Sharing of NAS information between PoPs

• US 6,895,434 B1
• Filed: 01/03/2000
• Issued: 05/17/2005
• Est. Priority Date: 01/03/2000
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Chandrupatla, Sunil Kumar, Sthothra Bhasham, Sampath Kumar, Mishra, Kali Prasanna, Chandrupatla, Anil Kumar, Podar, Sunil Kumar
• Primary Examiner(s): Feild, Joseph
• Assistant Examiner(s): NGUYEN, CHAU T
• Application Number:
  US09/477,021
• Time in Patent Office: 1,961 Days
• Field of Search: 370/401, 380/30, 380/25, 395/187.01, 709/227, 709/219, 709/229, 709/217, 709/218, 709/223, 709/224, 713/201, 455/3.03, 455/432.1, 455/433, 455/435.1, 455/436
• US Class Current: 709/223
• CPC Class Codes: H04L 12/2869 Operational details of access network equipments admission control or resource allocation in access networks H04L12/5692
• CPC Class Codes: H04L 41/085 Retrieval of network configuration; Tracking network configuration history
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method for handling access requests at multiple PoPs using the sharing of NAS information between the PoPs, enabling each PoP to maintain its own, independent, database of user records. When an access request is received, it is forwarded to a specific PoP designated as the user'"'"'s “home PoP”. This home PoP is the only PoP to contain the user'"'"'s records. The home PoP may then handle the access request by utilizing a local NAS list, the local NAS list being synchronized with other NAS lists in the network and providing information on all the “known” NASes throughout the entire network. This allows for a user to roam between PoPs, while reducing the bandwidth and security concerns that have existed in the past when users chose to roam. The NAS lists may then be updated via a central Network Control Console.

Claims

1. A method for centrally managing a computer network, including:

maintaining a central database of all NASes known to the computer network; and

broadcasting a message from said central database to a NAS list located at each POP in the computer network whenever said central database is changed, said message containing information regarding the change such that a current version of said central database of all NASes known to the computer network is maintained at said NAS list located at each POP.

2. The method of claim 1, wherein all of said NASes known to the computer network are all NASes within the computer network which have been chosen as being valid.

3. The method of claim 1, wherein said maintaining is performed by a Network Control Console.

4. The method of claim 3, wherein said Network Control Console is a graphical interface.

5. The method of claim 1, wherein said maintaining includes adding NASes, deleting NASes, and modifying the entries of NASes in said central database as the need arises.

6. The method of claim 1, wherein said broadcasting is performed automatically by a broker whenever a change to said central database is made.

7. The method of claim 1, wherein said broadcasting includes publishing a broker event via a broker.

8. A method for locally processing an access request at a Point-of-Presence (PoP) in a computer network having other PoPs, said access request received from a NAS, the method including:

accessing a list of network access servers (NASes) known to the PoP and known to the computer network, said list located locally at the PoP and periodically updated via communication with a central database of all NASes known to said computer network, wherein said central database broadcasts a message upon a change to said central database such that a current version of said central database of all NASes known to the computer network is maintained at said list; and

validating that said access request was received from a known entity by determining if an entry exists in said list for the NAS from which the access request was received.

9. The method of claim 8, further including retrieving a user record from a database of user records located locally at said PoP, said database of user records containing records for only those users who have been identified as having the PoP as their home PoP.

10. The method of claim 8, wherein each entry in said list contains a field identifying a NAS and a field identifying a dictionary of attributes supported by the corresponding NAS.

11. The method of claim 10, wherein said dictionary of attributes is a RADIUS dictionary.

12. The method of claim 8, wherein said each entry in said list contains fields for:

a domain name of a NAS;

a vendor name of said NAS;

a shared secret between all known NASes and AAA servers in the network; and

a dictionary name, said dictionary name indicating a dictionary of attributes supported by said NAS.

13. The method of claim 12, wherein said validating further includes validating that said access request was received from a known entity by determining if the domain name that the access request was received from matches the domain name field of any entry in said list.

14. The method of claim 13, wherein said validating further includes examining whether a password supplied with said access request matches the shared secret field of a corresponding entry in said list if the domain name that the access request was received from matches the domain name field of any entry in said list.

15. The method of claim 12, wherein said dictionary of attributes is a standard RADIUS dictionary.

16. The method of claim 8, wherein said accessing and validating are performed by an Authentication, Authorization, and Accounting (AAA) server.

17. The method of claim 8, further including subscribing to a broker event to update said list whenever a NAS known to the computer network is added, deleted, or modified.

18. A method for handling an access request at a PoP, said access request generated by a user logging on to said PoP, said user having a home PoP, the method including:

accessing a list of network access servers (NASes) known to the PoP and known to a computer network containing the PoP, said list located locally at the PoP and periodically updated via communication with a central database of all NASes known to said computer network, wherein said central database broadcasts a message upon a change to said central database such that a current version of said central database of all NASes known to the computer network is maintained at said list;

validating that said access request was received from a known entity by determining if an entry exists in said list for the NAS from which the access request was received;

determining if said user'"'"'s home PoP is said PoP;

forwarding said access request to an AAA server located at said PoP if said user'"'"'s home PoP is said PoP; and

relaying said access request to said user'"'"'s home PoP if said user'"'"'s home PoP is not said PoP.

19. The method of claim 18, wherein said determining, forwarding, and relaying are performed by a Protocol Gateway.

20. The method of claim 18, wherein said determining includes examining a user name entered by said user.

21. The method of claim 20, wherein said determining further includes parsing said user name to reveal a PoP location indicated within said user name.

22. The method of claim 21, wherein said PoP location indicated within said user name is a city name as a prefix to said user name.

23. The method of claim 21, wherein said PoP location indicated within said user name is an abbreviation for a city name contained within a domain name affixed to the end of said user name.

24. The method of claim 20, wherein said determining further includes parsing said user name to reveal a domain name, said domain name indicating an ISP in control of said home PoP.

25. An apparatus for centrally managing a computer network including:

a central NAS list maintainer;

a NAS list broadcaster coupled to said central NAS list maintainer and coupled to said computer network, said NAS list broadcaster configured to broadcast a message from a central database to a NAS list located at each POP in the computer network whenever said central database is changed, said message containing information regarding the chance such that a current version of said central database of all NASes known to the computer network is maintained at said NAS list located at each POP.

26. The apparatus of claim 25, wherein said central NAS list maintainer and said NAS list broadcaster are contained within a Network Control Console.

27. The apparatus of claim 25, wherein said central NAS list maintainer is coupled to a central NAS list, said central NAS list containing entries for each NAS known to the computer network.

28. The apparatus of claim 27, wherein each NAS known to the computer network is a NAS which has been chosen as being valid.

29. The apparatus of claim 25, wherein said NAS list broadcaster is coupled to a broker.

30. An apparatus for locally processing an access request at a PoP in a computer network having other PoPs, said access request received from a NAS, the apparatus including:

a memory configured to store a NAS list, said NAS list containing entries on each NAS known to the PoP and known to the computer network and located locally at the PoP and periodically updated via communication with a central database of all NASes known to said computer network, wherein said central database broadcasts a message upon a change to said central database such that a current version of said central database of all NASes known to the computer network is maintained at said list;

a NAS list accessor coupled to said NAS list; and

an access request validator coupled to said NAS list accessor.

31. The apparatus of claim 30, further including:

a user record database located locally at said PoP, said user record database containing records for only those users who have been identified as having the PoP as their home PoP; and

a user record retriever coupled to said user record database and coupled to said access request validator.

32. The apparatus of claim 30, wherein each entry in said NAS list contains a field identifying a NAS and a field identifying a dictionary of attributes supported by the corresponding NAS.

33. The apparatus of claim 32, wherein said dictionary of attributes is a RADIUS dictionary.

34. The apparatus of claim 30, wherein said each entry in said list contains fields for:

a domain name of a NAS;

a vendor name of said NAS;

a shared secret between all known NASes and AAA servers in the network; and

a dictionary name, said dictionary name indicating a dictionary of attributes supported by said NAS.

35. The apparatus of claim 33, wherein said dictionary of attributes is a standard RADIUS dictionary.

36. The apparatus of claim 30, wherein said NAS list accessor and said access request validator are contained in an Authentication, Authorization, and Accounting (AAA) server.

37. The apparatus of claim 30, further including:

a broker event subscriber coupled to said NAS list.

38. An apparatus for handling an access request at a PoP, said access request generated by a user logging on to said PoP, said user having a home PoP, the apparatus including:

a memory configured to store a NAS list, said NAS list containing entries on each NAS known to the PoP and known to a computer network containing the PoP, and located locally at the PoP and periodically updated via communication with a central database of all NASes known to said computer network, wherein said central database broadcasts a message upon a change to said central database such that a current version of said central database of all NASes known to the computer network is maintained at said list;

a NAS list accessor coupled to said NAS list;

an access request validator coupled to said NAS list accessor;

a user home PoP determiner; and

an access request forwarder coupled to said user home PoP determiner, said access request forwarder coupled to an AAA server if the PoP is said user'"'"'s home PoP and coupled to a computer network if the PoP is no said user'"'"'s home PoP.

39. The apparatus of claim 38, wherein said user home PoP determiner and said access request forwarder are contained within a Protocol Gateway.

40. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for centrally managing a computer network, the method including:

maintaining a central database of all NASes known to the computer network; and

broadcasting a message to a NAS list located at each POP in the computer network whenever said central database is changed, said message containing information regarding the change such that a current version of said central database of all NASes known to the computer network is maintained at said NAS list located at each POP.

41. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for locally processing an access request at a Point-of-Presence (PoP) in a computer network having other PoPs, said access request received from a NAS, the method including:

accessing a list of network access servers (NASes) known to the PoP and known to the computer network, said list located locally at the PoP and periodically updated via communication with a central database of all NASes known to said computer network, wherein said central database broadcasts a message upon a change to said central database such that a current version of said central database of all NASes known to the computer network is maintained at said list; and

validating that said access request was received from a known entity by determining if an entry exists in said list for the NAS from which the access request was received.

42. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for handling an access request at a PoP, said access request generated by a user logging on to said PoP, said user having a home PoP, the method including:

accessing a list of network access servers (NASes) known to the PoP and known to a computer network containing the PoP, said list located locally at the PoP and periodically updated via communication with a central database of all NASes known to said computer network, wherein said central database broadcasts a message upon a change to said central database such that a current version of said central database of all NASes known to the computer network is maintained at said list;

validating that said access request was received from a known entity by determining if an entry exists in said list for the NAS from which the access request was received;

determining if said user'"'"'s home PoP is said PoP;

forwarding said access request to an AAA server located at said PoP if said user'"'"'s home PoP is said PoP; and

relaying said access request to said user'"'"'s home PoP if said user'"'"'s home PoP is not said PoP.

43. An apparatus for centrally managing a computer network, including:

means for maintaining a central database of all NASes known to the computer network; and

means for broadcasting a message from said central database to a NAS list located at each POP in the computer network whenever said central database is changed, said message containing information regarding the change such that a current version of said central database of all NASes known to the computer network is maintained at said NAS list located at each POP.

44. The apparatus of claim 43, wherein all of said NASes known to the computer network are all NASes within the computer network which have been chosen as being valid.

45. The apparatus of claim 43, wherein said means for maintaining is a Network Control Console.

46. The apparatus of claim 45, wherein said Network Control Console is a graphical interface.

47. The apparatus of claim 43, wherein said means for maintaining includes means for adding NASes, deleting NASes, and modifying the entries of NASes in said central database as the need arises.

48. The apparatus of claim 43, wherein said broadcasting is performed automatically by a broker whenever a change to said central database is made.

49. The apparatus of claim 43, wherein said means for broadcasting includes means for publishing a broker event via a broker.

50. An apparatus for locally processing an access request at a Point-of-Presence (PoP) in a computer network having other PoPs, said access request received from a NAS, the apparatus including:

means for accessing a list of network access servers (NASes) known to the PoP and known to the computer network, said list located locally at the PoP and periodically updated via communication with a central database of all NASes known to said computer network, wherein said central database broadcasts a message upon a change to said central database such that a current version of said central database of all NASes known to the computer network is maintained at said list; and

means for validating that said access request was received from a known entity by determining if an entry exists in said list for the NAS from which the access request was received.

51. The apparatus of claim 50, further including means for retrieving a user record from a database of user records located locally at said PoP, said database of user records containing records for only those users who have been identified as having the PoP as their home PoP.

52. The apparatus of claim 50, wherein each entry in said list contains a field identifying a NAS and a field identifying a dictionary of attributes supported by the corresponding NAS.

53. The apparatus of claim 52, wherein said dictionary of attributes is a RADIUS dictionary.

54. The apparatus of claim 50, wherein said each entry in said list contains fields for:

a domain name of a NAS;

a vendor name of said NAS;

a shared secret between all known NASes and AAA servers in the network; and

a dictionary name, said dictionary name indicating a dictionary of attributes supported by said NAS.

55. The apparatus of claim 54, wherein said means for validating further includes means for validating that said access request was received from a known entity by determining if the domain name that the access request was received from matches the domain name field of any entry in said list.

56. The apparatus of claim 55, wherein said means for validating further includes means for examining whether a password supplied with said access request matches the shared secret field of a corresponding entry in said list if the domain name that the access request was received from matches the domain name field of any entry in said list.

57. The apparatus of claim 54, wherein said dictionary of attributes is a standard RADIUS dictionary.

58. The apparatus of claim 50, wherein said means for accessing and means for validating are an Authentication, Authorization, and Accounting (AAA) server.

59. The apparatus of claim 50, further including means for subscribing to a broker event to update said list whenever a NAS known to the computer network is added, deleted, or modified.

60. An apparatus for handling an access request at a PoP, said access request generated by a user logging on to said PoP, said user having a home PoP, the apparatus including:

means for accessing a list of network access servers (NASes) known to the PoP and known to a computer network containing the PoP, said list located locally at the PoP and periodically updated via communication with a central database of all NASes known to said computer network, wherein said central database broadcasts a message upon a change to said central database such that a current version of said central database of all NASes known to the computer network is maintained at said list;

means for validating that said access request was received from a known entity by determining if an entry exists in said list for the NAS from which the access request was received;

means for determining if said user'"'"'s home PoP is said PoP;

means for forwarding said access request to an AAA server located at said PoP if said user'"'"'s home PoP is said PoP; and

means for relaying said access request to said user'"'"'s home PoP if said user'"'"'s home PoP is not said PoP.

61. The apparatus of claim 60, wherein said means for determining, means for forwarding, and means for relaying are a Protocol Gateway.

62. The apparatus of claim 60, wherein said means for determining includes means for examining a user name entered by said user.

63. The apparatus of claim 62, wherein said means for determining further includes means for parsing said user name to reveal a PoP location indicated within said user name.

64. The apparatus of claim 63, wherein said PoP location indicated within said user name is a city name as a prefix to said user name.

65. The apparatus of claim 63, wherein said PoP location indicated within said user name is an abbreviation for a city name contained within a domain name affixed to the end of said user name.

66. The apparatus of claim 62, wherein said means for determining further includes means for parsing said user name to reveal a domain name, said domain name indicating an ISP in control of said home PoP.

67. A method for managing a computer network, including:

maintaining a central database of all NASes known to the computer network;

broadcasting a message from said central database to a NAS list located at each POP in the computer network whenever said central database is changed, said message containing information regarding the change such that a current version of said central database of all NASes known to the computer network is maintained at said NAS list located at each POP;

receiving said message at said NAS list located at each PoP in the computer network;

updating said NAS list to reflect the change;

receiving an access request at a PoP, said access request generated by a user logging on to said PoP, said user having a home PoP;

accessing said NAS list;

validating that said access request was received from a known entity by determining if an entry exists in said list for the NAS from which the access request was received;

determining if said user'"'"'s home PoP is said PoP;

forwarding said access request to an AAA server located at said PoP if said user'"'"'s home PoP is said PoP; and

relaying said access request to said user'"'"'s home PoP if said user'"'"'s home PoP is not said PoP.

68. The method of claim 67, wherein all of said NASes known to the computer network are all NASes within the computer network which have been chosen as being valid.

69. The method of claim 67, wherein said maintaining includes adding NASes, deleting NASes, and modifying the entries of NASes in said central database as the need arises.

70. The method of claim 67, wherein said broadcasting includes publishing a broker event via a broker.

71. The method of claim 67, wherein said central database and said PoP are operated by different corporate entities.

72. An apparatus for managing a computer network, including:

means for maintaining a central database of all NASes known to the computer network;

means for broadcasting a message from said central database to a NAS list located at each PoP in the computer network whenever said central database is changed, said message containing information regarding the change such that a current version of said central database of all NASes known to the computer network is maintained at said NAS list located at each POP;

means for receiving said message at said NAS list located at each PoP in the computer network;

means for updating said NAS list to reflect the change;

means for receiving an access request at a PoP, said access request generated by a user logging on to said PoP, said user having a home PoP;

means for accessing said NAS list;

means for validating that said access request was received from a known entity by determining if an entry exists in said list for the NAS from which the access request was received;

means for determining if said user'"'"'s home PoP is said PoP;

means for forwarding said access request to an AAA server located at said PoP if said user'"'"'s home PoP is said PoP; and

means for relaying said access request to said user'"'"'s home PoP if said user'"'"'s home PoP is not said PoP.

73. The apparatus of claim 72, wherein all of said NASes known to the computer network are all NASes within the computer network which have been chosen as being valid.

74. The apparatus of claim 72, wherein said means for maintaining includes means for adding NASes, means for deleting NASes, and means for modifying the entries of NASes in said central database as the need arises.

75. The apparatus of claim 72, wherein said means for broadcasting includes means for publishing a broker event via a broker.

76. The apparatus of claim 72, wherein said central database and said PoP are operated by different corporate entities.

77. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for managing a computer network, the method including:

maintaining a central database of all NASes known to the computer network;

broadcasting a message from said central database to a NAS list located at each PoP in the computer network whenever said central database is changed, said message containing information regarding the change such that a current version of said central database of all NASes known to the computer network is maintained at said NAS list located at each POP;

receiving said message at said NAS list located at each PoP in the computer network;

updating said NAS list to reflect the change;

receiving an access request at a PoP, said access request generated by a user logging on to said PoP, said user having a home PoP;

accessing said NAS list;

validating that said access request was received from a known entity by determining if an entry exists in said list for the NAS from which the access request was received;

determining if said user'"'"'s home PoP is said PoP;

forwarding said access request to an AAA server located at said PoP if said user'"'"'s home PoP is said PoP; and

relaying said access request to said user'"'"'s home PoP if said user'"'"'s home PoP is not said PoP.