JP2008060930A - Connection control system and management device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a connection control system by content delivery link in public Internet access service which surely delivers content such as advertisement to users, and enhances the effectiveness of the advertisement, etc. <P>SOLUTION: The connection control system provides the content delivery link in the public Internet access service which provides access to the Internet in public places to users which request access to the Internet, by using an access device which has an Internet access function and a content receiving function. The connection control system includes a means for permitting communication with only the limited destinations the first time when the access device is connected to the facility of the service provider; and a means for permitting communication between the access device and an arbitrary destination, only when it receives a receiving confirmation response issued by the access device after the access device receives the content provided via the facility of the service provider. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a connection control system, a management apparatus, and a program, and more particularly to a content distribution system and a public Internet connection service providing method in a public Internet connection service.

User authentication using a Web interface is widely performed in Internet connection services and public wireless LAN services in hotel rooms. For example, in the authentication device products of Nomadix (for example, products such as AG3000), this authentication screen is provided to the user terminal by an html file, and the business operator provides some information or banner advertisement to the user. Can be displayed on the screen as a general technique.
In addition, a function for forcibly displaying the portal page specified by the operator on the user's web browser upon completion of this user authentication is also implemented. For example, it is common to place advertising content on this portal page It is.
Looking at the contents for advertising, advertisements based on video contents are scattered on the Internet, but Internet advertising as an advertising technique is not a general technique.
In a commercial public wireless LAN service, a user uses an Internet connection by paying a usage fee related to the connection. There are public wireless LAN providers that provide free connection services to users, but this is because public wireless LAN connections are used as an auxiliary means to improve the performance of other businesses. Therefore, it is different from the framework as a business that increases profits through public wireless LAN services. A model for connection charge burden in a public wireless LAN is shown at 401 in FIG.

A mechanism for simply presenting static advertisement content to a public Internet connection service user or the like at the time of network connection can be realized by an existing technology as described in the background art. Thus, although it is possible to display an advertisement unidirectionally to the user, it is difficult to expect a sufficient advertisement effect because the user is less motivated to receive the advertisement.
Moreover, although the advertisement is displayed, there is a possibility that the user has not noticed the advertisement. For this reason, even if advertising content is distributed in such a form, a mechanism for allowing the user to pay attention to the content itself is necessary.
Static contents such as banner advertisements are generally used as advertising media, and are not satisfactory in terms of impact on users. In this regard, video / audio advertisements that can be expected to have a high appeal effect if received by the user are promising as an advertising technique. However, simply providing the user with a link to the video / audio advertisement does not allow the user to view the video / audio advertisement, or whether the user can continue to view the video / audio advertisement until the end. There is a problem.

On the other hand, video / audio content, particularly video content that requires a wide band, may cause a shortage of network resources, and may not be able to maintain sufficient quality. For this reason, a means for alleviating quality degradation due to a shortage of network resources, which is caused by excessive video / audio content, is required.
Therefore, it is considered effective to use broadcast (multicast) content distribution as a means of resolving shortage of network resources, but it is possible to determine whether the user has received the content to the end. There is a problem that it is difficult.
In the case of streaming distribution by unicast, it is possible to accurately grasp the viewing end time of the terminal, but in the case of multicast, it is difficult to grasp the viewing end time of a specific terminal.
Also, authentication methods for users are diversified. For example, taking a public wireless LAN connection service as an example, wireless ID authentication is not performed, and the user is manually input an ID and password. There is a method for specifying, and there are cases where the terminal is authenticated using IEEE802.1x. Even when these authentications are used, it is necessary for the present invention to be effective.

In the present invention, a method is proposed in which a user can use the Internet connection by receiving content. However, if the Internet connection time is unlimited, network resources (such as the number of IP addresses to be paid out to the terminal) are consumed unnecessarily. There may be a case. In addition, for a user who connects to the Internet for a long time, the business operator needs a mechanism for receiving advertisements again every predetermined time.
Taking the public wireless LAN connection service as an example, the user who wants to suddenly use the public wireless LAN on the road in the area of the user's charge when using the public wireless LAN is assumed to be in advance with the public wireless LAN operator. There were cases where the public wireless LAN could not be used for reasons such as not making a contract or purchasing a prepaid card. In addition, there are public wireless LAN operators that allow use without prior contracts. In that case, the user must enter information such as name and credit card number on the spot. It is an obstacle.
In addition, when a public wireless LAN provider also constructs a public wireless LAN spot in a spot-like or event-like manner, the target user is not a continuous user for a long period of time. It has been difficult to build a billing system for withdrawing fees from consumers.
The present invention has been made to solve the above-described problems of the prior art, and an object of the present invention is to reliably deliver contents such as advertisements to users and to improve the effects of advertisements and the like. It is an object of the present invention to provide a connection control system that enables content distribution in a public Internet connection service.
Another object of the present invention is to provide a management apparatus applied to a connection control system based on content distribution in the public Internet connection service described above.
Another object of the present invention is to provide a program for causing a computer to execute the above management apparatus.
The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.

Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.
The present invention is realized as follows.
FIG. 1 shows an operation sequence of the connection control system based on content distribution in the public Internet connection service of the present invention.
When the user connects to the public Internet connection service network using the access device 111 (step S101), the access device 111 can communicate only with a limited destination at first.
In this state, when the user attempts to connect to an arbitrary site on the Internet (step S102), the guidance device 114 instructs the access device 111 to receive content (step S103).
After receiving the content from the distribution device 116 (step S104), the access device 111 transmits a reception confirmation response message to the management device 113 (step S105). The management device 113 determines that the access device 111 has received the content, and allows the gateway device 115 to permit communication from the access device 111 to an arbitrary destination (here, the Web server 117) (step S106). ). At this time, the management device 113 records in the log that the access device 111 has received the designated content.
Through the above procedure, the access device 111 can connect to an arbitrary site (step S107).

Furthermore, the present invention is realized as follows.
When using the IP multicast method for content distribution, the management device 113 determines that the access device 111 of the user has received the content for a predetermined time or longer from the access device 111 to the gateway device 115. Enable communication to. With this, the access device 111 can connect to an arbitrary site.
Furthermore, the present invention is realized as follows.
In the above-described invention, the user access device 111 uses radio and connects to the public Internet connection service network via the radio base station 112. With this, the access device 111 can connect to an arbitrary site.
Furthermore, the present invention is realized as follows.
The system for the public Internet connection service is constructed by implementing the function of the gateway device 115 in the above-described invention in the radio base station 112.

Furthermore, the present invention is realized as follows.
Similar to the above-described invention, the function of the gateway device 115 is implemented in the radio base station 112, and VLAN switching is used as a method for realizing the function.
The operation sequence of this procedure is shown in FIG. In the present invention, the wireless base station 112 sets two VLANs (VLAN ID = # 1 and VLAN ID = # 2) on the wired interface side, and in accordance with an instruction from the authentication device 118, the access device (wireless LAN terminal) 111 It has a function of switching the accommodated VLAN.
Here, VLAN ID = # 1 is a VLAN corresponding to a limited network having no connection point with the Internet, and VLAN ID = # 2 is a VLAN corresponding to an Internet connection network having a connection point with the Internet.
Further, the management device 113 or the authentication device 118 has a user data table shown in FIG. 3 and returns authentication success to all MAC authentication requests by default, and VLAN ID = # 1 is set at that time. specify. The user access device 111 is first connected to the VLAN with VLAN ID = # 1, and content can be received at this stage.
Upon receiving the content reception confirmation message from the user access device 111, the management device 113 adds the MAC address value of the access device 111 to the table of FIG. 3, and sets # 2 as the corresponding VLAN ID at that time. . Then, the management apparatus 113 instructs the radio base station 112 to cancel the attribution of the access apparatus 111. The access device 111 whose membership has been resolved autonomously reconnects to the radio base station 112, and the authentication device 118 is instructed to use VLAN ID = # 2 at the time of the connection authentication. As a result, the access device 111 is accommodated in the Internet connection network.
Through the above procedure, the access device 111 can be connected to any site on the Internet.

Furthermore, the present invention is realized as follows.
The access device (wireless LAN terminal) 111 connects to the wireless base station 112 through two-step authentication. First, the second authentication is executed using the communication path established by the first stage authentication. Usually, in such a case, it is normal that only the data of the second authentication is passed through the communication path that is probable by the first authentication. However, in the present invention, communication to a specific area of the network (the limited network) is permitted using the communication path established by the first stage authentication. In addition, communication of the second authentication data is prohibited. Then, the management apparatus 113 instructs the base station apparatus 112 to end the prohibited state when confirming the content reception by the access apparatus 111. Thereafter, the access device 111 completes the second stage authentication and can connect to an arbitrary site.

Furthermore, the present invention is realized as follows.
The service provider holds information describing the relationship between the content and the allowable connection time, and based on this information, allows the user to communicate with an arbitrary destination only during the allowable connection time corresponding to the received content. After the allowable connection time has passed, the communication is returned to a state where communication is possible only with a limited destination. In addition, when the user receives a plurality of contents, the sum of the allowable connection times for each content is calculated, and this is used as the allowable connection time for the user.
Furthermore, the present invention is realized as follows.
The service provider holds information describing the relationship between the content and the connection quality, and based on this information, allows the user to connect to the network with the connection quality corresponding to the received content.
Furthermore, the present invention is realized as follows.
The service provider provides advertisement distribution performance information to the content provider, and receives compensation for the advertisement distribution. A user who uses the public Internet connection service connects to the Internet without paying a usage fee for the public Internet connection service by receiving the advertisement content.
A model provided by the present invention is shown at 402 in FIG. In this figure, the case where a wireless LAN is used as the connection means is described.

The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.
ADVANTAGE OF THE INVENTION According to this invention, content, such as an advertisement, can be reliably delivered to a user, and it becomes possible to improve the effect, such as an advertisement.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
In all the drawings for explaining the embodiments, parts having the same functions are given the same reference numerals, and repeated explanation thereof is omitted.
[Example 1]
FIG. 5 is a block diagram showing a schematic configuration of a connection control system based on content distribution in the public Internet connection service according to the first embodiment of the present invention.
In the present embodiment, an example will be described in which a wireless LAN is used as a medium for a user to connect to the facilities of a network operator. That is, the user's access device terminal is a wireless LAN terminal, and the network operator is a public wireless LAN operator.
In FIG. 5, 501 represents the Internet. Reference numeral 502 denotes a network having a communication path to the Internet (hereinafter referred to as an Internet connection network).
Reference numeral 503 denotes a network that does not have a direct route to the Internet (hereinafter referred to as a limited network).
Reference numeral 504 denotes a wireless LAN base station that conforms to IEEE802.11b, IEEE802.11g, IEEE802.11a for public wireless LAN connection services, or some of these standards (hereinafter simply referred to as a wireless LAN base station). It is.

Reference numeral 505-1 denotes a user who wishes to connect to the Internet via a public wireless LAN base station, and 505-2 denotes a wireless LAN terminal of the user 505-1, which is connected to the wireless LAN base station 504. Wireless LAN client function.
A gateway device 506 is located at the boundary between the Internet connection network 502 and the limited network 503, and permits a user's traffic to communicate with the Internet connection network by satisfying a specific condition.
In the present embodiment, the wireless LAN terminal 505-2 also functions as a guidance device for receiving content (hereinafter referred to as a gateway / guidance device). This device has a gate function that blocks traffic other than authorized users.
In order to allow an inquiry to a DNS server on the Internet, the DNS-related protocol is allowed to pass unconditionally.
Reference numeral 507 denotes a management server that controls the gate opening / closing of the gateway / guidance device. In the present embodiment, an HTTP server function is also implemented in order to display a Web-based message to the user.
Reference numeral 508 denotes a content distribution server. Reference numeral 509 denotes an arbitrary Web server on the Internet. Steps S501 to S509 represent transmission / reception of messages between various terminals, servers, and apparatuses.

FIG. 6 shows an operation sequence of this embodiment. Steps S601 to S609 represent transmission / reception of messages between various terminals, servers, and apparatuses.
FIG. 7 shows an example of a Web page displayed on the user's wireless LAN terminal 505-2 in this embodiment. Reference numerals 701 to 704 are display screens in the respective states. Here, it is assumed that the html file for displaying these pages is arranged on the management server.
In addition, FIG. 17 illustrates a functional block example of the management server 507 of the present embodiment.
In FIG. 17, 1701 is a management server, 1702 is a gateway device, and 1703 is a wireless LAN terminal. Reference numeral 1711 denotes an http processing unit, 1712 a user interface unit, 1713 a content list management unit, 1714 a terminal management unit, 1715 a recording unit, and 1716 a gateway device control unit.
Steps S1701 to S1715 represent transmission / reception of messages between various terminals, servers, apparatuses, and functional blocks.

Hereinafter, a procedure until the user receives an arbitrary Web page on the Internet will be described.
The wireless LAN terminal 505-2 of the user 505-1 connects to the wireless LAN base station 504 using the wireless LAN (step S501, step S601).
When the wireless LAN connection is completed, the user 505-1 attempts to acquire content on an arbitrary Web server 509 in the Internet 501. Then, the wireless LAN terminal 505-2 transmits an HTTP request to the Web server 509 (steps S502 and S602).
Here, the gateway / guidance device 506 returns the HTTP status code “301”, “302” or “307” as a response to the HTTP request from the unauthorized user (steps S503 and S603). These are HTTP redirection codes. When the URL indicating the html file of the web page 701 on the management server 507 is notified together with this code, the web page 701 is displayed on the browser screen (step S504). Step S505, Step S604, Step S605, Step S1701, Step S1702, Step S1703, Step S1704).
It is also possible to display content such as advertisements directly on the Web browser of the user's wireless LAN terminal 505-2 without displaying the link Web page 701 in the same procedure. The link information to the content at this time is created, for example, by making an inquiry from the user interface unit 1712 to the content list management unit 1713 (steps S1705 and S1706).

When the user follows the link from the link web page 701 or is forcibly redirected to HTTP, the wireless LAN terminal 505-2 acquires the html file of the content web page 702 and displays it on the browser screen. It is displayed (step S506, step S606).
A button 7012 is arranged, and it is considered that the user 505-1 has read the content Web page 702 from the top to the bottom when the user 505-1 has pressed the button 7012. When the button 7012 is pressed, the action is confirmed by the management server 507 (step S507, step S607, step S1707, step S1708).
In the management server 507, the terminal management unit 1714 receives this information, obtains information such as the allowable connection time from the content list management unit 1713 (step S1711, step S1712), and leaves a record in the recording unit 1715 (step S1713). At the same time, the processing is transferred to the gateway device control unit 1716 (step S1714).
The management server 507 notifies the gateway / guidance installation 506 and opens the gate to the Internet connection network 502 for the wireless LAN terminal 505-2 (step S508, step S608, step S1715).
After entering this state, the wireless LAN terminal 505-2 can connect to the Web server 509 on the IP layer (steps S509 and S609).

Further, instead of the content Web page 702, it is also possible to do the following. Using the content web page 703, the ID and password are paid out. When the user 505-1 presses the button 7013, the management server 507 displays the authentication Web page 704 and waits for input of ID and password.
Upon confirming that the correct ID and password that have been paid out have been input, it is determined that the user 505-1 has indeed received the content Web page 703, and the management server 507 The gate of 506 is opened (step S508, step S608).
In the above description, the gateway / guidance device 506, the management server 507, and the content distribution server 508 are described in the form of one function and one device in order to simplify the description, but this is merely an implementation method. It suffices if these functions are provided somewhere in the network, and even if some or all of these functions are implemented in one device, the operation itself does not change. For example, the function of the management server 507 may coexist in the gateway / guidance device 506.

[Example 2]
Hereinafter, as a second embodiment of the present invention, means for using IP multicast as content distribution means will be described. FIG. 8 shows an example of a screen displayed on the user's wireless LAN terminal 505-2.
In the first embodiment, the content Web page 702 has been described as being displayed on the wireless LAN terminal 505-2, but this portion is the content display screen 802 in the present embodiment. In this state, when the user 505-1 continues to receive the video for a predetermined time, the screen changes as indicated by 803. There are a plurality of means for realizing this screen transition. For example, it can be realized by the SetTimeout method of JavaScript.
Here, since the management server 507 can confirm that the user 505-1 has pressed the button 8013, the embedding server 507 opens the gate of the barrier / guidance device 506 by the operation of step S508.
As another example, when the content display screen 802 of FIG. 8 is displayed on the wireless LAN terminal 505-2 and the user 505-1 continues to receive video for a predetermined time, the screen is displayed. Transition is made to 804.
When the user 505-1 presses the button 814, an authentication Web screen 805 is displayed. When the ID and password are correctly input, the management server 507 opens the gate of the gateway / guidance device 506. Open.

[Example 3]
FIG. 9 is a block diagram showing a schematic configuration of a connection control system based on content distribution in the public Internet connection service according to the third embodiment of the present invention.
In FIG. 9, 901 represents the Internet. Reference numeral 902 denotes a VLAN with VLAN ID = 1 which does not have a direct route to the Internet. Reference numeral 903 denotes a VLAN with VLAN ID = 2 having a communication path to the Internet. Reference numeral 904 denotes a VLAN with VLAN ID = 3 having a communication path to the Internet. However, VLAN 903 and VLAN 904 have different network connection quality.
Reference numeral 905 denotes a wireless LAN base station (hereinafter simply referred to as a wireless LAN base station) conforming to IEEE802.11b, IEEE802.11g, IEEE802.11a for public wireless LAN connection service, or some of these standards. In this embodiment, the wireless LAN base station 905 operates as a gateway device. Hereinafter, it is referred to as a wireless LAN base station / gateway device.
A user 910-1 desires an Internet connection via the wireless LAN base station 905. A user's wireless LAN terminal 910-2 has a wireless LAN client function for connecting to the wireless LAN base station / gateway device 905.

912 is a DHCP for providing information such as an IP address, a netmask, a gateway address, and DNS necessary for network connection by the IP protocol when the user's wireless LAN terminal 910-2 is connected to the limited network. It is a server.
When the user's wireless LAN terminal 910-2 connects to the limited network and tries to connect to an arbitrary site on the Internet using the domain name, the server 913 uses the server's real IP address as the user's wireless This is a DNS server for notifying the LAN terminal 910-2.
915 is a management server for controlling permission of the user's wireless LAN terminal 910-2 to communicate with the Internet connection network 903. Reference numeral 916 denotes a management table placed in the management server 915. The contents of the table are shown in FIG.
Reference numeral 917 denotes a content distribution server.
Reference numeral 918 denotes a Radius server which is an authentication device for the wireless LAN base station. The wireless LAN base station 905 performs terminal authentication, makes an inquiry to the Radius server 918, and the Radius server 918 makes a database inquiry.
L901 and L902 indicate the connection status of the user's wireless LAN terminal 910-2 to each VLAN.

Steps S901 to S911 represent data transmission / reception between the user's wireless LAN terminal 910-2 and various servers.
FIG. 10 shows an operation sequence of this embodiment. The wireless LAN base station 905 used in the present embodiment has an authentication VLAN function that distributes the VLAN that accommodates the wireless LAN terminal 910-2 of the user 910-1 according to an instruction from the Radius server 918 during authentication. I will do it.
FIG. 18 shows an example of functional blocks of the management server 915 of this embodiment. In FIG. 18, 1801 is a management server, 1802 is a gateway device, 1803 is a wireless LAN terminal, 1804 is a Radius server, and 1805 is a DHCP server.
1811 is an http processing unit, 1812 is a user interface unit, 1813 is a content list management unit, 1814 is a terminal management unit, 1815 is a recording unit, 1816 is a gateway device control unit, and 1817 is a DB response handling unit.
Steps S1801 to S1821 represent message transmission / reception between various terminals, servers, apparatuses, and functional blocks.

Hereinafter, a procedure until the user 910-1 receives an arbitrary Web page on the Internet will be described.
The wireless LAN terminal 910-2 of the user 910-1 tries to connect to the wireless LAN base station / gateway device 905. When the wireless LAN terminal 910-2 connects the wireless LAN to the wireless LAN base station / gateway device 905 (step S1001), the wireless LAN base station / gateway device 905 sets the user-name attribute to the Radius server 918. Acces-Request including the MAC address value of the user's wireless LAN terminal 910-2 is transmitted (step S1002, step S901).
The Radius server 918 executes a database search inquiry to the management server 915 (step S1003, step S902, step S1816).
Upon receiving the inquiry, the management server 915 searches the management table 916 and searches for the MAC address of the inquiry. (Step S1818). This management table 916 is managed by the terminal management unit 1814.
At this stage, since the inquired MAC address does not exist, the last default record in the management table 916 is hit as indicated by 1101 in FIG. Then, in response to the database search inquiry, it behaves as if the record 1102 in FIG. 11 has been hit (step S1819).

The Radius server 918 determines that connection permission may be given to the MAC address based on a database search response (Step S1004, Step S902, Step S1817) from the embedding server 915. At that time, based on the acquired information of VLAN ID = 1, the connection destination VLAN of the user's wireless LAN terminal 910-2 is set to VLAN # 1 902 (L1001) (step S1005, step S901).
In steps S1002 and 1003, the management server 915
user-name: MAC address value of the wireless LAN terminal 910-2 (when using MAC authentication)
NAS-ID: identifier of the wireless LAN base station 905
NAS-IP-Address: IP address of non-recurring LAN base station 905
Calling-Station-ID: Information on the MAC address value of the wireless LAN terminal 910-2 can be acquired.
When the wireless LAN connection is completed, the wireless LAN terminal 910-2 acquires information such as an IP address, a netmask, a gateway address, and DNS from the DHCP server 912 (steps S1006 and S903).

At this stage, the user 910-1 tries to acquire content on an arbitrary Web server 921 in the Internet 901. The wireless LAN terminal 910-2 makes an inquiry to the DNS server 913 in order to acquire the real IP address of an arbitrary Web server 921 (steps S1007 and S904).
Here, in response to an inquiry from an unauthorized user, the DNS server 913 returns an IP address value of the management server 915 to the wireless LAN terminal 910-2 instead of the IP address of the Web server 921 ( Step S1008, Step S904). As a result, the wireless LAN terminal 910-2 transmits an HTTP request to the management server 915 (step S1009, step S905, step S1801).
The management server 915 returns the web page 701 to the user 910-1 (step S1804). The link information to the content at this time is created, for example, by making an inquiry from the user interface unit 1812 to the content list management unit 1813 (steps S1805 and S1806).
Here, a description will be given assuming that a static html file is placed on the content distribution server 917 as content (advertisement or the like).

An example of the Web page will be described with reference to FIG. 7 used in the first embodiment. When the user 910-1 follows the link from the link web page 701, the wireless LAN terminal 910-2 acquires the html file of the content web page 702 and displays it on the browser screen (step S1011, step S1011). S906).
When the user 910-1 presses the button 7012, the action is confirmed in the management server 915 (step S1012 and step S907). When the management server 915 determines that the content of the user 910-1 has been received, the management server 915 starts a network switching operation by the wireless LAN base station / gateway device 905.
The procedure is shown below. When the user 910-1 presses the button 7012, the management server 915 displays a screen for announcing the network switching on the browser screen on the wireless LAN terminal 910-2 (Step S 1013, Step S 908).
The management server 915 confirms the state with respect to the DHCP server 912 and acquires a MAC address value associated with the IP address used by the wireless LAN terminal 910-2 (steps S1014, S1015, step S909, step S1820). , Step S1821).

The terminal management unit 1814 obtains information such as allowable connection time and connection quality from the content list management unit 1813 (steps S1811 and S1812), and then updates the management table 916 and stores the information in the management table 916 in FIG. As shown in 1102, the record of the MAC address is added. At that time, 2 is set in the VLAN ID field of the MAC address.
Here, the VLAN ID can be set to a different value for each wireless LAN terminal in accordance with the quality of the connected network. Here, a case where VLAN ID = 2 is shown as an example.
The management server 915 designates the MAC address value of the wireless LAN terminal 910-2 to the wireless LAN base station / gateway device 905 and instructs the wireless LAN base station / gateway device 905 to perform wireless disconnection processing via the gateway device control unit 1816 ( Step S1016, Step S910, Step S1815).
Here, the wireless LAN terminal 910-2 that has been wirelessly disconnected autonomously reconnects (step S1017). When the user's wireless LAN terminal 910-2 reconnects the wireless LAN to the wireless LAN base station / gateway device 905, the wireless LAN base station / gateway device 905 sets the user-name attribute to the Radius server 918. Acces-Request including the MAC address value of the user's wireless LAN terminal 910-2 is transmitted (steps S1018 and S901).

The Radius server 918 makes a search inquiry in the management table 916 to the management server 915 (step S1019, step S902, step S1816).
Upon receiving the inquiry, the management server 915 searches the management table 916 and searches for the MAC address of the inquiry.
As a result, since the MAC address of the wireless LAN terminal 910-2 exists, the record is selected as shown by 1103 in FIG. In response to the database search inquiry, it behaves as if the record 1104 in FIG. 11 has been hit.
The Radius server 918 determines that connection permission may be given to the MAC address as a result of the database search for the management server 915 (step S1020, step S902, step S1817). At that time, based on the acquired VLAN ID = 2 information, the connection destination VLAN of the user's wireless LAN terminal 910-2 is set to VLAN # 2 (903) (step S1021, step S901). This state is L902 and L1002.

Here, as shown in FIG. 11, the information (in this case, 100 ms) of the Timer field of the embedding table 916 is also passed to the Radius server 918 (step S1020), whereby the Radius server 918 makes the Access-Accept Session-timeout = 100 is added as an attribute in the message (step S1021).
After entering this state, the wireless LAN terminal 910-2 can connect to the Web server 921 at the IP layer (steps S1022 and S911).
Note that the wireless LAN base station / gateway device 905 terminates the wireless connection of the wireless LAN terminal 910-2 when the time designated by session-timeout has elapsed.
The management server 915 deletes the MAC address from the embedding table 916 after a predetermined time has elapsed, and sets the management table 916 to a state indicated by 1101 in FIG.

[Example 4]
FIG. 12 is a diagram illustrating an operation sequence of the connection control system according to the content distribution linkage in the public Internet connection service according to the fourth embodiment of the present invention.
In this embodiment, as an example of two-step authentication, IEEE802.1x authentication is used, first-step authentication is open authentication, and second-step authentication is EAP-TLS.
FIG. 19 shows an example of functional blocks of the management server of this embodiment. In FIG. 19, 1901 is a management server, 1902 is a gateway device, 1903 is a wireless LAN terminal, and 1904 is a DHCP server.
Reference numeral 1911 denotes an http processing unit, 1912 a user interface unit, 1913 a content list management unit, 1914 a terminal management unit, 1915 a recording unit, 1916 gateway device control unit, and 1917 a storage unit.
Steps S1900 to S1924 represent transmission / reception of messages between various terminals, servers, apparatuses, and functional blocks.

Hereinafter, a procedure until the user receives an arbitrary Web page on the Internet will be described.
When the wireless LAN terminal 1210-2 connects to the wireless LAN base station 905 (step S1201), open authentication is completed (step S1202). This is an indispensable operation for maintaining backward compatibility in the IEEE802.1x standard. Normally, EAP authentication is executed as the next phase, and the wireless LAN terminal 1210-2 is not permitted to communicate with devices in the network until this authentication is completed.
In this embodiment, the wireless LAN base station 1205 performs the following operation.
The EAP authentication request message (step S1204) from the wireless LAN terminal 1210-2 is blocked, discarded at the wireless LAN base station 1205, and the information is notified to the management server 1215 (steps S1203 and S1900). The operation of this block is continued until a cancellation instruction is received from the management server 1215.
The wireless LAN terminal 1210-2 connected by open authentication is permitted to communicate with a specific network. As a result, at this stage, the wireless LAN terminal 1210-2 acquires the IP address from the DHCP server 1212 in the network (step S1205), and receives the content by the same procedure (step S1206) as in the third embodiment. (Step S1207).

The management server 1901 confirming the content reception at the wireless LAN terminal 1210-2 (step S1208, step S1907, step S19110) downloads a client certificate that can be used at this public spot to the wireless LAN terminal 1210-2. Is displayed (step S1910).
As a result, the wireless LAN terminal 1210-2 obtains a certificate (step S1209, step S1922, step S1923, step S1924, step S1925). Here, it is assumed that the certificate file is stored in the storage unit 1917 in the management server 1901. Further, instead of the certificate file, an electronic file (for example, a dedicated program for executing an authentication operation) necessary for the second-stage authentication may be passed to the wireless LAN terminal 1210-2.
At this time, the management server 1215 also acquires the correspondence between the IP address and the MAC address of the wireless LAN terminal 1210-2 from the DHCP server 1212 (step S1210, step S1920, step S1921).
Then, the management server 1215 sends a block release command to the wireless LAN terminal 1210-2 with the MAC address via the gateway device control unit 1916 to the wireless LAN base station 1205 (step S1211, step S1915).
After this operation, IEEE802.1x authentication is completed (step S1212 and step S1213), and the Internet can be used (step S1214).

[Example 5]
As the fifth embodiment of the present invention, the case of the first embodiment will be described as an example, and the operation for applying the allowable connection time corresponding to the browsing content and the network connection quality to the user will be described.
The management server 507 manages the relationship between the content and the allowable connection time using the content management table 1301 shown in FIG. This table is managed by the content list management unit 1713. For example, when the content used for distribution is content ID = 100001, the allowable time is 60 minutes. In addition, the QoS policy is 1.
Here, with respect to the QoS policy, settings such as QoS Policy = 1: Bandwidth limit 1 Mbps, QoS Policy = 2: Bandwidth limit 5 Mbps, QoS Policy = 3: No bandwidth limit are set in advance. Further, as shown in FIG. 14, a method of allowing the user to select content is also possible.
Further, as shown in the Web page 1501 of FIG. 15, a method in which a user selects a plurality of contents and the total allowable connection time set for each content is used as the total allowable connection time is also possible.

A web page 1501 is a web page corresponding to the web page 701 in the first embodiment. The user selects the received content on the Web page 1501, and repeats the transition between 1502 and 1503 by the number of contents according to the result.
When all the selected contents have been received, the screen transitions to the Web page 1504, and an ID and a password for connecting to the Internet are obtained. At this time, in the management server 507 (terminal management unit 1714 in the management server 1701), the content selected by the user 505-1 and the information in the content management table 1301 are transmitted to the user's wireless LAN terminal 505-2. The total allowable time T allowed for Internet connection is calculated. For example, if the selected content is AAAA, BBBB, CCCC, T = 60 + 10 + 30 = 100 minutes.
In the first embodiment, in order to terminate the Internet connection in T = 100 minutes, the management server 507 notifies the gateway / guidance device 506 of the connection permission time in the operation of granting the connection permission (step S608). The gateway / guidance device 506 operates the timer from the start of connection, and closes the gate to the Internet connection network 502 after the specified time has elapsed.

[Example 6]
FIG. 16 is a block diagram showing a configuration of the sixth embodiment of the present invention.
In FIG. 16, 1601 is an advertisement distribution applicant, 1602 is a public wireless LAN operator, 1603 is a user, 1630 is the Internet, 1631 is a network of a public wireless LAN operator, 1632 is a public wireless LAN spot, and 1640 is a content distribution server. , 1641 is a management server, 1642 is a gateway device, 1643 is a wireless LAN base station, 1644 is a user's wireless LAN terminal, and steps S1601 to S1609 are operations, signals, messages, and the like.
The advertisement distribution applicant 1601 provides advertisement content to the public wireless LAN operator 2002 (step S1601).
The public wireless LAN operator 1602 shapes the content into a form suitable for distribution and places it on the distribution server 1640 (step S1602). On the other hand, the user 1603 who desires to use the public wireless LAN spot 1632 connects to the wireless LAN base station 1643 and receives content from the distribution server 1640 by the procedure described in the first embodiment (step S1603).

The embedding server 1641 opens the gate of the gateway device 1642 in response to the content reception completion message of the user 1603 (step S1604), and communicates with the user's wireless LAN terminal 1644 to the Internet 1630 (step S1806). provide.
At this stage, the user 1603 uses the Internet without paying monetary consideration.
The management server 1641 records not only the fact that the advertising content is displayed in one direction but also the actions that the user has taken after receiving the advertising content, and outputs it as a log (step S1607).
The public wireless LAN operator 1602 analyzes this log, calculates a price for content distribution, and charges the advertisement distribution applicant 1601 (step S1608).
Based on the contents of this report, the advertisement distribution applicant 1601 pays a consideration to the public wireless LAN operator 1602 (step Sl609). The public wireless LAN operator 1602 can operate the public wireless LAN connection service by obtaining a fee for providing the public wireless LAN connection service itself from the user who wants to distribute the platform 1601 instead of the user 1603. .

As described above, according to the present embodiment, it is possible to distribute content (advertisement, etc.) specifically for users who use a public Internet connection service, and the user can perform the content reception phase on the Internet. By incorporating it into the connection procedure until the connection is completed, the user can be motivated to receive the content, and the advertising effect can be enhanced.
Furthermore, it becomes possible for the content delivery means to use the IP multicast and allow the user to receive the content for a sufficient time.
Furthermore, even when the user uses two-step authentication, for example, authentication such as IEEE802.1x, it is possible to insert the effect of the present invention.
Furthermore, it is possible to limit the connection time to the Internet that is permitted by one content viewing, and it is possible to suppress the case where network resources are consumed unnecessarily. In addition, it is possible to provide a user who connects to the Internet for a long time to receive the content again at regular intervals.

Furthermore, it is possible to provide a mechanism for allowing a user to receive a plurality of contents.
Furthermore, by changing the network quality provided according to the viewing content, the service provider can provide services of different quality according to the content viewed by the user.
Furthermore, the user can use the public Internet connection service without paying a fee. Also, as a service provider, this connection is not provided free of charge, but the corresponding price can be obtained from advertising revenue.
The apparatus of the present invention can be realized by a computer and a program, and can be recorded on a recording medium or provided through a network.
As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

It is a figure which shows the operation | movement sequence of an example of the connection control system by the content delivery interlocking | linkage in the public internet connection service of this invention. It is a figure which shows the operation | movement sequence of the other example of the connection control system by the content delivery interlocking | linkage in the public internet connection service of this invention. It is a figure which shows the management table used for the connection control system shown in FIG. It is a form of connection charge burden. It is a block diagram which shows schematic structure of Example 1 of this invention. It is a figure which shows the operation | movement sequence of Example 1 of this invention. In Example 1 of this invention, it is a screen image of the web page displayed on a wireless LAN terminal. In Example 2 of this invention, it is a screen image of the web page displayed on a wireless LAN terminal. It is a block diagram which shows schematic structure of Example 3 of this invention. It is a figure which shows the operation | movement sequence of Example 3 of this invention. It is a figure for demonstrating the management table of Example 3 of this invention. It is a figure which shows the operation | movement sequence of Example 4 of this invention. It is a figure for demonstrating the content management table of Example 5 of this invention. In Example 5 of this invention, it is a screen image of the web page displayed on a wireless LAN terminal. In Example 5 of this invention, it is a screen image of the web page displayed on a wireless LAN terminal. It is a block diagram which shows schematic structure of Example 6 of this invention. It is a functional block diagram which shows schematic structure of an example of the management server of Example 1 of this invention. It is a functional block diagram which shows schematic structure of an example of the management server of Example 3 of this invention. It is a functional block diagram which shows schematic structure of an example of the management server of Example 4 of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 111 Access apparatus 112 Wireless base station 113 Management apparatus 114 Guidance apparatus 115,506,1642,1702,1802,1902 Gateway apparatus 116 Distribution apparatus 117,509 Web server 118 Authentication apparatus 501,901,1630 Internet 502 Internet connection network 503 Limited network 504, 905, 1205, 1643 Wireless LAN base station 505-1, 910-1, 1603 User 505-2, 910-2, 1210-2, 1644, 1703, 1803, 1903 Wireless LAN terminal 507, 915, 1215 1641, 1701, 1801, 1901 Management server 508, 917, 1217, 1640 Content distribution server 701-704, 801-805, 1401, 1501-1504 We Screen example 7012~7014,813~815 Web on-screen button 902,903,904 VLAN
912, 1212, 1805, 1904 DHCP server 913, 1213 DNS server 916 Management table 918, 1218, 1804 Radius server 1301 Content management table 1601 Advertisement distribution applicant 1602 Public wireless LAN operator 1631 Network 1632 Public wireless LAN spots 1711, 1811, 1911 http processing unit 1712, 1812, 1912 user interface unit 1713, 1813, 1913 content list management unit 1714, 1814, 1914 terminal management unit 1715, 1815, 1915 recording unit 1716, 1816, 1916 gateway device control unit 1817 DB response corresponding unit 1917 Storage Department

Claims (15)

A connection control system based on content distribution in a public Internet connection service that provides an Internet connection in a public place to a user who seeks connection to the Internet using an access device having an Internet network connection function and a content reception function In
Means for allowing the access device to communicate only with a limited destination when initially connected to the service provider's equipment;
After the access device receives the content provided via the service provider's equipment, the access device receives a reception confirmation response issued from the access device, and performs communication between the access device and an arbitrary destination. And a means for permitting the connection control system. A connection control system based on content distribution in a public Internet connection service that provides an Internet connection in a public place to a user who seeks connection to the Internet using an access device having an Internet network connection function and a content reception function In
A base station device for accommodating the user access device;
A distribution device having a function of distributing content to the access device;
A guidance device having a function for causing the user to select reception of the content, or a function for causing the access device to receive the content itself;
A gateway device having a function of limiting a connectable area of the access device;
After the access device receives the content provided from the distribution device, the access device receives the reception confirmation response issued from the access device, determines the reception, the recording function, and the gateway device using the determination as a trigger. On the other hand, a management device having a function for allowing communication with an arbitrary destination of the access device,
When the access device connects to the Internet, it can communicate only with a limited destination at first, receive the content provided from the distribution device, and perform a reception confirmation response after receiving the content. A connection control system capable of communicating with a destination. When delivering the content using IP multicast,
3. The connection control system according to claim 2, wherein the management device includes means for granting connection permission to the gateway device after the access device receives the content for a predetermined time or more. Place the function of the gateway device in the base station and the base station authentication device,
The base station has a VLAN that provides communication only to a limited destination and a VLAN that communicates with an arbitrary destination in a wired network, and the access according to an instruction at the time of authentication from the base station authentication device It has a function to select the connection destination VLAN of the device,
The base station authentication device determines a VLAN to be instructed based on the contents of a management table existing on any device,
4. The connection control system according to claim 2, wherein the management device rewrites contents of a management table depending on whether the user has received the content. 5. The management table describes a relationship between the MAC address of the access device and a VLAN ID indicating a VLAN that is allowed to be connected,
The connection control system according to claim 4, wherein the management device rewrites the VLAN ID according to a reception confirmation response after content is received from the access device.   6. The connection control system according to claim 4, wherein the management device issues a disconnection instruction for the access device to the base station after changing the contents of the management table. Place the function of the gateway device in the base station and the base station authentication device,
The base station has a two-step authentication procedure for performing a second-step authentication after the first-step authentication;
After the first-stage authentication, the access device is allowed to communicate only to a limited destination, and the second-stage authentication data transmitted from the access device is prohibited from communicating,
The connection control system according to claim 2, wherein the prohibition state is terminated by an instruction from the management device. The management device holds information describing a relationship between the content and the allowable connection time,
Based on the information, the access device is allowed to communicate with an arbitrary destination only during a connection allowable time corresponding to the received content,
The connection control system according to any one of claims 2 to 7, wherein after the connection permissible time passes, the state is returned to a state in which communication is possible only with a limited destination. The content distribution apparatus has a function of distributing a plurality of contents,
9. The management apparatus according to claim 8, wherein when the access receives a plurality of contents, the management apparatus calculates a sum of allowable connection times for each content, and uses the sum as a allowable connection time for the access apparatus. The connection control system described. The management device stores information describing a relationship between the content and connection quality;
10. The apparatus according to claim 2, further comprising: a unit that allows the access device to communicate with connection quality corresponding to received content based on the stored information. 11. Connection control system. Any one of the devices arranged in the system has a function of recording information on the content distribution results;
A function of calculating a consideration from the information;
The connection control system according to any one of claims 1 to 10, further comprising a function of sending billing information for the consideration to a content provider. In a public Internet connection service that provides an Internet connection in a public place to a user who seeks connection to the Internet using an access device having an Internet network connection function and a content reception function, the access device is initially Can communicate only with destinations that are limited when connected to the service provider's equipment, receive content provided from the distribution device, and communicate with any destination by receiving a reception acknowledgment after receiving the content A management device in a connection control system based on content distribution that can be performed,
A content list management unit for managing content lists;
A terminal management unit for receiving the reception confirmation response from the access device;
A management apparatus comprising: a gateway apparatus control section that controls a gateway apparatus based on the reception confirmation response received by the terminal management section and permits connection from the access apparatus to the Internet. The connection control system has a management table that describes the association between the MAC address of the access device and a VLAN ID indicating a VLAN that is allowed to be connected,
A database response corresponding unit that receives the management table search inquiry from the authentication device and returns a management table search response to the authentication device;
13. The management apparatus according to claim 12, wherein the terminal management unit rewrites the VLAN ID in the management table in response to a reception confirmation response after receiving content from the access apparatus.   13. The management apparatus according to claim 12, further comprising a storage unit that stores an electronic file required for the second-stage authentication in the two-stage authentication procedure for the access device. The program for making a computer perform the function of the management apparatus of any one of Claim 12 thru | or 14.

Images