IP address allocation

• US 10,142,159 B2
• Filed: 08/14/2013
• Issued: 11/27/2018
• Est. Priority Date: 08/14/2012
• Status: Active Grant

• Current Assignee: Ciena Corporation
• Original Assignee: Benu Networks, Incorporated (Ciena Corporation)
• Inventors: Duggal, Rajendar, Sahoo, Swarup, Ghai, Rajat
• Primary Examiner(s): Patel, Dhairya A
• Application Number:
  US13/966,629
• Publication Number:
  US 20140052860A1
• Time in Patent Office: 1,931 Days
• Field of Search: None
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/503 using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols

Abstract

Systems and methods are described for IP Address allocation. A computerized method includes receiving at a wireless access gateway a request from a subscriber to connect to a network, allocating a first IP address to the subscriber from a first pool of IP addresses at the wireless access gateway, and assigning a second IP address to the subscriber from a second pool of IP addresses at the wireless access gateway when the subscriber requests a network service.

Claims

1. A computerized method for allocating a first IP address to a device that is used for authentication after the device requests a network connection, and only allocating a second IP address to the device that provides access to one or more network services after the device request a network service, so that IP addresses used to access network services can be reserved only for devices requesting one or more network services comprising:

receiving at a wireless gateway a request from a subscriber to connect to a network;

allocating a first IP address to the subscriber from a pool of IP addresses at the wireless access gateway, wherein the IP address facilitates a limited network connectivity between the subscriber and the wireless access gateway so that the wireless access gateway can authenticate the subscriber;

receiving a request for a network service from the subscriber;

assigning a second IP address to the subscriber from a second pool of IP addresses at the wireless access gateway in response to the request for the network service so that the subscriber can access the network service, thereby using IP addresses from the first pool of IP addresses for authentication, and reserving IP addresses in the second pool of IP addresses only for devices that actually request one or more network services;

determining that the subscriber does not request a network service within a first limited duration, wherein the first limited duration is configurable for the first IP address;

returning the first IP address to the first pool of IP addresses at the wireless gateway;

determining that the subscriber has not request a network service within a second limited duration, wherein the second limited duration is configurable for the second IP address; and

returning the second IP address to the second pool of IP addresses at the wireless access gateway;

sending an authentication request message to an authentication, authorization and accounting server;

receiving an authentication access message from the authentication, authorization and accounting server.

2. The computerized method of claim 1, wherein the first pool of IP addresses contains private IP addresses and the second pool of IP addresses contains pubic IP addresses.

3. The computerized method of claim 1, further comprising authenticating and authorizing the subscriber before assigning the second IP address.

4. The computerized method of claim 3, further comprising authenticating the subscriber based on a Media Access Control (MAC) address of the subscriber.

5. The computerized method of claim 3, wherein the authenticating and authorizing is based on Remote Access Dial In User Service (RADIUS) protocol with an authentication, authorization and accounting server.

6. The computerized method of claim 1, further comprising generating a subscriber context for the subscriber at the wireless access gateway.

7. The computerized method of claim 1, further comprising translating in data packets originated from and destined to the subscriber between the first and second IP addresses of the subscriber.

8. The computerized method of claim 7, wherein the translating occurs only in head sections of the data packets.

9. The computerized method of claim 1, further comprising including a Media Access Control (MAC) address of the subscriber in the authentication request message to the authentication, authorization and accounting server.

10. The computerized method of claim 1, further comprising detecting a re-directing URL in the authentication access message from the authentication, authorization and accounting server.

11. The computerized method of claim 1, further comprising receiving a Change of Authorization (CoA) message from the authentication, authorization and accounting server.

12. A computing system configured to allocate a first IP address to a device that is used for authentication after the device requests a network connection, and only allocating a second IP address to the device that provides access to one or more network services after the device request a network service, so that IP addresses used to access network services can be reserved only for devices requesting one or more network services comprising:

a memory that stores one or more modules; and

processor configured to run the one or more modules stored in the memory that are configured to cause the processor to;

maintain a first and a second pool of IP addresses;

receive a request from a subscriber to connect to a network and to allocate a first IP address to the subscriber from the first pool of IP addresses, wherein the first IP address facilitates a limited network connectivity between the subscriber and the computing system so that the computing system can authenticate the subscriber;

receive a request for a network service from the subscriber;

assign a second IP address to the subscriber in response to the request for the network service so that the subscriber can access the network service, thereby using IP addresses from the first pool of IP addresses for authentication, and reserving IP addresses in the second pool of IP addresses only for devices that actually request one or more network services;

determine that the subscriber does not request a network service within a first limited duration, wherein the first limited duration is configurable for the first IP address;

return the first IP address to the first pool of IP addresses;

determine that the subscriber has not request a network service within a second limited duration, wherein the second limited duration is configurable for the second IP address; and

return the second IP address to the second pool of IP addresses;

send an authentication request message to an authentication, authorization and accounting server;

receive an authentication access message from the authentication, authorization and accounting server.

13. The computing system of claim 12, wherein the first pool of IP addresses contains private IP addresses and the second pool of IP addresses contains pubic IP addresses.

14. The computing system of claim 12, wherein the one or more modules are further configured to cause the processor to generate a subscriber context for the subscriber.

15. The computing system of claim 12, wherein the one or more modules are further configured to cause the processor to authenticate and authorize the subscriber before the second IP address is assigned to the subscriber.

16. The computing system of claim 15, further comprising the authentication, authorization, and accounting server connector configure to communicate with an AAA server.

17. The computing system of claim 12, wherein the one or more modules are further configured to cause the processor to process uplink and downlink traffic data from and to the subscriber in one or more GRE tunnels.

18. The computing system of claim 12, wherein the one or more modules are further configured to cause the processor to translate in data packets originated from and destined to the subscriber between the first and second IP addresses of the subscriber.

19. The computing system of claim 18, wherein the one or more modules are further configured to cause the processor to translate only head sections of the data packets.

20. A non-transitory computer readable medium having executable instructions to, when executed by a processor, cause the processor to:

receive at a wireless gateway a request from a subscriber to connect to a network;

allocate a first IP address to the subscriber from a pool of IP addresses at the wireless access gateway, wherein the IP address facilitates a limited network connectivity between the subscriber and the wireless access gateway so that the wireless access gateway can authenticate the subscriber;

receive a request for a network service from the subscriber;

assign a second IP address to the subscriber from a second pool of IP addresses at the wireless access gateway in response to the request for the network service so that the subscriber can access the network service, thereby using IP addresses from the first pool of IP addresses for authentication, and reserving IP addresses in the second pool of IP addresses only for devices that actually request one or more network services;

determine that the subscriber does not request a network service within a first limited duration, wherein the first limited duration is configurable for the first IP address;

return the first IP address to the first pool of IP addresses at the wireless gateway;

determine that the subscriber has not request a network service within a second limited duration, wherein the second limited duration is configurable for the second IP address; and

return the second IP address to the second pool of IP addresses at the wireless access gateway;

send an authentication request message to an authentication, authorization and accounting server;

receive an authentication access message from the authentication, authorization and accounting server.

21. The non-transitory computer readable medium of claim 20, wherein the executable instructions are further operable to, when executed by the processor, authenticate and authorize the subscriber before assigning the second IP address.