Cisco Technology, Inc.

Maria Alice Dos Santos

Shujin Zhang

Shuxian Lou

Jie Chu

Jane Jiaying Jin

Aravind Sitaraman

Sampath Kumar Sthothra Bhasham

Xi Xu

Joseph F Mann

A method for routing packets sent from a user to the internet is provided for systems in which the user is connected to a private network. The method includes: extracting a source network address from the packet; using said source network address to retrieve a user profile for the user; examining said user profile to determine whether to route the packet through the private network or to route the packet directly to the Internet; and routing said packet according to said profile. This allows a user or network provider to choose whether to route packets destined for the Internet directly to the Internet rather than through the private network, thus preventing excessive network traffic on the private network.

Default internet traffic and transparent passthrough

A gateway routes a packet from a user to a connected network utilizing a per-user routing table. A source address is extracted from the packet; a per-user routing table corresponding to the source address is found, the per-user routing table contains entries corresponding to one or more currently accessible networks for the user and the range of network addresses corresponding to the currently accessible networks; a destination address is extracted from the packet; an entry in the matching per-user routing table with a range of network addresses containing the destination address is sought; the packet is routed to a matching network if the destination address is contained within one of the ranges of network addresses for the currently accessible networks ('ranges'); and the packet is routed to a default network if the destination address is not contained within one of the ranges. Different users may access a different set of networks and select a desired network for access.

Per user and network routing tables

Multiple simultaneous network connections from a single PPP connection may be accomplished by utilizing a gateway in the following manner. A first network connection is established between the gateway and a first network. A first real network address for the user is then received, the first real network address assigned by the first network. Then, the gateway may establish a network session between the gateway and a second network and receive a second real network address for the user, the second real network address assigned by the second network. A virtual network address may be assigned to the user for network address translation purposes. Additional network connections may be added in a similar manner. Network address translation is then performed on packets traveling between the user and any of the network sessions. This allows each of the simultaneous network connections to gain the benefits of network address translation.

Multiple network connections from a single PPP link with network address translation

Certain bits of a packet, such as bits in the IP header of an IP packet, are used to designate the type of service or Quality of Service (QoS) level to be afforded to the packet as it passes through a data communications network. A user entitled to a certain QoS level logs into a service selection gateway SSG. The SSG queries an authentication, authorization and accounting (AAA) server in response to a log-in attempt by the user. Upon authorization, the AAA server returns an access accept signal in addition to an indication from the user's service profile (user profile) as to the QoS level to be afforded the user. While the user is logged in, all packets are routed through the SSG. The SSG sets the certain bits of the packet in accordance with the user's assigned QoS level so that as the packets are routed through the data communications network, they are consistently afforded the assigned Quality of Service level. In another aspect of the invention, on-demand QoS may be provided by the SSG and accounted for by communications with the AAA server.

Use of precedence bits for quality of service

A method for maintaining Quality of Service for communication network subscribers regardless of their log-on location is disclosed. For one embodiment the communications network has a first access point having a first router and a local memory containing at least one user profile containing a subscriber's pool identifier, and a second access point having a second router configured to provide a forwarding rate based on a source address from each of said packets. A service type for a subscriber is defined. A pool identifier corresponding to a service level agreement is assigned to the subscriber. If the subscriber attempts to log-on to the second access point, the subscriber's pool identifier is obtained from a global memory available to the second access point. The pool identifier is used to select a source address. A packet sent by the subscriber is forwarded using the second router, each packet containing the source address.

Dynamic IP addressing and quality of service assurance

An address is allocated to a host device which is selected to obtain network access from any access point within a given communications system, while maintaining a network bandwidth management scheme that is consistently applied to a user's network bandwidth usage regardless of the access point used by the user. This is accomplished using a communications network having a at least one access point coupled to a first router which is configured to forward packets at a forwarding rate based on a source address contained in each of the packets. A user profile is assigned to each subscriber belonging to an access point. Each user profile includes a pool identifier which corresponds to a forwarding rate used by the router for packets corresponding to the subscriber. If a subscriber attempts to log-on to an access point, a source address is selected using the address pool identifier, the source address is assigned to the subscriber, and each packet is forwarded at a forwarding rate based on the source address contained within each of the packets. The communications system may also include a global memory which contains all of the user profiles stored for the communications system. The global memory provides the pertinent user profile to any access point from which a subscriber seeks to obtain access when the subscriber does not have a user profile contained within the local memory of the access point, such as in the case of a roaming subscriber.

A gateway is provided which routes a packet sent from a user to a connected network utilizing a per-user routing table. This is accomplished by extracting a source address from the packet; finding a per-user routing table corresponding to the source address, the per-user routing table containing entries corresponding to one or more currently accessible networks for the user and the range of network addresses corresponding to the currently accessible networks; extracting a destination address from the packet; seeking an entry in the matching per-user routing table with a range of network addresses containing the destination address; routing the packet to a matching network if the destination address is contained within one of the ranges of network addresses for the currently accessible networks; and routing the packet to a default network if the destination address is not contained within one of the ranges of network addresses for the currently accessible networks. This allows different users to have access to a different set of networks and allows a user to select the network he wishes to access. The gateway may also guarantee that packet are routed through a particular destination ISP or network by looking up the destination ISP or network in a table, each entry in the table having a router network address corresponding to each network currently accessible; establishing a tunneling session to the matching router network address; and forwarding the packet to the router network address through the tunneling session.

A method for providing single step log-on access for a subscriber to a computer network. The computer network is differentiated into public and private areas. Secure access to the private areas is provided by a Service Selection Gateway (SSG) Server, introduced between a conventional Network Access Server (NAS) and an Authentication Authorization and Accounting (AAA) Server. The SSG Server intercepts and manipulates packets of data exchanged between the NAS and the AAA Server to obtain all the information it needs to automatically log the user on when the user logs on to the NAS. An authorized user is thus spared the task of having to re-enter username and password data or launch a separate application in order to gain secure access to private areas of the network.

Method for providing single step log-on access to a differentiated computer network

A method for replying to a DHCP request packet is provided which allows a DHCP server to forward its reply packet directly back to the requester, thus permitting a gateway or similar device to make a DHCP request on behalf of a client. A reply to sender options field in the DHCP request packet is used to signify when the reply packet should be sent directly back to the requester. The method includes: examining the reply to sender field; extracting an address from the giaddr field if a flag in the reply to sender field is not set; forwarding a reply packet to said address extracted from the giaddr field if the flag in the reply to sender field is not set and said giaddr field is not empty; broadcasting a reply packet over a local subnet if the flag in the reply to sender field is not set and said giaddr field is empty; extracting a source network address from the source network address field if the flag in the reply to sender field is set; and forwarding a reply packet to said source network address if the flag in the reply to sender field is set.

Growing community of inventors

Redwood City, CA, United States of America

Maria Alice Dos Santos