Patent ID: 7617317
Filing Date: 2009-11-10
Classification: H04L,H04W

Abstract:
1. A method comprising: receiving from a subscriber station on an access network an authentication request, the authentication request identifying the subscriber station and identifying a designated service provider from among a plurality of service providers; sending the authentication request to the designated service provider; receiving from the designated service provider an authentication response indicating successful authentication of the subscriber station by the designated service provider, wherein the authentication response includes a service qualification that indicates at least one of (i) one or more types of services authorized for the subscriber station and (ii) one or more extents of service authorized for the subscriber station, wherein the service qualification specifies one or more types of communication and, for each specified type of communication, specifies whether the subscriber station is allowed to engage in the specified type of communication; responsive to the authentication response, assigning the subscriber station to operate in a designated layer of the access network set aside for subscribers that have been authenticated by the designated service provider and to operate according to the service qualification, wherein the access network is an IP network and the designated layer is an IP subnet, and wherein assigning the subscriber station to operate in the designated layer comprises assigning to the subscriber station an IP address in the IP subnet; and serving the subscriber station in the designated layer of the access network and pursuant to the service qualification indicated in the authentication response, wherein serving the subscriber station in the designated layer comprises handling communications with the subscriber station according to a logic set established for the designated layer, wherein handling communications with the subscriber station according to the logic set established for the designated layer comprises (i) detecting a packet bearing the IP address assigned to the subscriber station, and (ii) responsively applying the logic set to restrict transmission of the packet, wherein handling communications with the subscriber station according to the logic set established for the designated layer comprises disallowing at least a predetermined type of communication from passing from the subscriber station to outside of the access network, and wherein serving the subscriber station pursuant to the service qualification indicated in the authentication response comprises, for each type of communication specified in the service qualification, allowing or disallowing the type of communication by the subscriber station as specified by the service qualification.