Method and apparatus for managing subscriber profiles

• US 7,808,904 B2
• Filed: 11/18/2004
• Issued: 10/05/2010
• Est. Priority Date: 11/18/2004
• Status: Expired due to Fees

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Balay, Rajesh I, Desai, Sachin S., Sargor, Chandramouli, Lemarchand, Francois, Khetawat, Amit K.
• Primary Examiner(s): Ryman; Daniel J
• Assistant Examiner(s): Divecha; Nishant B
• Application Number:
  US10/991,970
• Publication Number:
  US 20080117917A1
• Time in Patent Office: 2,147 Days
• Field of Search: 370230-235, 370397-3953, 3703954-39543, 370/395.53, 370/409
• US Class Current: 370/233
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Methods and apparatus for managing subscriber profiles are described herein. In one embodiment, the method includes receiving, from a requester, a request to determine an operation to be performed on a data packet. The method also includes determining profile identifiers associated with the requester, wherein the profile identifiers include, a first-level profile identifier associated with a lower-level profile identifier that defines the operation. The method also includes determining, based on the profile identifiers, that the operation should be performed on the data packet and transmitting an indication of the operation to the requestor, wherein the requestor performs the operation on the data packet.

Claims

1. A method comprising:

defining each of a plurality of service contexts available to subscribers of a service provider in terms of one or more profile identifiers of a plurality of profile identifiers each of which is representative of a particular subscriber service supported by the service provider;

providing a scalable subscriber profile database in which a memory requirement for the scalable subscriber profile database is dependent upon a number of available service contexts by hierarchically organizing the plurality of profile identifiers as intermediate profile identifiers and leaf profile identifiers, wherein the leaf profile identifiers explicitly define subscriber services and the intermediate profile identifiers indirectly represent sets of one or more subscriber services, which are defined by way of the intermediate profile identifiers'"'"' associations with one or more lower-level identifiers including zero or more of the leaf profile identifiers and zero or more of the intermediate profile identifiers;

wherein the scalable subscriber profile database is distributed between an authentication system of the service provider and a plurality of virtual routers (VRs), wherein a first portion of the scalable subscriber profile database is stored within the authentication system, the first portion of the scalable subscriber profile database including information indicative of associations among the subscribers and corresponding first-level profile identifiers representing a subset of the intermediate profile identifiers and a second portion of the scalable subscriber profile database is stored within a profile manager operable within each of the plurality of VRs, the second portion including information indicative of the associations among the subset of intermediate profile identifiers and the one or more lower-level identifiers;

receiving, by a subscriber manager of a virtual router (VR) of the plurality of VRs of a VR-based telecommunications system of the service provider, a subscriber connection request from a subscriber of the service provider;

responsive to the subscriber connection request, determining, by the subscriber manager, the subscriber'"'"'s service context based on the first-level profile identifier associated with the subscriber and the scalable subscriber profile database, wherein determining the service context includes requesting, from the first portion of the scalable profile database, the first-level profile identifier and requesting, from the second portion of the scalable profile database, the one or more lower-level profile identifiers associated with the first level profile identifier; and

establishing, by the subscriber manager, the subscriber connection by configuring a virtual interface associated with the VR based on the subscriber'"'"'s service context.

2. The method of claim 1, wherein the subscriber'"'"'s service context includes a combination of services including a plurality of a firewall service, an antivirus service, virtual private network support and tunneling support.

3. The method of claim 1, further comprising prior to said determining, by the subscriber manager, the subscriber'"'"'s service context:

causing, by the subscriber manager, the subscriber connection request to be authenticated by the authentication system; and

if the subscriber connection request is affirmatively authenticated by the authentication system, then receiving by the subscriber manager from the authentication system, the first-level profile identifier.

4. The method of claim 3, wherein said determining, by the subscriber manager, the subscriber'"'"'s service context comprises the subscriber manager causing the profile manager of the VR to dereference intermediate profile identifiers, if any, associated with the first-level profile identifier based on the second portion of the scalable subscriber profile database.

5. The method of claim 1, wherein the authentication system comprises a Remote Authentication Dial-In User Service (RADIUS) server.

6. A tangible machine-readable storage medium embodying instructions, which when executed by one or more processors of a virtual router (VR) based telecommunications system of a service provider performs a method for establishing a subscriber connection, the method comprising:

receiving, at a VR of a plurality of VRs configured to operate within the telecommunications system, a subscriber connection request from a subscriber of the service provider;

responsive to the subscriber connection request, determining the subscriber'"'"'s service context based on a first-level profile identifier associated with the subscriber and a scalable subscriber profile database,

wherein each of a plurality of service contexts available to subscribers of the service provider are defined in terms of one or more profile identifiers of a plurality of profile identifiers each of which is representative of a particular subscriber service supported by the service provider;

wherein a memory requirement for the scalable subscriber profile database is dependent upon a number of available service contexts by hierarchically organizing the plurality of profile identifiers as intermediate profile identifiers and leaf profile identifiers, wherein the leaf profile identifiers explicitly define subscriber services and the intermediate profile identifiers indirectly represent sets of one or more subscriber services, which are defined by way of the intermediate profile identifiers'"'"' associations with one or more lower-level identifiers including zero or more of the leaf profile identifiers and zero or more of the intermediate profile identifiers;

wherein the scalable subscriber profile database is distributed between an authentication system of the service provider and the plurality of virtual routers (VRs), wherein a first portion of the scalable subscriber profile database is stored within the authentication system, the first portion of the scalable subscriber profile database including information indicative of associations among the subscribers and corresponding first-level profile identifiers representing a subset of the intermediate profile identifiers and a second portion of the scalable subscriber profile database is stored within a profile manager operable within each of the plurality of VRs, the second portion including information indicative of the associations among the subset of intermediate profile identifiers and the one or more lower-level identifiers;

wherein determining the service context includes requesting, from the first portion of the scalable profile database, the first-level profile identifier and requesting, from the second portion of the scalable profile database, the one or more lower-level profile identifiers associated with the first-level profile identifier; and

establishing the subscriber connection by configuring a virtual interface associated with the VR based on the subscriber'"'"'s service context.

7. The machine-readable storage medium of claim 6, wherein the subscriber'"'"'s service context includes a combination of services including a plurality of a firewall service, an antivirus service, virtual private network support and tunneling support.

8. The machine-readable storage medium of claim 6, the method further comprising prior to said determining the subscriber'"'"'s service context:

causing the subscriber connection request to be authenticated by the authentication system; and

if the subscriber connection request is affirmatively authenticated by the authentication system, then receiving from the authentication system, the first-level profile identifier.

9. The machine-readable storage medium of claim 8, wherein said determining the subscriber'"'"'s service context comprises causing the profile manager of the VR to dereference intermediate profile identifiers, if any, associated with the first-level profile identifier based on the second portion of the scalable subscriber profile database.

10. The machine-readable storage medium of claim 6, wherein the authentication system comprises a Remote Authentication Dial-In User Service (RADIUS) server.