DE10345015A1 - Method and arrangement for external control and management of at least one WLAN subscriber assigned to a local radio network - Google Patents

Abstract

The invention relates to a method for the external control and management of at least one WLAN subscriber (32) assigned to at least one local radio network (12, 52), who can request services via a public TCP / IP network (80). The invention further relates to an arrangement of a plurality of communication networks, in particular for carrying out the method, and a control and administration device (90) for use in such a network arrangement. DOLLAR A In the course of the rapid spread of local radio networks, also known as WLANs, and their connection to the Internet, similar to the situation in the public telephone network, it makes sense to take measures that make system expansions and the integration of new features and services simple, flexible and can be done quickly. The programming effort should also be kept low. DOLLAR A A core idea of the invention is to be seen in the fact that when an Internet service is requested by a WLAN subscriber (32), the corresponding connection and service control is carried out and managed by an external device (90).

Description

The invention relates to a method for external control and management of at least one, at least assigned to a local radio network (Wireless Local Area Network; WLAN) Wireless operator the over a public TCP / IP network services can request. The invention further relates to an arrangement of several communication networks in particular execution of the procedure and a tax and administrative body for Use in such a network arrangement.

In the course of the rapid spread of local radio networks, hereinafter also referred to as WLANs, and their Connection to the Internet is similar to the situation in the public Telephone network makes sense, measures to take advantage of system extensions and integrating new ones Features and services can be carried out easily, flexibly and quickly can. The programming effort for the integration of new services should also be kept small.

A key concept of the invention is to be seen in this when an Internet service is requested by a WLAN subscribers the corresponding connection and service control from an external Perform setup and let it be managed.

The technical mentioned above Solves problem the invention on the one hand with the method steps of the claim 1.

According to this, methods are provided for the external control and administration of at least one WLAN subscriber assigned to at least one local radio network (Wireless Local Area Network; WLAN), who can request services via a public TCP / IP network. At least one local radio network is connected to the public TCP / IP network via at least one interface device, hereinafter also referred to as an access cube, and an external control and administration device. The process has the following steps:
A WLAN subscriber requests a service;
the authorization of the access of the service requesting WLAN subscriber to the TCP / IP network is checked;
a connection is established via the TCP / IP network to the WLAN user if the WLAN user has access authorization to the TCP / IP network; and
Signaling and / or information data are transmitted and managed via the TCP / IP network to the external control and administration device.

At this point it should be noted that it is the public TCP / IP network around the Internet and, in the case of a WLAN subscriber, around a terminal, such as For example a notebook or a personal computer with a WLAN card can act. With the tax and administrative institution it can is a Nomads platform that meets all the requirements of one WLAN network should cover. Services in the sense of the invention are for Example of the Voice over IP service and all services available via Internet service providers.

Advantageous further developments are Subject of the subclaims.

An advantageous feature of the invention can be seen in that with regard to a service-requesting Wireless subscriber accruing time and / or volume dependent billing data in the tax and administrative body to be collected from it corresponding billing records to create. The accounting records can then be saved as files and processed further.

Before a service requesting WLAN subscriber Get access to the TCP / IP network, must be checked be whether he's at all has an access authorization. This test can be started in an interface device that the local radio network, in whose coverage area the WLAN user is located. Is the service-requester WLAN participants with regard to this interface setup already enabled, a connection from the WLAN subscriber to the Service providers, also service providers or especially Internet service Called provider, about the public TCP / IP network established. The connection is controlled and monitored the tax and administrative body.

However, if the WLAN subscriber requesting the service has not yet been activated with regard to this interface device, the following method steps are carried out:
At least one individual identifier, in particular the MAC (Medium Access Control) address and / or the IP address of the WLAN subscriber requesting services, are transmitted to the external control and administration device;
in response to the individual identifier, it is checked in the external control and administration device whether the WLAN subscriber requesting the service has already been granted access authorization; and
A connection is established via the TCP / IP network if the WLAN subscriber has access authorization to the TCP / IP network. This procedure, in which the access authorization of a WLAN subscriber requesting services is issued and administered centrally in the control and administration device, is also called authentication. This method enables an activated WLAN subscriber to move between different interface devices of the same local radio network or other local radio networks because of what is also referred to as roaming, without having to re-authenticate each time an interface device is changed.

Is the service requesting WLAN subscriber neither in the interface device nor in the control and Management device registered, that is, this WLAN subscriber If access authorization has not yet been granted, the WLAN subscriber will asked to enter his authentication data. The WLAN subscriber receives After entering the authentication data, a possibly restricted access authorization to the TCP / IP network. The authentication data can contain the MAC and IP address of the WLAN subscriber as information data.

For example, to uncover cases of fraud to be able becomes an authorization in the tax and administrative institution of the activated WLAN subscriber. Here, for example checked, whether the WLAN subscriber still has credit in the case of a prepaid customer owns, or may use the requested service at all. This functionality is also referred to as fraud management in the description.

At this point it should be mentioned that a local radio network, which interfaces and network access points, also called access points, contains in a so-called location, which can be a room or a building can, is implemented. A location forms together with the one in it implemented a local radio network a hotspot.

To detect system overload can, the degree of utilization of at least one local radio network in recorded and logged by the external control and administrative facility, so that depending the degree of utilization of a WLAN subscriber requesting services access authorization to the TCP / IP network at least temporarily can be denied.

To the utilization of the local radio networks to be able to recognize the identifier in the external control and administrative facility and / or the owner of at least some local radio networks and / or the address of the interface devices assigned to each local radio network saved. Synonymous with the identifier or the owner of a Local radio network is the identifier or the owner of the corresponding one Location or the corresponding hotspot in which the local radio network is implemented. additionally becomes a table in the external control and administrative facility managed, in the service requesting WLAN subscriber, the one Access authorization has been granted, the identifier and / or the Owner of the local radio network and / or the address of the local one Assigned radio network assigned interface device to that of the WLAN subscribers is currently logged on. The management of this data can be done in a facility as detailed in the description is referred to as a WLAN inventory module.

To a service requesting WLAN subscriber The first-time system registration can facilitate for at least one local radio network and / or at least one WLAN participant in the external control and administration device an individual website, for example in the form of a user interface or of a registration form that is transmitted to a service-requesting WLAN subscriber can be.

To get accurate billing records for a paid To be able to create a connection it is necessary to specify the payment type of the service requesting WLAN subscriber to know. For example, if it is a participant who for the use of services over the public TCP // IP network has paid in advance (voucher), it will be checked before activation whether the Service-requesting WLAN subscribers via one Credit, and that if so, a connection disconnected or none Connection is established when the credit has been used up is.

The above technical problem is also solved by an arrangement of several communication networks according to claim. For this purpose, the arrangement has at least one local radio network (Wireless Local Area Network; WLAN), which is connected to a public TCP / IP network via at least one interface device, at least one WLAN subscriber and
a control and administration device assigned to the public TCP / IP network. The interface device and the control and administration device have devices for exchanging signaling and / or
Information data about the public TCP / IP network, the interface device and / or the control and administration device each having a test device for checking the access authorization of a service-requesting WLAN subscriber to the public TCP / IP network. The control and administration device also has a device for controlling the establishment of a connection via the public TCP / IP network to the service-requesting WLAN subscriber, depending on the WLAN subscriber having access authorization to the TCP / IP Owns the network.

Advantageous further developments are Subject of the subclaims.

The arrangement is characterized in that the signaling data contain accounting data and that the Control and administrative device a device for generating of billing records from the billing data and a facility for forwarding the Accounting records to a billing unit.

The arrangement is further characterized in that the interface device is a device for transmitting at least one individual identifier, in particular the Has MAC address and / or the IP address of a service-requesting WLAN subscriber to the external control and administration device, the test device of the control and administration device, in response to the individual identifier, being able to check whether the service-requesting WLAN subscriber access authorization has already been granted.

Preferably, the control and Administrative facility means for storing an individual Website for at least one local radio network and / or for at least one WLAN subscriber and a device for transmission a website to a service requesting WLAN subscriber.

The test facility of the tax and Administrative facility can be a facility for checking the Authorization of a service-requesting WLAN subscriber assigned be, for example, the fraud explained in the description or fraud management.

The control and administrative facility can for this purpose a device for storing the identifier and / or the owner of a local radio network and / or the address of the have interface devices assigned to local radio networks. Furthermore, they contain a facility for managing a table in which anyone requesting services WLAN subscriber who has been granted access authorization the identifier and / or the owner of the local radio network and / or the address of the interface device assigned to the local radio network is assigned to which the WLAN subscriber is currently logged on is.

In addition, the tax and administrative facility a device for detecting the degree of utilization of at least one have local radio network and a blocking device, which is dependent the access level of a WLAN subscriber requesting services can refuse to the TCP / IP network.

To generate accurate billing records to be able the control and administration device has a device for Determine the payment type of a service requesting WLAN subscriber.

To make changes to the arrangement for example by connecting another local radio network quickly, offer new services without much effort and The control and administrative facility is able to improve the security of the arrangement trained as a computer network. The facilities or functionalities of the tax and management device, which is implemented by hardware and / or software components are distributed to certain computers in the computer network.

At this point it should be mentioned that in the description of the term "module" often for the terms calculator, Setup or functionality is used.

According to a preferred embodiment the arrangement of at least a first computer, in the description also called kernel module, in which the test facility, the facility for Generation of accounting records, the device for detecting the degree of utilization of at least one local radio network, the blocking device and the device for Determining the payment type is implemented.

Furthermore, at least one is second Calculator, also called view module in the description, in which the Setup for storing individual web pages and setup to transmit implemented a website for a service-requesting WLAN subscriber and at least a third computer, hereinafter also BSS (Business Support Service) module, provided in which among other things the accounting unit is implemented.

The control and administration device can have a device for monitoring and managing the computers and the distribution of the devices or functionalities of the control and administration device on the computers. This facility is referred to in the detailed description as the Nomads Distribution Functionality (NDF) module. See also 5 ,

The technical described above Problem is also caused by a tax and administrative body solved, for use in an arrangement of several communication networks according to one of claims 13 to 24 is suitable.

The invention is described below of an embodiment explained in connection with the accompanying drawings. Show it:

1 1 shows a schematic representation of an arrangement of two local radio networks and the Internet in which the invention is implemented,

2 a simplified representation of the in 1 shown control and administration network,

3 a detailed view of the kernel module of the in 2 shown control and administration network,

4 a block diagram of the in 2 BSS module shown,

5 a schematic representation of the NFD module,

6 the signaling and information flow between the WLAN subscriber, the access cube and the control and administration network, and

7 the flow of information within the tax and administrative network.

1 shows an exemplary network arrangement in which the invention is implemented. The Network arrangement has a first local radio network 12 on, which is also referred to as WLAN (Wireless Local Area Network). The WiFi 12 has two access points 31 and 32 each with a WLAN radio area 30 respectively. 40 supply. The access points 31 and 32 are also called access points. The access points 31 and 32 are with a wireless internet interface 60 connected, which is also called Access Cube or Nomads Access Cube in the following. Via the Access Cube 60 can use the wifi 12 with a public TCP / IP network, in this case the Internet 80 get connected. Within the WiFi 12 there is a WLAN subscriber 32 , which is for example a notebock with a WLRN card. The WiFi 12 , the access points 31 and 41 as well as the Access Cube 60 form a so-called hotspot 10 or a so-called location, which can be a hotel, for example. In this case, the access points 31 and 32 be arranged in different rooms of the hotel.

Another local radio network 52 includes an access point 51 and the associated WLAN radio range 50 , The access point 51 is with a wireless internet interface 70 , also called Access Cube. Via the Access Cube 70 can use the wifi 52 with the Internet 80 throw connected. WIRELESS INTERNET ACCESS 52 and the Access Cube 70 form a hotspot 20 or location 20 , The hotspot 20 can be a restaurant. The internet 80 is a tax and administration network 90 assigned, which is also referred to below as the Nomads platform. An Internet service provider is an example 100 in 1 shown, whose services for example by the user of the notebook 32 with the interposition of the Nomads platform 90 over the internet 80 can be requested.

The access cubes 60 and 70 exist in two different versions. One variant works as a transparent bridge or bridge, that is, according to the seven-layer model or the DOD model in the plane 2 classified. It can also be referred to as an L2 (Layer 2) access cube. This version can be the standard component if there are further requirements regarding the management of WLAN users. There is also an IP-based access cube, which is why it is also referred to as an L3 (Layer 3) access cube.

• – Wenn der Access-Cube als transparente Bridge arbeitet, wird die eigentliche Verbindung zwischen einem WLAN-Teilnehmer und dem aufgerufenen Service diesen Access-Cube auf der IP-Ebene nicht betrachtet.
• – Unter der Voraussetzung dass die eingesetzten MAC-Adressen in der WLAN-Karte des WLAN-Teilnehmers 32 nicht verändert werden kann, kann durch die Speicherung der MAC-Adresse in der Plattform 90 auch bei einer Bewegung des WLAN-Teilnehmers 32 im lokalen oder kostenfreien Contentbereich der Plattform 90 dessen Bewegungsspur aufgezeichnet werden. Vielfältige Betrugs- oder Frauderkennungsmechanismen bauen auf der Speicherung dieser Daten auf.

The L2 version of the access cubes 60 and 70 works on the control of the connection at the level of layer 2. This has some effects on the architecture in the implemented network infrastructures:

• - If the access cube works as a transparent bridge, the actual connection between a WLAN subscriber and the called service of this access cube is not considered at the IP level.
• - Provided that the MAC addresses used in the WLAN card of the WLAN subscriber 32 cannot be changed by storing the MAC address in the platform 90 even if the WLAN subscriber moves 32 in the local or free content area of the platform 90 whose movement track are recorded. A variety of fraud or woman detection mechanisms are based on the storage of this data.

Nomads stands for a platform that, similar to a GSM network or other network structures such as the intelligent network, should cover all requirements for the WLAN area. WLAN hotspot facilities are offered by various manufacturers. The availability of these products suggests that they will be distributed in various price ranges, so that a WLAN hotspot operator can select the appropriate technology based on certain price / performance criteria. The Nomads platform 90 supports all Wi-Fi manufacturers, as they have hotspots in the background 10 and 20 connects via a TCP / IP network. This integration is implemented by a decentralized component, each in the place of the WLAN hotspots 10 and 20 is established where the transition to the public TCP / IP network 80 he follows.

The decentralized nomad component is the Access Cubes 60 and 70 , The Access Cubes 60 and 70 provide the necessary data so that the requirements from the WLAN radio areas 30 . 40 and 50 on the Nomads platform 90 can be realized. How 1 shows the access cubes 60 and 70 over the public TCP / IP network 80 to the Nomads platform 90 connected. The connection can be protected by various encryption methods, so that the information exchange between the access cubes 60 and 70 and the central Nomads platform 90 is protected.

As encryption technologies for Example SSL (Secure Socket Layer) -, VPN (Virtual Private Network) - or the IPSec technology can be applied.

For further understanding or to differentiate it from other architectures, it should be mentioned here that the communication path of real data, that is the actual information, between the WLAN subscriber 32 and the corresponding service provider 100 directly over the internet 80 leads while signaling data between the Nomads access cubes 60 and 70 and the Nomads platform 90 over the internet 80 be replaced.

The Nomads platform 90 is schematically in 2 shown and is composed of three layers, the View Module 112 . 114 . 116 , Kernel module 120 , Default kernel module 125 and Business Support Services module 130 designated who the. The three layers can contain any number of modules and thus form a structured network.

In the view modules 112 . 114 . 116 All requirements regarding a user interface (system information, reference to local content, input options for information by the end user or operator) are implemented. In addition, a registration functionality can be implemented in each view module, which enables a WLAN subscriber to log on to an Access Cube and / or the platform 90 can be made available. Furthermore, all available providers (for example vWISP, WISP, GSM-Frovider, etc.) can be stored in each view module. Voucher generation with regard to a WLAN subscriber requesting services is also possible in a view module.

For each location, in the present case these are preferably the locations or hotspots 10 and 20 and the in 1 Location C, not shown, has its own look and feel in the form of a homepage in the view module 112 , the view module 114 or the view module 116 be filed. At this point it should be mentioned that for each location a separate view module, which in 2 With 112 . 114 and 116 can be set up. Alternatively, all locations 10 . 20 and C can be created in a single view module. In the view modules, the location identifier, the address of the associated access cube, the MAC and / or IP address of the WLAN subscriber who is logged on to the respective access cube and user interface elements for creating an individual, location-related website can be stored. A location, for example the location, is also conceivable 10 to be subdivided into sub-locations (e.g. rooms of a hotel), whereby the address of each sub-location can also be stored in the corresponding view module.

In the kernel module 120 the accounting data that can be obtained by metering or accounting essentially converge. This data is compressed as much as possible and the subsequent Business Support Services (BSS) module 130 made available. The data collected, whether it is available as individual data or as aggregated data, is irrelevant here, is collected in files and is transferred to the corresponding BSS module via file transfer functionalities of the SOAP protocol 130 made available.

In the BSS module 130 are all platform requirements 90 implemented, which result from the implementation of the value chain as well as from data collection in the decentralized access cubes 60 and 70 result.

The layer model enables the specific adaptation of the platform 90 to the needs of the locations or to support the framework conditions specified there. How 2 suggests, this flexibility is supported by the modular system Nomads. The different locations 10 . 20 and C, which in 1 is not shown, each on an individual view module 112 . 114 respectively. 116 where the "personal" look and feel can be reproduced. View modules, the highly available locations or locations with a high WLAN load, such as the location 10 , are each connected to a separate kernel module. In the present example, the view module 112 with the kernel module 120 connected. Other view modules in which locations with medium or low loads are created are connected to a standard or default kernel module. In this example, the view modules are 114 and 116 with the default kernel module 125 connected. The kernel module 120 and the default kernel module 125 recognize the respective locations and pass the corresponding information to the BSS module 130 further.

• – Flexible Verteilung der Komponeneten auf verschiedene Rechner über Cluster- und Netzwerkgrenzen hinweg. Die Komponenten können Hardware oder Softwarekomponenten enthalten.
• – Mögliche Rückfallszenarien für den Ausfall von zentralen Komponenten wie z.B. Kernel Module oder BSS Module. In 5 sind beispielsweise zwei Module 150 und 160 dargestellt, in denen gleiche oder verschiedene Funktionalitäten implementiert sein können.

The Nomads platform 90 also enables functionalities to be distributed to several modules or computers arranged separately, as shown in 5 is indicated. A so-called Nomads distribution functionality is used for the technical implementation of the distribution 140 (Nomads Distribution Functionality, NDF), which can provide the following functions:

• - Flexible distribution of the components on different computers across cluster and network boundaries. The components can include hardware or software components.
• - Possible fallback scenarios for the failure of central components such as kernel modules or BSS modules. In 5 are two modules, for example 150 and 160 shown in which the same or different functionalities can be implemented.

The network services of the NDF offer at its core a kind of professional directory service that does the assignment between the modules, possible technical alternative modules defined and also take over the routing should. For in the latter case, web service routing should be used become.

Assume that the module 160 offer a specific service. This service is in the NDF 140 entered. If the module 150 requires this service, it requests this service (Resolve) and binds itself to the service (Bind) upon receipt of the reference. This cycle is also offered in other frameworks (JINI), but is sometimes referred to differently there.

The communication relationships between the Access Cube are shown below as examples 60 and the platform 90 combined with 6 explained.

• – Bei einem initialen Zugriff des WLAN-Teilnehmers 32 über den Access Cube 60 auf das Internet 80 muss ein Anfrage (Request) auf die Plattform 90 geleitet werden, damit die folgenden Dienste realisiert werden können: – Authentifizierung insbesondere zur Bildung eines WLAN-Teilnehmers in der Plattform 90. Es wird festgelegt, welche personalisierten Daten und nicht personalisierten Daten (Voucher) für eine kostenpflichtige Verbindung zur Abrechnung herangezogen werden können. – Autorisierung. Das heißt, es wird die Akzeptanz bzgl. der WLAN-Nutzung geprüft. Ferner wird geprüft, ob der Dienste-anfordernde WLAN-Teilnehmer für den angeforderten Dienst freigeschaltet werden kann.
• – Nach der Freischaltung des WLAN-Teilnehmers wird in der Plattform 90 eine "Beobachtungseinheit" aktiviert, um Abrechnungsdaten von dem Access Cube zu sammeln, an dem sich der WLAN-Teilnehmer angemeldet hat.
• – Sperrung von spezifischen WLAN-Teilnehmern oder Endgeräten nach Vorgaben von Betreibern oder anderen Institutionen durch die Plattform 90.

In principle there are between an access cube, for example the access cube 60 , and the Nomads platform 90 following signaling and In exchange formation data or implement the following mechanisms:

• - With an initial access by the WLAN subscriber 32 via the Access Cube 60 on the internet 80 a request must be made to the platform 90 be routed so that the following services can be implemented: - Authentication, in particular to form a WLAN participant in the platform 90 , It is determined which personalized data and non-personalized data (voucher) can be used for a chargeable connection for billing. - authorization. This means that acceptance with regard to WLAN use is checked. It is also checked whether the WLAN subscriber requesting the service can be activated for the requested service.
• - After the activation of the WLAN participant is in the platform 90 an "observation unit" is activated in order to collect accounting data from the access cube to which the WLAN subscriber has registered.
• - Blocking of specific WLAN subscribers or end devices according to the specifications of operators or other institutions through the platform 90 ,

6 shows the WLAN subscriber 32 , the Access Cube 60 of the hotspot 10 , the view module 112 and the kernel module 10 the platform 90 , The block "Internet access" is intended to access the Internet 80 symbolize. The modules are listed below.

• – WISP-Account
• – VWISP-Account
• – ISP-Account
• – Kreditkarte
• – Telefon-Nr.
• – MAC-Adresse des WLAN-Teilnehmers
• – IP-Adresse des WLAN-Teilenehmers

Every time the WLAN subscriber accesses 32 to the public TCP / IP network 80 , here the Internet, is in the Access Cube 60 checked (User Valid?) whether the WLAN subscriber 32 to the internet 80 can be switched through. Requires the user of the WLAN participant 32 access to the Internet for the first time 80 via the Access Cube 60 on is the WLAN subscriber 32 unknown there, so access to the Access Cube 60 is denied. According to a standard behavior, the WLAN subscriber 32 over the internet 80 for example with the view module 112 connected and a request signal (Request), which the MAC address and / or IP address of the user 32 can become the view module 112 transfer. The view module 112 forwards the MAC address of the WLAN subscriber contained in the request 32 to the kernel module 120 , especially a WLAN inventory module 140 as it is in 3 is shown, further. Provides the WLAN inventory module 140 found that the WLAN subscriber 32 or whose MAC address is not known, it assigns it to the view module 112 one for the location 10 stored login page for the WLAN subscriber 32 transferred to. This page gives the WLAN subscriber 32 the possibility of logging on to the Access Cube in different ways 60 and the platform 90 to be able to authenticate. For authentication of the WLAN subscriber 32 In principle, the following authentication data can be used:

• - WISP account
• - VWISP account
• - ISP account
• - Credit card
• - Phone number.
• - MAC address of the WLAN subscriber
• - IP address of the WLAN subscriber

The authentication data is then via the Access Cube 60 , the Internet 80 , the view module 112 to the WLAN inventory module 140 of the kernel module 120 transfer.

The WLAN inventory module 140 forms, among other things, the basis for roaming a WLAN subscriber between different access cube areas, for example through the hotspots 10 and 20 be formed. For example, based on the information that the WLAN subscriber 32 with the MAC address m in the Access Cube 70 the location 20 is registered and is now on the Access Cube 60 the location 10 want to be the basis for roaming. Because as soon as the WLAN subscriber 32 Once logged on to an access cube, the corresponding authentication data is stored in the kernel module 120 , preferably in the WLAN inventory 140 , as well as registered in the respective Access Cube. Since in the above case the authentication data of the WLAN subscriber 32 in the kernel module 120 are registered, do not need to log in again or authenticate to the Access Cube 60 be performed. Depending on the structure of the infrastructure, the positive identification of the WLAN subscriber 32 cause it to be activated for internet use. In other words, the Nomads platform enables 90 that the WLAN subscriber 32 can move from one hotspot to another hotspot without having to log onto the platform each time a new hotspot is entered 90 or an Access Cube.

With the help of the WLAN inventory 140 Roaming across multiple access cube areas can also be supported if a hotspot is realized by building multiple access cubes, or if multiple hotspots overlap in their geographical spread. In these cases, too, a WLAN subscriber does not need to authenticate again. Because after his first successful registration ister in the platform 90 registered as an authorized WLAN subscriber.

The WLAN inventory module 140 is like 3 shows with the memory 160 , which can store location information or information about the location owner. In the store 160 there is information about which location owner owns which location. The location information is sent to the WLAN inventory module via an input port 140 delivered so that this information also when the WLAN inventory module is called 140 be available. It should be noted that the WLAN inventory module 140 , as in 3 shown part of the kernel module 120 is. However, it can also be implemented separately.

• – Setzen von Attributen oder Attribute-Mengen (Filter), die während einer Verbindungsaufnahme nach Black-Listen überprüft werden sollen.
• – Überprüfung der angemeldeten WLAN-Teilnehmer, indem vorhandene Informationen über die WLAN-Teilnehmer aus dem WLAN-Inventory Modul 140 ausgelesen und mit den gesetzten Attributen verglichen werden.

Was the authentication of the WLAN subscriber 32 successfully carried out, a fraud or fraud management is subsequently carried out 155 in a fraud management module 150 called like this in the 3 and 6 is shown. Fraud management uses appropriate lists of characteristics to determine whether certain users or WLAN participants, in the present case the WLAN participants 32 should be blocked. When a critical feature of a user who is currently logged in is found, the Internet access of the WLAN subscriber is blocked. If no suspicious features are found, the user is activated and can now use the Internet 90 on services such as the Service Probider 100 access. The characteristics can be entries from service providers, from which it can be seen that certain users still have outstanding invoices. The fraud management module should therefore at least fulfill the following two tasks:

• - Setting attributes or attribute sets (filters) that are to be checked for blacklists during connection.
• - Checking of the registered WLAN participants by adding information about the WLAN participants from the WLAN inventory module 140 read out and compared with the set attributes.

During the period of service use, the WLAN subscriber 32 monitored by suitable mechanisms and connection-related and / or WLAN subscriber-related data are stored as a file in a memory 160 , such as in 3 shown, written.

For this, an in 3 Session Watcher shown 170 , also called session observer, can be used. The session watcher 170 monitors the WLAN subscriber 32 over the internet 80 to a service provider, for example the service provider 100 , established connection. The session watcher 170 must recognize from the received data whether the WLAN subscriber 32 for example, a voucher, in which the costs incurred are paid for by prepaid cards. The session monitoring device is for this purpose 170 with a voucher management module 180 connected, which in turn is connected to the memory 160 can be connected as in 3 shown. Is it the WLAN subscriber 32 to a voucher, accounting-related signaling data caused by the access cube 60 on which the WLAN subscriber 32 is currently logged in, that are generated in the kernel module 120 Corresponding billing data records, also CDR (CALL Detail Record) saved and as files for the voucher management module 180 be transmitted.

• – VoucherID
• – VoucherPasswort
• – VaucherWert
• – VoucherZeit

gespeichert. Ob die Voucher dabei durch administratives Personal erzeugt und durch Marketing/Sales Kapazitäten vor Ort verkauft werden, oder ein Voucher personalisiert erzeugt wird, spielt dabei keine Rolle. Bei beiden Ansätzen wird der Authentifizierungvorgang eines WLAN-Teilnehmers durch die Voucherwerte VoucherID und VoucherPW angestoßen, wobei das Kernel Modul 120 dann die Presales-Eigenschaft der für den WLAN-Teilnehmer hergestellten Verbindung registriert. Damit kann nun das Kernel Modul 120 nicht nur die CDR-Datensätze der Verbindung generieren, sondern er nimmt auch Verbindung zum Voucher Management Modul 180 auf und minimiert das vorhandene Zeitkontigent des jeweiligen WLAN-Teilnehmers. Sobald das Guthaben eines WLAN-Teilnehmers aufgebraucht ist, wird das Kernel Modul 120 mit Hilfe des Fraud Management Moduls 150 die Verbindung über das Internet 80 trennen.The voucher management module 180 is triggered by view modules, in which currently registered WLAN subscribers are registered, to initiate a single voucher generation or a mass generation of vouchers. The vouchers are provided with the exemplary attributes

• - VoucherID
• - Voucher password
• - Vaucher value
• - Voucher time

saved. It does not matter whether the voucher is generated by administrative staff and sold on site through marketing / sales capacities, or whether a voucher is generated in a personalized manner. In both approaches, the authentication process of a WLAN participant is triggered by the voucher values VoucherID and VoucherPW, whereby the kernel module 120 then the presales property of the connection established for the WLAN subscriber is registered. Now the kernel module can 120 not only generate the CDR records of the connection, but it also connects to the voucher management module 180 and minimizes the existing time allocation of the respective WLAN subscriber. As soon as the credit of a WLAN participant is used up, the kernel module 120 with the help of the fraud management module 150 the connection over the internet 80 separate.

With a personalized process the vouchers are assigned to a specific person, i.e. the Voucher credit will be credited to one person. This Operation leads that the credit of a voucher is immediately set to zero and the user is "replenished" with this credit.

To carry out the authentication, you can use the WLAN inventory 140 both the MAC address and the IP address of the WLAn subscriber 32 be entered. The availability of this information depends on the access cube technology used. How 3 shows, manages the WLAN inventory 140 all relevant information about locations, such as the locations 10 and 20 , and assigns temporarily registered WLAN participants to the corresponding locations. Is the WLAN subscriber 32 instantly on the Access Cube 60 logged in, it is registered in the location's WLAN inventory 10 assigned. All of this information is stored in memory 160 stored.

As in 3 shown includes the kernel module 120 authentication performed so-called generic authentication in block 190 , in which the data received is checked to determine whether the data belongs to a voucher subscriber or a service provider. Depending on the test, either ISP (Internet Service Provider) authentication is then blocked 200 or a voucher authentication in block 210 carried out. block 200 is through an internet interface facility 220 with the Internet 80 connected. block 210 is with the voucher management module 180 connected.

How 3 shows are the function blocks 155 . 170 190 . 200 . 210 and the WLAN inventory module in the kernel module 120 implemented. The memory 160 , the internet interface 220 , the fraud management module 150 and the voucher management module 180 are outside the kernel module 120 shown. It is understood that the arrangement of the components shown only reflects an example. Of course, components of the kernel module 120 arranged externally and the components described 150 . 160 . 180 or 220 within the kernel module 120 be implemented.

• – Das BSS-Modul setzen auf Datenstrukturen auf, die vom Kernel Modul 120 und/oder 125 geliefert werden.
• – Das BSS-Modul besitzt keine direkte Verbindung zum Kernel Modul 120 und/oder 125; es existiert lediglich eine lose Kopplung auf der Ebene von CDR-Dateien.

The BSS module 130 is in 4 presented in more detail. The BSS module is preferably characterized by the following properties 130 out:

• - The BSS module is based on data structures created by the kernel module 120 and or 125 to be delivered.
• - The BSS module has no direct connection to the kernel module 120 and or 125 ; there is only a loose link at CDR file level.

The BSS module 130 includes a Voucher Settlement Module (VSM) 131 , an IPDR mediator (IPDR-M) 132 , a tariff module TM) 135 , a rating module (RM) 133 , a billing module (BM 134 and a settlement module (SM) 136 ,

• – Access Cube ID
• – Voucherkennung (dieser CDR gehört zu einer Prepaid-Ausprägung)
• – Zeitstempel (Beginn und Ende)
• – Tarifinformationen (Preis pro Zeiteinheit)
• – Mengeninformation

The kernel module 120 generates, for example, credit settlement data records, also called voucher CDRs, with the following parameters:

• - Access Cube ID
• - Voucher recognition (this CDR is part of a prepaid version)
• - timestamp (start and end)
• - Tariff information (price per unit of time)
• - Quantity information

• – Zuordnung der Access Cube ID auf eine Lokation
• – Zuordnung von Lokation auf Revenue-Share Beteiligte oder Revenue-Share

Based on this information, the Voucher Settlement Module 131 for example with access to the database 160 the platform 90 carry out the following processing steps:

• - Assignment of the Access Cube ID to a location
• - Allocation of location to revenue share participants or revenue share

In a first processing step are from the individual CDR's the sum of the connections per location or hotspot is calculated. This sum or turnover is multiplied by the period with the tariff information. about the information of the Revenue Share shares of the participants can be individual revenue shares are calculated and these records as Revenue Share Records (RSR) can be saved.

The IPDR mediator 132 generates IPDR data records from the CDRs that do not have the voucher ID according to the NDM-U standard of the non-profile organization IPDR.Org.

In the tariff module 135 it contains all information that results from the different tariffs of the corresponding locations. The different customer groups must also be taken into account. The details result from the respective project requirements. At its core, a generic model is implemented that can cover most requirements.

The rating module 133 is also implemented generically so that the relevant requirements can be implemented by the participants. The rating module 133 generates weighted so-called R-CDRs from the CDRs.

• – Erzeugung der Rechnung (invoice)
• – Druck der Rechnung nach vorgegebenen Format (Look&Feel des z.B. vWISP)
• – Übergabe der Bezahlungskontrolle an das FIBU
• – Mahnwesen

The billing or billing module 134 uses, for example, the billing functionality of T-COM. All from the rating module 133 R-CDRs generated are sent via a file interface, for example, to the T-COM accounting system. The following business steps are implemented here:

• - Generation of the invoice
• - Print the invoice according to the specified format (look and feel of, for example, vWISP)
• - Transfer of payment control to the FIBU
• - Dunning

• – Kenntnis über die Beteiligten in einer definierten Wertschöpfungskette oder Kenntnis über die prozentuale Aufteilung des Umsatzes
• – Abbildungsinformationen von Lokationen auf die möglichen RevenueShare Modelle.

Parallel to the billing module 134 are those of the rating module 133 generated R-CDR's to the settlement module 136 headed, which has the following information

• - Knowledge of those involved in a defined value chain or knowledge of the percentage breakdown of sales
• - Map information of locations on the possible RevenueShare models.

With this knowledge, R-CDR's per location calculated and assigned to those involved.

In 7 it is shown which data is managed in which modules and which data is exchanged between which modules.

Claims (33)

Method for external control and management of at least one, at least one local radio network (WLAN: Wireless Local Area Network, 12 . 52 ) assigned WLAN subscriber ( 32 ) that is connected via a public TCP / IP network ( 80 ) Can request services, whereby at least one local radio network ( 12 ; 52 ) via at least one interface device ( 60 ; 70 )) and an external tax and administrative body ( 90 ) with the public TCP / IP network ( 80 ) are connected with the following steps: a WLAN subscriber ( 32 ) requests a service; the authorization of the access of the service requesting WLAN subscriber ( 32 ) to the TCP / IP network ( 80 ) is checked; a connection is established via the TCP / IP network ( 80 ) to the WLAN subscriber ( 32 ) established if the WLAN subscriber has access authorization to the TCP / IP network; and signaling and / or information data are transmitted via the TCP / IP network ( 80 ) to the external tax and administration facility ( 90 ) transferred and managed there. Method according to Claim 1, characterized in that the signaling data contain billing data from which billing data records are generated and sent to a billing unit ( 130 ) to get redirected. Method according to claim 1 or 2, characterized in that the access authorization in a the local radio network ( 12 ) assigned interface device ( 60 ) is checked. Method according to Claim 3, characterized in that at least one individual identifier, in particular the MAC address and / or the IP address of the WLAN subscriber requesting the service ( 32 ) to the external tax and administration facility ( 90 ) is transmitted if it is determined that the service requesting WLAN subscriber ( 32 ) regarding the interface setup ( 60 ) it has not been activated that in response to the individual identifier in the external control and administration facility ( 90 ) it is checked whether the requesting WLAN subscriber has already been granted access authorization and that a connection via the TCP / IP network ( 80 ) is established if the WLAN subscriber has access authorization to the TCP / IP network. Method according to claim 4, characterized in that the WLAN subscriber ( 32 ) is asked to enter their authentication data if they have not yet been granted access authorization and that the WLAN subscriber ( 32 ) After entering the authentication data, access authorization to the TCP / IP network ( 80 ) receives. Method according to claim 3 or 5, characterized in that in the external control and administration device ( 90 ) it is checked whether the service requesting WLAN subscriber is authorized to use the TCP / IP network and / or the requested service. Method according to one of claims 1 to 6, characterized in that in the external control and management device ( 90 ) the identifier and / or the owner of each local radio network and / or the address of each local radio network ( 12 ; 52 ) assigned interface devices ( 60 ; 70 ) get saved. A method according to claim 7, characterized in that the degree of utilization of at least one local radio network in the external control and management device ( 90 ) is recorded and logged so that, depending on the degree of utilization, a service-requesting WLAN subscriber can at least temporarily be denied access to the TCP / IP network. A method according to claim 7 or 8, characterized in that for at least one local radio network and / or at least one WLAN subscriber an individual in the external control and administrative facility Website is stored, which transmits a service-requesting WLAN subscriber can be. Method according to claim 9, characterized in that a service requesting WLAN subscriber ( 32 ) by means of a transmitted website at the interface device ( 60 ) of a local radio network ( 12 ), in the coverage area of which he is located, in order to obtain access authorization to the public TCP / IP network. Method according to one of claims 7 to 10, characterized in that in the external control and management device ( 90 ) a table is managed in which each service requesting WLAN user ( 32 ) who has been granted access authorization, the identifier and / or the owner of the local radio network ( 12 ) and / or the address of the interface device assigned to the local radio network ( 60 ) is assigned to which the WLAN subscriber ( 32 ) is currently logged on. Method according to one of claims 2 to 11, characterized in that that it is determined whether the service-requesting WLAN subscriber has a Credit, and that if so, a connection disconnected or none Connection is established when the credit has been used up is. Arrangement of several communication networks, in particular for carrying out the method according to one of claims 1 to 11, with at least one local radio network ( 12 ; 52 ), which via at least one interface device ( 60 ; 70 ) with a public TCP / IP network ( 80 ) is connected, at least one WLAN subscriber ( 32 ) and one of the public TCP / IP network ( 80 ) assigned control and administrative facility ( 90 ), the interface devices ( 60 . 70 ) and the tax and administrative body ( 80 ) Have devices for exchanging signaling and / or information data via the public TCP / IP network, the interface device ( 60 . 70 ) and / or the tax and administrative body ( 90 ) one test facility each ( 120 ) to check the access authorization of a WLAN subscriber requesting services ( 32 ) to the public TCP / IP network, and wherein the control and administration device ( 90 ) has a device for controlling the establishment of a connection via the public TCP / IP network to the service-requesting WLAN subscriber, depending on the WLAN subscriber having access authorization to the TCP / IP network. Arrangement of several communication networks according to claim 13, characterized in that the signaling data contain accounting data and that the control and administration device ( 90 ) An institution ( 120 ) for generating billing data records from the billing data and a device for forwarding the billing data records to a billing unit ( 130 ) having. Arrangement of several communication networks according to claim 13, characterized in that the interface device ( 60 . 70 ) a device for transmitting at least one individual identifier, in particular the MAC address and / or the IP address of a WLAN subscriber requesting services, to the external control and administration device ( 90 ), the test device ( 120 . 140 ) the tax and administrative body ( 90 ) in response to the individual identifier can check whether the requesting WLAN subscriber has already been granted access authorization. Arrangement of several communication networks according to one of claims 13 to 15, characterized in that the control and administration device ( 90 ) An institution ( 112 . 114 . 116 ) to save an individual website for at least one local radio network ( 12 . 52 ) and / or for at least one WLAN subscriber ( 32 ) and a device for transmitting a website to a service-requesting WLAN subscriber. Arrangement of several communication networks according to one of Claims 13 to 16, characterized in that the test device ( 120 ) the tax and administrative body ( 90 ) An institution ( 150 . 155 ) for checking the authorization of a service-requesting WLAN subscriber. Arrangement of several communication networks according to one of Claims 13 to 17, characterized in that the control and administration device ( 90 ) a device for storing the identifier and / or the owner of a local radio network and / or the address of the interface devices assigned to the local radio network and a device ( 140 ) to manage a table in which each service-requesting WLAN subscriber who has been granted access authorization has the identifier and / or the owner of the local radio network and / or the address of the interface device assigned to the local radio network ( 60 . 70 ) is assigned to which the WLAN subscriber ( 32 ) is currently logged on. Arrangement of several communication networks according to one of Claims 13 to 17, characterized in that the control and administration device ( 90 ) An institution ( 140 ) for recording the degree of utilization of at least one local radio network ( 12 . 52 ) and have a blocking device which, depending on the degree of utilization, can at least temporarily deny access to the TCP / IP network to a WLAN subscriber requesting services. Arrangement of several communication networks according to one of claims 13 to 19, characterized in that the control and administration device ( 90 ) An institution ( 180 . 210 ) to determine the payment type of a service requesting WLAN subscriber ( 32 ) having. Arrangement of several communication networks according to one of claims 13 to 20, characterized in that the interface device ( 60 . 70 ) is designed to transmit accounting data. Arrangement of several communication networks according to one of claims 13 to 21, characterized in that the devices of the control and administration device ( 90 ) on several computers forming a computer network ( 112 . 114 . 116 . 120 . 125 . 130 ) are distributed. Arrangement of several communication networks according to claim 22, characterized in that the control and administrative device ( 90 ) has a device for monitoring and managing the computers and the distribution of the devices of the control and administrative device on the computers. Arrangement of several communication networks according to claim 22 or 23, characterized by at least one first computer ( 120 ), in which the test device, the device for generating billing data records, the device for recording the degree of utilization of at least one local radio network, the blocking device and the device for determining the payment type are implemented, at least one second computer ( 112 . 114 . 116 ), in which the device for storing individual user interfaces and the device for transmitting a user interface to a service-requesting WLAN subscriber is implemented, and at least a third computer ( 130 ) in which the accounting unit is implemented. Tax and administration facility ( 90 ) for use in an arrangement of several communication networks ( 12 . 52 . 80 ) according to one of claims 13 to 24, with devices ( 112 . 114 . 116 . 120 ) for exchanging signaling and / or information data with an interface device ( 60 ; 70 ) of a local radio network ( 12 ; 52 ) over a public TCP / IP network ( 80 ) are connected to each other, a test facility ( 120 . 140 . 190 . 200 . 210 ) to check the access authorization of a WLAN subscriber requesting services ( 32 ) to the public TCP / IP network ( 80 ), and a device for controlling the establishment of a connection via the public TCP / IP network to the service-requesting WLAN subscriber, depending on the WLAN subscriber ( 32 ) access authorization to the TCP / IP network ( 80 ) has. Control and administrative device according to claim 25, characterized by a device ( 120 ) for generating billing data records and a device for forwarding the billing data records to a billing unit ( 130 ). Control and administration device according to claim 25 or 25, characterized in that the test device ( 120 . 140 ) in response to an individual identifier of a WLAN subscriber requesting a service, it can check whether the WLAN subscriber requesting the service has already been granted access authorization. Control and administration device according to one of Claims 5 to 27, characterized in that the test device has a device ( 150 . 155 ) is designed to check the authorization of a service-requesting WLAN subscriber. Control and administration device close to one of claims 25 to 28, characterized by a device ( 160 ) for storing the identifier and / or the owner of a local radio network ( 12 . 52 ) and / or the address of the interface devices assigned to the local radio network and a device ( 140 ) to manage a table in which each service requesting WLAN subscriber ( 32 ) who has been granted access authorization, the identifier and / or the owner of the local radio network ( 12 ; 52 ) and / or the address of the interface device assigned to the local radio network ( 60 ; 70 ) is assigned to which the WLAN user is currently logged on. Control and administration device according to one of Claims 25 to 29, characterized by a device ( 140 ) for recording the degree of utilization of at least one local radio network ( 12 ; 52 ) and a blocking device which, depending on the degree of utilization, gives a service-requesting WLAN subscriber access authorization to the TCP / IP network ( 80 ) can at least temporarily refuse. Control and administration device according to one of Claims 25 to 30, characterized by a device ( 180 . 210 ) to determine the payment type of a requesting WLAN subscriber. Control and administration device according to one of claims 25 to 31, characterized in that the control and administration device a plurality of computers forming a computer network ( 112 . 114 . 116 . 120 . 125 . 130 ) contains, in which the individual devices are implemented in a predetermined manner. Control and administrative facility according to claim 32, characterized by a device for monitoring and managing the Calculator and the assignment of the facilities to the computers.