Broadband Network Gateway Unauthenticated User Traffic Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current broadband network gateways (BNG) inefficiently manage unauthenticated Internet Protocol (IP) users by allocating system resources regardless of authentication status, leading to unnecessary resource wastage, especially in high-traffic areas with roaming users.
Innovation Solution
Implementing a reserved media access control (MAC) address for unauthenticated devices, allowing them to use a common data channel for accessing authentication portals, thereby optimizing resource allocation and improving session management by withholding subscriber management until authentication is successful.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dedicated control plane sessions and data plane interfaces are allocated to each subscriber in the BNG, then authenticated users receive proper subscriber management functions, but system resources are unnecessarily consumed when unauthenticated users are treated the same way
Solution Approach 1:
The patent segments user handling into two distinct paths: authenticated users receive dedicated control plane sessions and data plane interfaces, while unauthenticated users are redirected to a shared data plane interface. This segmentation allows the BNG to allocate resources appropriately based on authentication status, avoiding unnecessary resource consumption for unauthenticated users while maintaining proper subscriber management for authenticated users.
2Ease of operation
If all unclassified data FSOL packets are sent to the CPU of the BNG to trigger authentication process, then authentication can be initiated for all users, but CPU usage increases unnecessarily for users who will not authenticate
Solution Approach 1:
The patent extracts unauthenticated user traffic from the main authentication processing path by redirecting it to a shared data plane interface. Instead of sending all unclassified data FSOL packets to the CPU, only authenticated users trigger the full authentication process through dedicated control plane sessions. This extraction reduces CPU usage by handling unauthenticated users through a more efficient shared interface path.
3Adaptability or versatility
If dedicated data plane interfaces are allocated to each user, then each user receives individualized network service, but resource allocation efficiency decreases when unauthenticated users consume the same resources as authenticated users
Solution Approach 1:
The patent implements dynamic resource allocation where the type of data plane interface assigned to a user depends on their authentication status. Authenticated users receive dedicated data plane interfaces for individualized service, while unauthenticated users are assigned to a shared data plane interface. This dynamic approach allows the system to adapt resource allocation to actual needs, providing individualized service when necessary while conserving resources when individualization is not required.
Data Source
AI summary
A network device, method, and computer program product to perform an operation, the operation comprising defining, in a routing device, a data channel for unauthenticated devices on a virtual local area network (VLAN), wherein the data channel is associated with a reserved media access control (MAC) address, receiving a first sign of life (FSOL) packet from a device, and upon determining that an authentication process for the device has failed, sending, by the routing device to the device, an unsolicited link layer advertisement with the reserved MAC address as the link layer address for the data channel.