Distributed subscriber management system

Abstract

A distributed subscriber management system and method that controls access to a network preventing unauthorized traffic through the access network and providing centralized access control between user networks. The system and method provide controlled access through the use of one of several technologies including user authentication, using PAP, CHAP, RADIUS, TACACS+, or other standard authentication means. The method includes the steps of receiving a connection request from a user located on one of the User Networks; interrogating the user for userid and password information; encrypting the userid and password information; transmitting the encrypted information, via the access network, to an authentication server attached to one of a plurality of external networks; decrypting the information at the authentication server; and transmitting an authentication message from the authentication server of the external network to the access control node via the access network. The preferred method includes the additional step of challenging all data leaving the access control node.

What is claimed is:  
     
         1 . A distributed subscriber management method for a user network for performing user authentication for an external network at an access control node, the external network being connected to the access control node by means of an access network; comprising: 
 (a) receiving, at an access control node operatively connected to a plurality of user networks, a data unit from a user located on one of the plurality of user networks;    (b) determining that the data unit requires authentication;    (c) authenticating the determined data unit; and    (d) determining that the authenticated data unit is eligible for transmission.    
     
     
         2 . The distributed subscriber management method as claimed in    claim 1   , wherein authenticating includes interrogating the user for access information.  
     
     
         3 . The distributed subscriber management method as claimed in    claim 2   , wherein authenticating includes transmitting the access information to an authentication server of an external network.  
     
     
         4 . The distributed subscriber management method as claimed in    claim 3   , wherein authenticating includes transmitting an authentication message from the authentication server to the access control node to permit the user to access the external network.  
     
     
         5 . The distributed subscriber management method as claimed in    claim 4   , further including encrypting the access information at the access control node prior to transmitting the access information; and decrypting the access information at the authentication server.  
     
     
         6 . The distributed subscriber management method as claimed in    claim 3   , wherein the authentication server of the external network employs remote authentication dial-in user service protocol.  
     
     
         7 . The distributed subscriber management method as claimed in    claim 3   , wherein the authentication server of the external network employs password authentication protocol.  
     
     
         8 . The distributed subscriber management method as claimed in    claim 3   , wherein the authentication server of the external network employs challenge handshake authentication protocol.  
     
     
         9 . The distributed subscriber management method as claimed in    claim 3   , wherein the authentication server of the external network employs terminal access controller access control system.  
     
     
         10 . The distributed subscriber management method as claimed in    claim 1   , further including packet-labelling the data unit.  
     
     
         11 . The distributed subscriber management method as claimed in    claim 4   , further including determining the contents of the authentication message at the access control node.  
     
     
         12 . The distributed subscriber management method as claimed in    claim 11   , further including dropping the data unit if the contents indicate rejection.  
     
     
         13 . The distributed subscriber management method as claimed in    claim 11   , further including examining the authentication message for authenticity.  
     
     
         14 . The distributed subscriber management method as claimed in    claim 1   , further including collecting statistical usage information at the access node.  
     
     
         15 . An integrated access device, for placement between a user network and an external network, the external network having an access rights authentication server, comprising: 
 a user network interface for operatively connecting to a plurality of user networks to receive data units from the plurality of user networks;    an authentication agent, operatively connected to the user network interface for authenticating, authorising and forwarding data units received from the plurality of user networks;    an external network interface, operatively connected to the authentication agent, for forwarding data units authorised by the authentication agent to an external network.    
     
     
         16 . An integrated access device as claimed in    claim 15   , wherein the user network interface includes a plurality of ingress cards and the external network interface includes an egress card.  
     
     
         17 . An integrated access device as claimed in    claim 15   , wherein the authentication agent includes a local authorisation table for authorising data units.  
     
     
         18 . An integrated access device as claimed in    claim 15   , wherein the authentication agent includes network address assignment and release means.  
     
     
         19 . An integrated access device as claimed in    claim 15   , further including service level enforcing means.  
     
     
         19 . An integrated access device as claimed in    claim 15   , further including network resource management means.  
     
     
         20 . An integrated access device as claimed in    claim 19   , further including means for statistical usage collection means.  
     
     
         21 . An integrated access device as claimed in    claim 20   , further including alarm monitoring means.  
     
     
         21 . An integrated access device as claimed in    claim 15   , wherein the authorization client includes a password authentication protocol client.  
     
     
         22 . An integrated access device as claimed in    claim 15   , wherein the authorization client includes a challenge handshake authentication protocol client.  
     
     
         23 . An integrated access device as claimed in    claim 15   , wherein the authorization client includes a terminal access controller access control system client.  
     
     
         24 . An integrated access device as claimed in    claim 15   , wherein the authorization client includes a remote authentication dial-in user service protocol client.