MANAGING HIERARCHICALLY ORGANIZED SUBSCRIBER PROFILES

• US 20110235548A1
• Filed: 06/13/2011
• Published: 09/29/2011
• Est. Priority Date: 11/18/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Balay, Rajesh I., Desai, Sachin S., Sargor, Chandramouli, Lemarchand, Francois, Khetawat, Amit K.
• Granted Patent: US 8,107,376 B2
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a policy engine of a VR defines services available to subscribers in terms of profile identifiers. A scalable subscriber profile database is established having a memory requirement dependent upon the number of available service contexts by hierarchically organizing profile identifiers as leaf profile identifiers, which explicitly define services, and intermediate profile identifiers, which indirectly represent services. The policy engine receives a first-level profile identifier and determines whether it is among those stored in the database. If not, then it obtains service profile information associated with the first-level profile identifier. If the first-level profile identifier is an intermediate profile identifier having leaf profile identifiers, then it further obtains them and associated profile information and stores this information in the database. The first-level profile identifier and the associated service profile information are also stored in the database.

Claims

1. A method comprising:

configuring a policy engine of a virtual router (VR) of a plurality of VRs of a VR-based telecommunications system to define services available to a plurality of subscribers of a service provider during respective subscriber connections by

defining each of a plurality of service contexts available to the plurality of subscribers in terms of one or more profile identifiers of a plurality of profile identifiers each of which is representative of a particular subscriber service supported by the service provider;

establishing a scalable subscriber profile database in which a memory requirement for the scalable subscriber profile database is dependent upon a number of available service contexts by hierarchically organizing the plurality of profile identifiers as intermediate profile identifiers and leaf profile identifiers, wherein the leaf profile identifiers explicitly define subscriber services and the intermediate profile identifiers indirectly represent sets of one or more subscriber services, which are defined by way of the intermediate profile identifiers'"'"' associations with one or more lower-level identifiers including zero or more of the leaf profile identifiers and zero or more of the intermediate profile identifiers;

receiving, by the policy engine, a first-level profile identifier;

determining, by the policy engine, whether the first-level profile identifier is among those of the plurality of first-level profile identifiers stored in the scalable subscriber profile database; and

if the first-level profile identifier is not stored in the scalable subscriber profile database, then performing the following

obtaining service profile information associated with the first-level profile identifier;

if the first-level profile identifier is an intermediate profile identifier that is associated with one or more leaf profile identifiers, then obtaining the one or more leaf profile identifiers and profile information associated with the one or more leaf profile identifiers and storing the one or more leaf profile identifiers and the profile information in the scalable subscriber profile database; and

storing the first-level profile identifier and the service profile information associated with the first-level profile identifier in the scalable subscriber profile database.

2. The method of claim 1, wherein the first-level profile identifier is received from a virtual interface of the VR.

3. The method of claim 1, wherein the one or more leaf profile identifiers are received from a component of the VR that manages subscriber profiles.

4. The method of claim 1, wherein said obtaining service profile information associated with the first-level profile identifier comprises receiving the service profile information from a Remote Authentication Dial-In User Service (RADIUS) server.

5. The method of claim 1, wherein said obtaining service profile information associated with the first-level profile identifier comprises receiving the service profile information from a control server.

6. A non-transitory machine-readable storage medium tangibly embodying instructions which when executed by one or more processors of a virtual router-(VR) based telecommunications system perform a method comprising:

configuring a policy engine of a VR of a plurality of VRs of the VR-based telecommunications system to define services available to a plurality of subscribers of a service provider during respective subscriber connections by

defining each of a plurality of service contexts available to the plurality of subscribers in terms of one or more profile identifiers of a plurality of profile identifiers each of which is representative of a particular subscriber service supported by the service provider;

establishing a scalable subscriber profile database in which a memory requirement for the scalable subscriber profile database is dependent upon a number of available service contexts by hierarchically organizing the plurality of profile identifiers as intermediate profile identifiers and leaf profile identifiers, wherein the leaf profile identifiers explicitly define subscriber services and the intermediate profile identifiers indirectly represent sets of one or more subscriber services, which are defined by way of the intermediate profile identifiers'"'"' associations with one or more lower-level identifiers including zero or more of the leaf profile identifiers and zero or more of the intermediate profile identifiers;

receiving, by the policy engine, a first-level profile identifier;

determining, by the policy engine, whether the first-level profile identifier is among those of the plurality of first-level profile identifiers stored in the scalable subscriber profile database; and

if the first-level profile identifier is not stored in the scalable subscriber profile database, then performing the following

obtaining service profile information associated with the first-level profile identifier;

if the first-level profile identifier is an intermediate profile identifier that is associated with one or more leaf profile identifiers, then obtaining the one or more leaf profile identifiers and profile information associated with the one or more leaf profile identifiers and storing the one or more leaf profile identifiers and the profile information in the scalable subscriber profile database; and

storing the first-level profile identifier and the service profile information associated with the first-level profile identifier in the scalable subscriber profile database.

7. The machine-readable medium of claim 6, wherein the first-level profile identifier is received from a virtual interface of the VR.

8. The machine-readable medium of claim 6, wherein the lower-level profile identifier is received from a component of the VR that manages subscriber profiles.

9. The machine-readable medium of claim 6, wherein said obtaining service profile information associated with the first-level profile identifier comprises receiving the service profile information from a Remote Authentication Dial-In User Service (RADIUS) server.

10. The machine-readable medium of claim 6, wherein said obtaining service profile information associated with the first-level profile identifier comprises receiving the service profile information from a control server.