MANAGING HIERARCHICALLY ORGANIZED SUBSCRIBER PROFILES

• US 20090007228A1
• Filed: 08/30/2008
• Published: 01/01/2009
• Est. Priority Date: 11/18/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Balay, Rajesh I., Desai, Sachin S., Sargor, Chandramouli, Lemarchand, Francois, Khetawat, Amit K.
• Granted Patent: US 7,869,361 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Apparatus are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a router includes a subscriber manager, a database and a virtual interface. The subscriber manager is operable to receive a connection request from a subscriber of a service provider. The database has stored therein hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers. The virtual interface defines a subscriber connection between the router and the subscriber and is created and configured responsive to the connection request based on a first-level profile identifier that is associated with the subscriber.

Claims

1. An apparatus comprising:

a subscriber manager to receive a connection request from a subscriber of a plurality of subscribers of a service provider and to receive a first profile identifier based on the connection request;

a profile manager to provide a lower-level profile identifier to the subscriber manager, wherein the lower-level profile identifier is associated with the first profile identifier, and wherein the lower-level profile identifier defines a subscriber connection service;

a policy engine to store the first profile identifier and the lower-level profile identifier in a profile identifier database; and

a virtual interface to apply the subscriber connection service to data packets received from the subscriber.

2. The apparatus of claim 1, wherein the subscriber connection service is selected from a group consisting of a firewall, a quality of service (QoS), a virtual private network and a virus protector.

3. The apparatus of claim 1, wherein the policy engine also includes a virtual interface database to store a virtual interface identifier in a first field and the first profile identifier in a second field.

4. A router comprising:

a subscriber manager operable to receive from a subscriber of a plurality of subscribers of a service provider a connection request;

a database of hierarchically organized profile identifiers, including a plurality of lower-level profile identifiers, which explicitly define subscriber services, and a plurality of first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers; and

a virtual interface, defining a subscriber connection between the router and the subscriber, created and configured responsive to the connection request based on a first-level profile identifier of the plurality of first-level profile identifiers that is associated with the subscriber.

5. The router of claim 4, wherein the connection request comprises a point-to-point protocol request.

6. The router of claim 4, wherein the connection request comprises a user activation over a shared medium in an advanced subscriber management system.

7. The router of claim 4, wherein the connection request includes subscriber authentication information.

8. The router of claim 7, wherein the subscriber manager is further configured to:

transmit an authorization request to a Remote Authentication Dial-In User Service (RADIUS) server; and

responsive to the authorization request, receive from the RADIUS server an authorization response including the first-level profile identifier and a host identifier indicating where lower-level profile identifiers associated with the first-level profile identifier are stored or indicating a virtual router operable within router from which the subscriber can receive service.

9. The router of claim 4, wherein creation and configuration of the virtual interface includes acquiring one or more lower-level profile identifiers associated with the first-level profile identifier.

10. The router of claim 9, further comprising a policy engine and wherein the one or more lower-level profile identifiers are acquired from the policy engine.

12. The router of claim 9, wherein the one or more lower-level profile identifiers are acquired from a Remote Authentication Dial-In User Service (RADIUS) server.

13. A router comprising:

a means operable within a virtual router for receiving from a subscriber of a plurality of subscribers of a service provider a connection request;

a repository means associated with the virtual router for maintaining hierarchically organized profile identifiers, the hierarchically organized profile identifiers including a plurality of lower-level profile identifiers, which explicitly define subscriber services, and a plurality of first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers; and

a means responsive to successful authentication of the subscriber for creating a subscriber connection corresponding to the connection request by creating and configuring a virtual interface within the virtual router for the subscriber connection based on a first-level profile identifier of the plurality of first-level profile identifiers that is associated with the subscriber.