Fault tolerance for authentication, authorization, and accounting (AAA) functionality

Patent metadata

Field	Value
Publication number	US-9253019-B1
Application number	US-201213416864-A
Country	US
Kind code	B1
Filing date	Mar 9, 2012
Priority date	Mar 9, 2012
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

An example network access device (NAD) includes a network interface to send and receive packets with an authentication, authorization, and accounting (AAA) server, and a subscriber management service unit (SMSU). The SMSU is configured to, responsive to determining that the AAA server is not reachable by the NAD, send a message from the NAD to the AAA server using the network interface, wherein the message directs the AAA server to send a discovery request message to the NAD, receive the discovery request message from the AAA server using the network interface, wherein the discovery request message includes a request for information about a plurality of subscriber sessions, and generate a discovery response message that includes information about at least a portion of the plurality of subscriber sessions, and send the discovery response message to the network access device using the network interface.

First claim

What is claimed is:

1. A method comprising:
providing, with a network access device, network access to a plurality of subscribers upon authenticating the subscribers with an authentication, authorization, and accounting (AAA) server;
storing, within the network access device, information for a plurality of subscriber sessions associated with the plurality of subscribers;
sending a first keep alive message from the network access device to the AAA server, wherein the first keep alive message includes a trigger parameter, wherein the trigger parameter specifies an initial value;
when a response to the first keep alive message is not received from the AAA server and by the network access device within a configurable amount of time, determining, with the network access device, that the AAA server is no longer reachable by the network access device;
responsive to determining that the AAA server is not reachable by the network access device, sending a second keep alive message from the network access device to the AAA server, wherein the second keep alive message includes a different value for the trigger parameter to cause the AAA server to send a discovery request message to the network access device;
receiving, with the network access device, the discovery request message from the AAA server, wherein the discovery request message includes a request for the information about one or more of the subscriber sessions;
generating, with the network access device, a discovery response message that includes information about at least a portion of the plurality of subscriber sessions; and
sending, with the network access device, the discovery response message to the AAA server.

2. The method of claim 1 , wherein the received discovery request message specifies a search criterion, and wherein information about a maximum number of subscriber sessions fits in a single discovery response message, the method further comprising:
identifying, based on the search criterion, a set of subscriber sessions having subscriber records currently stored within a database of the network access device; and
determining whether a number of subscriber sessions included in the identified set of subscriber session is greater than the maximum number of subscriber sessions,
wherein generating the discovery response message is based at least in part on whether the number of subscriber sessions included in the identified set of subscriber session is greater than the maximum number of subscriber sessions.

3. The method of claim 2 , wherein, when the number of subscriber sessions included in the identified set of subscriber sessions is less than or equal to the maximum number of subscriber sessions, generating the discovery response message comprises:
retrieving information about each subscriber session of the identified set of subscriber sessions from a database of the network access device; and
generating the discovery response message, the discovery response message including the retrieved information about the set of subscriber sessions.

4. The method of claim 2 , wherein, when the number of subscriber sessions included in the identified set of subscriber sessions is greater than the maximum number of subscriber sessions that can fit in the single discovery response message, generating the discovery response message comprises:
identifying a portion of the identified set of subscriber sessions, wherein the portion of the identified set of subscriber sessions includes a number of subscriber sessions that is less than or equal to the maximum number of subscriber sessions;
retrieving information about the portion of the identified set of subscriber sessions from a database of the network access device; and
generating the discovery response message, the discovery response message including the retrieved information about the portion of the identified set of subscriber sessions.

5. The method of claim 2 ,
wherein the generated discovery response message includes a result code that indicates success when the number of subscriber sessions included in the identified set of subscriber sessions is less than or equal to the maximum number of subscriber sessions that can fit in the single discovery response message, and
wherein the generated discovery response message includes a result code that indicates limited success when the number of subscriber sessions included in the identified set of subscriber sessions is greater than the maximum number of subscriber sessions that can fit in the single discovery response message.

6. The method of claim 2 , wherein identifying the set of subscriber sessions based on the search criterion comprises identifying subscriber sessions having a session identifier that is lexicographically greater than a value of the search criterion.

7. The method of claim 1 , wherein the received discovery request message includes a search criterion, and wherein generating the discovery response message further comprises:
identifying a set of subscriber sessions having a corresponding subscriber identifier that is lexicographically greater than a value of the search criterion included in the discovery request message.

8. The method of claim 1 , the discovery request message and the discovery response message are each formatted in accordance with an authentication, authorization, and accounting protocol.

9. A network access device comprising:
one or more network interfaces to send and receive packets associated with a plurality of subscriber session; and
a subscriber management service unit having a database of subscriber records to store subscriber information for the subscribers sessions upon authenticating the subscribers with an authentication, authorization, and accounting (AAA) server,
wherein the subscriber management service unit is configured to send a first keep alive message from the network access device to the AAA server, wherein the first keep alive message includes a trigger parameter, wherein the trigger parameter specifies an initial value, when a response to the first keep alive message is not received from the AAA server and by the network access device within a configurable amount of time, determine that the AAA server is no longer reachable by the network access device, responsive to determining that the AAA server is not reachable by the network access device, send a second keep alive message from the network access device to the AAA server, wherein the second keep alive message includes a different value for the trigger parameter to cause the AAA server to send a discovery request message to the network access device, receive the discovery request message from the AAA server using the network interface, wherein the discovery request message includes a request for information about a plurality of subscriber sessions, and generate a discovery response message that includes information about at least a portion of the plurality of subscriber sessions, and send the discovery response message to the AAA server using the network interface.

10. The network access device of claim 9 ,
wherein the received discovery request message includes a search criterion,
wherein information about a maximum number of subscriber sessions fits in a single discovery response message, and
wherein the subscriber management service unit further comprises:
active session contexts configured to store subscriber session information; and
a session control module configured to identify a set of subscriber sessions of the active session contexts that match the search criterion, determine whether a number of subscriber sessions included in the identified set of subscriber session is greater than the maximum number of subscriber sessions,

Assignees

• Romanov Aleksey
• Raison Paul
• Juniper Networks Inc

Inventors

• Romanov Aleksey
• Raison Paul

Classifications

• H04L67/1008

  based on parameters of servers, e.g. available memory or workload (monitoring of computer activity G06F11/30) · CPC title

• H04L29/12509 Primary

  Electricity · mapped topic

• H04L67/145 Primary

  avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session · CPC title

• H04L61/2567

  for reachability, e.g. inquiring the address of a correspondent behind a NAT server · CPC title

• H04L61/503

  using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter · CPC title