MANAGING HIERARCHICALLY ORGANIZED SUBSCRIBER PROFILES

• US 20080320553A1
• Filed: 08/30/2008
• Published: 12/25/2008
• Est. Priority Date: 11/18/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Balay, Rajesh I., Desai, Sachin S., Sargor, Chandramouli, Lemarchand, Francois, Khetawat, Amit K.
• Granted Patent: US 7,961,615 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment of the present invention, a subscriber connection is created with a virtual router operable within a telecommunications system of a service provider. A connection request is received from a subscriber of multiple subscribers of the service provider at a subscriber manager of the virtual router. The virtual router maintains a database of hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected by (i) explicitly defining the subscriber services or (ii) referring to one or more of the multiple lower-level profile identifiers. If the subscriber is successfully authenticated, a connection is created by creating and configuring a virtual interface within the virtual router for the subscriber connection based on the subscriber'"'"'s first-level profile identifier.

Claims

1. A method comprising:

configuring a policy engine to define services available to a plurality of subscribers of a service provider during respective subscriber connections, wherein the policy engine is included in a virtual router, and wherein the configuring includes,

establishing a database of hierarchically organized profile identifiers, including a plurality of lower-level profile identifiers, which explicitly define subscriber services, and a plurality of first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers;

receiving a first-level profile identifier;

determining whether the first-level profile identifier is among those of the plurality of first-level profile identifiers stored in the database; and

if the first-level profile identifier is not stored in the database, then performing the following,

obtaining service profile information associated with the first-level profile identifier;

if the first-level profile identifier is associated with a lower-level profile identifier that is not one of the plurality of lower-level profile identifiers, then receiving the lower-level profile identifier and lower-level profile information associated with the lower-level profile identifier and storing the lower-level profile identifier and lower-level profile information in the database; and

storing the first-level profile identifier and the service profile information associated with the first-level profile identifier in the database.

2. The method of claim 1, wherein the first-level profile identifier is received from a virtual interface of the virtual router.

3. The method of claim 1, wherein the lower-level profile identifier is received from a component of the virtual router that manages subscriber profiles.

4. The method of claim 1, wherein said obtaining service profile information associated with the first-level profile identifier comprises receiving the service profile information from a Remote Authentication Dial-In User Service (RADIUS) server.

5. The method of claim 1, wherein said obtaining service profile information associated with the first-level profile identifier comprises receiving the service profile information from a control server.

6. A method of creating a subscriber connection comprising:

receiving from a subscriber of a plurality of subscribers of a service provider a connection request at a subscriber manager of a virtual router operable within a telecommunications system of the service provider, the virtual router maintaining a database of hierarchically organized profile identifiers, including a plurality of lower-level profile identifiers, which explicitly define subscriber services, and a plurality of first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers;

if the subscriber is successfully authenticated, then creating a subscriber connection corresponding to the connection request by creating and configuring a virtual interface within the virtual router for the subscriber connection based on a first-level profile identifier of the plurality of first-level profile identifiers that is associated with the subscriber.

7. The method of claim 6, wherein the connection request comprises a point-to-point protocol request.

8. The method of claim 6, wherein the connection request comprises a user activation over a shared medium in an advanced subscriber management system.

9. The method of claim 6, wherein the connection request includes subscriber authentication information.

10. The method of claim 9, further comprising:

the virtual router transmitting an authorization request to a Remote Authentication Dial-In User Service (RADIUS) server;

responsive to the authorization request, the virtual router receiving from the RADIUS server an authorization response including the first-level profile identifier and a host identifier indicating where lower-level profile identifiers associated with the first-level profile identifier are stored or indicating another virtual router operable within the telecommunications system from which the subscriber can receive service.

11. The method of claim 6, wherein said creating a subscriber connection further comprises acquiring one or more lower-level profile identifiers associated with the first-level profile identifier.

12. The method of claim 11, wherein the one or more lower-level profile identifiers are acquired from a policy engine of the virtual router.

13. The method of claim 11, wherein the one or more lower-level profile identifiers are acquired from a profile engine of another virtual router operable within the telecommunications system.

14. The method of claim 11, wherein the one or more lower-level profile identifiers are acquired from a Remote Authentication Dial-In User Service (RADIUS) server.

15. A machine-readable medium including instructions which when executed by one or more processors of a telecommunications system perform operations comprising:

configuring a policy engine to define services available to a plurality of subscribers of a service provider during respective subscriber connections, wherein the policy engine is included in a virtual router, and wherein the configuring includes,

establishing a database of hierarchically organized profile identifiers, including a plurality of lower-level profile identifiers, which explicitly define subscriber services, and a plurality of first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers;

receiving a first-level profile identifier;

determining whether the first-level profile identifier is among those of the plurality of first-level profile identifiers stored in the database; and

if the first-level profile identifier is not stored in the database, then performing the following,

obtaining service profile information associated with the first-level profile identifier;

if the first-level profile identifier is associated with a lower-level profile identifier that is not one of the plurality of lower-level profile identifiers, then receiving the lower-level profile identifier and lower-level profile information associated with the lower-level profile identifier and storing the lower-level profile identifier and lower-level profile information in the database; and

storing the first-level profile identifier and the service profile information associated with the first-level profile identifier in the database.

16. The machine-readable medium of claim 15, wherein the first-level profile identifier is received from a virtual interface of the virtual router.

17. The machine-readable medium of claim 15, wherein the lower-level profile identifier is received from a component of the virtual router that manages subscriber profiles.

18. The machine-readable medium of claim 15, wherein said obtaining service profile information associated with the first-level profile identifier comprises receiving the service profile information from a Remote Authentication Dial-In User Service (RADIUS) server.

19. The machine-readable medium of claim 15, wherein said obtaining service profile information associated with the first-level profile identifier comprises receiving the service profile information from a control server.

20. A machine-readable medium including instructions which when executed by one or more processors of a telecommunications system perform operations comprising:

receiving from a subscriber of a plurality of subscribers of a service provider a connection request at a subscriber manager of a virtual router operable within a telecommunications system of the service provider, the virtual router maintaining a database of hierarchically organized profile identifiers, including a plurality of lower-level profile identifiers, which explicitly define subscriber services, and a plurality of first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers;

if the subscriber is successfully authenticated, then creating a subscriber connection corresponding to the connection request by creating and configuring a virtual interface within the virtual router for the subscriber connection based on a first-level profile identifier of the plurality of first-level profile identifiers that is associated with the subscriber.

21. The machine-readable medium of claim 20, wherein the connection request comprises a point-to-point protocol request.

22. The machine-readable medium of claim 20, wherein the connection request comprises a user activation over a shared medium in an advanced subscriber management system.

23. The machine-readable medium of claim 20, wherein the connection request includes subscriber authentication information.

24. The machine-readable medium of claim 23, further comprising:

the virtual router transmitting an authorization request to a Remote Authentication Dial-In User Service (RADIUS) server;

responsive to the authorization request, the virtual router receiving from the RADIUS server an authorization response including the first-level profile identifier and a host identifier indicating where lower-level profile identifiers associated with the first-level profile identifier are stored or indicating another virtual router operable within the telecommunications system from which the subscriber can receive service.

25. The machine-readable medium of claim 20, wherein said creating a subscriber connection further comprises acquiring one or more lower-level profile identifiers associated with the first-level profile identifier.

26. The machine-readable medium of claim 25, wherein the one or more lower-level profile identifiers are acquired from a policy engine of the virtual router.

27. The machine-readable medium of claim 25, wherein the one or more lower-level profile identifiers are acquired from a profile engine of another virtual router operable within the telecommunications system.

28. The machine-readable medium of claim 25, wherein the one or more lower-level profile identifiers are acquired from a Remote Authentication Dial-In User Service (RADIUS) server.

29. A method comprising:

a step for receiving from a subscriber of a plurality of subscribers of a service provider a connection request at a subscriber manager of a virtual router operable within a telecommunications system of the service provider, the virtual router maintaining a database of hierarchically organized profile identifiers, including a plurality of lower-level profile identifiers, which explicitly define subscriber services, and a plurality of first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers;

a step for, if the subscriber is successfully authenticated, creating a subscriber connection corresponding to the connection request by creating and configuring a virtual interface within the virtual router for the subscriber connection based on a first-level profile identifier of the plurality of first-level profile identifiers that is associated with the subscriber.