Modelling and Analysis of the CES Protocol of H.245 Lin Liu and Jonathan Billington Computer Systems Engineering Centre University of South Australia

Background Part of an ongoing project on modelling and analysing Internet multimedia protocols with CPNs, which is focused on ITU-T recommendation H.323. H.323 is a key standard for multimedia communications over packet-based networks, e.g. the Internet. The CES protocol is a sub-protocol of ITU-T recommendation H.245, which is one of the core protocols of the H.323 standard. UniSA

Outline The CES protocol Modelling and analysis results of The CES protocol with a reliable transport medium The CES protocol with an unreliable transport medium Conclusion and future work UniSA

The CES Protocol The Capability Exchange Signalling (CES) protocol is used by a communication party to inform its peer of its multimedia receive and transmit capabilities. OK, John. Thank you. Hi Mary, I can only transmit and receive audio. UniSA

UniSA Primitives and messages in the CES entities Primitives and messages in the CES entities

UniSA The SDL diagrams of the CES protocol The SDL diagrams of the CES protocol

UniSA Example MSCs of the CES protocol Example MSCs of the CES protocol

UniSA Example MSCs of the CES protocol Example MSCs of the CES protocol

UniSA Example MSCs of the CES protocol Example MSCs of the CES protocol

The CES Protocol with Reliable Transport Medium The CES protocol is designed to be independent of the underlying medium. When the CES protocol is applied to an H.323 system, it is required by H.323 to operate over a reliable transport layer. A reliable transport layer must preserve sequence, be error-free, and provide flow controlled transmission of messages. UniSA

UniSA Basically, each SDL state transition is modelled as a CPN transition.Basically, each SDL state transition is modelled as a CPN transition. Each CES primitive is treated as an atomic event, so when two CES primitives are included in a single SDL state transition, they are modelled as two separate CPN transitions, and a temporary state is introduced.Each CES primitive is treated as an atomic event, so when two CES primitives are included in a single SDL state transition, they are modelled as two separate CPN transitions, and a temporary state is introduced. Modelling SDL state transitions with CPNs

UniSA The Incoming CESE SDL

UniSA Modelling the CES messages

The CPN model UniSA

The declaration node UniSA

The hierarchical CPN model (1) UniSA

UniSA The top level page

UniSA The Outgoing_CESE subpage

UniSA The Incoming_CESE subpage

UniSA The hierarchical CPN model (2)

UniSA The top level page

UniSA The Outgoing_Send subpage

UniSA The Outgoing_Receive subpage

UniSA The Incoming_Receive subpage

UniSA The Incoming_send subpage

This original model has an infinite state space.This original model has an infinite state space. We investigate the following two cases:We investigate the following two cases: Model AModel A The queue length of places forChannel and revChannel is set to 3;The queue length of places forChannel and revChannel is set to 3; Modulo 2 instead of modulo 256 arithmetic.Modulo 2 instead of modulo 256 arithmetic. Model BModel B The number of times that transition TRANSFERreq occurs is limited to 2;The number of times that transition TRANSFERreq occurs is limited to 2; Modulo 2 instead of modulo 256 arithmetic.Modulo 2 instead of modulo 256 arithmetic. UniSA Analysis restrictions Analysis restrictions

The state space for Model A !!!!UniSA

The Occ graph (part) of Model A of Model A UniSA

UniSA The CES protocol can fail if wrapping of sequence numbers happens when there are n outstanding acknowledgments for modulo n arithmetic.

Two transitions should be dead when the transport medium is reliable, but they are not. The CES protocol can fail if wrapping of sequence numbers happens when there are n outstanding acknowledgments for modulo n arithmetic. This protocol could work properly if there are n outstanding acknowledgments, for modulo n arithmetic, then do not send a TerminalCapabilitySet message, set timer and report problem instead. Conclusion for Model A UniSA

The state space report for Model B UniSA

The full Occ graph of Model B UniSA

UniSA Desired terminal state and successful capability exchanges

Proper termination of exchanges and discard of expired messages UniSA

Transitions REJECTindUin and TRANSFERindT are dead transitions under the assumption of Model B. When the wrapping of sequence numbers (modulo 2) while there are 2 outstanding acknowledgments (i.e. not yet received by the outgoing CESE) does not occur, this protocol can carry out the capability exchange properly. An induction proof is needed to generalise these conclusions for arbitrary modulo arithmetic. Conclusion for Model B UniSA

The CES Protocol with Unreliable Transport Medium An unreliable transport layer may have message loss, duplication, and the ordering of the messages sent may not be preserved. We assume that each message can only be duplicated once at most. UniSA

The CPN model UniSA

The state space report Counter with limit 2Counter with limit 2 Modulo 2 arithmetic UniSA

UniSA REJECTindUin & TRANSFERindT can occur

UniSA Proper terminal states and successful capability exchanges

UniSA Inefficient behaviour

When the transport medium is unreliable, this protocol can work, but it may be inefficient. Conclusion for the Unreliable Medium Case UniSA

Conclusion Complete CPN models of the CES protocol have been created, providing a rigorous specification of the CES protocol. No matter whether the underlying medium is reliable or not, the CES protocol can fail if wrapping of sequence numbers happens when there are n outstanding acknowledgments for modulo n arithmetic. If the problem with sequence number wrap can be avoided, then when the transport layer is unreliable, the CES protocol may be inefficient. UniSA

Next step: verify the CES protocol against the service specification. We have created a complete and general CES service specification (with CPNs) and currently are working on generating the CES service language from this service model. Future work includes investigations of other parts of H.323, based on the experience and methodology gained from this pilot study. UniSA Future Work

UniSA