|Publication number||US7237025 B1|
|Application number||US 10/038,982|
|Publication date||Jun 26, 2007|
|Filing date||Jan 4, 2002|
|Priority date||Jan 4, 2002|
|Publication number||038982, 10038982, US 7237025 B1, US 7237025B1, US-B1-7237025, US7237025 B1, US7237025B1|
|Inventors||Mark Albert, Robert M. Batz, Barron C. Housel, Wayne R. Roiger, Chris O'Rourke, Richard M. Pruss, Pranav K. Tiwari, Tzu-Ming Tsang|
|Original Assignee||Cisco Technology, Inc.|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (24), Non-Patent Citations (12), Referenced by (12), Classifications (11), Legal Events (3)|
|External Links: USPTO, USPTO Assignment, Espacenet|
The present invention relates in general to information transfer over a network and more particularly to a system, device, and method for communicating user identification information over a communications network.
Network interfaces known as Service Selection Gateways (SSGs) or Network Access Servers (NASS) terminate Layer 2 protocol connections from network users. Layer 2, or Data Link, information regards the procedures and protocols used to operate communications lines and may include information about network links such as bandwidth, latency, and utilization. The user connections may be of various types, including traditional Point-to-Point Protocol (PPP) over a dial-up connection, Point-to-Point Protocol over Ethernet (PPoE), Point-to-Point Protocol over Asynchronous Transfer Mode (ATM) (PPPoA), Point-to-Point Protocol over Ethernet over Ethernet (PPPoEoE), or other Layer 2 protocols such as GPRS Tunneling Protocol (GTP) that terminate in General Packet Radio Service (GPRS) nodes. In the traditional setting the SSGs handle user authentication and user Internet Protocol (IP) address assignment when a user logs on by using a RADIUS or other Authentication, Authorization, and Accounting (AAA) server. The SSG associates a user-ID with the IP address of that user and retains the user-ID—IP address mapping until the user logs off the network. When the user logs off the network, an “Accounting Stop” message is communicated to the AAA server, and the IP address is returned to an address pool of available addresses.
Network Service Providers (SPs) may locate some client-specific services at the edge of the network in a Point of Presence (POP) location. This enables client-specific services such as data content rating and filtering to be enabled and enforced as closely as possible to the client devices. A network interface, hereinafter referred to as a Client Services Gateway (CSG), exists “upstream” from the NAS within the POP and is operable to provide these types of client services. In order to provide client specific services in a POP, the CSG needs to associate a user-ID with a given client address in order to retrieve the user profile that specifies the services to be applied to a user request. Therefore, it is desirable to have a CSG recognize which incoming packets are associated with a given service.
From the foregoing, it may be appreciated by those skilled in the art that a need has arisen for a technique to provide client services closer to the location of users in a network. In accordance with the present invention, a system, device, and method for communicating user identification information in a communications network are provided that substantially eliminate or greatly reduce disadvantages and problems associated with conventional information transfer and processing techniques in a network.
According to an embodiment of the present invention, there is provided a system for exchanging user identification information over a communications network that includes a first network interface establishing a communications session with a network user. The network user has a network locator address within the network. A second network interface processes requests from the network user received during the communications session. The second network interface unit determines whether it has stored within its local memory an identity of the network user associated with the network locator address. If the identity of the network user is stored in the local memory for the network locator address, the second network interface obtains additional information associated with the network user. The second network interface then processes the request according to the additional information. If the identity of the network user is not stored in the local memory, the second network interface unit sends a query to the first network interface unit. The first network interface obtains the identity of the network user in response to the query for forwarding to the second network interface. The second network interface stores the identity of the network user in the local memory and associates it with the network locator address of the request. The second network interface can then obtain the additional information associated with the network user and process the request accordingly.
The present invention provides various technical advantages over conventional information transfer and processing techniques in a network. For example, one technical advantage is requiring only a single “sign on” from a network user, thus eliminating multiple challenges to provide a user-ID and password. Another technical advantage is to allow for multiple CSGs in the event that the SSG routes information requests to different CSGs. Yet another technical advantage is to allow “upstream” CSGs to unambiguously determine the user-ID for each network user IP address. Other technical advantages may be readily ascertainable by those skilled in the art from the following figures, description, and claims.
For a more complete understanding of the present invention and the advantages thereof, reference is now made to the following description taken in conjunction with the accompanying drawings, wherein like reference numerals represent like parts, in which:
The SP POP 140 contains a network interface known as a Network Access Server (NAS) 120 and hereinafter referred to as a Service Selection Gateway (SSG) 120. SSG 120 terminates Layer 2 protocol connections from user 102. One task typically performed by SSG 120 is identification of user 102 by verifying the user-ID and password provided by user 102. An additional task performed by SSG 120 is to assign an Internet Protocol (IP) address to user 102 when user 102 seeks to initiate communication on network 100. The SSG 120 is operable to retain user-ID and IP address information in memory until the user 102 terminates the communication.
An SP may move some user-specific services to the edge of the network 100 at POP 140 so that user-specific policies, such as data content rating and filtering, may be enabled and enforced as close as possible to user 102. A second network interface, hereinafter referred to as a Client Service Gateway (CSG) 130, exists “upstream” from the SSG 120 within the POP 140. In a communication network setting, an “upstream” interface is one in which data from a “downstream” interface passes on its way to or from the network 150 and servers 160. CSG 130 has stored in its memory or otherwise has access to a plurality of user-IDs and the services that are to be applied to an individual user-ID. CSG 130 is operable to associate a user-ID with a user IP address so that CSG 130 can retrieve the user profile stored in its memory that specifies the services to be applied as well as recognize which incoming data packets are associated with a request of a specific user 102.
An exemplary login sequence by user 102 is initiated by user 102 opening a data session with SSG 120. In a preferred embodiment of the present invention, the data session is a Point-to-Point Protocol (PPP) over a dial-up connection, or other form of communication such as Point-to-Point Protocol over Ethernet (PPoE), Point-to-Point over Asynchronous Transfer Mode (ATM) (PPoA), Point-to-Point Protocol over Ethernet over Ethernet (PPPoEoE), or GPRS Tunneling Protocol (GTP). Upon initiating the data session, user 102 sends a user-ID and password to SSG 120 for authentication as is shown in communication 210. SSG 120 responds to communication 210 from user 102 by querying an authentication server 240 with the user-ID and password of user 102 as is shown in communication 212. In a preferred embodiment of the present invention, authentication server 240 is a RADIUS authentication or other form of Authentication, Authorization, and Accounting (AAA) server 240. If the user-ID and password match what is stored in the memory of authentication server 240, authentication server 240 communicates that information to SSG 120 as shown in communication 214.
After SSG 120 has authenticated the user-ID and password, user 102 opens a data communication session at communication 216 SSG 120 establishes a link for the session to its portal, Service Selection Dashboard (SSD) 250 at communication 218. The session may be in any data format, but in a preferred embodiment of the present invention, such a data communication session would be a Hypertext Transfer Protocol (HTTP) data session. The SSD 250 is operable to perform this session and serves up a “dashboard” 250, as illustrated at communication 220. Communication 221 illustrates the receipt of this “dashboard” 250 by the user 102, as well as the “dashboard” 250 enabling a “service” with CSG 130 in the path.
Communication 222 illustrates user 102 making a request on this “service,” and the request is forwarded by SSG 120 to the CSG 130. As part of communication 222, the IP address of user 102 is provided. When the CSG 130 receives communication 222, it attempts to locate the IP address received from user 102 stored in a mapping table 233 and associated with a user-ID. If the CSG 130 is unable to locate a match of the IP address received from user 102 in memory, the CSG 130 issues a query at communication 224 to the SSG 120 that includes the IP address of user 102. SSG 120 is operable to respond to the query at communication 226 from CSG 130 by returning the user-ID that corresponds to the IP address of user 102. In a preferred embodiment of the present invention, the IP address of each SSG 120 is established along with the range of user IP addresses that can be allocated by that SSG 120. The CSG 130 is thus able to determine the appropriate SSG 120 to query by determining which SSG 120 is allocated the address range that contains the IP address of the unknown user.
Once the CSG 130 determines the appropriate SSG 120 to query, the CSG 130 sends a message to the SSG 120 containing the IP address as is illustrated by communication 224. In a preferred embodiment of the present invention, both the CSG 130 and SSG 120 communicate using the User Datagram Protocol (UDP) format. The SSG 120 responds by sending a message containing the IP address and the associated user-ID to the CSG 130. This is illustrated by communication 226. Upon receiving communication 226, the CSG 130 adds a new entry to a mapping table stored in memory. The mapping table allows CSG 130 to recognize which incoming packets are associated with a given service. In a preferred embodiment of the present invention, the mapping table stores entries in a <source IP address, user-ID> format. CSG 130 is then able to retrieve a user profile associated with the IP address and user-ID in order to apply appropriate services specified therein.
A second technique to ensure mapping validity is to define a minimum “keep alive” time interval for the mapping table entries stored in the memory of CSG 130. CSG 130 will issue a “keep alive” message to SSG 120 if the “keep alive” time interval expires and no other queries have succeeded. The CSG 130 executes the “keep alive” message by re-querying the SSG 120 with the IP address of one of the entries in the mapping table. If the mapping table stored in the memory of CSG 130 is empty (i.e., no users 102, 104 currently active) no “keep alive” message is sent. If CSG 130 does not receive a response from SSG 120 within a set period of time, for example twice the “keep alive” time interval, CSG 130 discards the entire mapping table from memory. In the event that SSG 120 resumes communication with CSG 130, CSG 130 issues queries to re-establish valid mappings. This technique is operable to resolve situations in which user logoff signals from SSG 120 are not properly communicated to CSG 130 due to network congestion or network failure. Similarly, periodic queries may be sent from CSG 130 to SSG 120 in order to validate mapping table 223.
A third technique is employed when SSG 120 ceases to function and then resumes communication. Upon restart SSG 120 communicates a multicast “restart” signal to all CSGs 130 with which SSG 120 is communicating. Each CSG 130 responds to the “restart” signal by voiding the entire mapping table stored in memory and re-querying SSG 120. The mapping tables in CSGs 130 are destroyed and reconstructed upon the failure of SSG 120, because it would be possible for users 102, 104 to logon again, possibly with different IP addresses, following the failure of SSG 120.
Thus, it is apparent that there has been provided, in accordance with the present invention, a system, device, and method for communicating user identification information over a communications network that satisfies the advantages set forth above. Although the present invention has been described with respect to network interfaces referred to as Service Selection Gateways (SSGs) and Client Service Gateways (CSGs) the present invention may equally apply to other network interfaces to permit exchanges of such information as user-ID and Internet Protocol (IP) address mappings. Moreover, although discussed in terms of HTTP requests between a user and a CSG, the present invention may be equally implemented in any network that utilizes user identification information. Other examples may be readily ascertainable by those skilled in the art and may be made herein without departing from the spirit and scope of the present invention as defined by the following claims.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US5602907||Aug 1, 1994||Feb 11, 1997||Fujitsu Limited||Method and system for accounting communication charges|
|US5822411||Jul 14, 1995||Oct 13, 1998||British Telecommunications Public Limited Company||Telecommunications charging|
|US5828737||Oct 24, 1995||Oct 27, 1998||Telefonaktiebolaget L M Ericsson||Communications service billing based on bandwidth use|
|US5909238||Jul 22, 1996||Jun 1, 1999||Canon Kabushiki Kaisha||Image transmission system with billing based on the kind of MPEG frame transmitted|
|US5946670||Oct 22, 1996||Aug 31, 1999||Fujitsu Limited||Data switching device and method of notifying charge information in data switching network|
|US5987498||Feb 16, 1996||Nov 16, 1999||Atcom, Inc.||Credit card operated computer on-line service communication system|
|US6016509||Jan 9, 1998||Jan 18, 2000||Intel Corporation||General purpose metering mechanism for distribution of electronic information|
|US6035281||Jun 16, 1997||Mar 7, 2000||International Business Machines Corporation||System and method of multiparty billing for Web access|
|US6122357 *||Apr 8, 1998||Sep 19, 2000||Bell Atlantic Network Services, Inc.||Providing enhanced services through double SIV and personal dial tone|
|US6141684||Sep 12, 1997||Oct 31, 2000||Nortel Networks Limited||Multimedia public communication services distribution method and apparatus with distribution of configuration files|
|US6167119 *||Jan 12, 1998||Dec 26, 2000||Bell Atlantic Network Services, Inc.||Providing enhanced services through SIV and personal dial tone|
|US6205472 *||Mar 17, 1999||Mar 20, 2001||Tacit Knowledge System, Inc.||Method and apparatus for querying a user knowledge profile|
|US6208977||Sep 10, 1999||Mar 27, 2001||Apogee Networks, Inc.||Accounting and billing based on network use|
|US6282573||Apr 19, 2000||Aug 28, 2001||Community Learning And Information Network||Computer architecture for managing courseware in a shared use operating environment|
|US6480485||Jan 14, 1997||Nov 12, 2002||Nokia Telecommunications Oy||Packet radio network with charging information collected by nodes and forwarded to billing center|
|US6611821||Sep 29, 1998||Aug 26, 2003||Alcatel||Method of charging for the use of an internet service plus a service control unit and a service provider unit|
|US6671675||Feb 26, 1997||Dec 30, 2003||Canon Kabushiki Kaisha||Metering the flow of electronic information|
|US6690918 *||Jan 5, 2001||Feb 10, 2004||Soundstarts, Inc.||Networking by matching profile information over a data packet-network and a local area network|
|US6728266||Dec 23, 1999||Apr 27, 2004||Nortel Networks Limited||Pricing mechanism for resource control in a communications network|
|US6757371||Oct 23, 2002||Jun 29, 2004||Ktfreetel Co., Ltd.||Method for divisional billing and device thereof|
|US6950505 *||Nov 30, 2001||Sep 27, 2005||Care Monitoring 2000 Limited||Monitoring system|
|US20010023428||Dec 21, 2000||Sep 20, 2001||Tomiya Miyazaki||Data Terminal, data distribution system, and internet telephone system|
|US20020029267 *||Apr 4, 2001||Mar 7, 2002||Subhash Sankuratripati||Target information generation and ad server|
|US20020138601||Sep 21, 2001||Sep 26, 2002||Nixu Oy||Proxy for content service|
|1||A. Herzberg, "Safeguarding Digital Library Contents: Charging for Online Content," D-Lib Magazine, NDN 174-0590-9051-8, 16 pgs., Jan. 1998.|
|2||Business Wire, "Apogee Networks Announces Investment by Cisco Systems; Combined Efforts Enhance Billing Capabilities for Content Delivery Network Providers," NDN 219-0220-9035-0, 2 pgs., Jan. 23, 2001.|
|3||Business Wire, "Apogee Networks Introduces Industry's First Content Usage-Based Billing Solution for Web Hosters," NDN 219-0281-6988-1, 2 pgs., May 8, 2001.|
|4||Business Wire, "Apogee Networks Joins Content Alliance; Billing Expert to Join Industry Group Aimed At Advancing Content Networking," NDN 218-0181-2716-7, 3 pgs., Oct. 11, 2000.|
|5||Business Wire, "Apogee Networks Unveils NetCountant Wireless Billing At SUPERCOMM; Company Demonstrates Industry First Wireless Content Usage Based Billing Solution," NDN 218-0324-8075-6, 2 pgs., Jun. 5, 2001.|
|6||Business Wire, "Apogee Networks Wins 2000 Communications ASP Product of the Year Award; Apogee Networks' NetCountant Billing Takes Top Honors for Innovative Content Usage Based Billing Solutions," NDN 218-0282-3757-7, 2 pgs., Mar. 21, 2001.|
|7||Business Wire, "Apogee Networks, Inc. and Paysys International, Inc. to Integrate Technologies to Create Advanced IP Content Billing Solutions," NDN 218-0098-0623-9, 3 pgs., Jun. 19, 2000.|
|8||Business Wire, "Key Analysts Predict Content Billing is the Internet's New Frontier; Content is the Asset of the Industry; Apogee Networks Seen as the Leader in New Internet Industry Space," NDN 219-0162-6934-6, 3 pgs., Oct. 10, 2000.|
|9||Business Wire, "Wireless Internet Content Billing and Settlement Capability Announced; Companies Announce Interoperability Between WAP Gateway and Content Billing System," NDN 218-0220-0997-2, 2 pgs., Dec. 6, 2000.|
|10||Centaur Communications, "Secret Bear platform allows paid-for SMS Annotated Title-Secret Bear introduced cross-network reverse billing platform allowing content providers to charge for SMS content," New Media Age, NDN 173-0354-6130-3, 1 pg., Jun. 28, 2001.|
|11||Karsten Lüttge, "E-Charging API: Outsource Charging to a Payment Service Provider," NDN 174-0708-0924-8, pp. 216-227, 2001.|
|12||Online Inc., "Apogee Releases Content Usage-Based Billing Product Annotated Title-Software allows content usage-based billing," EContent, vol. 24, No. 5, NDN 173-0356-6509-7, 1 pg., Jul. 2001.|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7464148 *||Jan 30, 2004||Dec 9, 2008||Juniper Networks, Inc.||Network single entry point for subscriber management|
|US7620723 *||Jan 3, 2005||Nov 17, 2009||Green Packet, Inc.||Network management|
|US8107472||Nov 6, 2008||Jan 31, 2012||Juniper Networks, Inc.||Network single entry point for subscriber management|
|US9112843 *||Sep 9, 2010||Aug 18, 2015||Zte Corporation||Method and system for subscriber to log in internet content provider (ICP) website in identity/location separation network and login device thereof|
|US20070271396 *||Jan 3, 2005||Nov 22, 2007||Liangsheng Chen||Network Management|
|US20080242355 *||Mar 25, 2008||Oct 2, 2008||Sk Telecom Co., Ltd.||Mobile terminal with user identification card including personal finance-related information and method of using a value-added mobile service through said mobile terminal|
|US20080319858 *||Jun 16, 2008||Dec 25, 2008||Denk Jr William E||Automated system to determine, store, and share the relevance of information, and to assign trust to that information|
|US20100257027 *||Jul 23, 2008||Oct 7, 2010||Fio Corporation||Method and system for collating, storing, analyzing and enabling access to collected and analyzed data associated with biological and environmental test subjects|
|US20110173052 *||Jul 14, 2011||Bank Of America Corporation||Enhanced Knowledge Management|
|US20120180114 *||Sep 9, 2010||Jul 12, 2012||Bing Huang||Method and System for Subscriber to Log in Internet Content Provider (ICP) Website in Identity/Location Separation Network and Login Device Thereof|
|US20130166763 *||Sep 7, 2010||Jun 27, 2013||Nokia Siemens Networks Oy||Method and network devices for selecting between private addresses and public addresses within a user session|
|US20150381739 *||Feb 13, 2014||Dec 31, 2015||Hangzhou H3C Technologies Co., Ltd.||Network session control|
|U.S. Classification||709/225, 709/227, 709/217, 709/229|
|Cooperative Classification||H04L63/0815, H04L61/1541, H04L29/12113|
|European Classification||H04L61/15C, H04L63/08B, H04L29/12A2C|
|Jan 4, 2002||AS||Assignment|
Owner name: CISCO TECHNOLOGY, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:ALBERT, MARK;BATZ, ROBERT M.;HOUSEL, BARRON C.;AND OTHERS;REEL/FRAME:012460/0257;SIGNING DATES FROM 20011220 TO 20020103
|Dec 27, 2010||FPAY||Fee payment|
Year of fee payment: 4
|Dec 26, 2014||FPAY||Fee payment|
Year of fee payment: 8