Systems and methods for routing traffic originating from a communication device

Patent metadata

Field	Value
Publication number	US-11303636-B2
Application number	US-201515755605-A
Country	US
Kind code	B2
Filing date	Aug 28, 2015
Priority date	Aug 28, 2015
Publication date	Apr 12, 2022
Grant date	Apr 12, 2022

Abstract

Using an authentication server to program network elements, such as a network node, in accordance with software-defined networking techniques in order to establish a traffic flow rule for a communication device or user of the communication device. After successfully authenticating a communication device or user, the authentication server and/or network node may use an identifier received at the authentication server in connection with the authentication procedure in order to obtain a traffic flow rule for the communication device. The traffic flow rule may be established at the network node or forwarded to a second network node configured to receive network packets from the communication device. The first identifier may be any one of a user identifier identifying a user, an application identifier identifying an application, and a device identifier unique to the communication device.

First claim

The invention claimed is:

1. A method for routing traffic originating from a communication device, the method comprising:
receiving, at an authentication server, a first message comprising information indicating that the communication device or a user of the communication device is requesting access to a resource;
authenticating, by the authentication server, the communication device or the user of the communication device in accordance with an authentication protocol; and
after the device or the user is authenticated, establishing a traffic flow rule for traffic transmitted by the device based on a first identifier, wherein the first identifier is a device identifier unique to the device, and
wherein establishing the traffic flow rule comprises the authentication server transmitting to a network node a second message comprising the device identifier, the second message further comprises the obtained traffic flow rule, and the obtained traffic flow rule comprises traffic flow information identifying one or more traffic flows and traffic routing information for the identified traffic flows for enabling the network node to route traffic transmitted by the communication device and corresponding to one of the identified traffic flows to an appropriate network entity,
wherein the second message further comprises a user identifier and/or an application identifier, and
establishing the traffic flow rule further comprises the network node using the user or application identifier to obtain the traffic flow rule,
wherein the method further comprises the authentication server or the network node transmitting the traffic flow rule to a second network node, wherein the second network node is configured to receive traffic transmitted by the communication device, and the traffic flow rule identifies a destination to which the second network node should forward the received traffic, and
wherein the authentication server reprograms the network node through software-defined networking, SDN, mechanisms so that the communication device is connected with correct virtual instances serving group of customers.

2. The method of claim 1 , wherein
establishing the traffic flow rule further comprises the authentication server using the first identifier to obtain the traffic flow rule.

3. The method of claim 2 , wherein using the first identifier to obtain the traffic flow rule comprises:
the authentication server providing to a rules function the first identifier, wherein the rules function is configured to obtain a rule based on the first identifier and provide the selected rule to the authentication server; and
the authentication server receiving the traffic flow rule obtained by the rules function based on the first identifier.

4. The method of claim 1 , wherein the second message further comprises at least one of a user preference, a priority parameter, a quality of service parameter, a tunneling parameter, a device type parameter, a device identifier and a time-to-live parameter.

5. The method of claim 1 , wherein the first identifier further comprises one of a user identifier and an application identifier.

6. The method of claim 2 , wherein
the network node is a gateway,
the gateway is configured to receive a packet transmitted by the communication device,
the traffic flow rule identifies a destination to which the gateway should forward the received traffic packet,
the gateway determines the destination identified by the traffic flow rule, and
the gateway forwards the received packet to the destination identified by the traffic flow rule.

7. The method of claim 1 , further comprising:
receiving, at the authentication server, a third message providing an indication to terminate a user session of the device; and
transmitting, by the authentication server, a fourth message to the network node comprising instructions to modify one or more routing rules for the device.

8. The method of claim 1 , wherein
the network node is one of: a gateway and a node comprising a rules function, the network comprises a virtual switch, and
the method further comprises the authentication server transmitting a message to an access point for permitting the communication device to access the resource.

9. An authentication server comprising:
a data processing system; and
a network interface coupled to the data processing system, wherein the data processing system is configured such that, in response to receiving a first message comprising information indicating that a communication device or a user of the communication device is requesting access to a resource, the data processing system:
authenticates the communication device or the user of the communication device in accordance with an authentication protocol; and
after the communication device or the user is authenticated, establishes a traffic flow rule for traffic transmitted by the communication device based on a first identifier,
wherein the first identifier is a device identifier unique to the device, and wherein establishing the traffic flow rule comprises the data processing system using the network interface to transmit to a network node a second message comprising the device identifier, the second message further comprises the obtained traffic flow rule, and the obtained traffic flow rule comprises traffic flow information identifying one or more traffic flows and traffic routing information for the identified traffic flows for enabling the network node to route traffic transmitted by the communication device and corresponding to one of the identified traffic flows to an appropriate network entity,
wherein the second message further comprises the user identifier and/or the application identifier, and the network node is configured to use the user or application identifier to obtain the traffic flow rule,
wherein the authenticating server transmits the obtained traffic flow rule to a second network node, wherein the second network node is configured to receive traffic transmitted by the communication device, and the traffic flow rule identifies a destination to which the second network node should forward the received traffic, and
wherein the authentication server reprograms the network node through software-defined networking, SDN, mechanisms so that the communication device is connected with correct virtual instances serving group of customers.

10. The authentication server of claim 9 , wherein the data processing system is configured such that the establishing the traffic flow rule further comprises using the first identifier to obtain the traffic flow rule.

11. The authentication server of claim 10 , wherein the data processing system is configured such that, the using the first identifier to obtain the traffic flow rule further comprises:
providing to a rules function the first identifier, wherein the rules function is configured to select a rule based on the first identifier and provide the selected rule to the authentication server; and
receiving the traffic flow rule selected by the rules function based on the first identifier.

12. The authentication server of claim 9 , wherein the second message further comprises at least one of a user preference, a priority parameter, a quality of service parameter, a tunneling parameter, a device type parameter, a device identifier and a time-to-live parameter.

13. The authentication server of claim 9 , wherein the authentication server is an Authentication, Authorization, and Accounting (AAA) server,
the authentication protocol comprises at least one of a RADIUS or Diameter protocol, and
the device identifier is one of an IP address and a MAC address.

Assignees

• Ericsson Telefon Ab L M

Inventors

• Back Heidi-Maria
• Arkko Jari
• Kauppinen Tero
• Kjällman Jimmy
• Komu Miika
• Mecklin Tomas
• Salmela Patrik
• Sethi Mohit
• Wang Le

Classifications

• H04W12/086

  using security domains · CPC title

• H04W12/084

  using delegated authorisation, e.g. open authorisation [OAuth] protocol · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04W84/12

  WLAN [Wireless Local Area Networks] · CPC title

• H04W28/0268

  using specific QoS parameters for wireless networks, e.g. QoS class identifier [QCI] or guaranteed bit rate [GBR] (negotiating SLA or negotiating QoS H04W28/24) · CPC title