Policy-based routing in a multi-homed computer

• US 7,970,931 B2
• Filed: 06/26/2008
• Issued: 06/28/2011
• Est. Priority Date: 06/26/2008
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Biao, Ventakaramaiah, Narasimhan Agrahara, Sridharan, Murari
• Primary Examiner(s): BOUTAH, ALINA A
• Application Number:
  US12/146,478
• Publication Number:
  US 20090323681A1
• Time in Patent Office: 1,097 Days
• Field of Search: 709/225, 709/239, 370/351, 726/1, 726/5
• US Class Current: 709/239
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/308 Route determination based on user's profile, e.g. premium users

Abstract

Policy-based routing system and method for a multi-homed computer. Policy-based routing permits or blocks usage of system level route(s) based on user credentials and/or network application(s) associated with a data transfer. The credentials can include information associated with an application, a user, and the like. Optionally, one or more filter(s) can be configured over classifiable field(s), such as credential(s), information associated with a determined proposed route, to statically permit/block route usage and/or to invoke an inspection module (e.g., custom inspection routine) when the filter condition(s) are met.

Claims

1. A computer-implemented system that facilitates policy-based routing, comprising:

a computer comprising a processing unit and a system memory, the computer further comprising;

a routing component that receives information associated with a user and information associated with an application associated with a data transfer and generates a route proposal; and

a policy enforcement component that determines whether the proposed route is permitted or blocked based on the information associated with the user, information associated with the application and a policy, wherein the policy is based on a subscription level associated with the user, and wherein the policy enforcement component provides information to the routing component as to whether the proposed route is permitted or blocked.

2. The system of claim 1, wherein if the proposed route is blocked, the policy enforcement component receives another proposed route from the routing component and the policy enforcement component determines whether the another proposed route is permitted or blocked based on the credentials and the policy.

3. The system of claim 2, wherein the policy enforcement component continues to receive proposed routes from the routing component until a permitted route is determined or available routes have been exhausted.

4. The system of claim 1, further comprising a filter that invokes an inspection module if a filter condition is met.

5. The system of claim 4, wherein the inspection module configures a network interface and a network connection on demand.

6. The system of claim 5, wherein the network connection is associated with a virtual private network.

7. The system of claim 5, wherein the network connection is based on a General Packet Radio Service.

8. The system of claim 4, wherein the filter condition comprises information associated with the proposed route.

9. The system of claim 1, wherein the stored policy is received from a computer remote from the system.

10. The system of claim 1, employed in a multi-homed computer.

11. The system of claim 1, employed in a Transmission Control Protocol/Internet Protocol stack.

12. The system of claim 1, wherein the information associated with a proposed route comprises at least one of a destination IP address, a destination interface, a transport protocol or a next hop IP address.

13. A computer-implemented method of policy-based routing, comprising:

receiving information associated with a user and information associated with an application a credential associated with a data transfer and information associated with a proposed route;

determining whether the proposed route is permitted, based on the information associated with the user, the information associated with the application and a policy, wherein the policy is based on a subscription level associated with the user; and

,

if the proposed first route is permitted, allowing the data transfer, wherein receiving the information associated with the user and information associated with the application associated with the data transfer and information associated with a proposed route and determining whether the proposed route is permitted, based on the credential and the policy is repeated until a permitted route is determined or available routes have been exhausted.

14. The method of claim 13, further comprising:

if the proposed route is not permitted, blocking the data transfer.

15. A computer-implemented method of policy-based routing, comprising:

using a computer system, receiving credentials associated with a data transfer and information associated with a proposed route, the credential comprising information associated with a user and information associated with an application;

determining whether a filter condition has been met;

invoking a custom inspection module, if the filter condition has been met, the custom inspection module resident on the computer system;

determining whether the proposed route is permitted, based on the credentials and a policy, if the filter condition has been met, wherein the policy is based on a subscription level associated with the user; and

blocking the data transfer, if the filter condition has not been met.

16. The method of claim 15, wherein the custom inspection module configures a network connection associated with the data transfer.

17. The method of claim 15, wherein the filter condition comprises of information associated with a user an and information associated with the proposed route.