Method and apparatus for managing proxy and non-proxy requests in a telecommunications network

• US 8,527,629 B2
• Filed: 08/26/2011
• Issued: 09/03/2013
• Est. Priority Date: 09/16/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Manning, Michael, Burshan, Chen Yehezkel, Sowatskey, Nathan John, Kumar, Ritesh, Wilkins, Gregory John
• Primary Examiner(s): Dalencourt, Yves
• Application Number:
  US13/219,337
• Publication Number:
  US 20110314149A1
• Time in Patent Office: 739 Days
• Field of Search: 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method is disclosed for determining attributes of a client connection configured for use with a telecommunications network; comparing determined attributes with location definition information stored in a configuration file; determining at least one user-defined location in the location definition information associated with the client connection based on the comparison; wherein the method is performed by one or more computing devices.

Claims

1. A method comprising:

determining attributes of a client connection configured for communication of a client with a telecommunications network;

comparing a particular client subnet range, included in the determined attributes, with location definition information stored in a configuration file;

wherein the location definition information is represented as one or more client subnet ranges;

wherein the configuration file additionally stores a plurality of white lists of hosts to which users may connect before authentication, and wherein the white lists each have different contents;

determining at least one user-defined location in the location definition information associated with the client connection based on the comparison;

based on the at least one user-defined location, selecting a particular white list, from the plurality of white lists, to determine one or more sites accessible to the client, wherein contents of the particular white list depend on the particular client subnet range determined from the attributes of the client connection;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, wherein comparing determined attributes with location definition information comprises comparing determined attributes with at least one Location object created from the location definition information stored in the configuration file.

3. The method of claim 2, wherein a Location object comprises a MBean.

4. The method of claim 1, wherein the location definition information comprises at least two hierarchically defined locations.

5. The method of claim 1, wherein the location definition information comprises at least one location group definition, said defined location group comprising at least two defined locations.

6. The method of claim 1, wherein a network management action selected from the group consisting of determining payment methods, determining rate information, setting quality of service parameters, determining whether access is allowed, and selecting the particular white list, is performed based at least in part on the at least one determined user-defined location.

7. The method of claim 1, further comprising determining a network management application for redirecting the client connection based at least in part on the at least one determined user-defined location.

8. The method of claim 1, wherein determining attributes of the client connection comprises obtaining a Complete ID for the client connection.

9. The method of claim 8, wherein the Complete ID includes at least one attribute selected from the group consisting of VPI, and VCI.

10. The method of claim 1, wherein the location definition information defines at least one location as a VPI subnet range, or a combination of IP address range and VPI subnet range.

11. The method of claim 1, wherein the client connection is originated by a user at a wireless access point.

12. The method of claim 1, wherein the client connection is initiated by an unauthenticated user.

13. A non-transitory computer readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform:

determining attributes of a client connection configured for communication of a client with a telecommunications network;

comparing a particular client subnet range, included in the determined attributes, with location definition information stored in a configuration file;

wherein the location definition information is represented as one or more client subnet ranges;

wherein the configuration file additionally stores a plurality of white lists of hosts to which users may connect before authentication, and wherein the white lists each have different contents;

determining at least one user-defined location in the location definition information associated with the client connection based on the comparison;

based on the at least one user-defined location, selecting a particular white list, from the plurality of white lists, to determine one or more sites accessible to the client;

wherein contents of the particular white list depend on the particular client subnet range determined from the attributes of the client connection.

14. The non-transitory computer readable medium of claim 13, further storing instructions which, when executed, cause the one or more processors to perform:

comparing determined attributes with at least one Location object created from the location definition information stored in the configuration file.

15. The non-transitory computer readable medium of claim 13, further storing instructions which, when executed, cause the one or more processors to perform:

determining payment methods, determining rate information, setting quality of service parameters, determining whether access is allowed, and selecting the particular white list based at least in part on the at least one determined user-defined location.

16. An apparatus comprising:

one or more processors;

a network interface that is coupled to a data network for receiving one or more packet flows thereform;

a proxy server configured to perform;

determining attributes of a client connection configured for communication of a client with a telecommunications network;

comparing a particular client subnet range, included in the determined attributes, with location definition information stored in a configuration file;

wherein the location definition information is represented as one or more client subnet ranges;

wherein the configuration file additionally stores a plurality of white lists of hosts to which users may connect before authentication, and wherein the white lists each have different contents; and

determining at least one user-defined location in the location definition information associated with the client connection based on the comparison;

based on the at least one user-defined location, selecting a particular white list, from the plurality of white lists, to determine one or more sites accessible to the client;

wherein contents of the particular white list depend on the particular client subnet range determined from the attributes of the client connection.

17. The apparatus of claim 16, wherein the proxy server is further configured to perform:

comparing determined attributes with at least one Location object created from the location definition information stored in the configuration file.

18. The apparatus of claim 17, wherein a Location object comprises a MBean.

19. The apparatus of claim 16, wherein the location definition information comprises at least two hierarchically defined locations.

20. The apparatus of claim 16, wherein the location definition information comprises at least one location group definition, said defined location group comprising at least two defined locations.

21. The apparatus of claim 16, wherein the proxy server is further configured to perform any of:

determining payment methods, determining rate information, setting quality of service parameters, determining whether access is allowed, or selecting the particular white list based at least in part on the at least one determined user-defined location.

22. The apparatus of claim 16, wherein the proxy server is further configured to perform:

determining a network management application for redirecting the client connection based at least in part on the at least one determined user-defined location.

23. The apparatus of claim 16, wherein the proxy server is further configured to perform:

obtaining a Complete ID for the client connection.

24. The apparatus of claim 23, wherein the Complete ID includes at least one attribute selected from the group consisting of VPI, and VCI.

25. The apparatus of claim 16, wherein the location definition information defines at least one location as a VPI subnet range, or a combination of IP address range and VPI subnet range.

26. The apparatus of claim 16, wherein the client connection is originated by a user at a wireless access point.

27. The apparatus of claim 16, wherein the client connection is initiated by an unauthenticated user.