Method and systems for sharing network access capacities across Internet service providers

• US 20040117668A1
• Filed: 11/24/2003
• Published: 06/17/2004
• Est. Priority Date: 11/28/2002
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Chevalier, Denis, Szalai, Zsolf, Marmigere, Gerard
• Granted Patent: US 7,353,405 B2
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

For optimizing Internet access resources, a method and systems for sharing network access capacities across Internet service providers is disclosed. According to the method of the invention, a client service provider (CSP) may hire accesses to points of presence belonging to a master service provider (MSP) while maintaining a constant security level and providing connection accounting means. When a CSP'"'"'s subscriber sends an access request to a MSP, the MSP analyzes the subscriber'"'"'s realm and checks the capacities allocated to the subscriber'"'"'s CSP. If connection is allowed, the MSP sends an authentication request to the CSP. If the subscriber is authenticated, the MSP launches an accounting process based on the subscriber'"'"'s realm while the CSP may launch an accounting process associated with the subscriber identifier. Thus, the MSP does not need to maintain a database comprising information relative to the CSP'"'"'s subscribers.

Claims

1. A method for sharing network access capacities between a master service provider, comprising at least one point of presence, and a client service provider, said method comprising the steps of:

upon reception of an access request, including at least a subscriber identifier, a service provider identifier and a password, at said at least one point of presence;

determining, according to said service provider identifier, if said access request comes from a subscriber of said master service provider or from a subscriber of said client service provider, said access request being rejected otherwise;

if said access request comes from a subscriber of said master service provider,

determining, using said subscriber identifier and said password, if said subscriber is authorized to establish a connection; and

,

if said subscriber is authorized, establishing a connection, else, rejecting said access request;

else, if said access request comes from a subscriber of said client service provider,

determining if a new connection may be established for a subscriber of said client service provider; and

,

if a new connection may be established, sending an authorization request, comprising at least said subscriber identifier and said password, to said client service provider, else, rejecting said access request;

upon reception of an authorization acknowledgment, comprising said subscriber identifier, from said client service provider;

if said subscriber is authorized, establishing a connection

else, rejecting said access request.

2. The method according to claim 1 further comprising the step of replacing said subscriber identifier and said password by a virtual subscriber identifier and a virtual password, associated to said service provider identifier, when said access request comes from a subscriber of said client service provider, before determining if a new connection may be established for a subscriber of said client service provider.

3. The method of claim 1 further comprising the step of determining a duration of the connections established by subscribers of said client service provider.

4. The method of claim 1 further comprising the step of determining a number of simultaneous connections established by subscribers of said client service provider.

5. The method of claim 1 wherein said step of determining if a new connection may be established for a subscriber of said client service provider is based upon a number of ports allocated to said client service provider.

6. The method of claim 1 wherein said step of determining if a new connection may be established for a subscriber of said client service provider is based upon a connection time threshold associated with said client service provider.

7. The method of claim 1 implemented in a RADIUS proxy, using RADIUS protocol.

8. The method of claim 1 wherein said service provider identifier is a realm.

9. An apparatus comprising means adapted for carrying out the method according to claim 1.

10. A computer-like readable medium comprising instructions for carrying out the method according to claim 1.