Managing hierarchically organized subscriber profiles

• US 7,869,361 B2
• Filed: 08/30/2008
• Issued: 01/11/2011
• Est. Priority Date: 11/18/2004
• Status: Expired due to Fees

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Desai, Sachin S., Sargor, Chandramouli, Lemarchand, Francois, Khetawat, Amit K., Balay, Rajesh I.
• Primary Examiner(s): Ryman; Daniel J
• Assistant Examiner(s): Divecha; Nishant B
• Application Number:
  US12/202,232
• Publication Number:
  US 20090007228A1
• Time in Patent Office: 864 Days
• Field of Search: None
• US Class Current: 370/233
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Apparatus are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a router includes a subscriber manager, a database and a virtual interface. The subscriber manager is operable to receive a connection request from a subscriber of a service provider. The database has stored therein hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers. The virtual interface defines a subscriber connection between the router and the subscriber and is created and configured responsive to the connection request based on a first-level profile identifier that is associated with the subscriber.

Claims

1. A virtual router (VR) based telecommunications apparatus comprising:

a storage device having embodied therein instructions, which when executed, implement within a VR of the VR-based telecommunications apparatus a subscriber manager, a profile manager, a policy engine and a virtual interface; and

one or more processors coupled to the storage device configured to execute the instructions, where each of a plurality of service contexts available to subscribers of a service provider are defined in terms of one or more profile identifiers of a plurality of profile identifiers each of which is representative of a particular subscriber service supported by the service provider;

the policy engine maintains a scalable subscriber profile database in which a memory requirement for the scalable subscriber profile database is dependent upon a number of available service contexts by hierarchically organizing the plurality of profile identifiers as intermediate profile identifiers and leaf profile identifiers, wherein the leaf profile identifiers explicitly define subscriber services and the intermediate profile identifiers indirectly represent sets of one or more subscriber services, which are defined by way of the intermediate profile identifiers'"'"' associations with one or more lower-level identifiers including zero or more of the leaf profile identifiers and zero or more of the intermediate profile identifiers;

the scalable subscriber profile database is distributed between an authentication system of the service provider and a plurality of virtual routers (VRs), wherein a first portion of the scalable subscriber profile database is stored within the authentication system, the first portion of the scalable subscriber profile database including information indicative of associations among the subscribers and corresponding first-level profile identifiers representing a subset of the intermediate profile identifiers and a second portion of the scalable subscriber profile database is stored within the profile manager operable within each of the plurality of VRs, the second portion including information indicative of the associations among the subset of intermediate profile identifiers and the one or more lower-level identifiers;

the subscriber manager receives a connection request from a subscriber of the plurality of subscribers and an intermediate profile identifier associated with the connection request and configures the virtual interface in accordance with a subscriber connection service for the subscriber;

responsive to a request from the subscriber manager, the profile manager returns information regarding the subscriber connection service for the subscriber by returning to the subscriber the one or more lower-level profile identifiers associated with the intermediate profile identifier, wherein returning the information regarding the subscriber connection service includes requesting, from the first portion of the scalable profile database, the first-level profile identifier and requesting, from the second portion of the scalable profile database, the one or more lower-level profile identifiers associated with the first level profile identifier; and

the virtual interface applies the subscriber connection service to data packets received from the subscriber.

2. The apparatus of claim 1, wherein the subscriber connection service is selected from a group consisting of a firewall, a quality of service (QoS), a virtual private network and a virus protector.

3. The apparatus of claim 1, wherein the policy engine also includes a virtual interface database to store a virtual interface identifier in a first field and the first profile identifier in a second field.

4. A router comprising:

a storage device having embodied therein instructions, which when executed, implement within each of a plurality of virtual routers of the router a subscriber manager, a scalable subscriber profile database and a virtual interface; and

one or more processors coupled to the storage device configured to execute the instructions, where each of a plurality of service contexts available to subscribers of a service provider are defined in terms of one or more profile identifiers of a plurality of profile identifiers each of which is representative of a particular subscriber service supported by the service provider;

a memory requirement for the scalable subscriber profile database is dependent upon a number of available service contexts by hierarchically organizing the plurality of profile identifiers as intermediate profile identifiers and leaf profile identifiers, wherein the leaf profile identifiers explicitly define subscriber services and the intermediate profile identifiers indirectly represent sets of one or more subscriber services, which are defined by way of the intermediate profile identifiers'"'"' associations with one or more lower-level identifiers including zero or more of the leaf profile identifiers and zero or more of the intermediate profile identifiers;

the scalable subscriber profile database is distributed between an authentication system of the service provider and the plurality of virtual routers (VRs), wherein a first portion of the scalable subscriber profile database is stored within the authentication system, the first portion of the scalable subscriber profile database including information indicative of associations among the subscribers and corresponding first-level profile identifiers representing a subset of the intermediate profile identifiers and a second portion of the scalable subscriber profile database is stored within a profile manager operable within each of the plurality of VRs, the second portion including information indicative of the associations among the subset of intermediate profile identifiers and the one or more lower-level identifiers;

the subscriber manager is configured to receive from a subscriber of the service provider a connection request;

responsive to the subscriber connection request, determining, by the subscriber manager, the subscriber'"'"'s service context based on the first-level profile identifier associated with the subscriber and the scalable subscriber profile database, wherein determining the service context includes requesting, from the first portion of the scalable profile database, the first-level profile identifier and requesting, from the second portion of the scalable profile database, the one or more lower-level profile identifiers associated with the first level profile identifier; and

the virtual interface, defines a subscriber connection between the router and the subscriber, the virtual interface is created and configured responsive to the connection request based on the first-level profile identifier of the intermediate profile identifiers that is associated with the subscriber.

5. The router of claim 4, wherein the connection request comprises a point-to-point protocol request.

6. The router of claim 4, wherein the connection request comprises a user activation over a shared medium in an advanced subscriber management system.

7. The router of claim 4, wherein the connection request includes subscriber authentication information.

8. The router of claim 7, wherein the subscriber manager is further configured to:

transmit an authorization request to a Remote Authentication Dial-In User Service (RADIUS) server; and

responsive to the authorization request, receive from the RADIUS server an authorization response including the first-level profile identifier and a host identifier indicating where lower-level profile identifiers associated with the first-level profile identifier are stored or indicating a virtual router of the plurality of virtual routers configured within the router from which the subscriber can receive service.

9. The router of claim 4, wherein creation and configuration of the virtual interface includes acquiring one or more lower-level profile identifiers associated with the first-level profile identifier.

10. The router of claim 9, further comprising a policy engine and wherein the one or more lower-level profile identifiers are acquired from the policy engine.

11. The router of claim 9, wherein the one or more lower-level profile identifiers are acquired from a Remote Authentication Dial-In User Service (RADIUS) server.