Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F15/00—Digital computers in general; Data processing equipment in general
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
  • H04L63/104—Grouping of entities
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
  • H04L65/1066—Session management
  • H04L65/1069—Session establishment or de-establishment
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/01—Protocols
  • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/01—Protocols
  • H04L67/06—Protocols specially adapted for file transfer, e.g. file transfer protocol [FTP]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/14—Session management
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/14—Session management
  • H04L67/142—Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/2866—Architectures; Arrangements
  • H04L67/30—Profiles
  • H04L67/306—User profiles
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L12/00—Data switching networks
  • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
  • H04L12/2854—Wide area networks, e.g. public data networks
  • H04L12/2856—Access arrangements, e.g. Internet access

Definitions

• the present invention relates to a method and system for accessing a communications network, such as the Internet.
• the ISP provides remote access servers (RASs) which are able to communicate with remote computers of the users using modems and standard telephone lines.
• RASs remote access servers
• the remote computers and the RASs use standard software that executes a protocol, such as the point to point protocol (PPP), to allow the users to dial into the RASs and connect to the Internet.
• PPP point to point protocol
• the connection or PPP software on the user's computer requires the user to enter unique authentication data, such as the user's login name and password, and this is transmitted to the ISP when the software dials and connects to the ISP equipment. If the ISP equipment determines that the authentication data is valid, the user's computer is connected and the user is allowed uninhibited access to the Internet. The user is accordingly free to view any desired web pages using a web browser on the user's computer.
• any steps or method which an ISP can implement to direct users to particular pages, rather than the user's own default home page, would be highly desirable.
• the present invention seeks to provide such method or at least provide a useful alternative.
• an access system including: 9 .
• connection means for connecting a computer device and establishing a connection session for accessing a public communications network
• switch means having a plurality of access states, one of the access states being assigned to the session for at least part of the session, each access state determining network traffic receivable by the computer device
• session managing means for managing the session and assigning at least one of the access states during the session based on connection data for the session and access requests from the computer device.
• the present invention also provides an access system for a public communications network, such as the Internet, including: means for connecting a computer device and establishing a TCP IP session for access to the network; switch means having a plurality of access states, the access states determining the sites and pages which can be accessed by the computer device during the session; and means for managing the session to allocate at least one of the access states during the session.
• a public communications network such as the Internet
• the present invention also provides a communications network access system, including:
• connection means for receiving a request from a computer device to connect to the network and for connecting the computer device to the network in response to the request; sending means for sending login data to the computer device after it is connected to the network, the login data being adapted to generate a login display on the computer device which allows entry of unique authentication data by a user of the device; and login means for receiving the unique authentication data entered by the user and for allowing the user to access the network using the computer device on determining that the authentication data is valid.
• the present invention also provides a communications network access method, including: establishing a TCP/IP session with a computer device; and assigning access states during the session, the access states determining TCP/IP data received by the computer device.
• the present invention also provides a communications network access method. including: connecting a computer device to a communications network; accessing data from affiliate locations on the network without an access charge: and accessing data from other locations on the network with an access charge.
• the present invention also provides a communications network access method, including: receiving a request from a computer device to connect to the network; connecting the computer device to the network in response to the request; sending login data to the computer device after the connecting step, the login data being adapted to generate a login display on the computer device allowing entry of unique authentication data by a user of the device; receiving the unique authentication data entered on the computer; and allowing the user to access the network using the computer device when the authentication data is validated.
• the present invention also provides a communications network access method, including: sending a request from a computer device to connect to a communications network, and being connected to the network in response to the request; receiving login data after being connected; generating a login display on the computer device, based on the login data, the display allowing entry of unique authentication data; sending unique authentication data entered on the computer device to the network; and obtaining access to the network after the authentication data is validated.
• a communications network access method including: sending a request from a computer device to connect to a communications network, and being connected to the network in response to the request; receiving login data after being connected; generating a login display on the computer device, based on the login data, the display allowing entry of unique authentication data; sending unique authentication data entered on the computer device to the network; and obtaining access to the network after the authentication data is validated.
• Figure 1 is a block diagram of a preferred embodiment of a communications network access system
• Figure 2 is a block diagram of a server system of the access system
• Figure 3 is a flow diagram of a communications network access method of the access system
• Figure 4 is a diagram of a login page of the system and method.
• Figure 5 is a diagram of a customised home page of the system and method.
• a communications access system includes a plurality of remote access servers (RASs) 4, a layer four or higher switch 6, a database server 8, a web server system 10 and a router 12.
• the RASs 4 are provided to allow the computers 14 of remote users to dial into the system using standard telecommunication lines and modems and connect to the input ports of the RASs 4, respectively.
• the RAS 4 and the user's computer 14 establish a unique TCP IP session and the IP traffic for that session is switched by the switch 6.
• the user's computer 14 is allowed to access requested data on the Internet 16.
• the web server system 10 is used to control pages presented to a user 14 connected to the RAS 4 and handle authentication using a member profile database maintained on the database server 8, as described below.
• a RADIUS (Remote Authentication Dial In User Service) authentication server 1 1 is also provided for use in authentication.
• the equipment 4, 6, 8, 10, 1 1 and 12 of the access system is part of the Internet.
• the equipment 4 to 12 preferably includes standard commercially available hardware and basic database, web server and Internet access software which is known to those skilled in the art and is used in the access systems of most ISPs.
• the equipment 4 to 12 then also includes unique program code to manage and control each session, as discussed below.
• the layer four or higher switch 6 is another exception.
• the switch 6 is normally used by ISPs to balance the traffic handled by the RASs 4.
• An example of a suitable layer four switch is the AceDirector AD3TM produced by Alteon WebSystems Inc.
• the access system differs from that offered by ISPs, as described belo , in that the layer four switch 6 is used to connect users to the web server system 10 and control access to the Internet 16 for the users 14 on the basis of a limited number of access states encoded in the switch 6.
• the unique program code and the equipment 4 to 12 could be substituted, entirely or in part, by unique integrated circuits, such as ASICs, to execute the same functions.
• the switch 6 controls access to the Internet 16 by assigning an access state to each TCP session, as identified by a respective IP address.
• the states are each defined by one or more access rules which are encoded in the switch 6.
• the rules define how the switch 6 is to direct IP traffic by executing pattern matching on the received traffic.
• the states may include a login state, a portal state, a general state, an affiliate state, a registration state, and an allow state, as described below.
• a rule for example, may be receive a first URL and redirect to a second URL or the rules may allow or deny access to a predetermined set or list of URLs.
• the state assigned to a given IP address is controlled by a control system 20, as shown in Figure 2.
• the web server system 10 includes the control system 20 and a web server 22, running ApacheTM, which maintains web pages for the access system.
• the user 14 When the user 14 wishes to connect to the Internet using the access system, the user 14 dials into the system using standard PPP software and is allocated a port at the RAS 4 which answers the call.
• the user 14 On connecting to a RAS 4, the user 14 is assigned an IP address for the IP session.
• the IP address is allocated from an IP address pool which depends on the number which the user dialled to connect to the RAS 4. For example, the user may have a dial- in number which provides the user with free access to Internet web sites as part of a promotion, and the user 14 is assigned an IP address and port which signifies to the switch 6 that all traffic from that IP address is to be switched directly to the router 12 and out to the Internet 16. This would occur with all IP addresses within this pool being allocated to the allow state of the switch 6, described below.
• the control system 20 includes a RADIUS accounting server 30. a login server 32. a session coordinator 34, individual session managers 36, an authentication client 38, a redirector server 42 and a plan manager 44.
• the components 30 to 44 are all software components, but can if desired be partly or entirely replaced by application specific integrated circuits (ASICs).
• the control system 20 is configured to handle three different authentication scenarios:
• the user 14 dials into the RASs 4 using standard PPP software and provides a username and password. Based on the dial in number used and the configuration of the PPP software, the RAS port assigned to handle the call will direct the data provided to the RADIUS authentication server 11 to authenticate the user based on the PPP username and the password. Once authenticated, the RADIUS authentication server 11 returns a connect status message to the RAS 4 and an IP address is assigned to the user. Based on the IP address, the switch 6 forwards from the RAS 4 the connect status message, the username, calling line identification (CLI) and the IP address to the control system 20.
• CLI calling line identification
• the RADIUS accounting server 30 acknowledges the new connection for the IP address and accesses the database server 8 to record the connection time for the user.
• the RADIUS accounting server 30 acknowledges and monitors all connections and disconnections for IP addresses, and issues connection and disconnection messages to other components in the access system.
• the session coordinator 34 uses the connection data, together with profile data accessed from the member profile database for the user 14, to create an instance of a session manager 36 for the connection.
• the connection data passed to the session coordination 34 in the connect message includes the IP address, the usemame and the CLI. Session managers 36 are created for each connection or session, respectively, and provide instructions to the redirector server 42 to control the state at the switch 6 for the session.
• a session manager 36 controls the traffic which the user can receive during the session by controlling the state of the switch for the user's IP address.
• the state control is executed on the basis of the user ' s member profile held in the member profile database of the server 8.
• the profile specifies which one of a limited number of access profiles the user belongs to.
• the access profiles each contain data which defines the access states that the user is able to enter.
• the different access states are encoded in the switch 6.
• the session manager 36 for the session instructs the redirection server 42 to store data in the switch 6 indicating which one of the access states apply to the session. For example, during authentication the session is in a login state and can change to a general state or affiliate state once authentication has been completed.
• the access system executes browser based authentication using the access procedure shown in Figure 3.
• the user is able to connect to the Internet by simply dialling into the access system using standard PPP software, at step 62, and the RASs 4 will automatically connect the user 14 without requiring the entry of any username or password.
• the user is automatically connected, an IP address assigned and a TCP session established, when the user dials into a port of a RAS 4 using predetermined call numbers.
• the system informs the user's computer 14 of the connection and the PPP software will display for the user the fact that the connection has been established and any other details associated with the connection, such as the data rate.
• the IP address is assigned from an address pool for immediate connection.
• the switch 6 determines whether the user's machine 14 is requesting connection to another computer on the Internet 16, at step 64.
• the request for example, may be simply to the user's default home page when the user opens a web browser of the computer 14.
• the switch 6 determines, at step 66 by checking a stored flag representing the switch state for the IP address, whether the user has been authenticated and that the state is not the login state. If the connection session is in the login state, the switch 6 connects the user 14 to a login page on the web server 22, and the control system 20 executes a login process 68.
• the login process 68 is similar to that for legacy authentication, in that the RAS accounting server 30 acknowledges that connection has occurred and a new session has been established for the IP address.
• Data for the session is passed to the session coordinator 34 to create an instance of a session manager 36 for the session.
• the session manager 36 determines that the user needs to be authenticated using browser based authentication and accordingly waits for the login server 32 to receive from the web server 22 details submitted on the login page shown in Figure 4.
• the login page presents the user with a number of options, which includes executing a registration process to become a new registered user, entering a username and password if already registered, or accessing help pages stored on the server 22.
• the page also includes a number of banner advertisements which may include links to other pages or web sites. To gain general access to the Internet 16, however, the user must enter a valid username and password combination which is authenticated by the control system 20.
• the login page allows the user to enter a username and password combination and then send the combination for authentication by clicking on the "sign in” button.
• the combination may already be stored on the computer 14 by the user.
• the username and password combination is received by the session manager 36 for the session and the combination is forwarded to the authentication client 38.
• the authentication client 38 passes the combination to an authentication daemon 40 running on the database server 8.
• the authentication daemon checks the combination against stored combinations for users to determine if it is valid, identify the user and access the unique member profile for the user from the database server 8.
• the user is allocated a telephone number to dial in on which corresponds to no authentication.
• the user is automatically connected, as for browser based authentication, and assigned an IP address from a pool for no authentication. Operation proceeds as described above for browser based authentication, except that the session manager 36 does not revert to the authentication client 38 to authenticate the user based on a username and password combination. The user is simply authenticated automatically by the session manager 36.
• an individual session manager 36 uses the member profile data for the user to compile and send a customised home page, as shown in Figure 5 to the user 14.
• the customised home page may also include banner advertisements, in the same manner as for the login page.
• the session manager 36 instructs the redirector server 42 to change the state of the switch 6 to a portal state, after authentication, which directs the switch to connect to the URL for the customised home page or portal shown in Figure 5. Details concerning the user and customised home page data from the member profile are passed by the session manager 36 to the login server 32 for access by the Apache server 22 which controls compilation of the customised home page.
• the session manager 36 instructs the redirector server so as to divert the switch to one of the browsing states, either an affiliate state or a general state.
• the login authentication process is managed using the web browser of the user's machine 14. rather than the PPP software, and operation returns after the login process 68 to step 64.
• the switch 6 determines at step 70, on the basis of the access state for the session, whether the user is allowed to access a requested computer or service. If so, the user is granted access to the computer or service on the Internet 16 at step 62. If not, the user 14 is advised at step 64 of the access denial.
• the access denial can be communicated by connecting the user to a denial page of the Apache server 22.
• a user 14 having a session which is in the affiliate state is allowed access, at no charge, to sites maintained by affiliates of the provider of the access system.
• the affiliate sites may be maintained on the Apache server 22 or on other servers of the Internet 16.
• the affiliate sites are all identified by URLs in the rules of the affiliate state.
• the affiliate sites can also be accessed using the links provided in the web pages of Figures 4 and 5.
• the rules for the affiliate state specify that access is denied to any URLs which do not belong to the affiliate sites. If however a user has a member profile that allows access to other sites on the Internet, the user is able to move to the general state.
• the user's browser is redirected by the switch 6 to an interim blank page on the Apache server 22 while the session manager 36 determines whether to instruct the redirector server 42 to change the state of the switch to the general state.
• the interim blank page contains code to trap the requested URL and pass the URL and a message to the login server 32 advising that the user is attempting to move from the affiliate state to the general state. This message is passed to the session manager 36, on the basis of the IP address, and the session manager 36 accesses the member's profile.
• the session manager 36 determines on the basis of the profile that the user 14 is allowed to move the general state, a message is sent to the redirector server 42 to change the state of the switch to the general state for the session. A message is also sent from the manager 36 to the login server 32 advising that the user 14 is allowed to move to the trapped URL.
• the login server 32 sends a message to the Apache server 22 to forward the user 14 from the interim page to the page of the requested trapped URL. If access is denied, the URL of a denied page is used to substitute the trapped URL at the login server 32, and the user 14 is forwarded to the denial page.
• a session manager 36 will instruct the redirector server 42 to enter the switch into the registration state for a session when a user sends a message indicating they wish to register with the access system. This may be done when, for example, the user selects the registration option on the login page of Figure 4.
• the switch 6 redirects the user 14 to registration pages on the Apache server 22 and the control system 20 collects the requested details on the pages from the user 14 for the user file in the database server 8.
• the user file normally includes the member profile data for the user which is initially established on the basis of the requested details.
• a session manager 36 will instruct the redirector server to cause the switch 6 to enter the allow state when the IP address indicates that the user 14 is to be provided with unrestricted access to the Internet 16 without any monitoring or charge.
• the RAS 4 communicates disconnection to the RADIUS accounting server 30, which in turn advises the session manager 36.
• the manager 36 instructs the redirector server 42 to change the state of the switch to the login state for the IP address of the disconnected session.
• the manner in which the user is charged is controlled by a plan manager 44 that is accessed by the session manager 36.
• the plan manager 44 maintains different charging plans which can be applied to users. For example, all users would not be charged for access to affiliate sites, but the rate of charge may differ for accesses when in the general state. For instance, users may be allocated a predetermined period of free access for pages to the general state and then charged at a set rate thereafter.
• the plan manager specifies the times and rates for the different plans, and this is accessed by the session managers 36 which monitor the time a user spends in different access states.
• the ultimate charge for a session is compiled by the session managers 36 and then stored against the user's file in the database server 8.
• the operations executed by the switch 6 can be implemented by the following different system configurations.
• the switch 6 can be replaced by a layer four switch and a proxy server.
• the layer four switch redirects all traffic from the RASs 4 to the proxy server which is connected to the router 12.
• the proxy server is also connected to the control system 20.
• the proxy server 10 is used to establish the different access states for each connection session, with the states being dynamically adjusted under the control of the control system 20.
• the proxy server also stores the rules defining each of the access states which it can provide for different sessions.
• the control logic communicates with the control system 20, as discussed above, to dynamically adjust the access states for different sessions.
• the access method and system are particularly advantageous as they allow ISPs, at least initially, to dynamically control the pages viewed by a user.
• the user must, and cannot avoid, viewing the login or customised home page, as these are an integral part of the login process.
• This allows the ISP to present advertising information, and in particular present targeted advertising information based on the user's profile, which the ISP can guarantee that all of its users will not be able to avoid.
• the login and customised home pages therefore act as an entry portal for all users.
• the ISP is able to present and provide free access to selected and predetermined Internet content and services.
• the login page may include links to certain web pages that provide banking, stock trading or home shopping, and the user will not have to pay any fees to the ISP to access these pages.
• This allows the ISP to act as a free content provider for certain content, whilst charging a user to access other data on the Internet.
• the ISP can, if desired, still require and obtain certain information on and from users before providing the free content, and monitor their access.
• Encoding the access states in the switch 6 also allows the ISP to restrict or allow access to selected content or services on the Internet, such as sports betting, adult orientated content or children ' s content.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• General Engineering & Computer Science (AREA)
• Computer Hardware Design (AREA)
• Theoretical Computer Science (AREA)
• Computing Systems (AREA)
• Computer Security & Cryptography (AREA)
• Business, Economics & Management (AREA)
• General Business, Economics & Management (AREA)
• Multimedia (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Computer And Data Communications (AREA)
• Information Transfer Between Computers (AREA)
• Data Exchanges In Wide-Area Networks (AREA)

Applications Claiming Priority (5)

Publications (1)

Family

ID=25646048

Family Applications (1)

Country Status (9)

Families Citing this family (14)

Family Cites Families (6)

• 2000
  • 2000-05-05 IL IL14247300A patent/IL142473A0/xx unknown
  • 2000-05-05 JP JP2000616570A patent/JP2002544688A/ja active Pending
  • 2000-05-05 CN CN00802086A patent/CN1346475A/zh active Pending
  • 2000-05-05 KR KR1020017004912A patent/KR20020012532A/ko not_active Application Discontinuation
  • 2000-05-05 CA CA002346855A patent/CA2346855A1/en not_active Abandoned
  • 2000-05-05 EP EP00922334A patent/EP1188138A1/en not_active Withdrawn
  • 2000-05-05 WO PCT/AU2000/000418 patent/WO2000068862A1/en not_active Application Discontinuation
  • 2000-05-05 BR BR0007041-6A patent/BR0007041A/pt not_active Application Discontinuation
• 2001
  • 2001-04-04 NO NO20011704A patent/NO20011704L/no not_active Application Discontinuation

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events