Granted Patent B2

US 7,921,457 · App. 12/132,583 · Granted Apr 5, 2011

Abstract

Claims (44)

1. A method of distributed subscriber management in a data network, the method comprising:

receiving, at an integrated access device interposed between a plurality of user networks and an access network, data units from said plurality of user networks;

authenticating, at said integrated access device, user data received from said plurality of user networks, by means of a plurality of shared authentication clients residing in said integrated access device, prior to transmitting said user data through said access network;

allocating, by said integrated access device, discrete bandwidth levels to individual user networks from among said plurality of user networks;

enforcing, by said integrated access device, said discrete bandwidth levels;

collecting, by said integrated access device, statistics on traffic traversing said access network; and

controlling access between said user networks.

2. The method of claim 1 further comprising sending from said integrated access device at least one of said data units through said access network to an authentication server associated with an external network from among a plurality of external networks.

3. The method of claim 2 further comprising a step of encrypting said at least one of said data units prior to said transmitting.

4. The method of claim 2 further comprising using a Remote Authentication Dial-In User Service (RADIUS) protocol for communication between said authentication clients and said authentication server.

5. The method of claim 2 further comprising a step of receiving, at said integrated access device, from said authentication server, authentication information via said access network.

6. The method of claim 5 further comprising employing a memory device for storing said authentication information.

7. The method of claim 6 further comprising:

receiving access control information from any of data devices;

determining availability of relevant authentication information, in said memory device, pertinent to said access control information; and

communicating with a respective authentication server from among a plurality of authentication servers for acquiring authentication information corresponding to said access control information, subject to unavailability of said relevant authentication information in said memory device.

8. The method of claim 7 , further comprising employing, by said plurality of authentication clients, at least one of:

a password authentication protocol client;

a challenge handshake authentication protocol client;

a terminal-access controller-access control system client; and

a remote authentication dial-in user service protocol client.

9. The method of claim 7 further comprising using shared secret codes for secure communications between said integrated access device and said plurality of authentication servers.

10. The method of claim 1 further comprising using said statistics to ascertain compliance with preset service levels.

11. The method of claim 10 wherein said statistics comprise session durations and amounts of data authorized by said integrated access device.

12. The method of claim 1 further comprising a step of prompting a user initiating a connection session, from a user network, to provide access control information, wherein said prompting is issued according to at least one of the following disciplines:

at session start;

periodically;

per data unit;

after session time-out; and

after session interruption.

13. A distributed subscriber management system for controlling access of a plurality of user networks to a plurality of external networks, where each user network connects to a respective group of users, the system comprising:

a plurality of authentication servers each coupled to one of said external networks; and

a plurality of integrated access devices each integrated access device interposed between a respective subset of said user networks and an access network, said each integrated access device comprising:

a user-network interface for receiving data units from said respective subset of user networks;

a plurality of authentication clients for authenticating data units received from users of said respective subset of user networks and destined to at least one of said external networks;

means for controlling admission to each user network of said respective subset of user networks;

means for allocating discrete bandwidth values from said respective subset of user networks to at least one external network; and

an external-network interface coupled to said plurality of authentication clients and to said access network, said external-network interface forwarding data units authorized by any authentication client of said plurality authentication clients to a respective external network from among said plurality of external networks.

14. The distributed subscriber management system of claim 13 wherein said integrated access devices further comprise:

means for enforcing service level agreements; and

means for collecting statistics on session durations and amounts of data authorized by said plurality of integrated access devices.

15. The distributed subscriber management system of claim 14 further comprising a management station for polling said plurality of integrated access devices to upload said statistics.

16. The distributed subscriber management system of claim 13 wherein at least one of said integrated access devices further comprises means for selecting a destination external network from among said plurality of external networks.

17. The distributed subscriber management system of claim 13 wherein said means for allocating discrete bandwidth values is integrated with said user-network interface.

Assignments (13)