EP1279302A1

EP1279302A1 - Administrative protection of groups in public switching systems

Info

Publication number: EP1279302A1
Application number: EP01942999A
Authority: EP
Inventors: Joachim Huttel; Irena Romanski
Original assignee: Siemens AG; Nokia Siemens Networks GmbH and Co KG
Current assignee: Nokia Solutions and Networks GmbH and Co KG
Priority date: 2000-05-04
Filing date: 2001-05-02
Publication date: 2003-01-29
Also published as: US20040013261A1; DE10021778A1; WO2001084856A1; CN1435060A

Abstract

The invention relates to a switching centre (1) for connecting telephone objects (2a ... 2n) to a telephone network, comprising a control device (3) wherein operational functions can be administered by authorized operators by inputting commands via a terminal (6), and verification means (4) for checking access authorization enabling certain operators to administer within a group (5). The invention also relates to a method for administering operational functions in the switching centre.

Description

description

Administration protection of groups within public switching systems

The present invention relates to a switching center for connecting telephone objects to a telephone network, in which operating functions are administered by entering commands via a terminal by authorized operators, as described in the preamble of appended claim 1, and a method used in this switching center for the administration of operating functions, as described in the preamble of the appended claim 9.

In a switching center in a telephone network, several telephone objects, e.g. B. connected to this switching center telephone terminals or private branch exchanges of terminals, into groups. This group formation is e.g. B. useful in the CENTREX service (Centralized Office Exchange Service).

CENTREX is a special service in a network node, i. H. in a switching center, which makes the functionality of a subscriber terminal available to some of the connected terminals.

Switching centers can be administered by authorized operators or persons by entering commands (e.g. in man-machine language, MML) via a terminal. H. operating functions such as B. setting up end devices or assigning specific authorizations for end devices or participants e.g. with regard to performance features.

In the state of the art, the switching center has a protective function against unauthorized access per individual (MML) Command implemented locally per exchange. This means that an operator who is authorized to administer operational functions of the exchange has access to the entire exchange within the scope of his authorizations for this exchange (for certain MML commands) or all telephone objects connected to it. Individual MML commands can usually be carried out by several operators. So z. B. not coordinated accesses to individual groups of telephone objects can be performed.

This has the disadvantage that reliable administration or administration, e.g. individual groups of telephone objects is not possible.

The object of the present invention is thus to provide a switching center for connecting telephone objects to a telephone network according to the preamble of appended claim 1 and a method used in this switching center for the administration of operating functions according to the preamble of appended claim 9, in which one higher operational security in the administration of operational functions is made possible.

This object is achieved by a switching center in accordance with the appended claim 1 and a method used in this switching center for the administration of operating functions in accordance with the appended claim 9.

The following advantages result from the check according to the invention as to whether a particular operator is authorized to administer a particular group:

There is protection against unauthorized or accidental administration of unauthorized operators. There is also potential for savings in the telecommunications companies, since the protective measure means less dedicated personnel can be used for administration. In addition, customers of the telecommunications companies that are organized in such groups are no longer hindered by unauthorized or inadvertent administration of their telecommunications equipment or. disturbed. Protection is also possible both locally (in a switching center) and network-wide over the telephone network (in several) switching centers.

Advantageous embodiments of the present invention are given in the respective subclaims.

According to the present invention, several groups can be organized in a switching center, each of which has different access authorizations.

The individual groups are identified with different group identifications (IDs), so that only the operators who are authorized to administer this group can access the respective groups. For this purpose, an association of the operator's identifier with the group ID is created. The access authorization is then checked by checking the identifier contained in an administration command (user identification, user ID) to determine whether it is linked to the group ID and thus the

Administrative command (with the respective user ID) may be executed by the corresponding operator.

According to the present invention, the individual groups need not be limited to one switching center. A

Group (e.g. end devices from one company) can also span several switching centers (e.g. branches of a company).

The administration of a group in a switching center can be done locally for a switching center as well as centrally ral for all exchanges in which the group is present.

The present invention is explained in more detail below on the basis of preferred exemplary embodiments with reference to the accompanying drawings, in which:

Fig. 1 is a schematic representation of the invention

Exchange; Fig. 2 shows the schematic representation of the

Authorization check in the exchange; Fig. 3 shows an example of the network-wide group with local

Administration; 4 shows an example of a network-wide group with centralized network-wide administration; and

Fig. 5 shows an example of the protective effect in a

Switching center.

The schematic structure of the switching center 1 according to the invention is explained below with reference to FIG. 1.

At the exchange 1, the participants are connected with their terminals (telephone objects) 2a ... 2n. The switching center includes the switching devices 7 for switching and connecting the subscriber to the telephone network, such as. B. the connection units (line cards) for connecting the terminals 2a ... 2n to the switching center and the switching network for switching the connection. This switching devices 7 can be controlled or administered in their operating functions by a control device 3, such as. B. setting up new participants.

As already described at the beginning, a plurality of telephone objects (such as terminal devices 2a, 2b or private branch exchanges) can be grouped together in a group 5, e.g. B. be organized in the CENTREX service. In this case, for example, a company is switched by the switching center 1 to the functionality of a private branch exchange provided without having to purchase a private branch exchange from the company. The number of telephony objects belonging to a group 5 is not limited and can be determined by the telecommunications company. A group can also extend network-wide over several exchanges, the telephone objects then e.g. B. belong to the branches of a company.

The administration of the operating functions is carried out by entering commands (eg in the Man-Machine Language, MML) from a terminal 6. The check as to whether an operator who accesses the switching center is authorized to administer operating functions when the operator enters a command by means of the test device 4. This test device 4 is advantageously implemented as software in the control device 3.

According to the present invention, it is ensured that only selected operators are permitted by the telecommunications company to administer individual groups and the telephone objects contained therein. This ensures a higher level of security in the administration of the individual group. B. to avoid uncoordinated or unauthorized access.

For this purpose, according to the invention, a group ID is assigned to each group in each switching center in which the respective group is represented.

2 that the checking device 4 assigns an operator (in the example with the user ID X) and a group ID (in the example with the group ID 99) to check an access authorization. Incoming commands contain the identifier (user ID and / or password) of the accessing operator. The testing facility uses stored identifiers to check whether the respective operational tor is authorized to execute this command on the group to which this command is directed.

During the authorization check, the checking device uses stored identifiers to check whether the operator from whom the input originates is authorized to administer this command to the group to which this command is directed and thus to administer the telephone objects contained therein. If this is the case, the command is accepted, otherwise it is rejected. The number of different telephony objects per group and thus the number of different (MML) commands can be set individually for each group by the telecommunications company.

The group ID is assigned uniformly to all members of a group in the individual exchanges in which the group is present, and thus a network-wide group is formed (e.g. from all branches of a company available in the telephone network). This is done using appropriate (MML) commands that are issued for each member of the group in the relevant exchange.

It also defines which telephone objects (e.g. end devices, private branch exchanges) should belong to the group and thus defines the (MML) commands that are necessary for the administration of the group and the telephone objects contained therein.

The network administrator who assigns the identifiers (IDs) himself has access to all administratively supported switching centers and groups.

The example of FIG. 3 shows how administration protection works for a network-wide group with local administration. The network-wide group (ie the individual members of a group) is represented in three switching centers la, lb, lc. In each exchange la, lb, lc, the members of a group are each provided with the same group ID (in the example 99) and assigned to the respective operator with the user ID X. Access to the group with group ID = 99 and the telephone objects contained therein is therefore not possible for operator Y, although in principle the operator Y has the authorization to administer operational functions of the exchange.

In a further example in FIG. 4, the administration protection for a network-wide group in a centralized network-wide administration is explained.

The network-wide group is represented in the three switching centers la, lb, lc. In each switching center la, lb, lc, the members of the group are provided with the same group ID and assigned to the operator X. Access to the group and the telephone objects of the group by the central operator Y and the operators Y1, Y2, Y3 connected directly to the respective switching center is thus not possible, although these operators would have the basic authorization to close these switching centers la, lb, lc administer. This shows the possibility of differentiation from other administration centers of the telecommunications company with network-wide central administration: apart from operator X, nobody, even the other network-wide represented by operator Y or the local administration centers represented by operators Yl, Y2, Y3, have access to the group, although the operator Y can in principle access the switching centers la, lb, lc or the operators Yl, Y2, Y3 on the respective switching center la, lb, lc.

Thus, a total demarcation with regard to the operation compared to other administration centers of the telecommunications company is possible, e.g. B. can be the basic device are decoupled from further administration by participants (end devices).

5 explains how the protective effect works within a switching center. From this figure it is clear that the protection is effective for each group and not within a switching center. Operator X can access a telephone object of the protected group with the group ID = 99 (e.g. on a subscriber's end device) as well as other (unprotected) telephone objects (other subscribers). Operator Y can also administer participants, but not those from the protected group with group ID = 99.

Claims

claims

1. Switching center (1) for connecting telephone objects (2a ... 2n) to a telephone network, a part of the telephone objects (2a, 2b) being organized into a group (5) with a control device (3) in operating functions are administered by entering commands via a terminal (6) by authorized operators, and a checking device (4) for checking access authorizations, which allows the operating functions of the switching center (1) to be administered by authorized operators, characterized in that the checking device (4) to check an access authorization checks whether an accessing operator is permitted to administer the operational functions of group (5).

2. Switching center (1) according to claim 1, characterized in that a plurality of groups are present in a switching center (1) and the checking device (4) checks for access authorization whether an accessing operator for administering the operational functions of a particular one Group (5) is admitted.

3. Exchange (1) according to claim 2, characterized in that the groups (5) are each provided with a group identification for unambiguous identification.

4. Exchange (1) according to one of claims 1 to 3, characterized in that a group (5) in the telephone network extends over several exchanges (1).

5. Exchange (1) according to one of claims 1 to 4, characterized in that a group (5) consists of terminals which belong to a virtual private branch exchange.

6. Exchange (1) according to one of claims 2 to 5, characterized in that the checking device (4) for checking an access authorization carries out a comparison association of group identification and identification of the operator in order to check whether an accessing operator is authorized to perform operational functions of a certain group.

7. Switching center (1) according to one of claims 1 to 6, characterized in that the administration takes place locally for a switching center (1).

8. Exchange according to one of claims 1 to 7, characterized in that the administration takes place centrally for several exchanges (1).

9. Method for controlling operating functions in a switching center (1) for connecting terminals (2a ... 2n) to a telephone network, in which operating functions are administered by authorized operators by entering commands via a terminal (6), some of which the terminals (2a, 2b) is organized into a group (5) and when administering operating functions of the switching center (1) a check is carried out to determine whether the respective operator is authorized to administer operating functions, characterized in that it is checked whether a the accessing operator to administer the operating functions of group (5) is permitted.

10. The method according to claim 9, characterized in that it is checked whether an accessing operator to administrate the operating functions of a certain group (5) from a plurality of groups is permitted.

11. The method according to claim 10, characterized in that the groups (5) are each provided with a group identification for unique identification.

12. The method according to claim 9, 10 or 11, characterized in that a group (5) extends network-wide over several switching centers (1).

13. The method according to any one of claims 9 to 12, characterized in that an association of the group ID and the identifier of the operator is carried out in order to check whether a particular operator is authorized to carry out operational functions of the selected group.

14. The method according to any one of claims 9 to 13, characterized in that the administration takes place locally for a switching center (1).

15. The method according to any one of claims 9 to 14, characterized in that the administration is carried out centrally for several switching centers.