KR20020012532A - a communications network access method and system - Google Patents

Abstract

An access system is a connection system for connecting a computer device and establishing a connection session for accessing a public communication network such as the Internet, one access state assigned to the session during at least a portion of the session, and network traffic receivable by the computer device. A switch system having a plurality of access states each of which determines an access state, and a session manager for managing the session and allocating at least one access state during the session based on access data for the session and access requests from the computer device; Include. Access requests include requests for TCP / IP, such as web pages, streaming audio and video, interactive chat sessions, e-mail, or FIP sites, and access states allow a computer device to receive the requested TCP / IP data. Determine whether there is.

The data available in the public telecommunications network is partitioned based on the access state, and the session manager is configured to assign the access state to various other sessions coordinated by the switch system simultaneously and dynamically during each session.

Description

Communications network access method and system

Most Internet users now access the Internet through the equipment of an Internet service provider (ISP). The ISP provides a remote access server (RAS _S ) that can communicate with your remote computer using a modem and a standard telephone line. The remote computer and the RAS _S use standard software to implement the protocol, such as Point-to-Point Protocol (PPP), which allows users to dial in to the Internet by dialing into the RAS _S. To accomplish this, the connection on the user's computer or PPP software requires the user to enter unique authentication data, such as the user's login name and password, and when the software dials in to the ISP device to connect Is sent to the ISP. If the ISP device determines that the authentication data is valid, the user's computer is connected and the user is allowed unrestricted access to the Internet. Thus, the user can freely view any desired web page using a web browser on the user's computer.

Specifically, from a commercial perspective, the success of a website on the Internet depends almost exclusively on the site's ability to attract traffic to the site.

For this reason, many well-known sites, such as Netscape's homepage and ISP's homepage, have found a "portal" on the Internet in hopes that the user will continue to return to that site to decide where to go next. portals) has been reconfigured to work as "communication". Many sites have proved extremely advantageous in the same way as television stations that can attract many viewers. The current market prices of companies such as Yahoo and Excite, which maintain very high traffic volumes, indicate how profitable. Since the ISP configures the first access point for most Internet users, any step or method that can be performed to direct the user to a particular page rather than the user's own default home page is highly desirable. The present invention attempts to provide such a method or at least a useful alternative.

The present invention relates to a method and system for accessing a communication network such as the Internet.

Preferred embodiments of the invention are described below for illustrative purposes only with reference to the accompanying drawings.

1 is a block diagram of a preferred embodiment of a communication network access system,

2 is a block diagram of a server system of an access system;

3 is a flowchart of a communication network access method of the access system;

4 is a diagram illustrating a connection start page of a system and a method according to the present invention;

5 is a diagram of an order homepage of a system and method in accordance with the present invention.

Connection means for establishing a Connection Session for accessing a public communication network by connecting a computer device, the method comprising a plurality of access states, one access state being assigned to the session for at least a portion of the session Each access state being at least one access state during a session that manages the session and is based on connection data for session and access requests from the computer device, the switch means for determining network traffic that may be received by the computer device. There is provided an access system comprising session management means for allocating a.

The invention also provides a means for establishing a TCP / IP session for connecting a computer device and accessing a network, switch means having a plurality of access data for determining sites and pages that can be accessed by the computer device during the session, and A public communication system, such as the Internet, comprising means for managing a session to assign at least one of the access states during the session.

The invention also provides a means for receiving a request from a computer device to connect to a network and for connecting the computer device to the network in response to the request; Transmission means for transmitting connection initiation data employed to generate a login initiation display in a computer device that permits entry, and if only authentication data received by the user is received and the authentication data is determined to be valid; A communication network access system is provided that includes a connection initiation means that allows a user to access a network using a computer device.

The invention also provides a method of accessing a communication network comprising establishing a TCP / IP session with a computer device and assigning an access state during the session that determines TCP / IP data received by the computer device.

The invention also provides a communication comprising connecting a computer device to a communications network, accessing data from a subscriber location on the network without access charging, and accessing data from another location on the network with access charging. Provides a network access method.

The invention also provides for receiving a request from a computer device to connect to a network, connecting the computer device to the network in response to the request, and entering only authentication data by the user of the device into the computer device after the connection step. Receiving connection initiation data, which is adapted to generate connection initiation data to a computer device that allows access to the network, receiving only authentication data input to the computer device, and using the computer device when the authentication data is valid; Providing a communication network access method comprising the step of allowing a user to access.

The present invention also provides a method for transmitting a request from a computer to connect to a communication network, allowing a connection to the network in response to the request, receiving connection start data after being connected, and unique authentication based on the connection start data. Generating a connection initiation display allowing the input of data at the computer device, transmitting only authentication data input to the computer device to the network and obtaining access to the network after the authentication data is validated; Provides a network access method.

As shown in FIG. 1, a communication access system includes a plurality of remote access servers (RAS _S ) 4, a layer four or higher switch 6, a database 8, a web server system. 10 and the router 12. The RAS _S 4 is provided to allow a remote user's computer 14 to dial into a system using a standard communication line and a modem to connect to the input terminals of the RAS _S 4 respectively.

When connected to a terminal of one RAS _S (4), this RAS _S (4) and the user's computer (14) establish a unique TCP / IP session, and the IP traffic for that session is switched by the switch (6). . Once the user is authenticated or approved, as described below, the user's computer 14 is allowed to access the data requested on the Internet 16.

The web server system 10 is used to control pages that appear to users connected to the RAS _S 4 and to authenticate using the subscriber profile database held on the database server 8, as described below. . In addition, a RADIUS (Remote Authentication Dial In User Service) authentication server 11 is provided for use in authentication. As long as user 14 is involved, access system devices 4, 6, 8, 10, 11, 12 are part of the Internet.

The devices 4-12 preferably comprise standard commercially available hardware and a basic database web server and Internet software known to those skilled in the art and used in almost all ISP's access systems. Include. The devices 4-12 also include unique program code for managing and controlling each session, as described below. Layer 6 or higher switch 6 is another exception. The switch 6 is commonly used by the ISP to balance the traffic handled by the RAS _S 4. An example of a suitable Layer Four Switch is Ace Director AD3 ^™, produced by Alteon Websystem. The access system connects the user to the web server system 10 and controls access to the Internet 16 for the user 14 based on a limited number of access states encoded at the switch 6, as described below. The access used is different from that provided by the ISP. The single program code and devices 4-12 may also be replaced in whole or in part by a single integrated circuit such as ALICS to perform the same function.

The switch 6 controls access to the Internet 16 by assigning an access state to each TCP session, as identified by each IP address. The states are each defined by one or more access rules encoded at switch 6. The rule defines how the switch 6 directs IP traffic by performing a pattern that matches the received traffic. For example, the state includes a login state, a portal state, a general state, a subscription state, a registration state, and an allow state as described below. For example, one rule may receive the first URL and redirect to the second URL, or the rules may allow or deny access to a predetermined set or list of URLs. The state assigned to a given IP address is controlled by the control system 20, as shown in FIG. The web server system 10 includes a control system 20 and a web server 22 that manages Apack ^™ and maintains web pages for access systems.

When user 14 wants to connect to the Internet using an access system, user 14 is assigned a port at RAS _S 4 that answers the call by dialing the system using standard PPP software. Upon connecting to RAS _S 4, user 14 is assigned an IP address for the IP session. The IP address is assigned from an IP address pool that depends on the number the user dialed to access the RAS _S (4). For example, a user may have a dial number that provides a user with free access to an Internet website, such as a product promotion, and the user 14 may have an IP address and all traffic from that IP address to the router 16. It is directly switched to the port (Port) that is informed to the switch 6 that is output to the Internet (16) is assigned. This appears in all IP addresses in such a pool, which is assigned to the allow state of the switch 6, as described below.

Other IP addresses assigned by the RAS _S 4 are initially assigned to the open connection state of the switch until the state is changed by the control system 20. Traffic with the IP address assigned to the connection start state is redirected to the control system 20 by the switch 6.

As shown in FIG. 2, the control system 20 includes a RADIUS Accounting Server 30, a login server 32, a Session Coordinator 34, and an individual. A session manager 36, an authentication client 38, a redirector server 42, and a plan manager 44.

The components 30-44 are all software components, but may be replaced in whole or in part by Application Specific Integrated Circuits (ASICs) if desired. The control system 20 is configured to handle three different authentication scenarios.

(Iii) Legacy authentication using RADIUS authentication server (11).

(Ii) Authentication using a browser that is based on a connection initiation display, eg authentication.

(Iii) This certification is not required.

For the first scenario, user 14 dials RAS _S 4 using standard PPP software to provide a username and password. Based on the dial number used and the structure of the PPP software, the RAS terminal assigned to handle the call sends the data provided to the RADIUS authentication server 11 to authenticate the user based on the PPP username and password. Once authenticated, the RADIUS authentication server 11 sends a connection status message to the RAS _S 4 and an IP address is assigned to the user. Based on the IP address, the switch 6 sends a connection status message, user name, caller ID (CLI) and IP address from the RAS _S 4 to the control system 20. This data is processed by the RADIUS accounting server 30 accessing the database server 8 to confirm the new connection to the IP address and record the connection time for that user. It is processed by the RADIUS accounting server 30. The RADIUS accounting server 30 checks and monitors all connected and disconnected connections for IP addresses and sends connected and disconnected messages to other components in the access system. Session coordinator 34 uses the connection data, such as profile data accessed from the subscriber profile database for user 14 to create an instance of session manager 36 for the connection. The connection data passed to the session coordinator 34 in the connection message is an IP address, a user name, and a calling line information (CLI). A session manager 36 is created for each connection or session, respectively, and provides commands to the direction change server 42 to control the state at switch 6 for the session.

The session manager 36 controls the state of the switch 6 with respect to the user's IP address, thereby controlling the traffic the user can receive during the session. State control is performed based on the subscriber profile of the user kept in the subscriber profile database of the server 8. The user of the profile specifies which of the restricted numbers in the access profile belongs. The access profiles each contain data defining an access state that a user can enter. Various access states are encoded at the switch 6. On the authentication of the TCP / IP session, the session manager 30 for the immediate session instructs the redirection server 42 to store the data in the switch 6 indicating which of the access states apply to the session. For example, during authentication, the session is in the login state, and once authentication is complete, the session can be changed to the general state or the subscriber state.

In the second authentication scenario, the access system performs a browser based on authentication using the access procedure shown in FIG. The user can access the Internet simply by dialing into the access system using standard PPP software in step 62 and the RAS _S 4 automatically connects the user 14 without requiring any user name or password entry. When the user dials to the terminal of the RAS _S 4 using the preset call number, the user is automatically connected and an IP address is assigned to establish a TCP session. The system informs the user's computer 14 and the PPP software displays for the user the fact that the connection is established and other details related to the connection, such as the data rate. IP addresses are assigned from the Address Pool for immediate access.

When the user is connected to the access system, the switch 6 determines in step 64 whether the user's machine 14 requests a connection to another computer on the Internet 16. The request may also simplify the user's omitted homepage, for example, when the user opens the web browser of the computer 14. The switch 6 then determines in step 66 whether the user has been authenticated by checking a stored flag indicating the switch state for the IP address and whether the state is a connection initiation state. If the connection session is in the connection start state, the switch 6 connects the user 14 to the connection start page on the web server 22 and the control system 20 performs the connection start processor 68. The connection initiation processor 68 is similar to legacy authentication in which the RAS accounting server 30 confirms whether a connection to an IP address has been established and a new session is established. Data for the session is passed to the session coordinator 34 to create an instance of the session manager 36 for the session. However, based on the IP address, the session manager 36 needs to be authenticated by the user using a browser based on authentication, and thus receives details from the web server 22 submitted on the connection initiation page shown in FIG. In order to determine whether to wait for the connection start server 22. The connection start page is provided to the user with many options including performing a registration process to become a new registered user, entering a user name and password if already registered, or accessing a help page stored on the server 22. The page also includes many banner advertisements that may include links to other pages or websites. However, in order to gain general access to the Internet 16, the user must enter a combination of a valid username and password authenticated by the control system 20. The initiation page allows the user to enter a combination of username and password and then sends the combination for authentication by clicking on the "Sign in" button. 14 may already be stored. The combination of username and password is received by the session manager 36 for the session and the combination is sent to the authentication client 38. The authentication client 38 passes the combination to an authentication daemon 40 running on the database server 8. The authentication daemon determines whether the combination is valid and checks the combination against a stored combination for the user to identify the user and access the unique subscriber profile for the user from the database server 8.

No authentication is required in the third authentication scenario. In this scenario, the user is assigned a dial number corresponding to No Authentication. The user is automatically connected and assigned an IP address for non-authentication from an address pool, such as for a browser based on authentication. The operation proceeds in the same manner as described above for the browser based on authentication except that session manager 36 does not return to authentication client 38 to authenticate the user based on the combination of username and password. do. The user is simply and automatically authenticated by the session manager 36.

If the user is authenticated with either the connection initiation process 28 or using the RADIUS server 11, the individual session manager 36 compiles and presents the client home page to the user 14 as shown in FIG. Use subscriber profile data for sending users. The client home page may also include a banner advertisement in the same manner as for the initiation page. The session manager 36 instructs the change direction server 42 to change the state of the switch to the portal state of operating the switch to connect to the client homepage or the URL for the portal shown in FIG. 5 after authentication. Details about the user and the client home page from the subscriber profile are passed to the initiation server 32 by the session manager 30 for access by the Apache Server 22 which controls the translation of the client home page. do. The session manager 36 then instructs the redirect server 42 to switch the switch to either the browser state, either in the subscribed state or the normal state. As shown in Fig. 3, the initiation authentication process for the authentication-based browser is managed using the web browser of the user's machine 14, rather than the PPP software, and the operation is performed after the initiation process 68. Return to 64. Thus, if the user returns to step 64 and is determined to be authenticated in step 66, the switch 6 determines whether the user is allowed to access the requested computer or service based on the access status for the session in step 70. Decide If so, the user is granted access to the computer or service on the Internet 16 in step 62. Otherwise, user 14 is notified of access denial in step 64. Access denial can be communicated by connecting the user to the reject page of the Apache server 22.

A user 14 having a session in the subscription state is allowed to access a site maintained by the subscription of the provider of the access system without being charged. The subscription site may be maintained on Apache server 22 or on another server on the Internet 16. Subscription sites are all identified by the URL _S of the subscription status rule. The subscription site can also be accessed using the links provided on the web pages of FIGS. 4 and 5. The rules for subscription status specify that any URL _S that does not belong to the subscription site is denied access. However, if the user has a subscriber profile that allows access to other sites on the Internet, the user can move to the normal state. When there is a request for access to a site other than the subscription site for these users, the user's browser is redirected by switch 6 to a temporary blank page on Apache server 22, while session manager 36 Determines whether to instruct the direction change server 42 to change the switch state to the normal state. The temporary blank page contains code that traps the requested URL, code that passes through the URL, and a message to the initiation server 32 that indicates that the user is attempting to move from the subscription state to the normal state. This message is passed to the session manager 36 based on the IP address and the session manager 36 accesses the subscriber's profile. If the session manager 36 determines that the user 14 is allowed to move to the normal state, then a message is sent to the redirection server 42 to change the state of the switch to the normal state during the session. The message is also sent from the manager 36 to the initiation server 32 to inform the user 14 that he or she is allowed to go to the trapped URL. The connection initiation server 32 sends a message to the Apache server 22 which sends to the user 14 the page of the trapped URL requested from the temporary page. If access is denied, the URL of the rejected page is used to replace the trapped URL in the initiation server 32 and the user 14 is sent to the reject page.

The other access states are registered and allowed. When the session manager 36 sends a message that the user wants to register with the access system, the session manager 36 instructs the change direction server 42 to enter the switch in the registered state during the session. This can be done, for example, when the user selects a registration option on the connection initiation page of FIG. In the registration state, the switch 6 redirects the user 14 to a registration page on the Apache server 22 and the control system 20 requests the request from the user 14 for the user file in the database server 8. Collect details on the page. The user file contains subscriber profile data for the user initially set up based on normally requested details. The session manager 30 redirects the switch 6 to cause an entry into the allowed state when the IP address indicates that the user 14 is provided to access the Internet 16 unrestricted without any monitoring or charging. The server 42 is instructed.

When the session is not connected, the RASs 4 inform the RADIUS accounting server 30 of the disconnection and the RADIUS accounting server 30 informs the session manager 36. The manager 36 instructs the direction change server 42 to change the state of the switch 6 to the connection start state with respect to the IP address of the unconnected session.

The way in which the user is charged is controlled by the plan manager 44 accessed by the session manager 30. The plan manager 44 maintains a variety of different billing plans that may apply to the user. For example, all users are not charged for access to a subscription site but the billing rate may differ for access when in normal state. For example, a user is assigned free access for a preset period of time for a general page, after which the user is charged for the set charge. The plan manager 44 sets time and billing for various plans, which are accessed by the session manager 36, which monitors the time a user spends in various access states. The final charge for the session is aggregated by the session manager 36 and stored for the user's file in the database server 8.

In addition to the modifications of the software and hardware architecture for the access system described above, it may be implemented by various other system architectures performed by the switch 16. First, the switch 6 may be replaced with a four-layer switch and a proxy server 10. The four-layer switch redirects traffic from the RAS _s 4 to the proxy server 10 that is connected to the router 12. The proxy server 10 is also connected to the control system. The proxy server 10 is dynamically adjusted under control to the control system 20 and is used to establish a different access state during each connection session. The proxy server 10 also stores rules that define each access state that can be provided for other sessions.

Instead of accessing the access state at switch 6, another alternative is to provide software control logic as switch 6 to define another access state and to store the relevant rules for that state. Traffic logic to the web server 22 or proxy server 10 communicates with the control system 20 as described above to dynamically adjust the access state during other sessions as required in accordance with the access request made with the access state. .

Access methods and systems are particularly useful because at least initially allow the ISP to dynamically control the pages observed by the user. At least the user cannot avoid this connection start or observation of the client home page because the connection start and the client home page are an integral part of the connection start process. This allows the ISP to display the advertisement information and, in particular, to provide the target advertisement information based on the user's profile, so that the ISP can guarantee that all ISP users are unavoidable. Therefore, access initiation and client homepage serve as entry portal for all users.

By allowing access to the system for all unregistered users, ISPs can provide free access to selected and preset Internet content and services. For example, the access initiation page may include a link to any web page that provides banking, stock trading or home shopping, and the user does not have to pay any billing to the ISP to access these pages. This allows the ISP to serve as a free content provider for some content, while charging the user for accessing other data on the Internet. In order to provide information about advertisements related to free content, the ISP may, if necessary, obtain and obtain some information about and from the user before providing the free content and also monitor access to the content.

Encoding the access status to the switch 6 also allows the ISP to prohibit or allow access to selected content or services on the Internet, such as sports, adult-oriented or child-oriented content.

Various modifications will be apparent to those of ordinary skill in the art without departing from the scope of the present invention as described with reference to the accompanying drawings.

Included in the detailed description.

Claims (26)

Connection means for establishing a connection session for accessing a public communication network by connecting a computer device; Switch means having a plurality of access states, one of which is assigned to the session for at least a portion of the session, each access state determining network traffic receivable by the computer device; And Session management means for managing a session and assigning at least one access state during the session based on connection data for the session and an access request from the computer device. The method of claim 1, And said session management means is configured to dynamically assign and adjust access status during a session. The method of claim 1, And said access state is defined by a rule that determines a location of a network accessible by a computer device. In the third, The switch means is configured to change the computer orientation to a preset network location based on an access state during a session. The method of claim 1, The session is a TCP / IP session and the connection data comprises an IP address for the session and / or profile data stored within the system for the user of the computer device. The method of claim 5, The access request includes a request for TCP / IP data such as a web page, streaming audio and video, an interactive chat session, an e-mail or an FTP site, and the access state is such that the computer device receives the requested TCP / IP data. An access system to determine whether or not it can. The method of claim 1, Data available in the public telecommunications network is partitioned based on the access state, and the session management means is configured to assign the access state to various other sessions coordinated by the switch means simultaneously and dynamically during each session. The method of claim 7, wherein The session managing means processes a connection manager for managing connection and disconnection of each session, a session coordinator for establishing a session manager for each session, and an access processor in which each session is collected by an access system and assigned to each session. An access system comprising a session manager for assigning access status to the server. The method of claim 1, And the access status includes a subscription access status that prohibits access to a location on the network subscribed to a provider of the access system. The method of claim 1, The access state includes a portal state that connects a computer device to a portal page. The method of claim 1, The access state includes a connection initiation state, a registration state, a general browsing state allowing access to all locations on the network, and an allowance state allowing access to all locations on the network without a user of a computer device providing authentication data. Access system. The method of claim 1, Said session management means configured to assign a number of access status at each time during a session. The method of claim 11, The switch means for returning to a connection initiating access state upon disconnection of the session. In an access system for a public telecommunication network such as the Internet, Means for establishing a TCP / IP session for connecting a computer device to access the network; Switch means having a plurality of access states, said state means for determining sites and pages that can be accessed by a computer device during a session; And Means for managing a session to assign at least one of access during the session. Connecting means for receiving a request from a computer device for connecting to the network and for connecting the computer device to the network in response to the request; Transmitting means for transmitting connection initiation data to a computer after being connected to the network, wherein the connection initiation data causes the connection initiation display to be generated to a computer device which allows input of only authentication data by a user of the computer device; And And connection initiation means for allowing a user to access a network using a computer device upon receiving only authentication data input by the user and determining that the authentication data is valid. The method of claim 15, The connection means includes a switch having a set of access states encoded therein, wherein the connection initiation means uses a switch and profile data to connect to a network by a user to determine one of the access states for the switch. A communication network access system that accesses profile data for controlling access. The method of claim 16, And said access means comprises a RAS. The method of claim 17, And said transmission means and connection initiation means comprise a web server and a user database. Establishing a TCP / IP session with the computer device; And Allocating an access state for determining TCP / IP data received by the computer device during the session. Connecting a computer device to a communication network; Accessing data from the subscription location in the network without access charging; And Accessing data from another location on the network with access charging. Receiving a request from a computer device to connect to a network; Connecting a computer device to a network in response to the request; Transmitting, to the computer, connection initiation data that causes the computer device to generate a connection initiation display allowing the input of only authentication data by the user of the computer device after the connection step; Receiving only authentication data input to the computer; And Allowing the user to access using the computer device when the authentication data is valid. The method of claim 21, Accessing profile data for the user, Controlling access to a network using the profile data. The method of claim 22, Wherein said profile data connects a computer device to a network to determine one of a set of access states encoded at a switch. The method of claim 23, wherein And the connection initiation display includes a link to a location on the communication network where input of authentication data is not required. Transmitting a connection initiation display for connecting to a communication network and connecting to the network in response to a request; Receiving connection start data after being connected; Generating a connection initiation display on the computer device that allows input of only authentication data based on the connection initiation data; Transmitting the only authentication data input to the computer device to the network; And Obtaining access to the network after the authentication data has been validated. A computer software comprising code for performing each step of the method claimed in any one of claims 19-25.