Method and apparatus for managing subscriber profiles

• US 20080117917A1
• Filed: 11/18/2004
• Published: 05/22/2008
• Est. Priority Date: 11/18/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Balay, Rajesh I., Desai, Sachin S., Sargor, Chandramouli, Lemarchand, Francois, Khetawat, Amit K.
• Granted Patent: US 7,808,904 B2
• Time in Patent Office: Days
• US Class Current: 370/395.21
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Methods and apparatus for managing subscriber profiles are described herein. In one embodiment, the method includes receiving, from a requester, a request to determine an operation to be performed on a data packet. The method also includes determining profile identifiers associated with the requester, wherein the profile identifiers include, a first-level profile identifier associated with a lower-level profile identifier that defines the operation. The method also includes determining, based on the profile identifiers, that the operation should be performed on the data packet and transmitting an indication of the operation to the requestor, wherein the requestor performs the operation on the data packet.

Claims

1. A method comprising:

receiving, from a requester, a request to determine an operation to be performed on a data packet;

determining profile identifiers associated with the requester, wherein the profile identifiers include, a first-level profile identifier associated with a lower-level profile identifier that defines the operation;

determining, based on the profile identifiers, that the operation should be performed on the data packet; and

transmitting an indication of the operation to the requester, wherein the requester performs the operation on the data packet.

2. The method of claim 1, wherein the requestor is a virtual interface.

3. The method of claim 1, wherein the operation includes forwarding the data packet through a virtual interface.

4. The method of claim 1, wherein determining the profile identifiers includes searching for the first-level identifier in a database, and based on the first-level identifier, searching for the lower-level identifier in the database.

5. A method comprising:

configuring a policy engine to define services available during a subscriber connection, wherein the policy engine is included in a virtual router, and wherein the configuring includes, receiving a first profile identifier;

determining whether the first profile identifier is stored in a database; and

if the first profile identifier is not stored in the database, performing the following,

obtaining profile information associated with the first profile identifier;

determining whether the first profile identifier is associated with a lower-level profile identifier;

if the first profile identifier is associated with a lower-level profile identifier, receiving the lower-level profile identifier and lower-level profile information associated with the lower-level profile identifier and storing the lower-level profile identifier and lower-level profile information in the database; and

storing the first profile identifier and profile information associated with the first profile identifier in the database.

6. The method of claim 5, wherein the lower-level profile identifier defines a service available during the subscriber connection.

7. The method of claim 5, wherein the first profile identifier is received from a virtual interface.

8. The method of claim 5, wherein the lower-level profile identifier is received from a component of the virtual router that manages subscriber profiles.

9. An apparatus comprising:

a virtual interface to receive a data packet from a subscriber computer and to request an operation to be performed on the data packet, wherein the virtual interface defines a connection between a router and the subscriber computer;

a policy engine to receive the request for an operation, the policy engine including,

a virtual interface database to store a first profile identifier associated with the virtual interface; and

a profile identifier database to store a lower-level profile identifier associated with the first profile identifier, wherein the lower-level profile identifier indicates the operation to be performed on the data packet.

10. The apparatus of claim 9, wherein the operation is a packet forwarding operation.

11. The apparatus of claim 9, wherein the profile identifier database includes the first profile identifier and a second-level identifier associated with the first identifier.

12. An apparatus comprising:

a subscriber manager to receive a subscriber connection request and to receive a first profile identifier based on the subscriber connection request;

a profile manager to provide a lower-level profile identifier to the subscriber manager, wherein the lower-level profile identifier is associated with the first profile identifier, and wherein the lower-level profile identifier defines a subscriber connection service;

a policy engine to store the first profile identifier and the lower-level profile identifier in a profile identifier database; and

a virtual interface to apply the subscriber connection service to a data packet.

13. The apparatus of claim 12, wherein the subscriber connection service is selected from the group consisting of a firewall, a quality of service (QoS), and a virus protector.

14. The apparatus of claim 12, wherein the policy engine also includes a virtual interface database to store a virtual interface identifier in a first field and the first profile identifier in a second field.

15. A machine-readable medium including instructions which when executed perform operations comprising:

receiving, from a requestor, a request to determine an operation to be performed on a data packet;

determining profile identifiers associated with the requestor, wherein the profile identifiers include, a first-level profile identifier associated with a lower-level profile identifier that defines the operation;

determining, based on the profile identifiers and profile information, that the operation should be performed on the data packet; and

transmitting an indication of the operation to the requestor, wherein the requester performs the operation on the data packet.

16. The machine-readable medium of claim 15, wherein the requester is a virtual interface.

17. The machine-readable medium of claim 15, wherein the operation includes forwarding the data packet through a virtual interface.

18. The machine-readable medium of claim 15, wherein determining the profile identifiers includes searching for the first-level identifier in a database, and based on the first-level identifier, searching for the lower-level identifier in the database.

19-21. -21. (canceled)