DE102006012167B4 - Method and computer system for providing a service offered via a digital information network - Google Patents

Abstract

A method for providing a service offered via a digital information network, wherein a customer communicates with a provider of the service via the digital information network by:
- the customer requests the service from the provider via the information network,
- the access authorization of the customer is determined,
- a session is generated and
- the customer is provided with the service provided by the provider via the information network during the session,
characterized,
in that the communication between the customer (1) and the provider (3) takes place via a backup module (20) designed as a proxy (2), which performs the administration of the session and the provision of the service, whereby the proxy (2) is determined in the determination of the access authorization. authenticates the customer (1) and settles the requested service.

Description

The The invention relates to a method for providing an over a digital information network offered power according to the generic term of Claim 1 and a computer system for carrying out the method according to The preamble of claim 17.

Such In particular, since the existence of the Internet, procedures have been in the Computers are networked worldwide to an information network, meaning for the Distribution of services in the form of products and services directly through the Internet attained. In such a method, by means of which a performance over the Information network, in particular the Internet offered and ready a customer communicates via the digital information network with a provider, by the buyer at the provider's performance over the Information network requests and then the access authorization the customer noticed, generated a session and the customer in the context of the session the performance by the provider over the Information network is provided. The performance can be For example, downloading a digital music file or on having the Contents of a website that the customer through the Provider allows becomes.

Under Provider here is generally understood by anyone who has one Information network, in particular the Internet a performance in Offering products or services and in this context either directly as operator of an offer, in particular one Website with own digital content or content Recyclers of third-party content, where it is irrelevant whether this content is paid for at any distribution point are or not. Customers are analogous to anyone who understands for a specific purpose, in particular for referring, using or Viewing digital content, the offer of a provider over the Information network calls.

• – die Kostenpflichtigkeit der Inhalte für den Abnehmer, unter anderem bei kommerziell betriebenen Internetseiten oder zur Kostendeckung und Kostenbegrenzung bei privaten Internetseiten;
• – die Authentifizierung des Abnehmers, unter anderem bei Internetseiten für geschlossene Benutzergruppen, beispielsweise zum Zwecke des Jugendschutzes oder
• – die allgemeine Zugriffssteuerung von Inhalten, unter anderem zur Analyse des Verkehrs von externen Inhalten oder zur Freischaltung von bestimmten Inhalten an einzelne Abnehmer.

In such procedures, it is necessary for the provider to protect the digital content offered by him on the Internet from unauthorized access. The reasons for such a backup can be varied, with the most typical and important reasons including:

• - the cost of the content for the customer, including on commercially operated websites or for cost recovery and cost limitation on private websites;
• - the authentication of the customer, among other things in websites for closed user groups, for example, for the protection of minors or
• - the general access control of content, including the analysis of traffic from external content or the activation of certain content to individual customers.

The Digital content is available on the Internet through various protocols provided. The most important protocol for this is HTTP (Hypertext Transfer Protocol), about which all HTML pages (HTML: Hypertext Markup Language) and the There embedded components are provided. The big disadvantage the HTTP protocol for securing the digital content a website is the statelessness of the protocol, i. an authorization check must be made on each individual request and the feature that is to authentication must be retransmitted on every request become. There is a "native" authorization checking feature it is not in the HTTP protocol, so for that purpose alternative Implementations must be used.

traditionally, exist the following possibilities to realize a backup of the digital content in the HTTP protocol:

1st session management

Around a customer in the context of several consecutive requests (Page views, content views, etc.) to be able to authenticate produced by the provider a so-called session and the customer with each request a session identification number (as a session handle or also called SessionID). Under Session will be here a period of time in which the customer is able to to access and obtain the requested service. in the In general, the SessionID is a random and long enough String to provide a clear identification of the customer in the Frame of the session. The transfer the SessionID is for example by cookie or by URL coding sent to the individual requests.

A SessionID has a fixed lifetime. This is either from Time of the beginning of the session or the last access of the customer the digital content is measured. In the latter case, the session in principle not limited in their time. Only inactive sessions are removed from the administration and can in principle reappoint become.

Just within a valid Session receives one Customer access to the digital content of the provider. The security in this method is relatively high and essentially of the Length of SessionID and the transmission path dependent. The implementation by the provider is usually however consuming.

Such a method is for example from the EP 0 765 068 A2 known.

2nd Referer exam

Very widespread is the so-called referer ("mediator") - exam to Securing digital content. The circumstance is exploited, that an internet browser is the address of the last visited website in a request to a provider with can transfer. The HTTP protocol sees this possibility in front; however, the address of the last visited website no mandatory information and leaves yourself as well easy to manipulate. As with the review of a session, the Provider now the validity check the request being at the referer exam Only those customers who are allowed by a particular person are allowed access Internet site, the so-called referer, have come to the provider. The achievable security here is low, while the implementation is usually very easy.

3. Closed IP networks

at Use of closed IP networks only receive customers who have a fixed IP address use (IP: Internet Protocol), access to the digital Contents of the provider. The achievable security here is very high while the implementation effort on the side of the provider is low. However, the IP address must be the customer knows in advance, i. be authenticated. An authentication is only possible if the IP address allocation is controllable or the IP addresses the legitimate customer on the part of the provider are available. This is generally not the case.

4. Customer-side measures

customer side Activities, So measures, which alone on the part of the customer to secure the digital Contents of the offerer are made, are basically on vulnerable and thus easiest to get around. For example, the available Possibility, to offer the digital content only in one frame, or use from Javascript.

adversely in the known methods for providing a power in Form of digital content of a website A provider is that backing up the digital content either incomplete and easy to circumvent or elaborate on the part of the provider the implementation is.

From the WO 99/66384 For example, a gateway formed by a reverse proxy is known between an internal intranet and the external Internet. The reverse proxy handles the communication between external users and applications running on the intranet and authenticates the users by querying the user name and password and then connects the external users to the intranet. In the WO 99/66384 For example, the reverse proxy gateway is essential to provide a connection between the external Internet and the internal, separate intranet. Without the gateway could be physically no communication. An essential field of application for such arrangements are, for example, internal company networks which are connected to the Internet via such a gateway. The prerequisite for an external user to access the intranet via the gateway is that the external user is registered in advance and can be authenticated by specifying his user name and password. Another embodiment of such a gateway for connecting an internal company network, for example, from the WO 98/31124 known.

task The present invention is a method and computer system to provide a power that is high Security with low implementation costs and low costs on the part of the provider.

The The object is achieved by a method having the features of the claim 1 solved.

• – der Abnehmer bei dem Anbieter die Leistung über das Informationsnetzwerk anfragt,
• – die Zugangsberechtigung des Abnehmers festgestellt wird,
• – eine Session generiert wird und
• – dem Abnehmer im Rahmen der Session die Leistung durch den Anbieter über das Informationsnetzwerk bereitgestellt wird,

dadurch gekennzeichnet ist, dass die Kommunikation zwischen dem Abnehmer und dem Anbieter über ein als Proxy ausgebildetes Contentsicherungsmodul erfolgt, das die Verwaltung der Session und die Bereitstellung der Leistung durchführt, wobei im Rahmen der Feststellung der Zugangsberechtigung der Proxy den Abnehmer authentifiziert und die angefragte Leistung abrechnet.According to the invention, provision is made here for a method for providing a service offered via a digital information network, in which a customer communicates with a provider of the service via the digital information network by:

• - the customer requests the service from the provider via the information network,
• - the access authorization of the customer is determined,
• - a session is generated and
• - the customer is provided with the service provided by the provider via the information network during the session,

characterized in that the communication between the customer and the provider via a trained as a proxy Datensicherungsmodul takes place, which performs the administration of the session and the provision of the service, being authenticated in the context of determining the access authorization of the customer and the requested service bills ,

The invention is based on the recognition that a solution to the underlying problem, namely to ensure a high level of security in providing a service with low implementation costs for the provider, can only be achieved by a combination of the methods mentioned above. The presented solution therefore uses the principle of session management to authenticate the customer and the principle of closed IP networks to secure the performance of the provider and combines these methods in a back up module implemented by a proxy that handles both session management and provisioning performs the power. Through the implementation by means of the proxies representing the module backup the advantages of different methods - namely high security with little implementation effort on the part of the provider - combined in one procedure.

One Proxy, also called a proxy server, is a utility for information networks, that mediates in traffic. The mediation takes place between Training computers or programs in the information network Computer networks where the provider has an offer, for example in the form of a website providing web server performance in the form of products, services or other digital content (Content) offers and makes available to the customer. As part of the inventive method behaves the proxy here from the point of view of the supplier like a customer View of the customer, however, like a provider. For the provider of the service then the situation turns out to be just one Customer has, namely the proxy itself. The provider submits the power thus only to the proxy, which has a fixed IP address, so that the provider together with the proxy a closed IP network forms. For the customer, however, the proxy represents the provider of the he requested the service as part of a proxy generated Session receives.

Of the Proxy can be used in this context as a reverse proxy, by means of which the control of the access by the customer to the performance of the provider takes place and at the same time serves as a buffer (cache), be realized and combined with means for session management. The proxy in this case is one with a session management means provided reverse proxy trained. A reverse proxy (also called "HTTP Accelerator" or "surrogate Called proxy ") is a proxy that is in the environment of one or more web servers of the provider is installed and logical from the point of view of the customer placed in front of the web server of the provider. All connections from the information network to one of the web servers are then through the proxy who either completely handles the requests himself answered (by placing a pre-cached performance under Inclusion of the cache independently Fulfills), or partially or entirely to one or the other Forwarding web server. The downstream web servers are here the web servers of the provider providing the service.

Of the Proxy, which represents the back up module, thus provides one Interface between the customer and the provider, over the the communication between the customer and the provider is handled becomes.

Especially it is advantageous in this case that in the context of the procedure of the customer exclusively communicates with the proxy and all Inquiries for obtaining a service are directed to the proxy, and the Proxy makes the further processing of the requests. In this way is excluded that a customer is directly to a provider can apply for an unauthorized service from the provider Respectively. The provider is thus unauthorized by the proxy Protected access, by giving the proxy the full Access control takes over.

Furthermore It is also beneficial for the provider to provide the performance exclusively communicates with the proxy and provides the power to the proxy, who then transmits the service to the customer. This ensures that there is no phase to a direct communication between the customer and the provider of the service comes and all Communication in any case the proxy is handled. For the proxy is the proxy then the only buyer, while for the customer of the Proxy acts as the sole provider.

Of the Proxy is logical between the customer and the customer Provider and protects by means the access control and the mediation of the performance of the provider Completely against unauthorized access from outside.

According to the invention takes over the trained as a proxy backup module the administration the session and the provision of the service. As part of session management the proxy can guarantee the customer's access authorization by the proxy authenticating the customer and thereby the requested one Performance billed. The authentication of the customer takes place then only on condition that the service has been paid is. Other conditions, such as affiliation the customer to a specific user group may have additional requirements for authentication be.

The authentication and billing by the proxy can in this case in particular a pay-by-call procedure is carried out in the context of which the customer is provided with a toll-paying telephone number (premium rate connection), which the customer calls to pay for the service. The call, on the one hand, pays for the service and, on the other, authenticates the customer by determining that the call has been made.

to Session management, the proxy generates a session, within its scope the customer an authorization for a service is assigned. Here, the customer may have a session identification number (SessionID) assigned by the customer in the frame the session is uniquely identified and used as an identifier for the customer used to obtain the benefit.

The Provision of the power can then proceed as follows. In order to provide the service, the customer makes a request to the proxy, whereupon the proxy the access authorization of the customer as part of the session checks. The session identification number is transmitted by the customer in the context of the request to the proxy and guaranteed the clear identification of the customer and the assignment of the customer Customer to the performance, for which he has acquired an authorization. The proxy translates after the exam the access authorization the request to a destination address of the provider, under which the requested service is available. The proxy refers the performance afterwards in the form of digital data from the provider, manipulates this digital Data as needed and need and provides the digital data to the Customers available. The manipulation of the digital data by the proxy can also be done here for example, the change of addresses or encryption refer to the data. It is essential that the processing the request and the provision of the service completely over the Proxy is handled, the proxy thus as an intermediary between Buyer and provider acts and direct communication between the buyer and the provider prevented.

The Information network, about that the provider sells his performance and the customer the performance In particular, the Internet can be.

Prefers if performance then consists of providing digital data, for example, music files, image files, software or the like, the customers over requesting the Internet and providing the provider via the Internet.

The Performance may be specific in this regard to the provision refer to a single digital file.

Conceivable However, that too is as having access to a full website is granted, over the the customer then refer to several files and about their content the customer feature can.

As well It is conceivable that as a performance access to multiple independent websites granted which the customer can then use.

In In a preferred variant of the method, the communication takes place between the proxy and the provider over a secure connection over the the provider all the proxy Provides services in the form of digital content. By means of the secured Connections takes place the transmission then the performance exclusively encoded and is therefore additional from abuse from outside protected.

As well can communication between the proxy and the customer, in whose Framework the proxy the customer the service related to the provider to disposal puts over a secure connection is made. Through the secure connection and an encryption used in the secure connection is then guaranteed that the service delivered by the proxy is only the authorized customer and can not reach an unauthorized third party.

The secured connection can in this case in particular an SSL connection (SSL: Secure Server Line), which is a widely used standard for secured Represents connections.

The Task is about it beyond by a computer system having the features of claim 17 solved.

• – auf eine Anfrage eines Abnehmers die Zugangsberechtigung des Abnehmers feststellen,
• – eine Session generieren und
• – dem Abnehmer im Rahmen der Session die Leistung durch den Anbieter über das Informationsnetzwerk bereitstellen.

In this context, the invention relates to a computer system for providing a service offered via a digital information network, for carrying out the method according to one of claims 1 to 16, with a web server arranged in the information network, via which the provider offers the service, wherein the web server means or cooperates with means which

• - determine the customer's access authorization at the request of a customer,
• - generate a session and
• - provide the customer with the service through the provider over the information network during the session.

According to the invention it is provided that in the environment of the web server, a trained as a proxy backup solution is installed, the administration of the session and the Provisioning performance.

at the computer system according to the invention is thus in the environment of a Web server, over which the offerer its Offers performance, as a trained proxy backup module installs all the tasks of session management and deployment the power takes over. The proxy serves as an interface between the customer and the provider of the service, with all communications between the buyer and the provider the proxy is handled.

Of the Web server can in this context, in particular through a web host be formed, the server services of the provider in the information network operates with the proxy installed directly on the web host. The web host represents a computer through which the physical connection to the information network, especially the Internet will and over the distribution of performance in the form of digital data through the Provider performed becomes.

Of the The idea underlying the invention is based on the following the embodiments illustrated in the figures will be explained in more detail. Show it:

1 a schematic representation of the arrangement of a customer, a proxy and a provider in an information network;

2 a schematic flow diagram for illustrating the process in the generation of a session and

3 a schematic flow diagram illustrating the flow in the provision of a power.

1 schematically shows the arrangement of a pickup 1 , a provider 3 which offers a service in the form of digital content, and one as a proxy 2 trained back-up module in an information network I, which may be the Internet, for example. The provider 3 is in this case via a trained by a computer web server 31 connected to the information network I and provides via the web server 31 the performance in the information network I. The customer 1 is also via a computer, as a client 11 referred to, connected to the information network I.

The communication between the customer 1 and the provider 3 in the information network I takes place exclusively via the proxy 2 trained backup module, which is a session management 21 and on the other a reverse proxy 22 over which the access control of the customer 1 on the services of the provider 3 and the provision of the power takes place. The content backup module in the form of the proxy 2 This can be done on a separate webserver running in the environment of the webserver 31 of the provider 3 or directly on the provider's web server 3 be installed. Environment means here that the proxy 2 and the web server 31 logically related to the physical connection between the proxy hosting web server and the web server 31 of the provider 3 in turn, can be made via the information network I or a separate network, so that the web server of the proxy 2 and the provider 3 can be completely separated.

The proxy 2 thus acts within the information network I as an interface between the customer 1 and the provider 3 , It is advantageous in this case, in particular, if the customer 1 and the provider 3 exclusively with the proxy 2 communicate and no direct communication between the customer 1 and the provider 3 he follows.

For the provider 3 Represents the proxy 2 then the only buyer, the provider 3 provides all services. The proxy 2 and the provider 3 thus form a closed IP network, where the IP address of the proxy 2 the provider 3 is known and the delivery of the service by the provider 3 thus only to the known IP address of the proxy 2 he follows. For the customer 1 however, the proxy provides 2 the supplier, the customer 1 receives a desired performance. The authorization of the customer 1 to the performance is through the proxy 2 checked by means of a session management, the proxy 2 as part of session management 21 the customer 1 authenticated, assigns him a session identification number and thus the authorization of the customer 1 to determine a performance. The basic procedure here is that on request of a customer 1 initially as part of the session management 21 a session is generated and, as soon as the session passes, the customer 1 in the context of the existing session, the performance by the proxy 2 is made available.

2 shows the process when generating a session. At first, the customer judges 1 in step 210 a request for a service to that as a proxy 2 trained content backup module. The proxy 2 then authenticate in step 211 the customer 1 for example, by providing required data (eg name and address of the customer 1 ) and the service is charged if necessary. The billing can be done here for example via a pay-by-call method, in whose context the customer 1 is asked to give him a ver call toll-paying telephone number (for example, a 0900 number), which then bills the service. Such a pay-bay call procedure is for example from the EP 0 765 068 A2 known. Prerequisite for the authentication here can be that the customer 1 has paid the service so that the customer 1 a session access authorization will only be granted if the service is fully and properly settled. In step 212 the proxy creates a session with the customer 1 for unique identification, a session identification number (session ID) is assigned, by means of which the customer 1 linked to the session and unambiguously identifiable in later requests during the session. In step 213 the proxy sends a destination address to the customer as a response 1 , where the customer 1 is communicated together with the destination address the session identification number.

After the generation of the session is on the side of the proxy 2 the customer 1 authenticated, ie, the customer 1 has earned the entitlement to a service.

The customer 1 In this case, a destination address has been transmitted which it must call in order to receive the requested service. The provision of the service takes place exclusively via the proxy 2 ,

The process of providing the service is in 3 shown. In step 220 the customer calls 1 first give it to him through the proxy 2 transmitted destination address. The proxy 2 then checks whether the session still exists and whether the customer 1 has the required access authorization. This is done in step 221 , After checking, the proxy translates 2 then the destination address in the Internet address under which the provider 3 the service offers. This process, which is also referred to as mapping, takes place in the step 222 , In step 223 the proxy gets 2 the performance in the form of digital data from the provider 3 , a process also known as downloading. Subsequently, the proxy manipulates 2 if necessary and as necessary the data in the step 224 and transmits the power in the form of the digital data in the step 225 to the customer 1 , The manipulation of the data in step 224 This may refer to a change in the addresses or encryption of the digital data.

The course of the method for providing a service over the Internet, which in this context represents an information network I, will be explained in more detail below with reference to a concrete example. In the process, a customer judges 1 A request for a service as a proxy 2 trained content backup module. The request can be made, for example, by calling the Internet address
http://www.contentsicherungsmodul.de/?getfile=neu/artikel.zip
where new / article.zip is the requested performance in the form of a digital file. In response to this call is by proxy 2 trained content assurance module the authentication of the customer 1 performed, the service billed, a session generated and the customer 1 in response the destination address of the proxy 2 transmitted along with a session identification number (SessionID). The destination address of the proxy 2 can, for example
http://www.proxy.de/aa011ff727064197324ffb5dde00d866/~/neu/artikel.zip
where aa011ff727064197324ffb5dde00d866 / ~ / the SessionID is in the to the customer 1 transmitted destination address is integrated. Inside the proxy 2 will be the one for the customer 1 generated session with the internet address of the provider 3 under which the requested service is available and the requested service to which the customer is 1 is authorized in the context of the session. This link is referred to as mapping, whereby in the context of the mapping in an existing session, the call of the destination address of the proxy 2 by the customer 1 automatically translated into the Internet address where the service is provided, and thus within the proxy 2 an assignment of the customer 1 guaranteed to the requested performance. The general Internet address of the provider 3 in the context of the mapping with the session of the customer 1 can be linked, for example
http://www.content.de/download/
are and in the context of the mapping extended to the concrete achievement to which the customer 1 is entitled in the context of the session. The Internet address for the specific line with which the destination address of the proxy 2 then, for example, can
http://www.content.de/download/neu/artikel.zip
ring. The customer 1 thus receives only the in the assigned destination address of the proxy 2 (http://www.proxy.de/aa011ff727064197324ffb5dde00d866/~/neu/artikel.zip) and calls this up. A direct call to the Internet address of the provider 3 is the customer 1 This is not possible because the access to this Internet address only via the proxy 2 is possible. The destination address will then be within the proxy 2 translated into the actual Internet address of the achievement (http://www.content.de/download/neu/artikel.zip), under which the proxy 2 retrieves the service and the customer 1 provides. customer 1 and providers 3 communicate thus exclusively with the proxy 2 and not with each other. The proxy 2 put it like that with an interface between the customer 1 and the provider 3 representing the customer 1 from the provider 3 Logically separates and performs all tasks of authentication, billing and authentication in the context of session management, the performance of the provider 3 retrieves and the customer 1 provides.

ever the type of requested service may vary the session management. In securing the performance in the context of the Internet (using the HTTP protocol) There are the following subdivisions, each with different requirements in terms of mapping.

1. Backup of a single file

A customer 1 In this case, it asks for a digital file (for example, "article.zip") as the service, and a file (a file name) is passed when the service is requested 2 generates a session, where the customer 1 only for this a file receives an access authorization by the with the session of the customer 1 connected and the customer 1 submitted destination address of the proxy 2 is rigidly linked to the address of the file. Only this file can be later by the customer 1 be obtained. For the above example, this means that the destination address transmitted to the customer
http://www.proxy.de/aa011ff727064197324ffb5dde00d866/~/neu/artikel.zip
always in the address of the requested file
http://www.content.de/download/neu/artikel.zip
is translated. The proxy 2 can be designed so that even a file name modified call of the destination address by the customer 1 , for example
http://www.proxy.de/aa011ff727064197324ffb5dde00d866/~/neu/nochwas.zip
or
http://www.proxy.de/aa011ff727064197324ffb5dde00d866/~/
always automatically translated into the address of the requested file (http://www.content.de/download/neu/artikel.zip), so that is guaranteed that the customer 1 just this one file through the proxy 2 can relate.

2. securing a simple Website

In this case, the performance is that the customer 1 may have the contents of a website, the contents being located on the website (also referred to as a domain) and relative paths being allowed, the customer 1 thus also access to the website has subordinate, branched pages. So if in the above example below http://www.content.de/download/ is a (branched) website, then all the branched pages of the website via the proxy 2 reachable. For this purpose, the destination address of the proxy 2
http://www.proxy.de/aa011ff727064197324ffb5dde00d866/~/start.html
as part of the mapping within the proxy 2 translated into
http://www.content.de/download/start.html,
where on the initial page of the website providing file start.html a link (a so-called link) on the article new / artikel.zip may be present. By accessing the entire website, the customer has access to the address
http://www.content.de/download/neu/artikel.zip,
under which he can retrieve the file new / artikel.zip. The relative addressing of the file on the website of the provider 3 becomes the customer 1 through the proxy 2 about the destination address
http://www.proxy.de/aa011ff727064197324ffb5dde00d866/~/neu/artikel.zip.

provided. In order to make this assignment, it is necessary that the cookies on the part of the customer 1 be rewritten to the customer 1 to suggest that the proxy 2 acts as a provider (host) to the customer 1 provides the power. The proxy 2 must therefore pose as a provider, thus the buyer 1 the cookie to the proxy 2 sends and not directly to the actual provider 3 , The proxy 2 must therefore rewrite the information defining the provider (host) when setting the cookie (on itself) and with each request of the customer 1 translate back again.

3. Backup a multiwebs

In this case, the performance is that the customer 1 may have the content of several independent Internet sites (domains), whereby the Internet pages are no longer linked (linked) relative to each other, but are addressed in an absolute manner by different Internet addresses. In this case the same applies as for the backup of a simple website (see above). However, the following must also be noted: Since the paths are no longer relatively addressed (in a link with a second domain with its own Internet address, this inevitably results), resulting on the side of the customer is not automatically the right to the proxy 2 directed destination addresses, ie the customer 1 would be due to the incorrect addressing the proxy 2 and thus bypass the backup. For this reason, the entire content of the Internet pages evaluated and manipulated if necessary. From the absolute Internet addresses of the provider 3 become absolute destinations of the proxy 2 , in addition to the information about the provider 3 (Host information). The through the proxy 2 generated and the customer 1 transmitted destination address can then, for example
http://www.proxy.de/aa011ff727064197324ffb5dde00d866/www.content.de/start.html
are and will be when the destination address is called by the customer 1 then translated into the actual Internet address of the provider 3 , namely
http://www.content.de/download/start.html,
from the the proxy 2 the performance relates to the customer 1 provides. Depending on your needs, the host information (www.content.de) can also be encrypted.

4. Encryption:

To encrypt the transmitted power, a secure connection in the form of SSL (Secure Server Line) can be used, by means of which the performance in the form of digital data between the provider 1 and the proxy 2 and / or the proxy 2 and the customer 3 can be transferred. Since the data transfer is still based on the HTTP protocol, the session management and the mapping are the same as described above, but the digital data is transmitted securely. The proxy 2 provides an SSL connection to the provider 3 and obtains the digital data via this SSL connection. As a rule, the output is made by the proxy 2 That is, the provision of the digital data to the customer 1 , not via an SSL connection. It is however conceivable that with achievements, which the proxy 2 from the provider 3 via an SSL connection, the proxy 2 automatically an SSL connection to the customer 1 generated and the benefits of this connection to the customer 1 provides. The customer 1 The destination address transmitted in this context could then be:
https://www.proxy.de/aa011ff727064197324ffb5dde00d866/~/start.html,
where "https" indicates that the transmission is over a secure connection.

1

customer

11

client

2

Content security module

21

session management

210-213

steps for generating the session

22

Reverse Proxy

220-225

steps to provide the service

3

providers

31

Web Server

I

Information network

Claims (18)

Method for providing a service offered via a digital information network, in which a customer communicates with a provider of the service via the digital information network by: - the customer requests the service from the provider via the information network, - the customer's access authorization is determined, - a Session is generated and - the customer is provided in the context of the session, the service by the provider via the information network, characterized in that the communication between the customer ( 1 ) and the provider ( 3 ) via a proxy ( 2 ) is carried out, which carries out the administration of the session and the provision of the service, whereby in the course of determining the access authorization the proxy ( 2 ) the customer ( 1 ) and settles the requested service. Method according to claim 1, characterized in that the proxy ( 2 ) as having a session management means ( 21 ) combined reverse proxy ( 22 ) is trained. Method according to one of claims 1 or 2, characterized in that the proxy ( 2 ) in the information network (I) an interface between the customer ( 1 ) and the provider ( 3 ) trains. Method according to one of the preceding claims, characterized in that the customer ( 1 ) exclusively with the proxy ( 2 ) communicates. Method according to one of the preceding claims, characterized in that the provider ( 3 ) the power only to the proxy ( 2 ), which provides the service to the customer ( 1 ) transmitted. Method according to one of the preceding claims, characterized in that the authentication and the billing by the proxy ( 2 ) via a pay-by-call procedure. Method according to one of the preceding An claims, characterized in that the generation of the session by the proxy ( 2 ), whereby the customer ( 1 ) a session identification number is assigned, by which the customer ( 1 ) is identified during the session. Method according to one of the preceding claims, characterized in that in order to provide the service of the customers ( 1 ) a request to the proxy ( 2 ), the proxy ( 2 ) the access authorization of the customer ( 1 ) as part of the session, the proxy ( 2 ) the request to a destination address of the provider ( 3 ), the proxy ( 2 ) the performance in the form of digital data from the provider ( 3 ), the proxy ( 2 ) manipulated the digital data as needed and necessary and the proxy ( 2 ) the digital data to the customer ( 1 ). Method according to one of the preceding claims, characterized characterized in that the information network (I) is the Internet. Method according to one of the preceding claims, characterized characterized in that the power from the provision of digital Data exists. Method according to one of the preceding claims, characterized characterized in that as a performance provided a digital file becomes. Method according to one of the preceding claims, characterized characterized in that as a service access to a website granted becomes. Method according to one of the preceding claims, characterized characterized in that as a service access to multiple independent websites granted becomes. Method according to one of the preceding claims, characterized in that the communication between the proxy ( 2 ) and the provider ( 3 ) via a secure connection. Method according to one of the preceding claims, characterized in that the communication between the proxy ( 2 ) and the customer ( 1 ) via a secure connection. Method according to one of claims 14 or 15, characterized the SSL connection is used as the secure connection. A computer system for providing a service offered via a digital information network, for carrying out the method according to one of claims 1 to 16, with a web server arranged in the information network via which the provider offers the service, the web server having means or cooperating with means - determine the customer's access authorization on a request from a customer, - generate a session and - provide the customer with the service in the context of the session via the information network, characterized in that in the environment of the web server ( 31 ) as proxy ( 2 ) is implemented, which performs session management and provisioning of the service, whereby the proxy ( 2 ) in the context of the determination of the access authorization, the customer ( 1 ) and settles the requested service. Computer system according to claim 17, characterized in that the web server ( 31 ) is formed by a web host that runs the server services, and the proxy ( 2 ) is installed on the web host.