Method and system for inlining services within a network access device

• US 7,813,759 B2
• Filed: 01/03/2007
• Issued: 10/12/2010
• Est. Priority Date: 01/04/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Starent Networks LLC (Cisco Systems, Inc.)
• Inventors: Virgile, Kenneth E.
• Primary Examiner(s): Chang; Kent
• Assistant Examiner(s): Behnamian; Shahriar
• Application Number:
  US11/649,328
• Publication Number:
  US 20070223437A1
• Time in Patent Office: 1,378 Days
• Field of Search: 370259-271, 4554141-4144, 455/415, 455/418, 455/426.2, 455/432.3, 455/466, 455/456.3
• US Class Current: 455/552.1
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/80 Responding to QoS
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor
• CPC Class Codes: H04W 4/08 User group management
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 88/16 Gateway arrangements
• CPC Class Codes: H04W 88/18 Service support devices; Network management devices

Abstract

An apparatus for providing network access and application session services includes a wireless network access device for receiving packet data streams from or transmitting packet data streams to one or more subscribers, and for conveying the packet data streams to or from a network or other subscribers. The wireless network access device includes profile information relating to the one or more subscribers. The apparatus further includes one or more application session services that are provided as a component of the wireless network access device. The wireless network access device selects, based on the profile information, zero or more of the application session services to process the packet data streams. The wireless network access device can also determine an application state associated with the packet data streams, and can modify actions of at least one of the application session services according to the application state.

Claims

1. An apparatus for providing network access and application session services, comprising:

a wireless network access device for receiving packet data streams from or transmitting packet data streams to one or more subscribers, and for conveying the packet data streams to or from a network or other subscribers, wherein the wireless network access device includes profile information relating to the one or more subscribers;

a plurality of application session services being a component of the wireless network access device, wherein each application session service comprises an application state regarding the state of the respective service;

wherein the wireless network access device selects, based on the profile information, two or more of the application session services to process the packet data streams, and wherein the wireless network access device determines a preferred order for executing the selected application session services, and arranges the selected application session services to execute in the preferred order, and wherein the wireless network access device controls the actions of at least one of the application session services based at least in part on the application state of a different one of the application session services.

2. The apparatus of claim 1, wherein the preferred order is configured or determined according to how at least one of the application session services affects at least one of the other application session services.

3. The apparatus of claim 1, wherein for each of the subscribers, the wireless network access device determines based on the subscriber profile information, which application session services should not be executed for packet data streams to or from the subscriber, and excludes from execution those of the one or more application session services that should not be executed for packet data streams to or from the subscriber.

4. The apparatus of claim 1, wherein at least one of the application session services includes a charging service that examines content of the packet data stream, determines an amount to be charged for the content, and maintains a record of the amounts charged.

5. The apparatus of claim 1, wherein the application session services include at least one of parental controls, malicious code detection, stateful firewall, intrusion detection, intrusion prevention, virus checking and VPN services.

6. The apparatus of claim 1, wherein the application session services include at least three of parental controls, malicious code detection, stateful firewall, intrusion detection, intrusion prevention, virus checking and VPN services.

7. The apparatus of claim 1, wherein an application session service maintains application state across multiple packets of the same packet stream.

8. An apparatus for providing network access and application session services, comprising:

a wireless network access device for receiving packet data streams from or transmitting packet data streams to one or more subscribers, and for conveying the packet data streams to or from a network or other subscribers, wherein the wireless network access device includes profile information relating to the one or more subscribers;

a plurality of application session services being a component of the wireless network access device, wherein each application session service comprises an application state regarding the state of the respective service;

wherein the wireless network access device selects, based on the profile information, two or more of the application session services to process the packet data streams, and wherein the wireless network access device controls the actions of at least one of the application session services based at least in part on the application state of a different one of the application session services, and wherein the wireless network access device and the application session services are implemented with redundancy.

9. The apparatus of claim 8, wherein an application session service maintains application state across multiple packets of the same packet stream.

10. A method of providing network access and application data session services, comprising:

receiving packet data streams from or transmitting packet data streams to one or more subscribers with a wireless network access device, and conveying the packet data streams to or from a network or other subscribers, wherein the wireless network access device includes profile information relating to the one or more subscribers;

providing a plurality of application session services as a component of the wireless network access device, wherein each application session service comprises an application state regarding the state of the respective service;

selecting, based on the profile information, two or more of the application session services to process the packet data streams;

determining a preferred order for executing the selected application session services, and arranging the selected application session services to execute in the preferred order; and

controlling the actions of at least one of the application session services based at least in part on the application state of a different one of the application session services.

11. The method of claim 10, further comprising for each of the subscribers, determining which application session services should not be executed for packet data streams to or from the subscriber, the determining being based on the subscriber profile information, and excluding from execution those of the one or more application session services that should not be executed for packet data streams to or from the subscriber.

12. The method of claim 10, further comprising examining content of the packet data stream, determining an amount to be charged for the content, and maintaining a record of the amounts charged.

13. The method of claim 10 wherein the application session services include at least one of parental controls, malicious code detection, stateful firewall, intrusion detection, intrusion prevention, virus checking and VPN services.

14. The method of claim 10 wherein the application session services include at least three of parental controls, malicious code detection, stateful firewall, intrusion detection, intrusion prevention, virus checking and VPN services.

15. The method of claim 10, further comprising maintaining the application state of an application session service across multiple packets of the same packet stream.

16. An apparatus for providing network access and application session services, comprising:

a wireless network access device for receiving packet data streams from or transmitting packet data streams to one or more subscribers, and for conveying the packet data streams to or from a network or other subscribers;

a plurality of application session services being a component of the wireless network access device, wherein the one or more application session services processes the packet data streams;

wherein the wireless network access device selects two or more of the application session services from the plurality of application session services to process the packet data streams; and

,

wherein the wireless network access device determines an application state regarding the state of a first application service, and modifies actions of a second application session services based on the application state of the first application service.

17. The apparatus of claim 16, wherein the wireless network access device performs deep packet inspection to determine the application state associated with the packet data streams.

18. The apparatus of claim 16, wherein the wireless network access device modifies actions associated with an application session service concerned with billing functions when another application session service modifies or drops packets from the packet data stream.

19. The apparatus of claim 16, wherein the application session services include at least one of parental controls, malicious code detection, stateful firewall, intrusion detection, intrusion prevention, virus checking and VPN services.

20. The apparatus of claim 16, wherein at least in some instances, the wireless network access device selects zero application session services from the plurality of application session services to process the packet data streams.

21. The apparatus of claim 16, wherein at least in some instances, the wireless network access device selects one application session service from the plurality of application session services to process the packet data streams.

22. The apparatus of claim 16, wherein at least in some instances, the wireless network access device selects more than one application session service from the plurality of application session services to process the packet data streams.

23. The apparatus of claim 16, wherein the application session services include at least three of parental controls, malicious code detection, stateful firewall, intrusion detection, intrusion prevention, virus checking and VPN services.

24. The apparatus of claim 16, wherein an application session service maintains the application state regarding the state of the first application service across multiple packets of the same packet stream.

25. A method of providing network access and application session services, comprising:

receiving packet data streams from or transmitting packet data streams to one or more subscribers with a network access device, and conveying the packet data streams to or from a network or other subscribers, wherein one or more application session services are a component of the wireless network access device;

providing a plurality of application session services as a component of the wireless network access device, wherein the one or more application session services processes the packet data streams;

selecting two or more of the application session services from the plurality of application session services to process the packet data streams;

determining an application state regarding the state of a first application service; and

modifying actions of a second application session service based on the application state of the first application service.

26. The method of claim 25, further comprising performing deep packet inspection to determine the application state associated with the packet data streams.

27. The method of claim 25, further comprising modifying actions associated with an application session service concerned with billing functions when another application session service modifies or drops packets from the packet data stream.

28. The method of claim 25 wherein the application session services include at least one of parental controls, malicious code detection, stateful firewall, intrusion detection, intrusion prevention, virus checking and VPN services.

29. The method of claim 25, wherein at least in some instances, zero application session services are selected from the plurality of application session services to process the packet data streams.

30. The method of claim 25, wherein at least in some instances, more than one application session services are selected from the plurality of application session services to process the packet data streams.

31. The method of claim 25 wherein the application session services include at least three of parental controls, malicious code detection, stateful firewall, intrusion detection, intrusion prevention, virus checking and VPN services.

32. The method of claim 25, further comprising maintaining the application state regarding the state of the first application service across multiple packets of the same packet stream.

33. A method of providing network access and application data session services, comprising:

receiving packet data streams from or transmitting packet data streams to one or more subscribers with a wireless network access device, and conveying the packet data streams to or from a network or other subscribers, wherein the wireless network access device includes profile information relating to the one or more subscribers;

providing a plurality of application session services as a component of the wireless network access device, wherein each application session service comprises an application state regarding the state of the respective service;

selecting, based on the profile information, two or more of the plurality of application session services to process the packet data streams;

determining a preferred order for executing the selected application session services;

arranging the selected application session services to execute in the preferred order;

determining an application state regarding the state of a first application service; and

modifying the actions of a second application session service based on the application state of the first application service.

34. The method of claim 33, wherein at least in some instances, zero application session services are selected from the plurality of application session services to process the packet data streams.

35. The method of claim 33, wherein at least in some instances, more than one application session services are selected from the plurality of application session services to process the packet data streams.

36. The method of claim 33, further comprising maintaining the application state regarding the state of the first application service across multiple packets of the same packet stream.