On demand session provisioning of IP flows

A method for on demand session provisioning includes receiving a first packet from a user at a service selection gateway. The service selection gateway provides the user with access to one or more services. The first packet is associated with a selected one of the services. An access request is sent to an authorization server. A temporary user session is created to allow the user to temporarily access the selected service pending authorization. Subsequently received packets are forwarded while the temporary user session is valid. An authorization response is received from the authorization server. If the authorization response indicates that the user is authorized to access the selected service, a permanent user session is created to allow the user to access the selected service. Otherwise, the temporary user session is terminated.

TECHNICAL FIELD OF THE INVENTION

This invention relates in general to network systems and, more particularly, to on demand session provisioning of IP flows.

BACKGROUND OF THE INVENTION

Network systems have become increasingly sophisticated to support enhanced access to various services provided by a networks. Access to networks and services is provided by access gateways. Typically, the access gateways require authentication and authorization of the user before permitting communications between the user and the networks or services. Authentication enables the access gateway to identify a particular user and may include login and password dialog or other security protocols. Authorization enables the access gateway to identify services to which the particular user may access.

SUMMARY OF THE INVENTION

In accordance with the present invention, techniques for configuring remote gateways are provided.

According to one example of the present invention, a method for on demand session provisioning includes receiving a first packet from a user at a service selection gateway. The service selection gateway provides the user with access to one or more services. The first packet is associated with a selected one of the services. An access request is sent to an authorization server. A temporary user session is created to allow the user to temporarily access the selected service pending authorization. Subsequently received packets are forwarded while the temporary user session is valid. An authorization response is received from the authorization server. If the authorization response indicates that the user is authorized to access the selected service, a permanent user session is created to allow the user to access the selected service. Otherwise, the temporary user session is terminated.

Certain embodiments of the invention may provide one or more technical advantages. These techniques permit authorization functionality to reside within the service selection gateway. For example, the service selection gateway may seek authorization before a user is given access to a particular requested network service. This centralizes management of who may access network services in the service selection gateway. A technical advantage may be that the need for the service selection gateway to act as a radius proxy to the access gateway is alleviated. Certain embodiments include volatile memory, such that the service selection gateway may temporarily store user profiles that indicate the particular services to which a user is authorized to access. Thus, the service selection gateway need not store the thousands or millions of user profiles in the quick response memory.

Other technical advantages will be readily apparent to one skilled in the art from the following figures, descriptions and claims. Moreover, while specific advantages have been described above, various embodiments may include none, some, or all of the enumerated technical advantages.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1illustrates a system10that supports packet communication services for users12and provides users12access to one or more network services14. In the illustrated embodiment, system10includes an access network16, an access gateway18, and a network20. Access gateway18links with access network16and network20. Network20includes a service selection gateway22that operates to manage access to the one or more network services14offered by or linked to network20. During operation, access gateway18receives packets from users12requesting one or more services14and forwards the packets to network20. Service selection gateway22within network20creates a temporary user session to allow user12to temporarily access or deny the requested service14while authorization is obtained. A permanent user session may be created when and if authorization is received. Accordingly, service selection gateway22may selectively route IP packets to service providers within network20or other destination networks26on a per subscriber basis. Where authorization is not received, the temporary user session may be terminated and subsequently received packets dropped.

Users12may be any type of device suitable for communicating with access network16and for providing support for voice and/or data services. The voice and/or data services may include any packet-based communications. Users12may comprise, for example, cellular telephones, personal computers, personal digital assistants, mobile handsets, or any other devices suitable for wireless and/or wireline communications. Users12may gain access to services provided by network20or other networks linked to network20by communicating requests to access network16. Thus, users12may communicate with access network16over wireless telephone networks, wireline telephone networks, or any other communication network appropriate for the particular user device. In particular embodiments, users12may send IP packets that identify the user12to access gateway18. The IP or other packets may also request a particular service14offered by network20or another destination network26linked to network20.

Access network16provides services for voice and data access to users12communicating with access network16. According to particular embodiments, access network16may support wireless communications using elements such as towers and other supporting equipment to facilitate communication between users12and network20. The requests for access to services14, as generated by users12, may be transmitted to access gateway18and network20via access network16. Access gateway18links access network16with network20and other destination networks26, such as the Internet, to provide voice and/or data services to user12. According to particular embodiments, access gateway18receives packets generated by users12and determines the identity of the user12from the packets. Access gateway18may also perform security functions, such as authentication, to ensure that data transmitted through access gateway18is secure. The specific steps or elements necessary for authentication may depend on what access network16and access gateway18require. For example authentication may include login and password dialog, challenge and response, messaging support, and, depending on the security protocol utilized, encryption. In particular embodiments, authentication may be performed locally by access gateway18. Alternatively, access gateway18may communication with authorization server24or other devices to perform authentication.

Network20and destination networks26include any collection or arrangement of elements supporting communications and providing voice and/or data services to users12. According to the illustrated embodiment, network20includes authorization server24and service selection gateway22. In coordination with access gateway18and authorization server24, service selection gateway22serves as an access point permitting users12to access services14provided by network20and other linked destination networks26. Service selection gateway22may selectively route the packets to services14on a per subscriber basis. Services14may include intranets, the Internet, games, video on demand, or other packet based services. As illustrated, services14may be offered by network20or by other destination networks26linked to network20. For example, service14amay include intranet services provided by a network26a, and service14bmay include games14bprovided by a network26b. By contrast, service14cmay include Internet services provided directly by network20. Accordingly, service selection gateway22may provide access to any number of services14offered by any number of linked networks.

Authorization server24may include any computing device or data storage system that contains the programs and files for performing authorization of users12. Authorization server24may communicate with service selection gateway22to receive access requests identifying user12and requesting authorization to allow user12to access a requested service14. In particular embodiments, authorization server24may use the information in the access request to allow authorization for each requested service14. Authorization may succeed where authorization server24assembles or locates a set of attributes that describe what user12is authorized to access. For example, authorization server24may locate a user profile associated with a particular user12from a database28. The user profile may list services14to which the user12is a subscriber. Authorization server24may use the user profile to determine whether the user has authority to access the requested service14. Alternatively, authorization server24may send the user profile to service selection gateway22such that service selection gateway22may determine whether to allow user12to access the requested service14. Accordingly, service selection gateway22and authorization server24act cooperatively to permit users12to access services14provided by network20and other linked destination networks26.

In operation, a user will typically authenticate with access gateway18. Upon authentication, any subsequently transmitted packets are sent directly from user12to service selection gateway22. Service selection gateway22may receive IP packets over public network, private network, a fixed link, or other communications link. Upon receiving the packets from user12, service selection gateway22may determine whether user12is authorized to access a service implicated by those packets. To determine authorization, service selection gateway22may send an access request to authorization server24or another device in network20. The access request may request authorization to allow user12to access the particular service or services14requested by user12. Information in the access request may be based on the packets received from user12and forwarded by access gateway18. In particular embodiments, the access request may include an IP address of user12in dotted notation. Authorization server24may use the information in the access request to identify a user profile or other set of attributes associated with user12from database28. For example, where the access request includes the IP address of user12, authorization server24may use the IP address to retrieve the user profile or attributes from database28. Authorization server24may forward the user profile or attributes to service selection gateway22, which may then use the user profile or attributes to determine whether user12is authorized to access the particular service14that user12has requested. As will be described in greater detail with regard toFIG. 3, the determination as to whether user12has authorization to access requested services14determines the handling of any packets subsequently received at service selection gateway22.

FIG. 2illustrates a particular embodiment of a service selection gateway22from system10. In the embodiment illustrated, service selection gateway22includes one or more interfaces40, a processor42, and a memory44. During operation, service selection gateway22works with access gateway18and authorization server24to support access of users12to elements within network20.

Service selection gateway22includes at least one interface40for communicating with other elements of system10. As illustrated, interface40links service selection gateway22with authorization server24and other elements in or linked to network20. For example, service selection gateway22may communicate access requests to authorization server24via a fixed communication link through interface40. In response, service selection gateway22may receive user profiles and/or user attributes from authorization server24through interface40. Other elements may also be linked to service selection gateway22through interface40. These elements may include access gateway18and one or more services14. For example, interface40may receive packets from access gateway, as generated by users12and forwarded by access network16. As another example, interface40may be used to communicate packets to services14offered by network20and any linked destination networks26. Although service selection gateway22is illustrated as including a single interface40that communicates with multiple elements, service selection gateway22may include multiple interfaces40and each interface40may communicate with specific elements of system10.

Processor42controls the management and operation of service selection gateway22by using interface40to communicate with other elements inside and outside of operator network18and by accessing and storing information in memory44. In particular embodiments, processor42processes packets received from access gateway18. Processor42may identify a particular user12from information in the packets received from access gateway18. For example, processor42may identify user12from an IP address, device identifier, user name, sources address, or other identifying information included in the packets. Processor42may also generate access requests using the information in the packets received from access gateway18and transmit the access requests to authorization server28. In particular embodiments, processor42may also create a temporary user session or other host object to allow user12to temporarily access the requested service14. Using the temporary user session, processor42may forward any packets subsequently received from user12to the requested service14even though service selection gateway22has not received authorization identifying the user as authorized to access the requested service14.

Additionally, processor42may determine whether service selection gateway22has received authorization from authorization server28. As discussed above, authorization may indicate that user12is authorized to access a requested service14. This authorization may be, as previously discussed, in any form such as a user profile specifying all services to which user12has authorization to access. If authorization is received, processor42may create a permanent user session or other host object for user12and terminate the temporary user session. Alternatively, processor42may convert the temporary user session into a permanent user session. If authorization is not received or if user12is not authorized, processor42may terminate the temporary user session. For example, processor42may terminate the temporary user session by dropping any subsequently received packets or by otherwise ceasing to forward the packets. In particular embodiments, processor42may terminate the temporary user session if the user session has timed out. A user session may time out if a specified amount of time passes without receiving authorization from authorization server24. For example, the temporary user session may time out if user12has not been authorized after 500 to 2000 milliseconds. This value is defined to be configurable on service selection gateway22.

According to particular embodiments, processor42may determine whether a user session has become inactive. A user session may become inactive when service selection gateway22does not received packets or other traffic from user12for a specified amount of time. In particular embodiments, the user session may become inactive if service selection gateway22does not receive packets from user12as required by a configurable timer after 10 to 20 seconds. Thus, processor42may determine how long it has been since service selection gateway22received packets from user12and terminate the user session if the user session has become inactive. If data traffic is received from user12after a user session has become inactive, processor42may generate a new access request to be transmitted to authorization server24for authorization to allow user12access to the requested server14. Processor42may further operate to establish a second temporary user session while processor42waits for authorization. By determining whether a user session has become inactive, service selection gateway22may more quickly react to communications received for active sessions. Additionally, service selection gateway22need not keep track of user profiles associated with inactive sessions.

Memory44includes information for use during the operation of service selection gateway22, such as for processing packets received from access gateway18and generating access requests to be transmitted to authorization server24. In the illustrated embodiment, memory104also stores user profiles46. Accordingly, memory44may include logic that enables processor42to perform functions such as determining an IP address associated with user12from the received packets. Memory44may also include logic that enables processor42to generate an access request from the information included in the packets received from access gateway18. As illustrated, memory44may also include user profiles46or other data associated with user12. These user profiles46may include, for example, information and attributes that identify services14to which user12is a subscriber. User profiles46may also billing data, bandwidth specifications, and other information associated with user12that may be used for regulating access to services14. In particular embodiments, user profiles46may comprise authorization received from authorization server24. The authorization may identify particular services14that the user12is authorized to access.

In operation, service selection gateway22responds to packets received from access gateway18via interface40. Using information in the packets, processor42generates an access request that identifies user12and requests authorization to allow user12to access one or more requested services14. Service selection gateway22transmits the access request to authorization server24via interface40or another interface of service selection gateway22. In particular embodiments, processor22may initiate a temporary user session or other host object that enables user12to access the requested service14while service selection gateway22waits for authorization from authorization server24. Subsequently received packets may be forwarded to the appropriate service14until a response is received or until the temporary user session times out.

Upon receiving a response from authorization server24, processor42may store user profile46or other information and attributes associated with user12in memory44. Because information in user profile46may indicate the particular services14that user12is authorized to access, processor42may then determine whether user12is authorized to access the particular service14requested by user12. Where user12is authorized to access the requested service14, processor42may initiate a permanent user session for user12. Subsequently received packets and other communications from user12may then be routed to the requested service14as is appropriate. Moreover, service selection gateway22may provide user12access to requested services14based upon parameters established by the user profile received from authorization server24. The user profile46associated with user12may be stored in memory44until user12terminates the user session or until the user session otherwise becomes inactive.

While the embodiment illustrated and the preceding description focus on a particular embodiment of service selection gateway22that includes specific elements, system10contemplates service selection gateway22having any suitable combination and arrangement of elements for handling user requests to services14. Therefore, the modules and functionalities described may be combined, separated, or otherwise distributed among any suitable functional components, and some or all of the functionalities of service selection gateway22may be implemented by logic encoded in media, such as software and programmed logic devices.

FIG. 3illustrates an example method for on demand session provisioning at a service selection gateway22. The method begins at step100where access gateway18receives login information or other information identifying user12to system10. Access gateway18may perform authentication locally or communicate the login or other information to other devices in system10to authenticate user12to system10. At this point, access gateway18has verified an identify for user12, but authorization for various services14has not been established.

At step102, access gateway18forwards the packets to service selection gateway22. The packets may be transmitted over a fixed line or other communications link between access gateway18and network20. The packets may include an address or other information identifying or associated with user12. In response to receiving packets from user12, service selection gateway22generates an access request at step104. The access request identifies user12and requests authorization to allow user12to access one or more requested services14. The access request may be generated using information in the packets received from access gateway18. In particular embodiments, the access request may include an address associated with user12.

At step106, Service selection gateway22sends the access request to authorization server24. The access request may be transmitted to authorization server24via interface40or another interface of service selection gateway22. To permit user12immediate access to the requested service14while authorization takes place, a temporary user session may be initiated at step108. The temporary user session may be used by service selection gateway22while service selection gateway22waits for authorization from authorization server22. Accordingly, processor42of service selection gateway22may forward any packets subsequently received from user12to the appropriate service14while service selection gateway22awaits authorization from authorization server24. In particular embodiments, authorization server24may use a source address or other information in the received packets to identify a user profile or other information or attributes associated with the user in memory28. The user profile or other information or attributes may then be forwarded to service selection gateway22. The user profile or other information or attributes may identify various services14that user12is authorized to access. For example, the user profile for a particular user12may indicate that the particular user12is authorized to access a game through service14boffered by destination network26aand the Internet through service14coffered by network20.

At decision step110, service selection gateway22determines whether the temporary user session has timed out. As described above, a user session may time out when service selection gateway22has not received authorization within a specified amount of time. If service selection gateway22determines that the temporary user session has timed out, service selection gateway22may drop any packets subsequently received from user12at step112. Alternatively, if service selection gateway22determines that the temporary user session has not timed out at step110, the method continues to step114.

At decision step114, service selection gateway22determines whether user12has authorization to access the requested service14. The determination may be based on the user profile received from authorization server24. For example, assume that user12has requested access to an intranet through service14a. Where the user profile associated with user12as received from authorization server24indicates that user12is authorized to access games through service14band the Internet through service14cbut does not indicate that user12is authorized to access the particular intranet through service14a, processor42may determine that authorization has failed. Thus, service selection gateway22may determine that authorization has failed anytime user12requests access to a service14to which user12is not authorized. Where authorization fails, service selection gateway22may drop any packets subsequently received from user12at step112.

Alternatively, service selection gateway22may determine at step114that user12has authorization to access the requested service14. For example, where user12requests access to an intranet through service14aand the user profile associated with user12indicates that user12is authorized to access service14a, service selection gateway22may determine that user12has authorization. Thus, service selection gateway22may determine that user12has authorization anytime user12requests access to a service14to which user12is not authorized. When service selection gateway22determines that user12has authorization to access the requested service14, the user profile or other information or attributes received from authorization server24is stored at step116. The user profile or other attributes may be stored as a user profile46in memory44. Processor42may then access user profile46in memory44as needed for the direction of traffic received from user12. Future packets received may allow user12to access the same service14for which a user session was initially created or other services14also authorized by the user profile.

At step118, a permanent user session is created. Service selection gateway22may initiate the permanent user session, or service selection gateway22may convert the temporary user session into a permanent user session. Any packets subsequently received from user12may be forwarded to the requested service14based upon the permanent user session. For example, where user12requests a game through service14boffered by destination network26b, any packets received from user12as user12plays the game may be forwarded to service14bin destination network26a. In particular embodiments, service selection gateway22may be operable to handle service selection changes. For example, user12may begin by requesting a game through service14b, but at some point desire to search for something on an intranet through service14a. As new packets are received from user12, service selection gateway22may determine whether user12is authorized to access the intranet through service14ausing user profile46stored in memory44. If user profile46indicates that user12is authorized to access the Internet through service14c, the packets initially requesting the Internet through service14cand any subsequently received packets may be forwarded to service14c. In this manner, service selection gateway22may selectively route IP packets to access services14for a user12where that user12has a permanent user session initiated through service selection gateway22.

According to particular embodiments, service selection gateway22may determine at decision step120whether a user session has become inactive. As described above, a user session may become inactive if service selection gateway22does not receive packets or other traffic from user12for a specified amount of time. For example, the user session may become inactive if service selection gateway22does not receive any packets from user12for more than three to four seconds. If service selection gateway22determines that the user session has not become inactive, service selection gateway22may continue to monitor packet activity at step121until the user session is determined to be inactive at step120. When service selection gateway22determines that the user session has become inactive, service selection gateway22terminates the permanent user session at step122. User profile46associated with user12may be deleted from memory44at step124. Upon deletion of user profile46from memory44, any subsequently received packets may be dropped at step112.

Thus, the flowchart and preceding description outline the configuration of network20and service selection gateway22to dynamically handle access to services requests. However, the flowchart and accompanying description illustrate only an exemplary method of operation, and system10contemplates the configuration of network20and service selection gateway22using any suitable techniques and elements for processing packets accessing services14offered by network20or other destination network26. Therefore, many of the steps in this flowchart may take place simultaneously and/or in different orders than as shown. In addition, the configuration of network20and service selection gateway22may use methods with additional steps, fewer steps, and/or different steps, so long as the methods remain appropriate.