Cisco Technology, Inc.

Craig Michael Alesso

Aravind Sitaraman

Charles Troper Yager

In a first aspect of the present invention, a Wholesaler dynamically identifies one of a plurality of AAA services at a remote domain to route an access request to. The AAA service is selected based upon a set of rules applied to information which has been received dynamically from the plurality of AAA services and is indicative of load and status of the plurality of AAA services. In a second aspect of the present invention, a Wholesaler, based upon a Service Level Agreement (SLA) between the Wholesaler and a user, routes the user to one of a plurality of sub-service providers.

Proxy on demand

A data communications network with a plurality of PoPs maintains a local database associated with each PoP and a central database somewhere on the data communications network. The local database contains a group identification such as a domain identification corresponding to a group of users, a maximum number of VPN sessions to provide the group of users at the PoP and a dynamic VPN session count corresponding to active VPN sessions currently provided to the group of users at the PoP. The central database contains a maximum number of VPN sessions to provide the group of users over the entire data communications network and a dynamic network-wide VPN session count corresponding to active VPN sessions currently provided to the group of users on the entire data communications network. Actions are taken when the group attempts to exceed either the local maximum number of sessions or the network-wide maximum number of sessions by more than a predetermined number. The actions may include assessing extra charges, denying access, and sending warning messages to appropriate recipients.

Virtual private data network session count limitation

A method and apparatus for directing data network communications based on the geographic location of the user. One or the other or both of the geographic location of the local telephone access number with which the user is connected to one of a plurality of points of presence (PoPs) and the telephone number that the user is calling from to connect to the PoP is determined. This geographic location is compared to the geographic location of the home of the user. If the geographic locations differ, then it is determined that the user is a roaming user. If the user is a roaming user, then communications to the user over the data communications network are directed based at least in part upon the geographic location of the user.

Directing data network communications based on geographic location of a user

A data communications network with a plurality of PoPs maintains a local database associated with each PoP and a central database somewhere on the data communications network. The local database contains a group identification such as a domain identification corresponding to a group of users, a maximum number of proxied sessions to provide the group of users at the PoP and a dynamic proxy session count corresponding to active proxied sessions currently provided to the group of users at the PoP. The central database contains a maximum number of proxied sessions to provide the group of users over the entire data communications network and a dynamic network-wide proxy session count corresponding to active proxied sessions currently provided to the group of users on the entire data communications network. Actions are taken when the group attempts to exceed either the local maximum number of sessions or the network-wide maximum number of sessions by more than a predetermined number. The actions may include assessing extra charges, denying access, and sending warning messages to appropriate recipients.

Proxy session count limitation

A data communications network with at least one PoP maintains a local cache database associated with each AAA service at the PoP on the data communications network. Each local database contains a group identification such as a domain identification corresponding to a group of users or an FQDN specifying a group of one individual, a maximum number of B-Channels to provide the group of users at the PoP and a dynamic B-Channel session count corresponding to active B-Channel connections currently provided to the group of users at the PoP. Actions are taken when the group attempts to exceed the maximum number of B-Channels by more than a predetermined number. The actions may include assessing extra charges, denying access, and sending warning messages to appropriate recipients. The local database may be synchronized by publishing B-Channel connection and disconnection events to all subscribing local databases. For proxy authentication users, the authentication information is published to the local caches of each AAA service at the PoP upon the first log-in of the user so as to avoid the need to proxy each successive connection authentication to a remote AAA service.

Growing community of inventors

Lake Elmo, MN, United States of America

Craig Michael Alesso