Managing hierarchically organized subscriber profiles

• US 7,961,615 B2
• Filed: 08/30/2008
• Issued: 06/14/2011
• Est. Priority Date: 11/18/2004
• Status: Expired due to Fees

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Balay, Rajesh I., Desai, Sachin S., Sargor, Chandramouli, Lemarchand, Francois, Khetawat, Amit K.
• Primary Examiner(s): Sheikh; Ayaz R
• Assistant Examiner(s): Moutaouakil; Mounir
• Application Number:
  US12/202,223
• Publication Number:
  US 20080320553A1
• Time in Patent Office: 1,018 Days
• Field of Search: 370230-235, 370/351, 370397-3953, 3703954-39543, 370/395.53, 370/409
• US Class Current: 370/233
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment of the present invention, a subscriber connection is created with a virtual router operable within a telecommunications system of a service provider. A connection request is received from a subscriber of multiple subscribers of the service provider at a subscriber manager of the virtual router. The virtual router maintains a database of hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected by (i) explicitly defining the subscriber services or (ii) referring to one or more of the multiple lower-level profile identifiers. If the subscriber is successfully authenticated, a connection is created by creating and configuring a virtual interface within the virtual router for the subscriber connection based on the subscriber'"'"'s first-level profile identifier.

Claims

1. A method of creating a subscriber connection comprising:

defining each of a plurality of service contexts available to subscribers of a service provider in terms of one or more profile identifiers of a plurality of profile identifiers each of which is representative of a particular subscriber service supported by the service provider;

providing a scalable subscriber profile database in which a memory requirement for the scalable subscriber profile database is dependent upon a number of available service contexts by hierarchically organizing the plurality of profile identifiers as intermediate profile identifiers and leaf profile identifiers, wherein the leaf profile identifiers explicitly define subscriber services and the intermediate profile identifiers indirectly represent sets of one or more subscriber services, which are defined by way of the intermediate profile identifiers'"'"' associations with one or more lower-level identifiers including zero or more of the leaf profile identifiers and zero or more of the intermediate profile identifiers;

receiving from a subscriber of a plurality of subscribers of a service provider a connection request at a subscriber manager of a virtual router (VR) of a plurality of VRs operable within a VR-based telecommunications system of the service provider; and

if the subscriber is successfully authenticated, then creating, by the subscriber manager, a subscriber connection corresponding to the connection request by creating and configuring a virtual interface within the VR for the subscriber connection based on a first-level profile identifier associated with the subscriber and the scalable subscriber profile database.

2. The method of claim 1, wherein the connection request comprises a point-to-point protocol request.

3. The method of claim 1, wherein the connection request comprises a user activation over a shared medium in an advanced subscriber management system.

4. The method of claim 1, wherein the connection request includes subscriber authentication information.

5. The method of claim 4, further comprising:

the VR transmitting an authorization request to a Remote Authentication Dial-In User Service (RADIUS) server;

responsive to the authorization request, the VR receiving from the RADIUS server an authorization response including the first-level profile identifier and a host identifier indicating where lower-level profile identifiers associated with the first-level profile identifier are stored or indicating another VR of the plurality of VRs operable within the telecommunications system from which the subscriber can receive service.

6. The method of claim 1, wherein said creating, by the subscriber manager, a subscriber connection further comprises acquiring one or more lower-level profile identifiers associated with the first-level profile identifier.

7. The method of claim 6, wherein the one or more lower-level profile identifiers are acquired from a policy engine of the VR.

8. The method of claim 6, wherein the one or more lower-level profile identifiers are acquired from a profile engine of another VR of the plurality of VRs operable within the telecommunications system.

9. The method of claim 6, wherein the one or more lower-level profile identifiers are acquired from a Remote Authentication Dial-In User Service (RADIUS) server.

10. A machine-readable storage medium tangibly embodying instructions which when executed by one or more processors of a virtual router-(VR) based telecommunications system of a service provider perform operations comprising:

receiving from a subscriber of a plurality of subscribers of a service provider a connection request at a subscriber manager of a VR of a plurality of VRs operable within the telecommunications system;

if the subscriber is successfully authenticated, then

determining the subscriber'"'"'s service context based on a first-level profile identifier associated with the subscriber and a scalable subscriber profile database, wherein each of a plurality of service contexts available to subscribers of the service provider are defined in terms of one or more profile identifiers of a plurality of profile identifiers each of which is representative of a particular subscriber service supported by the service provider and wherein a memory requirement for the scalable subscriber profile database is dependent upon a number of available service contexts by hierarchically organizing the plurality of profile identifiers as intermediate profile identifiers and leaf profile identifiers, wherein the leaf profile identifiers explicitly define subscriber services and the intermediate profile identifiers indirectly represent sets of one or more subscriber services, which are defined by way of the intermediate profile identifiers'"'"' associations with one or more lower-level identifiers including zero or more of the leaf profile identifiers and zero or more of the intermediate profile identifiers; and

creating a subscriber connection corresponding to the connection request by creating and configuring a virtual interface within the VR for the subscriber connection based on the subscriber'"'"'s service context.

11. The machine-readable medium of claim 10, wherein the connection request comprises a point-to-point protocol request.

12. The machine-readable medium of claim 10, wherein the connection request comprises a user activation over a shared medium in an advanced subscriber management system.

13. The machine-readable medium of claim 10, wherein the connection request includes subscriber authentication information.

14. The machine-readable medium of claim 13, wherein the operations further comprise:

the VR transmitting an authorization request to a Remote Authentication Dial-In User Service (RADIUS) server;

responsive to the authorization request, the VR receiving from the RADIUS server an authorization response including the first-level profile identifier and a host identifier indicating where lower-level profile identifiers associated with the first-level profile identifier are stored or indicating another VR of the plurality of VRs operable within the telecommunications system from which the subscriber can receive service.

15. The machine-readable medium of claim 10, wherein said determining the subscriber'"'"'s service context further comprises acquiring one or more lower-level profile identifiers associated with the first-level profile identifier.

16. The machine-readable medium of claim 15, wherein the one or more lower-level profile identifiers are acquired from a policy engine of the VR.

17. The machine-readable medium of claim 15, wherein the one or more lower-level profile identifiers are acquired from a profile engine of another VR of the plurality of VRs operable within the telecommunications system.

18. The machine-readable medium of claim 15, wherein the one or more lower-level profile identifiers are acquired from a Remote Authentication Dial-In User Service (RADIUS) server.