POLICY-BASED ROUTING IN A MULTI-HOMED COMPUTER

• US 20090323681A1
• Filed: 06/26/2008
• Published: 12/31/2009
• Est. Priority Date: 06/26/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Biao, Ventakaramaiah, Narasimhan Agrahara, Sridharan, Murari
• Granted Patent: US 7,970,931 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/308 Route determination based on user's profile, e.g. premium users

Abstract

Policy-based routing system and method for a multi-homed computer. Policy-based routing permits or blocks usage of system level route(s) based on user credentials and/or network application(s) associated with a data transfer. The credentials can include information associated with an application, a user, and the like. Optionally, one or more filter(s) can be configured over classifiable field(s), such as credential(s), information associated with a determined proposed route, to statically permit/block route usage and/or to invoke an inspection module (e.g., custom inspection routine) when the filter condition(s) are met.

Claims

1. A computer-implemented system that facilitates policy-based routing, comprising:

a routing component that receives a credential associated with a data transfer and generates a route proposal; and

a policy enforcement component that determines whether the proposed route is permitted or blocked based on the credential and a policy, wherein the policy enforcement component provides information to the routing component as to whether the proposed route is permitted or blocked.

2. The system of claim 1, wherein if the proposed route is blocked, the policy enforcement component receives another proposed route from the routing component and the policy enforcement component determines whether the another proposed route is permitted or blocked based on the credentials and the policy.

3. The system of claim 2, wherein the policy enforcement component continues to receive proposed routes from the routing component until a permitted route is determined or available routes have been exhausted.

4. The system of claim 1, further comprising a filter that invokes an inspection module if a filter condition is met.

5. The system of claim 4, wherein the inspection module configures a network interface and a network connection on demand.

6. The system of claim 5, wherein the network connection is associated with a virtual private network.

7. The system of claim 5, wherein the network connection is based on a General Packet Radio Service.

8. The system of claim 4, wherein the filter condition comprises at least one of information associated with a user, information associated with an application or information associated with the proposed route.

9. The system of claim 1, wherein the policy is stored in a policy store.

10. The system of claim 9, wherein the stored policy is received from a computer remote from the system.

11. The system of claim 1, employed in a multi-homed computer.

12. The system of claim 1, wherein the credential comprises at least one of information associated with a user or information associated with an application.

13. The system of claim 1, employed in a Transmission Control Protocol/Internet Protocol stack.

14. The system of claim 1, wherein the information associated with a proposed route comprises at least one of a destination IP address, a destination interface, a transport protocol or a next hop IP address.

15. A computer-implemented method of policy-based routing, comprising:

receiving a credential associated with a data transfer and information associated with a proposed route;

determining whether the proposed route is permitted, based on the credential and a policy; and

,

if the proposed first route is permitted, allowing the data transfer.

16. The method of claim 15, further comprising:

if the proposed route is not permitted, blocking the data transfer.

17. The method of claim 15, wherein receiving the credential associated with the data transfer and information associated with a proposed route and determining whether the proposed route is permitted, based on the credential and the policy is repeated until a permitted route is determined or available routes have been exhausted.

18. A computer-implemented method of policy-based routing, comprising:

receiving credentials associated with a data transfer and information associated with a proposed route;

determining whether a filter condition has been met;

invoking a custom inspection module, if the filter condition has been met;

determining whether the proposed route is permitted, based on the credentials and a policy, if the filter condition has been met.

19. The method of claim 18, wherein the custom inspection module configures a network connection associated with the data transfer.

20. The method of claim 18, wherein the filter condition comprises at least one of information associated with a user, information associated with an application or information associated with the proposed route.