Patent Application
20090157852
The invention relates to the transmission of data over communications networks. More specifically, the invention relates to managing services and accounting for services for subscribers in a network.
With the growing popularity of the Internet and the World Wide Web, the volume of traffic over networks has substantially increased. As a result, the need for maintaining an efficient flow of information over data communication networks has become increasingly important. Due to the inherent limitations of network infrastructures, network bandwidth (a measure of the capacity of a communications channel) is limited. Network providers pay for network utilization, and, consequently, pass at least some of these costs on to their subscribers. Typically, subscribers of network services utilize a myriad of applications and receive a variety of services over networks. For example, subscribers may run real-time applications such as, but not limited to, Video On Demand (VOD), Voice over Internet Protocol (VoIP), Walled Garden, Premium Data, and etc. VOD is a technology where users can demand a selected video, such as a movie, be played over the network. Similarly, VoIP is a technology used to transmit voice conversations over a data networks using an Internet Protocol. These technologies require a router or other network element to provide the services to subscribers over a network, such as a data network. Typically, real-time applications such as VOD and VoIP involve transmitting and receiving IP packets that require relatively large bandwidth, short latency jitter, and a reasonably small data loss ratio.
Often subscribers want a certain bandwidth and connection rate to run their applications. In order to guarantee a certain connection and data rate, service providers provide levels of “Quality of Service” (QoS) which is a generic term used for expressing the measuring and maintaining of the quality of a network channel. QoS involves the idea that transmission rates, error rates, and other characteristics of quality of a network can be measured, improved, and, to some extent, guaranteed in advance. One problem that has arisen is that, since service providers charge a fee for bandwidth utilization, subscribers often pay different amounts for different levels or classes of services. Providing accounting for these different levels of QoS for each subscriber can often lead to difficult and complex problems configuring and managing both the services themselves as well as the accounting for those services for each subscriber.
One solution has been to establish support for services and accounting for services within the network element (e.g., a bridge or router) that receives individual subscriber records containing information for each subscriber from a remote server (e.g., through remote authentication dial-in user service or Radius). To do this requires configuring a set of internal network attributes within the network element to provide support for services and accounting for services. These internal network element attributes include such things as port descriptions, network interfaces, data rate, volume limit, other traffic policies, and so on. The network attributes are used for configuring the network element for services and accounting for services. As such, these attributes are subscriber-specific depending on the subscriber's level of service, and must be configured on a per-subscriber basis. Unfortunately, as the number and types of services has increased over time, so has the number and complexity of the network attributes that must be configured within the network element. Thus, service management has become a difficult task because of the complex internal network element attributes required to configure services and accounting for services for each subscriber. Additionally, the attributes are exposed to network server administrators who must manage the associated subscriber databases at the server. As a result, administrators have to understand the complex internal attributes of the network element as well as all the interdependencies between the complex internal attributes to properly configure services and accounting for services for each subscriber on the network element. This problem is compounded when a subscriber requires a change in services or deactivation of services. Change of services and/or deactivation of services involves the update to numerous internal attributes and their interdependent attributes. This component is increasingly complex and prone to human error.
Additionally, the server must store all the internal network element attributes and must pass them to the network element using messaging over the network. Consequently, the size and frequency of messages that must be passed between the server and the network element which manages subscriber access to services is becoming increasingly large and the processing logic is becoming increasingly complex.
For example,
In order to configure the network to support services and accounting for services, Radius server 125 sends a set of complex Radius service attributes 126 contained within a subscriber record of subscriber records 129 corresponding to the subscriber who requires activation and/or deactivation of services. For example, there may be an activation or deactivation request initiated by the subscriber that causes the network to be reconfigured for that particular subscriber. In such a case, the subscriber's records located in subscriber records 129 are updated and sent as Radius service attributes 126 to the network element so that the services can be configured/re-configured. These Radius service attributes 126 are received at AAA component 122 and stored into the local per-subscriber memory 155 corresponding to the local configuration file, local config file_0 associated with the subscriber requiring a change of services.
The Radius service attributes 126 are the same attributes as the complex internal attributes stored in the local per-subscriber memory 155 for each subscriber. That is, the Radius service attributes 126 are copied directly from subscriber records 129 and stored into the local per-subscriber memory 155 of local config file_0. The Radius service attributes 126 are complex subscriber-specific attributes to configure services within network element 101. These are the internal attributes required to provide the level of services for the corresponding subscriber on the network. However, as discussed above, when the level and quantity of services offered by service providers increases, so does the amount and complexity of these internal network element attributes contained within the attribute list maintained within AAA component 122. These complex attributes must be configured by administrators (not shown) at Radius server 125. Radius server 125 includes a set of subscriber records 129 corresponding to each subscriber currently subscribed to the network. Subscriber records 129 include various strings used by network administrators to configure the services and accounting for services in network element 101. For example, subscriber records 129 includes strings of attribute names and attribute values such as IP-filter, rate limit, and many others including vendor specific attributes. In order to provide support for services and accounting for services, the administrators at server 125 must configure subscriber records 129 to provide the appropriate internal attributes to the network element such as network element 101. As a result, the administrators must be well-versed in the internal attributes of the network element. Moreover, when a subscriber changes his or her service level or requests additional or different services, subscriber records 129 must be re-configured. As discussed above, the complexity and interdependency of configuring subscriber services and accounting for services in this way is inefficient and prone to human error.
Methods, machine-readable media, and apparatuses for configuring a network element to provide services to a plurality of subscribers are described. In one embodiment, a set of one or more service attributes are received from a server and used to dynamically generate internal network attributes, the internal network attributes being used to configure the network element to provide network services and accounting for services for subscribers.
A better understanding of the present invention can be obtained from the following detailed description in conjunction with the following drawings, in which:
Throughout the description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced without some of these specific details. In other instances, well-known structures and devices are shown in block diagram form to avoid obscuring the underlying principles of embodiments of the present invention.
A flexible/scalable method and apparatus for dynamic subscriber service configuration and management is described. Prior art systems do not dynamically convert simple network attributes from a server, such as a Radius server, into complex internal attributes. In order to configure a network for services and accounting for services, prior art systems required passing complex attributes from the Radius server to the network element. Many of these prior art attributes, however, are overly complicated and interdependent, and must be configured by network administrators (users) at the server resulting in inefficiency and human error. At least certain embodiments provide a method, computer-readable medium, and apparatus to dynamically generate a set of one or more internal network attributes based on simple service attributes received from a server. This reduces the complexity of the attributes stored at the server and reduces network processing and message passing over the network.
In
AAA component 122 of control card 123 performs the three primary services required by a Radius server such as Radius Server 125. All authentication, authorization, and accounting are performed by AAA component 122. Essentially, an AAA handles user requests for access to network resources and provides authentication, authorization and accounting services. The AAA component typically interacts with network access and gateway servers and with databases and directories containing user information. The user information may include a particular subscriber's bandwidth utilization, network traffic volume limits, and other user-specific information. Authentication, authorization, and accounting is a term for a framework for intelligently controlling access to network resources, enforcing policies, auditing usage, and providing information necessary to bill for services. These combined processes are considered information for effective network management and security. Authentication is essentially proving who you are. That is, authentication provides a way of identifying a user, typically by having the user enter a valid username and password before access is granted. The process of authentication is based on each user having a unique set of criteria for gaining access. The AAA component compares a user's authentication credentials with the credentials stored in a database. If the credentials match, the user is granted access to the network. If the credentials don't match, authentication fails and network access is denied. Following authentication, a user must gain authorization for doing certain tasks. Authorization is defining what a subscriber is and is not allowed to do. After logging into a system, for example, the user may try to issue commands. The authorization process determines whether the user has the authority to issue such commands. In this way, authorization is the component of enforcing policies and determining what types or qualities of activities, resources, or services a user is permitted. Usually, authorization occurs within the context of authentication. Once you have authenticated a user, they may be authorized for different types of access or activity. Finally, accounting measures the resources a user consumes during the access. This can include the amount of system time and the amount of data a user has sent and/or received during a session. Accounting is carried out by logging session statistics and usage information and is typically used for authorization control, billing, trend analysis, resource utilization, and/or capacity planning activities.
The Radius non-substitutable service attributes 242, on the other hand, are complex and are the same as Radius service attributes 126 described above with respect to
AAA component 122 is the component at the interface with Radius server 125 and is responsible for the communication between the Radius server 125 and the network element. AAA component 122 includes dynamic attribute generator 203, which further includes service profile template 205 and service profile parser 235. The service profile template 205 includes a plurality of service profiles maintained in template format within the AAA component 122. Service profiles within service profile templates 205 include, for example, a service profile such as service profile 287. In certain embodiments, the service profiles such as service profile 287 correspond to a particular network service or services to be configured on the network element. Service profiles such as service profile 287, in at least certain embodiments, provide a master placeholder to store service information associated with the service or services to be configured on the network element. For example, a service profile may contain service information such as the profile name, dynamic service attributes, and, optionally, service parameters This service information is not visible to the administrators at the server 125 because, under the principles of the invention, the only information the network administrators at server 125 need to be aware of is the simple Radius substitutable service attributes 241. These simple attributes are configured at the server 125. The rest of the service-related information is dynamically generated within the network element.
In the example of service profile 287, the profile name is “service 1” 211 which corresponds to the service-name, “service 1” 212 of Radius substitutable service attributes 241 sent from server 125. Service profile 287 also includes dynamic service attributes such as dynamic service attribute_A 281 and dynamic service attribute_B 283. Each of the dynamic service attributes, in at least certain embodiments, may be configured to receive service parameters from server 125. In this example, dynamic service attribute_A 281 is configured to receive service parameter_A 282 corresponding to parameter_A 213 of the received Radius substitutable service attributes 241, and dynamic service attribute_B 283 is configured to receive service parameter_B 284 corresponding to parameter_B 214 of the received Radius substitutable service attributes 241. It should be noted that this is given by way of example and not limitation. The dynamic service attributes within a service profile may be configured to receive more or fewer service parameters passed from server 125.
Service profile 287 further includes, in at least certain embodiments, predefined attributes such as predefined attribute_A 291 and predefined attribute_B 292. Predefined attribute_A 291 and predefined attribute_B 292 are static service attributes which are associated with the service or services to be provided. The term static means that the predefined attributes, such as predefined attribute_A 291 and predefined attribute_B 292, are provided to configure the network for services without dynamic generation. Thus, server administrators (users) have the option of including a set of predefined static internal attributes such as predefined attribute_A 291 and predefined attribute_B 292 along with the dynamic service attributes such as dynamic service attribute_A 281 and dynamic service attribute_B 283 for each service profile of service profile templates 205. Whenever a service profile such as service profile 287 of service profile templates 205 is accessed, the associated predefined attributes in one embodiment may be used in conjunction with the dynamic service attributes to configure services and accounting for services for subscribers on the network element.
Whenever a subscriber on the network activates/deactivates services, these services must be configured on the network element. Service profile template 205 supports a template configuration with user-defined parameters. In operation, Radius substitutable service attributes 241 and Radius non-substitutable service attributes 242 are configured by network administrators at server 125 for each subscriber. This information is stored in the subscriber record of subscriber records 129 for each subscriber. The Radius substitutable service attributes 241 are simple user-friendly attributes which, in at least certain embodiments, are used to dynamically generate a set of complex internal attributes to configure the network element for services. The Radius non-substitutable service attributes 242, on the other hand, are complex and are the same attributes as the complex Radius service attributes 126 of prior art
The service information contained within the service profile, including the dynamic service attributes, the parameter values, and the predefined attributes, is passed back to the profile access component 236 over line 245. The profile access component 236 then passes the dynamic service attributes and corresponding parameter values to the service parameter expander component 238 over line 247. The service parameter expander component 238 receives the dynamic service attributes and corresponding parameter values and dynamically generates a set of internal attributes for configuring the network element for services and accounting for services based on these attributes. This generating includes substituting the parameter values into the appropriate locations within the received dynamic service attributes. The value of parameter_A 282, therefore, is substituted into the appropriate locations within dynamic service attribute_A 281, and the value of parameter_B 284 is substituted into the appropriate locations within dynamic service attribute_B 283. In at least certain embodiments, the parameter values, such as parameter_A 282 and parameter_B 284 are converted into the data type of the particular dynamic service attribute. For example, in embodiments where the dynamic service parameters are integers, the parameter values are converted into integers. In other embodiments where the dynamic service parameters are strings, the parameter values are converted to string data types and placed appropriately within the string. It should be noted, however, that although the invention is discussed with respect to integers and strings, the invention is not limited to these data types as other data types such as tagged strings, real and/or complex numbers, and so on are contemplated and are within the scope of the invention. In at least one embodiment, once the values of the parameters have been converted to the appropriate data type and placed within the appropriate locations within the dynamic service attributes, the dynamic generation of the internal attributes for configuring services and accounting for services on the network element is complete. The generated internal attributes are then passed to and stored in the local per-subscriber memory 255 over line 248. Local per-subscriber memory 255 is the same as local per-subscriber memory 155 of
The predefined attributes, such as predefined attribute_A 291 and predefined attribute_B 292, which were also passed back to the profile access component 236, however, do not get routed to the service parameter expander 238. Rather, since the predefined attributes are already in complex internal attribute format, they do not need to go through the dynamic generation process. As such, the predefined attributes are passed over line 246 and stored directly into the local per-subscriber memory 255.
In this manner, the service profiles of service profile templates 205 are used in conjunction with the service profile parser 235 to invoke service profiles, to expand Radius substitutable service attributes, and to store complex internal attributes into the local per-subscriber memory 255 for each subscriber. In so doing, the service profile templates 205 provide an easy and convenient way for network administrators to configure services and accounting for services for subscribers on the network. The service parameters may be optional or mandatory. If a mandatory service parameter is missing, an error message will be generated and sent back to server 125. If an optional service parameter is missing, a default value will be applied and no error message will be generated. Using the dynamic attribute generation of this invention, the internal subscriber records associated with each subscriber will be configured with the correct attributes for providing support for services and accounting for services. Radius substitutable attributes 241, therefore, are received from Radius server 125 in order to configure the network element, such as network element 101 of
Using such a system, customers can enable multiple services within a single subscriber session. Services can be activated and/or deactivated dynamically and independently through Radius messages, such as Radius substitutable service attributes 241. Whenever a subscriber desires a change in the level of service, Radius substitutable service attributes 241 are configured within Radius server 125 and passed to AAA component 122 to be stored within the service profile template 205. After receiving Radius substitutable service attributes 241, the service parameter expander component 238 of service profile parser 235 substitutes the parameter value in the service profile template 205 with the values received from Radius server 125, and forms a set of complex internal attributes to configure services and accounting for services for subscribers.
In one embodiment, new commands are added to the command line interface (CLI) for configuring the service profile templates, such as service profile templates 205. A CLI is a user interface to a computer's operating system or an application in which the user responds to a visual prompt by typing in a command on a specified line, receives a response back from the system, and then enters another command, and so forth. Service profiles of service profile templates 205 facilitate a template configuration for various AAA internal attributes and are place holders for the service parameters received from Radius server 125. The substituted Radius attributes within service profile template 205 include attributes which are simple and used to dynamically activate and/or deactivate the services with the parameters supplied from the Radius server 125 via these Radius substitutable service attributes 241. In this way, service configuration and management is simplified by supporting a template configuration with user-defined parameters and abstracting the complex attributes with simple (substitutable) ones.
Additionally, this abstracting leads to a reduced amount of required attributes which were previously located in the subscriber records 129 at Radius server 125. As discussed above, these internal attributes are not visible to the Radius server 125 allowing reduced message passing and processing at the Radius server. Essentially, the complex and interdependent attributes required to configure a network element for services, are carried on by the network element, such as network element 101 of
Likewise, when internal attributes stored within local per-subscriber memory 255 are passed back to Radius server 125 as messages from the network element, such as network element 101 of
Also, when configuring services and/or accounting for services, the server 125 sends the Radius attributes (which includes both Radius substitutable service attributes 241 and Radius non-substitutable service attributes 242 of
Feature managers 140 include components running within the control card of the network element, such as network element 101 of
In this manner, services are deactivated dynamically using the simple Radius attributes, which are used to identify a set of complex and interdependent internal attributes configured on components of the network element. Radius Service attributes such as activate-service name and deactivate-service name may be sent to the network element in order to activate and/or deactivate services respectively. Thus, Radius-based policy functionality is now performed within a network element, such as network element 101 of
Embodiments of the invention may include various operations as set forth above. The operations may be embodied in machine-executable instructions which cause a general-purpose or special-purpose processor to perform certain operations. Alternatively, these operations may be performed by specific hardware components that contain hardwired logic for performing the operations, or by any combination of programmed computer components and custom hardware components.
Various changes may be made in the structure and embodiments shown herein without departing from the concept of the invention. Further, features of the embodiments shown in various figures may be employed in combination with embodiments shown in other figures. Accordingly, the scope and spirit of the invention should be judged in terms of the claims which follow as well as the legal equivalents thereof.
References in the specification to “one embodiment,” “an embodiment,” “an example embodiment,” etc., indicate that the embodiment described may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. When a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to effect such a feature, structure, or characteristic in connection with other embodiments whether or not explicitly described. Various changes may be made in the structure and embodiments shown herein without departing from the principles of the invention. Further, features of the embodiments shown in various figures may be employed in combination with embodiments shown in other figures.
In the description as set forth above and claims, the terms “coupled” and “connected,” along with their derivatives, may be used. It should be understood that these terms are not intended to be synonymous with each other. Rather, in particular embodiments, “connected” is used to indicate that two or more elements are in direct physical or electrical contact with each other. “Coupled” may mean that two or more elements are in direct physical or electrical contact. However, “coupled” may also mean that two or more elements are not in direct contact with each other, but yet still co-operate or interact with each other.
Some portions of the detailed description as set forth above are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of operations leading to a desired result. The operations are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.
It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the discussion as set forth above, it is appreciated that throughout the description, discussions utilizing terms such as “processing” or “computing” or “calculating” or “determining” or “displaying” or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.
The invention also relates to apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored or transmitted in a machine-readable medium, such as, but is not limited to, a machine-readable storage medium (e.g., any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMS, EEPROMS, flash memory, magnetic or optical cards, or any type of media suitable for storing electronic instructions), or a machine-readable transmission medium such as, but not limited to, any type of electrical, optical, acoustical or other form of propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.).
The algorithms and displays presented herein are not inherently related to any particular computer system or other apparatus. Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatuses to perform the method operations. The structure for a variety of these systems appears from the description above. In addition, the invention is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the invention as described herein.
Embodiments of the invention may include various operations as set forth above or fewer operations or more operations or operations in an order which is different from the order described herein. The operations may be embodied in machine-executable instructions which cause a general-purpose or special-purpose processor to perform certain operations. Alternatively, these operations may be performed by specific hardware components that contain hardwired logic for performing the operations, or by any combination of programmed computer components and custom hardware components.
Throughout the foregoing description, for the purposes of explanation, numerous specific details were set forth in order to provide a thorough understanding of the invention. It will be apparent, however, to one skilled in the art that the invention may be practiced without some of these specific details. Accordingly, the scope and spirit of the invention should be judged in terms of the claims which follow as well as the legal equivalents thereof.
