Distributed subscriber management system
A distributed subscriber management system and method that controls access to a network preventing unauthorized traffic through the access network and providing centralized access control between user networks. The system and method provide controlled access through the use of one of several technologies including user authentication, using PAP, CHAP, RADIUS, TACACS+, or other standard authentication means. The method includes the steps of receiving a connection request from a user located on one of the User Networks; interrogating the user for userid and password information; encrypting the userid and password information; transmitting the encrypted information, via the access network, to an authentication server attached to one of a plurality of external networks; decrypting the information at the authentication server; and transmitting an authentication message from the authentication server of the external network to the access control node via the access network. The preferred method includes the additional step of challenging all data leaving the access control node.
1. A distributed subscriber management system comprising:
a plurality of user networks, each user network connecting a respective group of users;
an integrated access device interposed between said plurality of user networks and an access network, said integrated access device comprising means for controlling admission to each of said user networks of users while connected to each other user network of said plurality of user networks; and
a plurality of external networks connected to said access network, each said external network having an authentication server;
wherein said integrated access device comprises a set of at least two authentication clients shared by said plurality of user networks and operable to authenticate and authorize data units received from users belonging to any of said user networks and destined to any of said external networks.
2. The distributed subscriber management system of claim 1 further including means for centralized access control between said user networks.
3. The distributed subscriber management system of claim 1 further comprising a secure data-unit labeling system associated with said integrated access device for marking data units received from said user networks to produce marked data units so that each said marked data unit destined to a specific external network from among said plurality of external networks becomes illegible to any other of said external networks.
4. The distributed subscriber management system of claim 1 wherein said set of at least two authentication clients uses a Remote Authentication, Dial-in User Service (RADIUS) protocol.
5. The distributed subscriber management system of claim 1 further including, in said integrated access device, means for:
receiving a data unit from a user located on one of said plurality of user networks;
interrogating said user for access information;
encrypting said access information prior to transmitting the
access information to an authentication server; and
wherein the encrypted access information is decrypted at the authentication server.
6. The distributed subscriber management system of claim 1 wherein said plurality of user networks includes a first number of user networks, said set of at least two authentication clients includes a second number of authentication clients, and said first number is unequal to said second number.
7. An integrated access device comprising:
a user-network interface connecting to a plurality of user networks to receive data units from said plurality of user networks;
at least two authentication clients operatively connected to said user network interface for authenticating and authorizing data units received from said plurality of user networks;
an external-network interface operatively connected to said at least two authentication clients and to an access network, said external-network interface operable to forward a data unit authorized by any of said at least two authentication clients to an external network from among a plurality of external networks connected to said access network; and
means for controlling admission to each of said user networks of users while connected to each other user network of said plurality of user networks.
8. The integrated access device of claim 7 further comprising means for allocating discrete bandwidth levels to at least one of said user networks.
9. The integrated access device of claim 7 further comprising:
means for service-level enforcing;
means for network-resource management;
means for collecting usage statistical usage; and
means for alarm monitoring.
10. The integrated access device of claim 7 , further comprising at least one of the following:
a password authentication protocol client;
a challenge handshake authentication protocol client;
a terminal-access controller-access control system client; and
a remote authentication dial-in user service protocol client.
11. The integrated access device of claim 7 wherein the user network interface includes a plurality of ingress cards and the external network interface includes an egress card.