System and Method for Enforcing Policy in a Communication Network

• US 20070226775A1
• Filed: 02/06/2007
• Published: 09/27/2007
• Est. Priority Date: 02/07/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Rosenberg, Jonathan, Andreasen, Flemming
• Granted Patent: US 8,042,148 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]

Abstract

A system for enforcing policy in a communication network includes a policy server which is operable to receive a request to invoke an application, receive a policy profile for a network user, and decide a proper allocation of network users based on the policy profile, the application, and available network resources. The policy server is further operable to communicate with a non-SIP application. The system also includes a network resource manager operably associated with the policy server and operable to monitor available network in the resources in the communication network. In addition, the network resource manager is functional to allocate network resource amongst a plurality of network users. The system also contains an application control point which is operably associated with the policy server and operable to communicate with a SIP application. The system is operable to use policy peering between the home and visited network to enable user-specific policies to be enforced while roaming.

Claims

1. A system for enforcing policy in a communication network comprising:

a policy server, the policy server operable to;

receive an authorization request to invoke an application;

receive a policy profile for a network user;

decide a proper allocation of network resources based on the policy profile, the application, application parameters, and available network resources; and

communicate with a non-SIP application;

a network resource manager, the network resource manager operably associated with the policy server, the network resource manager operable to monitor available network resources in the communication network, the network resource manager further operable to allocate network resources amongst a plurality of network users; and

an application control point, the application control point operably associated with the policy server, the application control point operable to communicate with an SIP application.

2. The system of claim 1, wherein the policy server is further operable to:

decide whether the application may be invoked based on the application, the application parameters, the policy profile, and the available network resources;

determine a proper allocation of the available network resources to provide for the application;

communicate a decision regarding whether the application may be invoked; and

communicate the proper allocation of available network resources for the application.

3. The system of claim 2, wherein the authorization request comprises at least one token representing the application.

4. The system of claim 2, wherein the authorization request is sent from the application control point, wherein the policy server is further operable to send an authorize message to the application control point, the authorize message comprising a set of tokens indicating the proper allocation of available network resources.

5. The system of claim 2, wherein the policy server is further operable to communicate the proper allocation of available network resources to the application control point, wherein the authorization request to invoke an application relates to a first application, wherein the application control point is operable to initiate a second application or modify the application invocation based on the proper allocation of available network resources.

6. The system of claim 2, wherein the policy server is operable to invoke a non-SIP application if it decides that a non-SIP application may be invoked.

7. The system of claim 2, wherein the policy server is operable to communicate the decision regarding the proper allocation of network resources to the network resource manager.

8. The system of claim 1, wherein the policy server, network resource manager, and application control point interface using DIAMETER protocol.

9. The system of claim 1, wherein the network resources comprise:

quality of service;

deep packet inspection;

accounting;

mobility;

security;

transcoding;

packet replication; and

relay.

10. The system of claim 1, further comprising a deep packet inspector, the deep packet inspector operable to classify traffic within the communication network.

11. The system of claim 10, wherein the deep packet inspector is operable to identify an application that operates on a server in a roaming network.

12. The system of claim 1, wherein the application control point is further operable to transmit service enablers to SIP applications, the service enablers containing a policy hook, the policy hook operable to control the operation of the application.

13. The system of claim 1, wherein the policy profile is a user-specific policy profile.

14. The system of claim 1, wherein the policy profile is a generic network policy profile.

15. The system of claim 1, wherein the non-SIP application is stored in an applications server, the application server operable to communicate with the policy server.

16. The system of claim 1, wherein the policy server is further operable to send a tell message to an access terminal, the tell message indicating a change in the proper allocation of network resources.

17. The system of claim 1, wherein the network resource manager is further operable to send an inform message in response to a change in available network resources, the inform message indicating a change in available network resources.

18. A method for enforcing policy in a communication network comprising:

sending a request to invoke an application from an access terminal;

in response to receiving a request to invoke an application, sending an authorization request for authorization to invoke to a policy server, the authorization request containing a set of tokens representing the application and its associated parameters;

in response to receiving an authorization request for authorization to invoke;

obtaining a policy profile;

obtaining information regarding available network resources from a network resource manager; and

allocating available network resources based on the policy profile, the application, the application parameters, and the available network resources.

19. The method of claim 18, further comprising the steps of:

determining whether an application may be invoked based on the available network resources, policy profile, the application and its associated parameters;

invoking the application in response to determining the application may be invoked.

20. The method of claim 18, wherein the application is an SIP application.

21. The method of claim 18, wherein the application is a non-SIP application.

22. The method of claim 18, wherein allocating available network resources further comprises deciding a proper allocation of network resources based on the policy profile, the application, and the available network resources and communicating the proper allocation of network resources to a network resource manager.

23. The method of claim 22, further comprising the step of sending an instruct message to a network resource manager communicating the proper allocation of network resources.

24. The method of claim 18, further comprising the step of sending an inform message from a network resource manager in response to a change in the available network resources.

25. The method of claim 18, further comprising the step of sending a tell message from the policy server to the access terminal in response to a change in the proper allocation of network resources.

26. The method of claim 18, wherein the policy profile is access terminal specific.

27. The method of claim 18, wherein the policy profile is generic to the communication network.

28. The method of claim 18, wherein the network resources comprise:

quality of service;

deep packet inspection;

accounting;

mobility;

security;

transcoding;

packet replication; and

relay.

29. A method for enforcing policy for a user in a visited communication network comprising:

determining network state variables at a policy server in the visited communication network;

sending network state variables to a policy server in a home network;

sending a request for network resources to the policy server in the visited network based on a home network policy for the user; and

supplying network resources to the user in the visited network based on the request for network resources and a visited network policy.

30. The method of claim 29, further comprising invoking an application in the home network based on the home network policy and network state variables.

31. The method of claim 29, wherein the home network policy is user-specific.

32. A system for enforcing user-specific policy in a visited network comprising:

a home network, the home network maintaining a user-specific policy profile;

a visited network having a visited network policy;

a home policy server in a home network operable to communicate with a non-SIP application, the home policy server further operable to request network resources in a visited network based on the user-specific policy profile;

a visited policy server in a visited network operably associated with the policy server in the home network, the visited policy server operable to;

receive a request for network resources from the home policy server;

determine whether to grant the request for network resources based on the available network resources in the visited network, the visited network policy, and the request for network resources; and

a network resource manager in the visited network, the network resource controller operable to monitor available network resources in the visited network, the network resource manager further operable to allocate network resources amongst a plurality of users in the visited network;

33. The system of claim 32, further comprising an application control point, the application control point operable to communicate with a SIP application.