MANAGING HIERARCHICALLY ORGANIZED SUBSCRIBER PROFILES

• US 20080317040A1
• Filed: 08/30/2008
• Published: 12/25/2008
• Est. Priority Date: 11/18/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Balay, Rajesh I., Desai, Sachin S., Sargor, Chandramouli, Lemarchand, Francois, Khetawat, Amit K.
• Granted Patent: US 7,843,813 B2
• Time in Patent Office: Days
• US Class Current: 370/395.21
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Apparatus are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a router includes multiple virtual interfaces and a policy engine. The virtual interfaces define connections between the router and corresponding subscribers of a service provider. A first virtual interface is operable to receive packets from a first subscriber and to process the packets in accordance with a first-level profile identifier. The policy engine is coupled with the virtual interfaces and operable to de-reference subscriber profiles of the subscribers on behalf of the virtual interfaces based on a database of hierarchically organized profile identifiers. The database includes multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the lower-level profile identifiers.

Claims

1. An apparatus comprising:

a virtual interface to receive a data packet from a subscriber computer and to request information regarding one or more operations to be performed on the data packet, wherein the virtual interface defines a connection between a router and the subscriber computer; and

a policy engine to receive a request from the virtual interface for the information regarding the one or more operations to be performed on the data packet, the policy engine including,

a virtual interface database having stored therein a first-level profile identifier associated with the virtual interface; and

a profile identifier database having stored therein a lower-level profile identifier associated with the first-level profile identifier, wherein the lower-level profile identifier indicates the one or more operation to be performed on the data packet.

2. The apparatus of claim 1, wherein the one or more operations comprise a packet forwarding operation.

3. The apparatus of claim 2, wherein the one or more operations further comprise firewall operations, quality of service operations, tunneling operations, virtual private network operations or operations associated with virus protection.

4. The apparatus of claim 1, wherein the profile identifier database includes the first profile identifier and a lower-level identifier associated with the first profile identifier.

5. A router comprising:

a plurality of virtual interfaces defining connections between the router and corresponding subscribers of the plurality of subscribers, the plurality of virtual interfaces including a first virtual interface operable to receive packets from a first subscriber of the plurality of subscribers and to process the packets in accordance with a first-level profile identifier of the plurality of the first-level profile identifiers associated with the first subscriber; and

a policy engine coupled in communication with the plurality of virtual interfaces and operable to de-reference subscriber profiles for a plurality of subscribers of a service provider on behalf of the plurality of virtual interfaces based on a database of hierarchically organized profile identifiers, the database including a plurality of lower-level profile identifiers, which explicitly define subscriber services, and a plurality of first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers.

6. The apparatus of claim 5, wherein the first virtual interface is configured to forward the packets as directed by the policy engine.

7. The apparatus of claim 6, wherein the first virtual interface is further configured to perform firewall operations on the packets as directed by the policy engine.

8. The apparatus of claim 6, wherein the first virtual interface is further configured to perform virus protection operations in relation to the packets as directed by the policy engine.

9. The apparatus of claim 6, wherein the first virtual interface is further configured to perform tunneling operations in relation to the packets as directed by the policy engine.

10. The apparatus of claim 6, wherein the first virtual interface is further configured to perform virtual private network operations in relation to the packets as directed by the policy engine.

11. The router of claim 5, wherein the database is populated at least in part based on information acquired from a Remote Authentication Dial-In User Service (RADIUS) server.

12. The router of claim 5, wherein the first virtual interface is created and configured responsive to a connection request from the first subscriber.

13. A router comprising:

a plurality of interface means for defining connections between the router and corresponding subscribers of the plurality of subscribers, the plurality of interface means including a first interface means for receiving packets from a first subscriber of the plurality of subscribers and for processing the packets in accordance with a first-level profile identifier of the plurality of the first-level profile identifiers associated with the first subscriber;

a repository means for maintaining hierarchically organized profile identifiers including a plurality of lower-level profile identifiers, which explicitly define subscriber services, and a plurality of first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers; and

a policy engine means, coupled in communication with the repository means and the plurality of interface means, for de-referencing subscriber profiles of a plurality of subscribers of a service provider on behalf of the plurality of interface means based on the hierarchically organized profile identifiers.

14. The apparatus of claim 13, wherein the first interface means is further for forwarding the packets as directed by the policy engine means and for performing one or more of firewall operations, tunneling operations, virtual private networking operations and/or virus protection operations in relation to the packets.