Cisco Technology, Inc.

Purnam Anil Sheth

Aravind Sitaraman

Charles Troper Yager

Gregory D Burns

Hussein Farouk Salama

Shujin Zhang

Shuxian Lou

Indrajanti Sukiman

Thomas E Cramer, Jr

A method for managing Internet Protocol (IP) addresses on a data communications network includes allocating multiple local IP address pools, requesting IP address usage data from one or more of the network edge devices, receiving the requested IP address usage data, determining whether the local IP address pools should be reallocated based upon the requested IP address usage data, reallocating one or more of the local IP address pools based upon the determination and updating one or more of the local IP address pool databases and a global IP pool database based upon the reallocating. Each of the local IP address pools is associated with a different network edge device that is capable of accepting connection requests requiring an IP address. The global IP address pool database includes the information maintained in each local IP address pool. A network edge device capable of managing IP addresses on a data communications network includes an allocator capable of allocating multiple local IP address pools, a receiver capable of receiving a communication, an allocator capable of allocating an available IP address from the local IP address pool if the communication includes a connection request, a determiner capable of determining whether the local IP address pool should be adjusted, a notifier capable of sending an alarm message to an IP pool manager when the IP address pool should be adjusted and a memory capable of storing an IP address allocation when the communication includes an IP address allocation.

IP pool management utilizing an IP pool MIB

A method for on-demand management of Internet Protocol (IP) address pools includes allocating an unused IP address from a local IP address pool designated for a remote domain if a request to connect to the remote domain is received and deallocating an IP address if the IP address is released. The local IP address pool includes at least one subnet dynamically assigned from a global IP address pool. Each of the subnets specifies a contiguous set of one or more IP addresses. IP addresses are allocated using a first-assigned-subnet-first policy, wherein an IP address is allocated from a least recently assigned subnet having at least one unallocated IP address. According to one aspect, subnets are deassigned using a last-assigned-subnet-first policy, wherein the deassigned subnet is the most recently assigned subnet having no allocated IP addresses.

Resource allocation and reclamation for on-demand address pools

Local network address management

Determining the domain name associated with a virtual circuit may includes receiving, at an Authentication, Authorization, and Accounting (AAA) server, a Point-to-Point Protocol (PPP) authentication request comprising a unique identifier comprising a virtual channel ID, and determining whether a domain configuration override attribute exists in a virtual circuit profile associated with a DSLAM port used to receive the PPP authentication request. Determining the domain name further includes, if the domain configuration override attribute exists in the virtual circuit profile or if the PPP authentication request does not comprise a domain name, returning a domain name associated with the unique identifier, and if the domain configuration override attribute does not exist in the virtual circuit profile, returning a PPP domain name used in the PPP authentication request.

PPP domain name and L2TP tunnel selection configuration override

A method for preventing denial of service attacks against Hypertext Transfer Protocol (HTTP) servers includes receiving a HTTP request from a subscriber using a first communication network coupled to at least one other communication network, receiving a profile for the subscriber, filtering the request to determine whether the subscriber is authorized to make the request based upon the profile and forwarding the request to the other communication network when the subscriber is authorized to make the request. An apparatus capable of preventing denial of service attacks against HTTP servers includes a profile request generator capable of generating a profile request based upon a HTTP request received from a subscriber using a first communication network, a filter capable of determining whether the request is authorized based upon the requested profile and an authorizer capable of allowing the request to be forwarded on at least one other communication network coupled to the first communication network.

Preventing HTTP server attacks

A method for controlling subscriber access in a network capable of establishing connections with a plurality of domains includes receiving a communication from a subscriber using a first communication network coupled to at least one other communication network, the communication optionally including a domain identifier associated with a domain on the at least one other communication network, determining whether the subscriber is authorized to access the domain based upon the domain identifier and a list of authorized domains for a virtual circuit used to receive the communication and authorizing subscriber access to the domain when the domain identifier is included in the list. An access server includes a tunnel ID request generator and an authorizer. The tunnel ID request generator generates a tunnel ID request that includes a virtual circuit identifier associated with a virtual circuit used to accept a PPP authentication request. The authorizer grants subscribers domain access based upon a list of authorized domains for the virtual circuit.

Method and system for controlling subscriber access in a network capable of establishing connections with a plurality of domain sites

A method for on-demand management of Internet Protocol (IP) address pools includes allocating an unused IP address from a local IP address pool designated for a remote domain if a request to connect to the remote domain is received and deallocating an IP address back to the local IP address pool if the IP address is unused. The method also includes apportioning one or more of the at least one subnet between the global IP address pool and the local IP address pool based upon utilization of the local IP address pool. The local IP address pool includes one or more of at least one subnet obtained from a global IP address pool and each subnet specifies a contiguous set of one or more IP addresses.

On-demand address pools

A method for load sharing between tunnels connecting communication networks includes receiving a communication from a subscriber using the first communication network, determining tunnel selection criteria for the communication, selecting one of the at least one tunnel based on the tunnel selection criteria and forwarding the communication on the selected tunnel. The tunnel selection criteria indicate the basis for selecting one of the tunnels. An apparatus for load sharing between tunnels connecting communication networks includes a receiving interface to receive a communication from a subscriber using the first communication network, a tunnel selection criteria determiner to determine tunnel selection criteria for the communication, a tunnel selector to select one of the tunnels based on the tunnel selection criteria and a session forwarder to forward the communication on the selected tunnel. In one aspect of the invention, load sharing is performed between Layer 2 Tunneling Protocol (L2TP) tunnels.

Load sharing between L2TP tunnels

A method for dynamic ingress to egress tunnel mapping from a first communication network to a second communication network includes receiving a tunneled communication from a subscriber using the first communication network, determining egress tunnel selection criteria for the tunneled communication, selecting one of at least one egress tunnel based on the egress tunnel selection criteria and forwarding the tunneled communication on the selected egress tunnel. The egress tunnel selection criteria indicate the basis for selecting one of the egress tunnels. An apparatus for dynamic ingress to egress tunnel mapping from a first communication network to a second communication network includes a receiving interface to receive a tunneled communication from a subscriber using the first communication network, an egress tunnel selection criteria determiner to determine egress tunnel selection criteria for the tunneled communication, an egress tunnel selector to select one of at least one egress tunnel based on the egress tunnel selection criteria and a session forwarder to forward the tunneled communication on the selected egress tunnel. In one aspect of the invention, tunnel mapping is performed between Layer 2 Tunneling Protocol (L2TP) ingress and egress tunnels.

Dynamic multi-hop ingress to egress L2TP tunnel mapping

A method for controlling subscriber access in a network capable of establishing connections with multiple services includes receiving a communication from a subscriber using a first communication network coupled to a second communication network, the communication optionally including a domain identifier associated with a service on the second communication network, and authorizing the subscriber to access a service on the second communication network using a virtual circuit. The authorization is based upon a domain configuration override attribute associated with the virtual circuit used to receive the communication from the subscriber. An access server capable of forcing subscribers of a communications system to gain access exclusively to a domain network associated with a virtual circuit includes an authorizer to grant service authorization to the subscribers based upon a virtual circuit used to make a service request, a virtual circuit profile request generator to generate virtual circuit profile requests and a calculator to determine whether the service associated with the virtual circuit matches the service associated with a domain configuration override attribute.

Growing community of inventors

Livermore, CA, United States of America

Purnam Anil Sheth