Abstract:
Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a policy engine of a VR defines services available to subscribers in terms of profile identifiers. A scalable subscriber profile database is established having a memory requirement dependent upon the number of available service contexts by hierarchically organizing profile identifiers as leaf profile identifiers, which explicitly define services, and intermediate profile identifiers, which indirectly represent services. The policy engine receives a first-level profile identifier and determines whether it is among those stored in the database. If not, then it obtains service profile information associated with the first-level profile identifier. If the first-level profile identifier is an intermediate profile identifier having leaf profile identifiers, then it further obtains them and associated profile information and stores this information in the database. The first-level profile identifier and the associated service profile information are also stored in the database.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a divisional of U.S. patent application Ser. No. 12/202,223, filed Aug. 30, 2008, which is a divisional of U.S. patent application Ser. No. 10/991,970, filed Nov. 18, 2004, both of which are hereby incorporated by reference in their entirety for all purposes. 
     
    
     COPYRIGHT NOTICE 
       [0002]    Contained herein is material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction of the patent disclosure by any person as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all rights to the copyright whatsoever. Copyright© 2004-2011, Fortinet, Inc. 
       FIELD 
       [0003]    Various embodiments of the present invention are related to the field of telecommunications and more particularly to delivering network services based on hierarchically organized subscriber profiles. 
       BACKGROUND 
       [0004]    In a networking service delivery environment (e.g., a digital subscriber line service environment), it is critical to deploy fast, versatile, and scalable systems. Broadband service providers (e.g., DSL) typically offer a large variety of service plans, which allow subscribers to choose between various service options. For example, subscribers can choose between low-cost service plans offering basic services and expensive service plans offering premium services. 
         [0005]    For DSL providers, as the number of subscribers and services increases, so does the amount of system resources needed for tracking subscriber services. According to one prior art technique, a DSL provider stores a list of services for each subscriber. Such a list can include the subscriber&#39;s maximum bandwidth, available filters (e.g., firewalls), encryption information, virtual private network information, access control lists, etc. When a subscriber initiates a session, the service provider retrieves the subscriber&#39;s service list to determine which services are available to the subscriber. As the number of subscribers grows, repeated fetching of service lists can create computational and communication overhead. Moreover, with a large number of subscribers, the space needed for storing service lists can become relatively large. Furthermore, when the DSL provider adds new services, it must update each subscriber&#39;s service list, consuming system resources and potentially reducing the system&#39;s service capacity. 
       SUMMARY 
       [0006]    Methods and apparatus for managing hierarchically organized subscriber profiles are described. According to one embodiment, a method is provided for configuring a policy engine of a virtual router to define services available to multiple subscribers of a service provider during respective subscriber connections. Each of multiple service contexts available to the subscribers is defined in terms of one or more profile identifiers of multiple profile identifiers each of which is representative of a particular subscriber service supported by the service provider. A scalable subscriber profile database is established in which a memory requirement for the scalable subscriber profile database is dependent upon a number of available service contexts by hierarchically organizing the profile identifiers as intermediate profile identifiers and leaf profile identifiers. The leaf profile identifiers explicitly define subscriber services and the intermediate profile identifiers indirectly represent sets of one or more subscriber services, which are defined by way of the intermediate profile identifiers&#39; associations with one or more lower-level identifiers including zero or more of the leaf profile identifiers and zero or more of the intermediate profile identifiers. A first-level profile identifier is received by the policy engine. The policy engine determines whether the first-level profile identifier is among those of the first-level profile identifiers stored in the scalable subscriber profile database. If not, then it obtains service profile information associated with the first-level profile identifier. If the first-level profile identifier is an intermediate profile identifier that is associated with one or more leaf profile identifiers, then it further obtains the one or more leaf profile identifiers and profile information associated with the one or more leaf profile identifiers and stores the leaf profile identifiers and the profile information in the scalable subscriber profile database. The first-level profile identifier and the service profile information associated with the first-level profile identifier are also stored in the scalable subscriber profile database. 
         [0007]    In the aforementioned embodiment, the first-level profile identifier may be received from a virtual interface of the VR. 
         [0008]    In various instances of the aforementioned embodiments, the leaf profile identifier may be received from a component of the VR that manages subscriber profiles. 
         [0009]    In the context of various of the aforementioned embodiments, obtaining service profile information associated with the first-level profile identifier may involve receiving the service profile information from a Remote Authentication Dial-In User Service (RADIUS) server. 
         [0010]    In various instances of the aforementioned embodiments, obtaining service profile information associated with the first-level profile identifier may involve receiving the service profile information from a control server. 
         [0011]    Other embodiments of the present invention provide a method of creating a subscriber connection. A connection request is received from a subscriber of multiple subscribers of a service provider at a subscriber manager of a virtual router operable within a telecommunications system of the service provider. The virtual router maintains a database of hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the multiple lower-level profile identifiers. If the subscriber is successfully authenticated, then a subscriber connection corresponding to the connection request is created by creating and configuring a virtual interface within the virtual router for the subscriber connection based on a first-level profile identifier associated with the subscriber. 
         [0012]    In the aforementioned embodiment, the connection request may be a point-to-point protocol request. 
         [0013]    In other instances of the aforementioned embodiments, the connection request may represent user activation over a shared medium in an advanced subscriber management system. 
         [0014]    In various instances of the aforementioned embodiments, the connection request may include subscriber authentication information. 
         [0015]    In the context of various of the aforementioned embodiments, the method may further involve the virtual router transmitting an authorization request to a Remote Authentication Dial-In User Service (RADIUS) server. Responsive to the authorization request, the virtual router may receive from the RADIUS server an authorization response including the first-level profile identifier and a host identifier indicating where lower-level profile identifiers associated with the first-level profile identifier are stored or indicating another virtual router operable within the telecommunications system from which the subscriber can receive service. 
         [0016]    In various instances of the aforementioned embodiments, creating a subscriber connection may involve acquiring one or more lower-level profile identifiers associated with the first-level profile identifier. 
         [0017]    In the aforementioned embodiment, the one or more lower-level profile identifiers may be acquired from a policy engine of the virtual router, a profile engine of another virtual router operable within the telecommunications system or a Remote Authentication Dial-In User Service (RADIUS) server. 
         [0018]    Other features of embodiments of the present invention will be apparent from the accompanying drawings and from the detailed description that follows. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0019]    Embodiments of the present invention are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which like reference numerals refer to similar elements and in which: 
           [0020]      FIG. 1  is a dataflow diagram illustrating dataflow occurring in conjunction with configuring a subscriber connection, according to exemplary embodiments of the invention; 
           [0021]      FIG. 2  is a block diagram illustrating an operating environment for certain embodiments of the invention; 
           [0022]      FIG. 3  is a block diagram illustrating a virtual router, according to exemplary embodiments of the invention; 
           [0023]      FIG. 4  is a flow diagram illustrating operations for creating a subscriber connection, according to exemplary embodiments of the invention; 
           [0024]      FIG. 5  is a flow diagram illustrating operations for returning lower-level information, according to exemplary embodiments of the invention; 
           [0025]      FIG. 6  is a flow diagram illustrating operations for storing lower-level profile identifiers, according to embodiments of the invention; 
           [0026]      FIG. 7  illustrates tables stored in the policy engine, according to exemplary embodiments of the invention; 
           [0027]      FIG. 8  is a flow diagram illustrating operations occurring in conjunction with packet forwarding during a subscriber connection, according to embodiments of the invention; and 
           [0028]      FIG. 9  is a flow diagram describing operations for modifying subscriber services, according to exemplary embodiments of the invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0029]    Methods and apparatus for managing subscriber profiles are described herein. In the following description, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In other instances, well-known circuits, structures and techniques have not been shown in detail in order not to obscure the understanding of this description. Note that in this description, references to “one embodiment” or “an embodiment” mean that the feature being referred to is included in at least one embodiment of the invention. Further, separate references to “one embodiment” in this description do not necessarily refer to the same embodiment; however, neither are such embodiments mutually exclusive, unless so stated and except as will be readily apparent to those of ordinary skill in the art. Thus, the present invention can include any variety of combinations and/or integrations of the embodiments described herein. Moreover, in this description, the phrase “exemplary embodiment” means that the embodiment being referred to serves as an example or illustration. 
         [0030]    Herein, block diagrams illustrate exemplary embodiments of the invention. Also herein, flow diagrams illustrate operations of the exemplary embodiments of the invention. The operations of the flow diagrams will be described with reference to the exemplary embodiments shown in the block diagrams. However, it should be understood that the operations of the flow diagrams could be performed by embodiments of the invention other than those discussed with reference to the block diagrams, and embodiments discussed with references to the block diagrams could perform operations different than those discussed with reference to the flow diagrams. Moreover, it should be understood that although the flow diagrams may depict serial operations, certain embodiments could perform certain of those operations in parallel. 
         [0031]    This description of various embodiments of the present invention is divided into three sections. The first section presents an overview of exemplary embodiments of the invention. The second section presents an exemplary system architecture, while the third section describes exemplary operations performed by embodiments of the system. 
       Overview 
       [0032]    This section presents an overview of a telecommunications system for managing service profile information for a large number of subscribers. 
         [0033]      FIG. 1  is a dataflow diagram illustrating dataflow occurring in conjunction with configuring a subscriber connection, according to exemplary embodiments of the invention. In  FIG. 1 , a telecommunications system  100  includes a subscriber manager  102 , profile manager  104 , virtual interface  106 , and policy engine  108 . The exemplary system  100  is adapted to provide network services to thousands of subscribers. Each subscriber can receive a set of services upon establishing a connection with the system  100 . The services can include firewalls, various qualities of service, tunneling support, virtual private network support, etc. Although there are numerous services and thousands of subscribers, the number of different service combinations is relatively small. That is, each of the thousands of users subscribers use one or more of a relatively small number (e.g., 30) of service contexts, where a service context refers to a combination of services that a subscriber receives during a connection. Therefore, each subscriber is associated with one or more service contexts. 
         [0034]    Each service context can include one or more profile identifiers. For example, a service context can include profile identifiers that define the following services: bandwidth=100 kbps, firewall=high security firewall, VPN support=not enabled, and tunneling support=not enabled. The profile identifiers can be organized in a hierarchy. For example, a first-level profile identifier can define a service or refer to one or more second-level profile identifiers. The second-level profile identifiers can either define services or refer to third-level profile identifiers, and so on. 
         [0035]    The dataflow of  FIG. 1  describes determining services represented by a hierarchy of profile identifiers. The dataflow is divided into five stages. At stage one, when establishing a subscriber connection, the subscriber manager  102  receives a first-level profile identifier associated with the subscriber. At stage two, the subscriber manager  102  requests and receives second-level profile information including a second-level profile identifier (associated with the first-level profile identifier) from the profile manager  104 . 
         [0036]    At stage three, the subscriber manager  102  creates a virtual interface  106  and configures the virtual interface  106  according to the second-level profile information. In one embodiment, the virtual interface  106  defines a physical connection to a subscriber. In one embodiment, the second-level profile information defines inbound and outbound policies used when forwarding packets through the virtual interface  106 . 
         [0037]    At stage four, the second-level profile information is stored in the policy engine  108 . At stage five, the policy engine requests and receives additional lower-level profile information including lower-level profile identifiers for defining services used in configuring the virtual interface  106 . After the policy engine  108  stores the profile information, the system  100  can use the profile identifiers to define services on other later-created virtual interfaces that use the same profile identifiers. 
         [0038]    Arranging profile identifiers in a hierarchy allows the system  100  to provide services at a high level of granularity. More specifically, because a first-level profile identifier can refer to several lower-level profile identifiers that define a service, the services can be very specifically defined. For example, “Premium” Internet service, represented by a first-level profile identifier, can be defined as 1 Mbps bandwidth, a premium firewall, and virus protection. The premium firewall can be further defined using additional lower-level profile identifiers. Having highly granular services allows the system to offer a broad range of customizable services. 
         [0039]    Organizing the profile identifiers in a hierarchy also allows the system  100  to modify services without updating each subscriber&#39;s profile identifiers. In one embodiment, the system  100  stores a high-level profile identifier for each subscriber. If a service is modified, the system  100  does not modify each subscriber&#39;s high-level profile identifiers. In contrast, in one embodiment, the system  100  may implement a service change by modifying a common database of lower-level profile identifiers. 
       Exemplary System Operating Environment 
       [0040]    This section describes an exemplary operating environment and system architecture, according to embodiments of the invention. Operations performed by the exemplary system are described in the next section. In this section,  FIGS. 2 and 3  are presented. 
         [0041]      FIG. 2  is a block diagram illustrating an operating environment for certain embodiments of the invention. As shown in  FIG. 2 , personal computers (PCs)  202  are connected to modems  206 . The modems  206  are connected to a digital subscriber line access module (DSLAM)  216 , which multiplexes signals from the modems  206  onto the Internet protocol (IP) network  218 . The IP network  218  is connected to a router box  214  that includes virtual routers (VRs)  228 . The router box  214  is connected to the Internet  212 . The router box  214  is also connected to a dynamic host configuration protocol (DHCP) server  220 , web portal  222 , RADIUS server  224 , and control server  226 . 
         [0042]    Although the router  214  includes three VRs, other embodiments call for any number of VRs or any computing system. In one embodiment, one or more of the VRs  228  can establish subscriber connections. When establishing the connections, the VRs  228  can use the DHCP server  220  for assigning IP addresses to the PCs  202 . The VRs  228  can use the RADIUS server  224  to authenticate subscribers. After authenticating subscribers, the VRs  228  can configure subscriber connections according to service contexts, which refer to services that subscribers receive during connections. In one embodiment, the VRs  228  can receive service profile information from the control server  226  and/or the RADIUS server  224 . 
         [0043]    After the VRs  228  establish subscriber connections, they provide access to the web portal  222 , where users can select new services. Additionally, after establishing subscriber connections, the VRs  228  process and forward packets over the IP network  218  and the Internet  212 . 
         [0044]    While  FIG. 2  describes an exemplary operating environment,  FIG. 3  describes a virtual router in more detail.  FIG. 3  is a block diagram illustrating a virtual router, according to exemplary embodiments of the invention. As shown in  FIG. 3 , virtual router  328  includes a subscriber manager  302  connected to virtual interfaces  304  and  316 . The virtual interfaces  304  are connected to a policy engine  306 , which is connected to a profile manager  308 . The profile manager  308  is connected to the subscriber manager  302 . The profile manager  308  includes a profile cache  310  and the policy engine  306  includes a virtual interface database  312  and a profile database  310 . 
         [0045]    In one embodiment, the subscriber manager  302  processes subscriber connection requests, while the profile manager  308  stores subscriber profile information used for establishing subscriber connections and processing subscriber data. In one embodiment, the policy engine  306  aids in de-referencing subscriber profiles. In one embodiment, the profile database  314  stores profile identifiers that define subscriber services, whereas the virtual interface database  312  can store first-level profile identifiers and/or services used for defining services associated with the virtual interfaces (VIs)  304 . Operations of the virtual router&#39;s functional units are described below in the next section. 
         [0046]    It should be understood that the functional units (e.g., the subscriber manager  302 , virtual interface  304 , etc.) of the virtual router  328  can be integrated or divided, forming any number of functional units. Moreover, the functional units can be communicatively coupled using any suitable communication method (e.g., message passing, parameter passing, and/or signals through one or more communication paths etc.). Additionally, the functional units can be physically connected according to any suitable interconnection architecture (e.g., fully connected, hypercube, etc.). 
         [0047]    According to embodiments of the invention, the functional units can be any suitable type of logic (e.g., digital logic) for executing the operations described herein. Any of the functional units used in conjunction with embodiments of the invention can include machine-readable media including instructions for performing operations described herein. Machine-readable media include any mechanism that provides (i.e., stores and/or transmits) information in a form readable by a machine (e.g., a computer). For example, a machine-readable medium includes read only memory (ROM), random access memory (RAM), magnetic disk storage media, optical storage media, flash memory devices, electrical, optical, acoustical or other forms of propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.), etc. 
       Exemplary Operations 
       [0048]    This section describes exemplary operations of the exemplary system described above. In the following discussion,  FIG. 4  describes operations performed by an embodiment of a subscriber manager.  FIG. 5  describes operations performed by an embodiment of a profile manager and  FIG. 6  describes operations performed by an embodiment of a policy engine. 
         [0049]      FIG. 4  is a flow diagram illustrating operations for creating a subscriber connection, according to exemplary embodiments of the invention. The flow diagram  400  will be described with reference to the exemplary system shown in  FIGS. 2 and 3 . The flow  400  commences at block  402 . 
         [0050]    At block  402 , a subscriber connection request is received. For example, the subscriber manager  302  receives a connection request from a PC  202 . The connection request can be a point-to-point protocol (PPP) request or a user activation over a shared medium as in advanced subscriber management (ASM) system where subscribers are recognized using source information of the data packets. In one embodiment, the subscriber connection request includes subscriber authentication information (e.g., a subscriber identifier and a password), which can be used to authenticate the subscriber. The flow continues at block  404 . 
         [0051]    At block  404 , a subscriber authorization request is transmitted. For example, the subscriber manager  302  transmits an authorization request to the Remote Authentication Dial-In User Service (RADIUS) server  224 . In one embodiment, the authorization request is an asynchronous message that includes the subscriber authentication information. The flow continues at block  406 . 
         [0052]    At block  406 , a host identifier and authorization response including one or more first-level profile identifiers are received. For example, the subscriber manager  302  receives an authorization response from the RADIUS server  202 . The authorization response can include a message, a host identifier, and one or more first-level profile identifiers. The message indicates whether the subscriber was successfully authenticated. The first-level profile identifier defines a subscriber service or refers to one or more second-level profile identifiers (see discussion above) and the host identifier indicates where the profile identifiers are stored or indicates the service VR where the subscriber may receive service (e.g., the host identifier indicates which of the VRs  230  is storing second-level profile identifiers). The flow continues at block  408 . 
         [0053]    At block  408 , a determination is made about whether the authorization was successful. For example, the subscriber manager  302  determines whether the authorization response included a message indicating that the authorization was successful. If the authorization was successful, the flow continues at block  410 . Otherwise, the flow continues at block  414 . 
         [0054]    At block  414 , the requestor is informed that the session could not be created. For example, the subscriber manager  302  transmits a message to the PC  202  informing the subscriber that a session could not be created. From block  414 , the flow ends. 
         [0055]    At block  410 , if necessary, the second-level profile identifier is acquired. For example, the subscriber manager  302  requests and receives one or more second-level profile identifiers (associated with the first-level profile identifier) from a system component. In one embodiment, the subscriber manager  302  requests and receives the second-level profile identifiers from the profile manager  308 . Alternatively, the subscriber manager  302  can request and receive the profile identifiers from another VR  228 . According to embodiments, the second-level profile identifiers can be stored in any VR&#39;s profile manager, radius server, or other accessible repository. In one embodiment, the subscriber manager  302  does not need to acquire second-level profile identifiers because the first-level profile identifier(s) explicitly define subscriber services. The flow continues at block  412 . 
         [0056]    At block  412 , a virtual interface is created and the requester is informed about the connection. For example, the subscriber manager  302  creates a virtual interface  304  and transmits a connection message to the PC  202 . In one embodiment, the virtual interface  304  refers to a physical connection between the PC  202  and the router box  214 . In one embodiment, the subscriber manager  302  configures the virtual interface  304  based on the profile identifiers. For example, based on the profile identifiers, the subscriber manager  302  configures inbound and outbound policies for the virtual interface  304 . From block  414 , the flow ends. 
         [0057]    While  FIG. 4  describes operations performed by an embodiment of a subscriber manager,  FIG. 5  describes operations performed by an embodiment of a profile manager.  FIG. 5  is a flow diagram illustrating operations for returning lower-level profile information, according to exemplary embodiments of the invention. The flow diagram  500  will be described with reference to the exemplary system of  FIGS. 2 and 3 . In one embodiment, the operations of the flow diagram  500  can be performed by any VR&#39;s profile manager. The flow  500  commences at block  502 . 
         [0058]    At block  502 , a profile identifier is received. For example, the profile manager  308  receives a profile identifier (e.g., a first-level profile identifier) from the subscriber manager  302  or the policy engine  306 . The flow continues at block  504 . 
         [0059]    At block  504 , a determination is made about whether the profile cache includes an entry for the profile identifier. The entry can also include profile information. Profile information can include a set of attributes that define the content of a profile. Profile information may be available in the profile cache if the profile was previously obtained from a profile server. For example, the profile manager  308  determines whether its profile cache  310  includes an entry for the profile identifier. If the profile cache  310  does not include an entry for the profile identifier, the flow continues at block  508 . Otherwise, the flow continues at block  506 . 
         [0060]    At block  506 , the profile information is retrieved from the profile cache. For example, the profile manager  308  retrieves lower-level profile information (e.g., a second-level or third-level profile information) from the profile cache entry. The flow continues at block  514 . 
         [0061]    At block  508 , a determination is made about where to request the profile information. For example, the profile manager  308  determines where it should request the profile identifiers. In one embodiment, the profile manager  308  refers to an ordered list of profile servers to determine where to request the profile information. For example, the ordered list can dictate that the profile manager  308  first request the lower-level profile information from the RADIUS server  224 . If that request is not successful, the profile manager  308  would then request the lower-level profile information from other repositories enumerated in the list (e.g., other VRs  228 , the control server  226 , etc.) The flow continues at block  510 . 
         [0062]    At block  510 , the profile information is requested and received. For example, the profile manager  308  requests and receives lower-level profile information from a system component (e.g., the RADIUS server  224 ). The flow continues at block  512 . 
         [0063]    At block  512 , the profile information is stored in the profile cache. For example, the profile manager  308  stores the lower-level profile information in its profile cache  310 . The flow continues at block  514 . 
         [0064]    At block  514 , the profile information is returned to the requester. For example, the profile manager  308  returns the profile information to a system component (e.g., the policy engine  314 ). From block  514 , the flow ends. 
         [0065]      FIG. 6  is a flow diagram illustrating operations for storing lower-level profile identifiers, according to embodiments of the invention. In one embodiment, flow diagram  600  describes operations performed by the policy engine. The flow diagram  600  will be described with reference to the exemplary system of  FIGS. 2 and 3 . The flow diagram  600  commences at block  602 . 
         [0066]    At block  602 , a profile identifier is received. For example, the policy engine  306  receives a profile identifier from the virtual interface  304  when a subscriber&#39;s inbound or outbound policy is set or changed. The flow continues at block  604 . 
         [0067]    At block  604 , a determination is made about whether the profile information including the profile identifier is stored in the profile database. In one embodiment, the policy engine  306  searches its profile database  314  for the profile information using the profile identifier. 
         [0068]    A brief example of searching for a lower-level profile identifier in the profile database  314  is described below, in conjunction with  FIG. 7 .  FIG. 7  illustrates tables stored in the policy engine, according to exemplary embodiments of the invention. Tables  704  and  706  include hierarchical profile identifiers. In particular, table  704  includes fields associating first-level profile identifiers with second-level profile identifiers. For example, in table  704 , first-level profile identifier S 1  is associated with second-level profile identifiers F 1 , F 2 , and F 3 . Table  706  includes fields for associating second-level profile identifiers with third-level profile identifiers. For example, in table  706 : 1) second-level profile identifier F 1  is associated with third-level profile identifier A 1 ; 2) second-level profile identifier F 2  is associated with third-level profile identifiers A 2  and A 4 ; and 3) second-level profile identifier F 3  is associated with third-level profile identifiers A 1  and A 3 . 
         [0069]    Based on the tables  704  and  706 , the policy engine  306  can determine whether a particular profile identifier is associated with a lower-level profile identifier by dereferencing the profile identifiers. For example, using tables  704  and  706 , the policy engine  306  can determine that first-level profile identifier SI is associated with third-level profile identifiers A 1 , A 1 , A 2 , A 3 , and A 4 . In one embodiment, the third-level profile identifiers define services that can be performed during subscriber sessions. In one embodiment, the relationships represented in the tables  704  and  706  can be represented in a single table. 
         [0070]    Referring back to  FIG. 6 , if the profile identifier is in the profile database  314 , the flow ends. Otherwise, the flow continues at block  605 . 
         [0071]    At block  605 , profile information associated with the profile identifier is obtained and stored in the profile database. For example, the policy engine  306  obtains, from the profile manager  308 , the profile information associated with the profile identifier and stores the profile information in its profile database  314 . In one embodiment, the profile information includes a field associated with the lower-level profile identifier. In one embodiment, the profile identifier is not associated with a lower-level profile identifier. As noted above, the profile identifier can explicitly define subscriber services. From block  605 , the flow continues at block  606 . 
         [0072]    At block  606 , a determination is made about whether there are one or more lower-level profile identifiers associated with the profile identifier. In one embodiment, the policy engine  306  determines whether there are lower-level profile identifiers associated with the profile identifier by examining the profile information associated with the profile identifier. In one embodiment, the policy engine  306  determines whether there are more lower-level profile identifiers associated with the profile identifier by examining lower-level profile information associated with previously obtained lower-level profile identifiers. In one embodiment, if there are not one or more lower-level profile identifiers associated with the profile identifier, the profile identifier explicitly defines one or more subscriber services. In one embodiment, if there are one or more lower-level profile identifiers, the profile identifier explicitly defines one or more subscriber services and each of the one or more lower-level profile identifiers defines one or more additional subscriber services. In one embodiment, the one or more lower level profile identifiers and the profile identifier together define a service one or more subscriber services. If there are more lower-level profile identifiers associated with the profile identifier, the flow continues at block  608 . Otherwise, the flow ends. 
         [0073]    At block  608 , the lower-level profile information associated with the one or more profile identifiers is requested and received. For example, the policy engine  306  requests the lower-level profile information associated with the one or more profile identifiers from the profile manager  308 . The flow continues at block  610 . 
         [0074]    At block  610 , the lower-level profile information is stored in the profile database. For example, the policy engine  306  stores the lower-level profile information in its profile database  314 . In one embodiment, the policy engine  306  stores additional information (e.g., a handle) for the lower-level profile in a field along with the profile identifier to provide quicker access to the lower level profile without requiring to search the profile database. From block  610 , the flow continues at block  606 . 
         [0075]      FIGS. 4-7  describe operations for initializing virtual interfaces and establishing subscriber connections. However,  FIG. 8  describes operations for forwarding packets during a subscriber connection. 
         [0076]      FIG. 8  is a flow diagram illustrating operations occurring in conjunction with packet forwarding during a subscriber connection, according to embodiments of the invention. The flow diagram  800  will be described with reference to the exemplary system of  FIGS. 2 and 3 . The flow diagram  800  commences at block  802 . 
         [0077]    At block  802 , a request is received, where the request is to determine whether a packet should be forwarded and other operations performed. For example, the policy engine  306  receives a request from the virtual interface  304  to determine whether a packet should be forwarded and whether other operations should be performed on the packet (e.g., operations regarding a firewall, QoS, etc.). The flow continues at block  804 . 
         [0078]    At block  804 , the determination about whether to forward/operate on packets is made based on one or more profile identifiers associated with the requestor. For example, the policy engine  306  determines whether the packet should be forwarded and whether other operations are to be performed based on one or more profile identifiers associated with the virtual interface  304 . In one embodiment, the policy engine  306  looks in the virtual interface database  312  to determine a first-level identifier associated with the virtual interface  304 . The policy engine  306  de-references the first-level profile identifier (using the profile database  314 ) to determine whether there are any lower-level profile identifiers associated with the virtual interface  304 . After de-referencing the profile identifiers, the policy engine  306  can use the lower-level profile identifiers to determine whether the packet should be forwarded/operated upon. Because the lower-level profile identifiers define services (e.g., a firewall) to apply to the packet, the policy engine  304  can decide whether to forward the packet. The flow continues at block  806 . 
         [0079]    At block  806 , the results of the determination are transmitted. For example, the policy engine  306  transmits the results to the virtual interface  304 . In one embodiment, after the virtual interface  304  forwards and/or performs other operations on data packets based on the determination. From block  806 , the flow ends. 
         [0080]    According certain embodiments, the system  200  can alter existing services and/or add new services any time during the operation of the router box  214 . As part of a process for modifying services, the system  200  can redefine associations between first-level profile identifiers and lower-level profile identifiers. The premium service package can initially include a 1 Mbps bandwidth service, where the premium service package is associated with a first-level profile identifier, and where the 1 Mbps bandwidth service is associated with a lower-level profile identifier. After the system  200  has been running for some time, the premium service package can be “upgraded” to include 5 Mbps bandwidth service instead of 1 Mbps bandwidth service. In order to make the upgrade available, a virtual router  228  can dissociate the premium service package&#39;s first-level profile identifier from the 1 Mbps lower-level identifier. It can then associate the premium service package&#39;s first-level profile identifier with a lower-level profile identifier that defines bandwidth service at 5 Mbps. As a result of modifying the profile identifiers, the virtual router  228  can modify services without requiring users to reestablish connections and without updating data for each subscriber in the system. 
         [0081]    In one embodiment, the system performs the following operations for modifying services.  FIG. 9  is a flow diagram describing operations for modifying subscriber services, according to exemplary embodiments of the invention. The flow diagram  900  will be described with reference to the exemplary system of  FIGS. 2 and 3 . The flow diagram  900  commences at block  902 . 
         [0082]    At block  902 , service profile changes are requested from a system component that was previously used to resolve profiles. For example, the profile manager  308  requests new/modified profile identifiers from the RADIUS server  224  or other component of the system  200 . In one embodiment, the profile manager  308  can request profile identifiers from any system component that it previously used to resolve subscriber profiles. The flow continues at block  904 . 
         [0083]    At block  904 , a determination is made about whether there has been a response. For example, the profile manager  308  determines whether it has received a response from the system component (e.g., the control server  226 ). In one embodiment, the response can be an asynchronous response received anytime. If there has been a response, the process continues at block  910 . Otherwise, the process continues at block  906 . 
         [0084]    At block  906 , a determination is made about whether there are other system components from which modified profile information can be obtained. For example, the profile manager  308  can search a list of system components (e.g., an ordered list of VRs, Radius Servers or other profile servers) that could contain profile information. Based on the search, the profile manager  308  can determine which system components may contain modified profile information. 
         [0085]    If there are system components other than those already queried that could include modified profile information, the flow continues at block  908 . Otherwise, the flow continues at block  912 . 
         [0086]    At block  908 , profile changes are requested from another system component. For example, the profile manager  308  requests profile changes from another system component, such as the RADIUS server  224 . In one embodiment, the profile manager  308  determines the other system component by searching an ordered list of components. The flow continues at block  904 . 
         [0087]    At block  910 , a determination is made about whether any profile changes were returned from the system components. If profile changes were returned from system components, the flow continues at block  912 . Otherwise, the flow ends. 
         [0088]    At block  912 , all applications that use the profile are updated. For example, the profile manager  308  can transmit profile changes to any system component that is currently using the relevant profile. As a more specific example, profile manager  308  can transmit modified profile identifiers to the policy engine  306 . 
         [0089]    In one embodiment, system components that use the service profile are updated about the profile refresh failure (e.g., a profile refresh failure occurs when the flow arrives at block  912  by taking the “no” path from blocks  904  and  906 ). For example, the policy engine  306  is informed of a profile refresh failure. As a result, the policy engine  306  can remove from the profile database one or more lower-level profile identifiers associated with the service profile&#39;s first-level profile identifier. The profile manager  306  can be updated later, when new lower-level profile identifiers are available. 
         [0090]    In another embodiment, system components that use the service profile are not updated about the profile refresh failure. In this case, the system components (e.g., the policy engine  306  continue to use previous profile identifiers. This enables the system  200  to operate normally during temporary network outages, when profile information may not be available. From block  912 , the flow ends. 
         [0091]    Although the flow  900  ends after block  912 , in one embodiment, system components can wait some time period and begin executing flow  900  from block  902 . In one embodiment, depending on the number profile refresh failures, the time period changes. In one embodiment, the system component can stop executing flow  900  after some number of profile refresh failures. 
         [0092]    Thus, methods and apparatus for managing subscriber profiles are described herein. Although the present invention has been described with reference to specific exemplary embodiments, it will be evident that various modifications and changes may be made to these embodiments without departing from the broader spirit and scope of the invention. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense.