PPP domain name and L2TP tunnel selection configuration override

• US 6,874,030 B1
• Filed: 11/13/2000
• Issued: 03/29/2005
• Est. Priority Date: 11/13/2000
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Sitaraman, Aravind, Yager, Charles T., Sheth, Purnam Anil, Burns, Gregory D.
• Primary Examiner(s): Winder, Patrice
• Assistant Examiner(s): LAZARO, DAVID R
• Application Number:
  US09/712,780
• Time in Patent Office: 1,597 Days
• Field of Search: 709/218, 709/219, 709/225, 709/227, 709/229, 709/221, 709/220, 713/200, 713/201
• US Class Current: 709/229
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2859 Point-to-point connection between the data network and the subscribers encapsulation H04L12/4633; virtual LANs H04L12/4641; routing of packets H04L45/00
• CPC Class Codes: H04L 2101/365 Application layer names, e.g. buddy names, unstructured names chosen by a user or home appliance name
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/168 specially adapted for link layer protocols, e.g. asynchronous transfer mode [ATM], synchronous optical network [SONET] or point-to-point protocol [PPP]
• CPC Class Codes: H04L 69/324 in the data link layer [OSI layer 2], e.g. HDLC

Abstract

A method for controlling subscriber access in a network capable of establishing connections with multiple services includes receiving a communication from a subscriber using a first communication network coupled to a second communication network, the communication optionally including a domain identifier associated with a service on the second communication network, and authorizing the subscriber to access a service on the second communication network using a virtual circuit. The authorization is based upon a domain configuration override attribute associated with the virtual circuit used to receive the communication from the subscriber. An access server capable of forcing subscribers of a communications system to gain access exclusively to a domain network associated with a virtual circuit includes an authorizer to grant service authorization to the subscribers based upon a virtual circuit used to make a service request, a virtual circuit profile request generator to generate virtual circuit profile requests and a calculator to determine whether the service associated with the virtual circuit matches the service associated with a domain configuration override attribute.

Claims

1. A method for controlling subscriber access in a network capable of establishing connections with a plurality of services, comprising:

receiving, at an access server coupled to a first communication network and a second communication network, a communication from a subscriber on said first communication network, said communication optionally including a domain identifier associated with a service on a network device located on said second communication network; and

authorizing said subscriber to access only a domain associated with a domain configuration override attribute, said domain located on said second communication network, using one of a plurality of virtual circuits, said authorizing based upon a domain configuration override attribute associated with the virtual circuit used to receive said communication from said subscriber.

2. The method of claim 1 wherein said authorizing further comprises:

receiving from a memory a virtual circuit profile associated with said virtual circuit;

assessing said virtual circuit profile to determine if a domain configuration override attribute exists within said virtual circuit profile; and

forcing said subscriber to connect exclusively to a service associated with said domain configuration override attribute when said domain configuration override attribute exists within said virtual circuit profile.

3. The method of claim 2 wherein said receiving a virtual circuit profile further comprises performing a table lookup based upon a Virtual Path Identifier (VPI)/Virtual Channel Identifier (VCI) associated with said virtual circuit.

4. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method to control subscriber access in a network capable of establishing connections with a plurality of services, the method comprising:

receiving, at an access server coupled to a first communication network and a second communication network, a communication from a subscriber on said first communication network, said communication optionally including a domain identifier associated with a service on a network device located on said second communication network; and

authorizing said subscriber to access only a domain associated with a domain configuration override attribute, said domain located on said second communication network, using one of a plurality of virtual circuits, said authorizing based upon a domain configuration override attribute associated with the virtual circuit used to receive said communication from said subscriber.

5. The program storage device of claim 4 wherein said authorizing further comprises:

receiving from a memory a virtual circuit profile associated with said virtual circuit;

assessing said virtual circuit profile to determine if a domain configuration override attribute exists within said virtual circuit profile; and

forcing said subscriber to connect exclusively to a service associated with said domain configuration override attribute when said domain configuration override attribute exists within said virtual circuit profile.

6. The program storage device of claim 5 wherein said receiving a virtual circuit profile further comprises performing a table lookup based upon a Virtual Path Identifier (VPI)/Virtual Channel Identifier (VCI) associated with said virtual circuit.

7. An apparatus for controlling subscriber access in a network capable of establishing connections with a plurality of services, the apparatus comprising:

means for receiving, at an access server coupled to a first communication network and a second communication network, a communication from a subscriber on said first communication network, said communication optionally including a domain identifier associated with a service on a network device located on said second communication network; and

means for authorizing said subscriber to access only a domain associated with a domain configuration override attribute, said domain located on said second communication network using one of a plurality of virtual circuits, said authorizing based upon a domain configuration override attribute associated with the virtual circuit used to receive said communication from said subscriber.

8. The apparatus of claim 7 wherein said means for authorizing further comprises:

means for receiving from a memory a virtual circuit profile associated with said virtual circuit;

means for assessing said virtual circuit profile to determine if a domain configuration override attribute exists within said virtual circuit profile; and

means for forcing said subscriber to connect exclusively to a service associated with said domain configuration override attribute when said domain configuration override attribute exists within said virtual circuit profile.

9. The apparatus of claim 8 wherein said means for receiving a virtual circuit profile further comprises a means for performing a table lookup based upon a Virtual Path Identifier (VPI)/Virtual Channel Identifier (VCI) associated with said virtual circuit.

10. An access server capable of forcing subscribers of a first communications network coupled to said access server to gain access exclusively to a domain associated with a domain configuration override attribute, said domain located on in a second communications network coupled to said access server using a virtual circuit, said access server comprising:

an authorizer capable of granting service authorization to said subscribers based upon a virtual circuit used to make a service request, said service request optionally including a domain identifier;

a virtual circuit profile request generator capable of generating virtual circuit profile requests;

an assessor capable of assessing said requested virtual circuit profile for a domain configuration override attribute; and

a calculator capable of determining whether the service associated with said virtual circuit matches the service associated with said domain configuration override attribute.

11. The access server of claim 10, further comprising:

a receiving interface capable of accepting said service requests;

a forwarding interface capable of sending said virtual circuit profile requests to a memory bank; and

a second receiving interface capable of accepting requested virtual circuit profiles.

12. The access server of claim 11 wherein said receiving interface comprises at least one access multiplexer, each access multiplexer having a plurality of inputs for receiving a service request, each of said inputs being associated with a particular subscriber virtual circuit.

13. The access server of claim 11 wherein said memory bank and said access server communicate using the Remote Authentication Dial-In User Service (RADIUS) protocol.

14. The access server of claim 10 wherein said service request comprises a Point-to-Point Protocol (PPP) session service request.

15. The access server of claim 10 wherein said assessor is capable of performing a table lookup based upon a Virtual Path Identifier (VPI)/Virtual Channel Identifier (VCI) associated with said virtual circuit.

16. An access server capable of forcing subscribers of a first communications network coupled to said access server to gain access exclusively to a domain associated with a domain configuration override attribute, said domain located on in a second communications network coupled to said access server using a virtual circuit, said access server comprising:

a memory device capable of storing a plurality of virtual circuit profiles, said virtual circuit profiles capable of having a domain configuration override attribute associated with subscriber authorized services;

an authorizer capable of granting service authorization to said subscribers based upon a virtual circuit used to make a service request, said service request optionally including a domain identifier;

a virtual circuit profile request generator capable of generating virtual circuit profile requests;

an assessor capable of assessing said requested virtual circuit profile for a domain configuration override attribute; and

a calculator capable of determining whether the service associated with said virtual circuit matches the service associated with said domain configuration override attribute.

17. The access server of claim 16, further comprising:

a receiving interface capable of accepting said service requests;

a forwarding interface capable of sending said virtual circuit profile requests to a memory bank; and

a second receiving interface capable of accepting requested virtual circuit profiles.

18. The access server of claim 17 wherein said receiving interface comprises at least one access multiplexer, each access multiplexer having a plurality of inputs for receiving a service request, each of said inputs being associated with a particular subscriber virtual circuit.

19. The access server of claim 16 wherein said assessor is capable of performing a table lookup based upon a Virtual Path Identifier (VPI)/Virtual Channel Identifier (VCI) associated said virtual circuit.