 5, 2013
`
`4
`
`Computing Machine Architecture
`
`[0033] FIG. 2 is a block diagram illustrating components of
`an example machine able to read instructions from a machine(cid:173)
`readable medium and execute them in a processor (or con(cid:173)
`troller) to implement the disclosed system for on-demand
`real-time network monitoring and subscriber identification.
`Specifically, FIG. 2 shows a diagrammatic representation of a
`machine in the example form of a computer system 200
`within which instructions 224 ( e.g., software) for causing the
`machine to perform any one or more of the methodologies
`discussed herein may be executed. In alternative embodi(cid:173)
`ments, the machine operates as a standalone device or may be
`connected (e.g., networked) to other machines. In a net(cid:173)
`worked deployment, the machine may operate in the capacity
`of a server machine or a client machine in a server-client
`network environment, or as a peer machine in a peer-to-peer
`( or distributed) network environment.
`[0034] The machine may be a server computer, a client
`computer, a personal computer (PC), a tablet PC, a set-top
`box (STB), a personal digital assistant (PDA), a cellular tele(cid:173)
`phone, a smart phone, a web appliance, a network router,
`switch or bridge, or any machine capable of executing
`instructions 224 ( sequential or otherwise) that specify actions
`to be taken by that machine. Further, while only a single
`machine is illustrated, the term "machine" shall also be taken
`to include any collection of machines that individually or
`jointly execute instructions 224 to perform any one or more of
`the methodologies discussed herein.
`[0035] The example computer system 200 includes one or
`more processors 202 ( e.g., a central processing unit (CPU), a
`graphics processing unit (GPU), a digital signal processor
`(DSP), one or more application specific integrated circuits
`(ASICs), one or more radio-frequency integrated circuits
`(RFICs), or any combination of these), a main memory 204,
`and a static memory 206, which are configured to communi(cid:173)
`cate with each other via a bus 208. The computer system 200
`may further include graphics display unit 210 ( e.g., a plasma
`display panel (PDP), a liquid crystal display (LCD), a pro(cid:173)
`jector, or a cathode ray tube (CRT)). The computer system
`200 may also include alphanumeric input device 212 ( e.g., a
`keyboard), a cursor control device 214 ( e.g., a mouse, a track(cid:173)
`ball, a joystick, a motion sensor, or other pointing instru(cid:173)
`ment), a storage unit 216, and a network interface device 220,
`which also are configured to communicate via the bus 208.
`[0036] The storage unit 216 includes a machine-readable
`medium 222 on which is stored instructions 224 (e.g., soft(cid:173)
`ware) embodying any one or more of the methodologies or
`functions described herein. The instructions 224 (e.g., soft(cid:173)
`ware) may also reside, completely or at least partially, within
`the main memory 204 or within the processor 202 ( e.g.,
`within a processor's cache memory) during execution thereof
`by the computer system 200, the main memory 204 and the
`processor 202 also constituting machine-readable media. The
`instructions 224 (e.g., software) may be transmitted or
`received over a network 110 via the network interface device
`220.
`[0037] While machine-readable medium 222 is shown