System and method for local policy enforcement for internet service providers

• US 7,409,704 B1
• Filed: 07/15/1999
• Issued: 08/05/2008
• Est. Priority Date: 07/15/1999
• Status: Expired due to Fees

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Charas, Philippe
• Primary Examiner(s): Zia; Syed A.
• Application Number:
  US09/354,418
• Time in Patent Office: 3,309 Days
• Field of Search: 713200-202, 713/182, 713/153, 713/162, 713/155, 455/3.04, 455407-408, 455/411, 709223-229, 380/247, 380/250
• US Class Current: 726/2
• CPC Class Codes: H04L 12/2858 Access network architectures
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A telecommunications system and method is disclosed for implementing a Policy Enforcement Point (PEP) for an Internet Service Provider (ISP) at the subscriber premises. This PEP enforces policies with respect to authentication of subscribers, authorization to access and services, accounting and mobility of the subscribers. These policies are defined by the ISP operator in a Policy Decision Point (PDP), which is a server connected to the Internet that communicates with the PEP. In addition, the ISP can supply an encryption key for the PEP and an encryption key for a particular subscriber. Thus, all communications between the subscriber and the PEP, as well as between the PEP and the PDP can be encrypted.

Claims

1. An on-premises policy enforcement point (PEP), said PEP being housed within a subscriber premises associated with a plurality of subscribers who utilize an Internet Service Provider (ISP) to access the Internet, said PEP comprising:

a PEP key;

PEP authentication means for sending the PEP key to an ISP node external to the premises, said ISP node utilizing the PEP key to authenticate the PEP without authenticating individual subscribers;

subscriber authentication means for locally authenticating within the PEP, each of the plurality of subscribers in response to receiving Internet access requests from the subscribers; and

policy enforcement means responsive to the subscriber authentication means for locally authorizing within the PEP, each of the plurality of subscribers to access Internet services to which the subscribers subscribe while preventing the subscribers from accessing services to which the subscribers do not subscribe, said policy enforcement means operating independently of the external ISP node to authenticate subscribers and enforce policies without communicating with the external access node.

2. The on-premises PEP of claim 1, wherein the policy enforcement means includes an authorization database for storing authorization information associated with the plurality of subscribers.

3. The on-premises PEP of claim 1, further comprising:

an accounting log for recording session information associated with an Internet session initiated by each of the plurality of subscribers.

4. The on-premises PEP of claim 1, wherein the subscriber authentication means includes:

a memory for storing a subscriber key for each of the plurality of subscribers; and

means for receiving from a given subscriber, the Internet access request, said request including authentication information relating to the subscriber key for the given subscriber.

5. The on-premises PEP of claim 4, wherein said subscriber key is used to encrypt information transmitted between the on-premises PEP and each of the plurality of subscribers.

6. The on-premises PEP of claim 1, wherein the PEP key is used to encrypt information transmitted between the on-premises PEP and the ISP node.

7. The on-premises PEP of claim 1, wherein said subscriber premises includes a local area network, said on-premises PEP being a server connected to said local area network.

8. The on-premises PEP of claim 1, wherein said subscriber premises is a terminal associated with the plurality of subscribers.

9. A telecommunications system for conducting an Internet session by at least one subscriber using an Internet Service Provider, said system comprising:

a policy enforcement point of the Internet Service Provider, said policy enforcement point being housed within a subscriber premises associated with the at least one subscriber, said policy enforcement point including;

means for receiving a subscriber key from the at least one subscriber when the at least one subscriber initiates the Internet session, wherein the subscriber key is associated with a specific subscriber;

authentication means for utilizing the subscriber key to locally authenticate within the policy enforcement point, the at least one subscriber;

means for sending a policy enforcement point key to the Internet Service Provider for authentication of the policy enforcement point; and

policy enforcement means for authorizing the at least one subscriber to access services to which the subscriber subscribes while preventing the subscriber from accessing services to which the subscriber does not subscribe; and

an access node of the Internet Service Provider located outside of the subscriber premises, said access node including;

means for receiving the policy enforcement point key from the policy enforcement point; and

means for utilizing the policy enforcement point key to authenticate the policy enforcement point;

wherein the policy enforcement means within the policy enforcement point operates independently of the access node, to authenticate subscribers and enforce policies without communicating with the access node.

10. The telecommunications system of claim 9, wherein said policy enforcement point has a memory therein for storing a stored subscriber key for said at least one subscriber, said stored subscriber key being compared with said received subscriber key to authenticate said at least one subscriber.

11. The telecommunications system of claim 9, wherein said policy enforcement point includes an authorization database for storing authorization information associated with said at least one subscriber.

12. The telecommunications system of claim 11, wherein said policy enforcement point receives a request for service from said at least one subscriber and accesses said authorization database to determine whether said requested service is authorized using said authorization information, said Internet session being conducted when said requested service is authorized.

13. The telecommunications system of claim 9, wherein said policy enforcement point includes an accounting log for recording session information associated with said Internet session.

14. The telecommunications system of claim 13, wherein said session information comprises a start time a stop time and at least one requested service.

15. The telecommunications system of claim 9, wherein said subscriber key is used to encrypt information transmitted between said policy enforcement point and said at least one subscriber during said Internet session.

16. The telecommunications system of claim 9, wherein said policy enforcement point key is used to encrypt information transmitted between said policy enforcement point and said access node during said Internet session.

17. The telecommunications system of claim 9, wherein said subscriber premises includes a local area network, said policy enforcement point being a server connected to said local area network.

18. The telecommunications system of claim 9, wherein said subscriber premises is a terminal associated with said at least one subscriber.

19. The telecommunications system of claim 9, further comprising:

a policy decision point of said Internet Service Provider connected to the Internet and accessible by said policy enforcement point through said access node.

20. The telecommunications system of claim 19, wherein said policy enforcement point transmits said policy enforcement point key to said policy decision point to authenticate said policy enforcement point.

21. The telecommunications system of claim 19, wherein said policy enforcement point transmits said subscriber key to said policy decision point to authenticate said at least one subscriber when said at least one subscriber is visiting said subscriber premises.

22. The telecommunications system of claim 19, wherein said policy enforcement point transmits session information associated with said Internet session to said policy decision point upon completion of said Internet session.

23. The telecommunications system of claim 22, wherein said session information is encrypted using said policy enforcement point key, said encrypted session information being transmitted to said policy decision point.

24. A method of establishing an Internet session utilizing an Internet Service Provider (ISP), wherein a subscriber within a subscriber premises requests to establish the session, said method comprising the steps of:

transmitting a policy enforcement point (PEP) key from an on-premises PEP to an ISP access node located externally to the subscriber premises;

authenticating by the external access node, the on-premises PEP based on the received PEP key;

receiving at the on-premises PEP, a request to establish the session from at least one subscriber within the subscriber premises, said request including a subscriber key;

authenticating by the on-premises PEP, the at least one subscriber based on the received subscriber key without communicating with the external access node; and

upon successful authentication of the at least one subscriber, locally authorizing by the on-premises PEP, the at least one subscriber to access Internet services to which the subscriber subscribes while preventing the subscriber from accessing services to which the subscriber does not subscribe, said on-premises PEP operating independently of the external access node to authenticate subscribers and enforce policies without communicating with the external access node.

25. The method of claim 24, further comprising the step of:

encrypting information transmitted between the on-premises PEP and the external access node during said Internet session utilizing the PEP key.

26. The method of claim 24, wherein said step of authenticating said at least one subscriber includes the steps of:

storing within the on-premises PEP, a stored subscriber key for said at least one subscriber; and

comparing said stored subscriber key with said received subscriber key to authenticate said at least one subscriber.

27. The method of claim 24, further comprising the steps of:

storing within the on-premises PEP, authorization information associated with said at least one subscriber;

receiving at the on-premises PEP a request for service from said at least one subscriber; and

the on-premises PEP determining whether said requested service is authorized based on said authorization information, and if so, indicating that said Internet session can be conducted.

28. The method of claim 24, further comprising the step of:

during said Internet session, recording within an accounting log within the on-premises PEP, session information associated with said Internet session.

29. The method of claim 28, further comprising the step of:

upon completion of said Internet session, transmitting said session information from the on-premises PEP to a policy decision point of said Internet Service Provider connected to the Internet and located outside of said customer premises.

30. The method of claim 29, wherein said step of transmitting said session information further comprises the step of:

encrypting said session information using a PEP key.

31. The method of claim 24, further comprising:

determining by the on-premises PEP, that the received subscriber key is not found in a subscriber key database within the on-premises PEP;

transmitting the received subscriber key from the on-premises PEP to the external access node; and

authenticating the at least one subscriber by the external access node.

32. The method of claim 24, further comprising the step of:

encrypting information transmitted between the on-premises PEP and said at least one subscriber during said Internet session using said subscriber key.