KR20040002042A - Billing Agent Service and Session Control Method Using Single Sign On and Firewall Function - Google Patents

Abstract

PURPOSE: A service for the collection agency using an SSO(Single Sing On) and a firewall function, and a method for controlling a session are provided to reduce a cost of a contents service by renting the function of a service session controller and a local central management part at a low expense. CONSTITUTION: The service session controller generates a subscriber code for registering/storing the subscriber information to the local central management part and for calculating a charge, and receives certification by requesting the certification of a subscriber to an integrated central management part(801). If a certification request of the subscriber is successful, a right accessing the contents service is given to the subscriber(807), and a use charge is calculated based on the preset rate information by collecting the subscriber information from the integrated central management part(811). If the service use of a user is exceeded, the management data for controlling the access is transmitted(819).

Description

Billing Agent Service and Session Control Method Using Single Sign On and Firewall Function}

The present invention relates to a retrieval service and session control method using integrated authentication and firewall functions, and a computer-readable recording medium recording a program for realizing the method. More specifically, the existing firewall and internet pay-as-you-go billing data Integrate collection capabilities to proactively and variably control access to specific services of specific subscribers (control sessions between web browsers and web servers), and collect bills through bills issued by integrated service providers It relates to a recovery agency service method.

Until now, free services have been provided to expand the use of the Internet for content services provided on the Internet, but solutions for the monetization are being developed for the profits of service providers.

In particular, a revenue model that provides high value-added information and charges it is being developed one after another, and an increasing number of Internet service providers who provide paid services using these service models are gradually increasing.

However, even in the current situation where various types of service models and revenue models have been developed and applied to actual paid services, paid Internet services, in particular, fee for use due to the lack of technology to actively control network and service provider's assets It is difficult to build a prepaid paid Internet service that pays in advance and uses it.

This is because Internet content services are mainly based on web services. Thus, until now, only paid services have been developed that analyze the log files of web servers and count the service usage of subscribers.

However, in case of billing and retrieval of subscribers or settlement between operators, it is impossible to secure the integrity and security of log files stored in the server where the web server is installed depending on the physical location of the web server. There was a problem that might occur.

In addition, when charging a fee in the form of prepayment in the time of payment, the subscriber's usage information should be tracked in real time, and if necessary, after checking the amount of information or usage time that is set in advance (when the usage or usage time is exceeded, etc.) ) Requires the ability to actively disconnect the user's physical network to prohibit the subscriber from using the service.

However, with the technology developed so far, it is difficult to actually collect and calculate the real-time service usage when the prepaid fee is charged, and further limit the use of the service in excess of the predetermined usage while the subscriber is using the service. There was a problem that was difficult to do.

In other words, in the case of billing methods such as prepayment, the subscriber tracks usage in real time for the communication session (or channel) of the service being used, and the subscriber no longer uses the service if the service uses more than the predetermined amount. If a function such as restricting the use of a service is forcibly prohibited, a separate system must be established for this purpose, and there is a problem such as an additional cost due to the absence of a protocol for executing such a function.

Due to these problems, as the multimedia service based on the web environment and the service providing high value-added information increase, the flat rate method is gradually changing to pay-based pay service.

In particular, a pay-as-you-go method is essential for services where real-time subscription, withdrawal, and correction of user information are performed.

In this case, in the case of a paid service that uses a pay-as-you-go method to charge as much as the service is used, different rates are applied depending on the user's login information, the amount of information used, the amount of time used, or the level and grade of the information used. The fee calculation method should be applied.

The fee calculation method introduced for this is the content billing method.

Content billing refers to charging based on a predetermined rule (or rate) between subscribers and service providers according to the amount or level of data sent and received between the web browser and the web server. The method is mainly a fixed amount method.

The method of collecting billing data for the pay-as-you-go content billing developed so far is to read the log file of the web server recorded on the hardware server where the web server software is installed and to generate an IP Detail Record (IPDR), which is called by the web server. The Common Gateway Interface (CGI) program may store data in a predetermined form in the form of a log file and generate an IPDR using the same.

In addition, it is much more efficient to extract charging data in an integrated form at the network contact point between the network of the content provider and the network to which the subscriber belongs, and the integrity of the charging data is also easy to secure.

However, to date, there is a difficult situation to find out how to actively restrict the use of the service of the subscriber or the standard data format in the method and system for content billing, and in particular, the single sign-on method (hereinafter referred to as SSO). Actively restrict the collection of standardized billing data and use of services when a specific service provider provides services on behalf of various service providers (or content providers) and provides integrated services such as subscriber management and authentication. It is expected that such needs will be essential.

On the other hand, in general, most Internet content services using a web browser and a web server are applied with a security service using a device (or software) such as a firewall for a range of networks in which a service software system is operated. It only plays a role of filtering, such as restricting the passage of packets sent from a specific Internet Protocol (IP) address.

That is, it cannot perform the role of actively forcibly cutting the communication channel (or session) between the web browser and the web server or the client and server in the client-server structure.

In this case, the firewall is a security function in the form of tracking and retrieval of all communication packets passing between the network domain of the service provider operating the server and software operated by the service provider and the network domain to which the external subscriber is connected. It refers to the service to perform.

Conventional firewall schemes used for the security of networks and services include packet filtering and application proxy schemes.

The packet filtering method controls the access at the network layer (IP) and the transmission control protocol (TCP) during the Open System Interconnection (Layer 7) layer. This method performs filtering of the IP address, the port of the TCP / IP protocol, and the TCP / IP synchronization bit.

On the other hand, the application proxy method is a method in which the firewall function is added to the application layer, which is the uppermost layer of the OSI 7 layer. In order to access a network providing a service, only the firewall function included in the application layer, that is, the application gateway is used. This is how you can access specific applications.

Application gateway performs network access control by using IP address and TCP port by using proxy for each application service, and can additionally perform functions such as virus check for user authentication and file transfer.

Each of these two types of firewalls has the following advantages and disadvantages.

First of all, packet filtering method has fast processing speed, provides transparency to users, and has flexibility for service because it is not packet filtering method for specific service. There is a risk of loss, and the load on the firewall increases greatly depending on the quantity and method of access control.

Next, in the application proxy method, since the network connection between the subscriber and the service provider is possible only through the proxy server, only the IP address of the proxy server is exposed on the subscriber side, and there is no exposure of the IP address where the actual service is provided. Using a daemon has the disadvantage of inflexibility with services.

This type of traditional firewall functions only perform user level authentication or network level access authorization / authentication, which can prevent the passing of data packets sent from a specific IP address, but not subscribers. It does not have the ability to actively prevent or allow passage through integration with information and billing information.

As such, a service or a device used for controlling access rights to a paid content service is not developed until now, and thus is performed for the purpose of controlling access rights to systems and services (simple access control). There is a need to expand the function to support Internet content related services and service models, which are diversifying firewall functions.

The present invention has been proposed to solve the above problems and to meet the above-mentioned demands. In the paid form of Internet service, the application is connected to an Internet service using HTTP (Hypertext Transfer Protocol). As a protocol for mandatory disconnection of sessions, the subscriber using the Internet service collects usage information data and quantifies the usage information in real time using the collected data to control the service connection of the subscriber in real time. Features such as selective packet passing or interruption by firewalls and services such as billing system and toll collection, which are difficult for content providers to build independently, with integrated single authentication and subscriber management services To collect billing data It is an object of the present invention to provide a recovery agent service and session control method using an integrated authentication and firewall function, and a computer-readable recording medium recording a program for realizing the method.

1 is an exemplary configuration diagram of an Internet content service system for managing / controlling a user's authority to which the present invention is applied.

Figure 2 is a detailed configuration diagram of an embodiment of the local central management unit of FIG.

3 is a diagram illustrating an embodiment of a relationship between a service session controller and a local central management unit of FIG. 1;

4 is an exemplary configuration diagram of an Internet content service system when the function of the service session controller of FIG. 1 is leased to each content provider.

5 is an explanatory diagram showing an operation of a content service for managing / controlling the authority of an Internet user to which the present invention is applied;

FIG. 7 illustrates an embodiment of a protocol commonly used between the service session controller of FIG. 5 and a local and integrated central management unit.

8 is a flow chart of an embodiment of a collection agency service and a session control method through an integrated authentication and firewall function according to the present invention.

9 is a detailed flowchart of a subscriber new registration and subscriber code generation process of FIG. 8;

* Explanation of symbols for the main parts of the drawings

101: subscriber station 104: service session controller

105: local central management department 107: integrated central management department

In order to achieve the above object, the present invention, in the collection agent service and session control method using the integrated authentication and firewall function in the Internet content service system, the service session controller for registration / storage and billing of subscriber information to the local central management unit; A first step of generating a subscriber code, requesting authentication of the subscriber from the integrated central management unit, and responding with authentication; If the subscriber's authentication request is successful, grant the subscriber access to the specific content service, collect the subscriber's information from the integrated central management unit, and calculate the fee based on the preset rate information. A second step of doing; And a third step of transmitting management data for access control when the service usage amount is exceeded, depending on whether the content service usage amount is exceeded by the user.

In addition, the present invention, in the Internet content system having a processor for the collection agent service and session control using the integrated authentication and firewall function, the service session controller subscriber to the local central management to register / store and calculate the subscriber information A first function of generating a code and requesting authentication of the subscriber to an integrated central management unit to receive authentication; If the subscriber's authentication request is successful, grant the subscriber access to the specific content service, collect the subscriber's information from the integrated central management unit, and calculate the fee based on the preset rate information. A second function of doing; And a computer-readable recording medium having recorded thereon a program for realizing a third function of transmitting management data for access control if the service usage exceeds the content service usage.

The present invention provides a service session controller and a management protocol for managing the same in order to perform a function of forcibly allocating or cutting a communication channel through which a service is made through a firewall function in a pay-per-content content service. .

In addition, the content service provider presented a collection agency service method in which charges are collected through a bill issued by an integrated service provider without establishing a separate system or issuing a bill.

Recently, a subscriber authentication method using a Lightweight Directory Access Protocol (LDAP) server has been gradually spread in connection with subscriber authentication.

This is a method of allowing a subscriber to receive an integrated authentication service without going through several authentications each time a user accesses a separate service through a subscriber authentication method using an integrated single authentication (SSO) method.

In order to provide such an integrated single authentication method, only the information necessary for authentication among the subscriber-related information managed by each content provider is collected separately so that the integrated service provider can manage and register, delete and change it in real time.

In particular, when the subscriber information is managed by the integrated single authentication method, there is an advantage in that the information on the use of the paid information of the subscriber can be managed in real time using service integration with the service session controller proposed by the present invention.

The service session management agent in the service session controller restricts the login of a specific subscriber in connection with the billing system or tracks the service usage of a specific subscriber who has already logged in and is using the service. It has a function to block access to the service.

The service session controller proposed by the present invention performs functions such as collection of usage per subscriber / service and active real-time connection control in conjunction with a billing system in addition to the function of a firewall and collects, bills and accesses such usage data. It is a server that acts for the authentication of subscribers.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of an embodiment of an Internet content service system for managing / controlling user rights according to the present invention.

As shown in FIG. 1, an Internet content service system for managing / controlling a user's authority according to the present invention includes a subscriber station 101 including a subscriber's PC, a mobile phone, a PDA, and the like, and a subscriber network. A service session controller 104 for controlling / managing the rights to use the contents of the subscriber at the contact point of the 102 and the content provider network 103, a content server unit or a web server unit 106 for providing content, The subscriber network 102, which is a connection network between the subscriber terminal 101 and the service session controller 104, the content provider network 103, which is a connection network between the content server unit 106 and the service session controller 104, and the content server unit. Local central management unit 105 that controls some functions of the service session controller 104 in conjunction with 106, and a function for the integrated single authentication and recovery agency service provider to manage the service session controller 104. Integration is achieved by providing a central management unit 107.

The integrated central management unit 107 stores subscriber-specific authentication information required for the collection agency service provided by the integrated service provider, receives and stores various billing information collected by the service session controller 104, and stores the collection agency service. In connection with the billing system for the service session controller 104 serves as an administrator for the remote control to allow or forcibly cut the connection between the specific subscriber and the content provider.

In addition, the integrated central management unit 107 provides a function for the integrated single authentication and recovery agency service provider to manage the service session controller 104 and a manager setting, and a content provider with the service session controller 104 installed. The service usage information of the subscriber using the service of the service is collected using the service session controller 104 and controlled.

That is, the integrated single authentication and recovery agency service provider manages the subscriber authentication related information of the content providers subscribed to the integrated single authentication and recovery agency service, service code information provided by the content providers, etc. using the integrated central management unit 107. .

FIG. 2 is a detailed configuration diagram of an embodiment of the local central management unit of FIG. 1.

As shown in FIG. 2, the local central management unit 105 is a subscriber information management unit 200 which is in charge of management of matters related to personal information of a subscriber, subscribed services, charges, and the like, and clients and services used by the subscriber. Session management unit 201 that performs functions related to forcible truncation and allocation of sessions between servers, and manages service charges such as service rates and rate information for calculating them, and performs actual charge calculation. A rate information management unit 202, a service information management unit 203 serving to manage information on services provided and operated at a server end of a client-server structure, a subscriber information management unit 200, and rate information Based on the data collected by the manager 202 and the service information manager 203, a session between the client and the server is forced through the session manager 201. Service information management unit 204, which performs a role such as cutting the data, and subscriber information that plays a role of storing information on subscriber's personal information, subscription service information, billing information, etc. under the management of subscriber information management unit 200; The storage unit 205, the usage information storage unit 206 which stores quantitative billing information regarding the amount of the service used by each subscriber or the remaining usage amount, and the subscriber information management unit 200, store, retrieve, and change the information. A user information storage unit 207 for storing subscriber information, and a security management unit used to implement an established security policy as a function for managing an agent performing a firewall function for communication packets transmitted and received. 208.

In addition, the service information management unit 203 performs a role related to the generation, change, deletion, etc. of information on a service object, such as a service grade and a service charging method.

3 is a diagram illustrating a relationship between a service session controller and a local central management unit according to the present invention.

Since the local central management unit 105 shown in FIG. 3 is the same as the local central management unit 105 shown in FIG. 2, the same reference numerals are used, and only some components are shown to describe the relationship with the service session controller. .

The service session controller 104 receives control / management from each of the management units 201, 204, and 208 of the integrated central management unit 107.

That is, the session management agent 301 of the service session controller 104 forcibly controls the physical communication session connected to the content server unit by a specific subscriber under the control of the session management unit 201 of the local central management unit 105. And the security agent 308 of the service session controller 104 prohibits access to a specific IP address in the form defined by the security management unit 208 of the local central management unit 104 or the content server. It restricts access to a specific server of a department or a specific port of a specific server.

In addition, the usage aggregation agent 304 of the service session controller 104 retrieves all packets passing through the service session controller 104 and selects a URL or IP address of a content server unit that provides paid information. It classifies the packets and collects each service and user and converts them into a billing base data (IPDR: IP Detail Record) format and stores them.

The mediation function, which is in charge of collecting the billing data, includes the content of the paid service along with the function performed by the current firewall that filters all packets passing through the service session controller 104. Alternatively, it classifies packets containing information separately and converts them into basic billing data for content billing.

This is a form that integrates functions that have been performed on separate devices such as firewall, mediation, and remote control so far into one device, and reduces the burden on service management of a service provider or billing agent. Not only can it be expected, but it also has the advantage of integrated management such as centralized control.

4 is an embodiment configuration diagram of an Internet content service system when the function of the service session controller of FIG. 1 is leased to each content provider, and is integrated to provide a collection agent and an integrated single authentication service through each service session controller. It shows the physical network and equipment with the telecommunications service provider, which is a single authentication and retrieval service provider.

The service subscriber 101 is provided with a service provided by the content provider 402 through the Internet 405. In this case, in order to access the content server of the content provider 402, the service subscriber 101 accesses the network of the content provider 402 through the service session controller 104.

Through this, the billing data for the service used by the service subscriber 101 is extracted by the service session controller 104, and the extracted data is transmitted to the recovery agency service provider 404 that provides the recovery agency service.

At this time, the recovery agency service provider 404 is connected in the form of a closed network such as the service session controller 104 and the virtual private network (VPN) 403 of each content provider 402 to provide important billing data and the like. Security and network stability are guaranteed.

Since the local central management unit controlling each function of the service session controller 104 is managed and operated by the respective content providers 402, the local central management unit is not shown in FIG.

The reason why the content provider 402 directly manages some functions of the service session controller 401 is that the unique functions to be implemented through the service session controller 104 are different for each service provided by each content provider 402. The integrated single authentication and recovery agent service provider 404 is to send only the billing-related data.

In other words, the security policy for allowing access to the service may be different for each content provider 402, and the content provider 402 establishes a security policy suitable for each of them rather than the integrated single authentication and recovery agency service. This is because it is desirable to implement.

In addition, the services provided by each content provider 402 may also have different rates and service charge policies for charges, so each content provider 402 manages these rate information itself, and integrates a single authentication and recovery agency service provider. (Retrieval service provider) 404 is responsible for collecting only the billing data generated from the service session controller 104, reflects this in the rate according to the rate policy registered by the content provider 402 and takes the form of issuing a bill. .

FIG. 5 is a diagram illustrating an operation of a content service system for managing and controlling rights of an Internet user according to the present invention. FIG. 5 is a diagram illustrating a packet passing through a network for a service based on the physical configuration described in FIG. This is logical from the viewpoint, and the content provider manages / operates the local central management unit as in FIG. 4.

The service subscriber 101 exchanges a communication packet with the content provider 402 using a network passing through the service session controller 104. The communication packet transmitted and received between the subscriber terminal 101 and the content provider 402 includes user information for distinguishing the service subscriber 101 and service specific information for distinguishing a service provided by the content provider 402. It is.

The service session controller 104 has a function of analyzing a packet as described above. Specifically, the service session controller 104 can check information about a source and a destination of the packet, which are IP addresses. This is because service information including a URL or the like is included.

Therefore, if necessary, the service session controller 104 is controlled by the local and integrated central management units 105 and 107 and transmitted to the specific subscriber 101 or to the subscriber side 101 at the request of the specific subscriber 101. A session can be disconnected by forcibly preventing the movement of packets.

In addition, through packet analysis, information on the service usage and the total usage time of the content service used by the subscriber 101 can be extracted together, and the information on the usage is integrated into the integrated single authentication and recovery agency service provider. It is used as basic data for generating an IPDetail Record (IPDR) of the management unit 107.

In addition, the service session controller 104 is also managed by the local and integrated central management unit (105, 107) to perform the function of a firewall that restricts the passage of packets transmitted and received from a specific IP address.

At this time, there is a separate protocol between the local and integrated central management unit 105, 107 and the service session controller 104 to control the service session controller 104 and check its status.

That is, the local and integrated central management unit 105, 107 transmits management data 505 to control the service session controller 104, and the service session controller 104 is transmitted by the local and integrated central management units 105, 107. After performing the corresponding function according to the management data 505, the result is transmitted back to the local and integrated central management unit 107 in the form of management result data 504.

FIG. 6 is a diagram illustrating an embodiment of a range and a range of authority of a management area of an integrated central management unit and a local central management unit according to the present invention.

The integrated central management unit 107 performs the function of collecting the billing data for the charge calculation in accordance with the service identification number assignment method presented by the integrated single authentication and recovery agency service provider 404.

In addition, by using the subscriber information and the rate information for each service set by the content provider 402 to calculate the rate, and manages the information and authority for each service provider 402, integrated single authentication for each subscriber It acts as an LDAP server for.

The service session controller 104 performs the function of an LDAP client for subscriber single authentication (SSO). That is, according to the authentication request transmitted from the subscriber terminal, the authentication is requested to the integrated central management unit 107 according to LDAP, and the integrated central management unit 107 retrieves the subscriber information and the authority of the directory server and retrieves the result of the service session. To the controller 104.

Then, the service session controller 104 performs a function of granting or denying the authentication of the subscriber who requested the authentication by using the search result returned from the integrated central management unit 107.

The local central management unit 105 managed by the content provider 402, unlike the integrated central management unit 107 managed by the integrated single authentication and recovery agency service provider 404, has only a very limited function to the content provider 402. Provide.

In addition, the local central management unit 105 provides the service session controller 104 with a function for setting and changing the rate for each type of service provided by the service according to the rules set by the integrated single authentication and recovery agency service provider 404. And, it is immediately delivered to the integrated central management unit 107 of the integrated single authentication and recovery agency service provider 404 is utilized in the collection and billing of billing data, integrated single authentication process of the service subscriber.

In addition, the content provider 402 establishes a security policy necessary for the operation of the firewall to prevent intrusion of the external network to the network that is owned and managed by the service session controller 104 through the local central management unit 105. ) Provides the ability to run.

That is, the content provider 402 automatically or manually inputs some information for integrated single authentication among the subscriber information subscribed to the service provided by the content provider 402, and manages the integrated central management managed by the integrated single authentication and recovery agency service provider 404. It is to be used as information for subscriber authentication of the management unit 107, and also to be used as subscriber information for fee calculation.

FIG. 7 is an exemplary detailed diagram illustrating a protocol commonly used between the service session controller of FIG. 5 and a local and integrated central management unit.

2 to 7, the operation of the service session controller and the local and integrated central management unit in more detail as follows.

The protocol for communication between the service session controller 104 and the local and integrated central management units 105 and 107 is largely composed of management data 505 and management result data 504.

The management data 505 is data transmitted by the local and integrated central management units 105 and 107 to the service session controller 104 in order to manage the functions of the service session controller 104. The management result data 504 is local and local. The central management unit 105, 107 contains the result of the service session controller 104 performed on the management data 505 transmitted to the service session controller 104.

The management data 505 is transmitted to the service controller for each function of the local and integrated central management units 105 and 107, which is largely the service usage management unit 204, the subscriber information management unit 200, and the security management unit 208. , And the data transmitted by the session manager 201 to perform a unique function.

In addition, among the functions of the service session controller 104, the session management agent 301, the security agent 308, and the usage aggregation agent 304 that perform the corresponding functions in response to each function of the local central management unit 105 are local. If necessary, the management result data 504 containing the result is transmitted to the local central management unit 105 after the management function is performed under the control of the central management unit.

Since the user information management unit (subscriber information management unit) 200 for subscriber integrated single authentication performs a role of an LDAP server, authentication-related LDAP data for this and data for authentication are also transmitted and received.

FIG. 8 is a flowchart illustrating a method for controlling a collection agent service and a session through an integrated authentication and firewall function according to the present invention, and calculating usage remaining amount or time according to service usage collection and rate application of a prepaid subscriber. It represents a process for cutting or allowing a service session in real time according to the calculation result.

The subscriber newly registers as a content provider and generates a subscriber code (801).

Then, when the subscriber requests login through the login screen provided by the content provider (801), the content server sends the subscriber authentication related information to the integrated central management unit to check the password of the subscriber and bring the service information subscribed to the subscriber ( 803).

At this time, if the authentication fails, or in the case of prepaid subscriber, if the fee paid in advance is exhausted (805), it is determined whether to use the service or continue to continue through the re-approval (817) according to the desire to use the service.

If the subscriber's authentication succeeds (805), the user is given access to a particular service, which allows a physical session connection in the form of unlimited pass-through for packets sent and received from a particular subscriber through the service session controller. It is realized by permission (807). At this time, the service session controller continuously collects information on all communication packets transmitted and received through it, recognizes it as data for construction of basic billing data, and transmits it to the integrated central management unit (809).

The integrated central management unit receives the basic billing data, aggregates the service usage and the remaining amount for each subscriber in real time, and calculates a usage fee using the rate information (811).

Subsequently, in the case of a specific subscriber who subscribes to the service in advance, the service detects whether the usage of the service has been exceeded in advance (813), and if so, asks whether to continue using the service (817). The management data is transmitted to the service session controller of the content provider to which the subscriber belongs, and the service session controller performs the function of restricting the access of the subscriber at the network level (819) and uses the service. If desired, a processing function for requesting a repayment is performed (815).

As a result of the detection (813), if the amount of service previously agreed does not exceed, the process returns to step 809 to continuously collect user information.

FIG. 9 is a detailed flowchart illustrating a new subscriber registration and a subscriber code generation process of FIG. 8, wherein a subscriber selects and registers his or her own service subscription in real time through a service screen provided by a content service provider and uses the service for a certain period of time. If so, a diagram showing the processing thereof.

First, the subscriber requests a registration through a registration screen provided by a content service provider (901).

Then, the subscriber information management unit of the local central management unit managed by the content provider registers the subscriber's information, stores the code of the service requested by the subscriber, and stores the payment method of the service fee (903).

Thereafter, the integrated central management unit operated by the integrated single authentication and recovery agency service provider receives / reports the subscriber information and subscription service code necessary for integrated single authentication from the local central management department of the content provider in which the new registration of the subscriber has occurred. This is stored in the subscriber information storage through the subscriber information management unit (905).

In operation 907, information on a fee calculation method, a discount rate, and a prepaid payment for the new subscriber is stored, and a subscriber code is assigned thereto, thereby completing preparation for fee calculation (907).

The service session controller proposed by the present invention accommodates both methods of the firewall, that is, the packet filtering method and the application proxy method, as well as the integrated login authentication of the user, the real-time collection of the usage per service, and the billing system. It is a device that includes all the functions of active service session management in connection with the service. In particular, the function of the service session controller is an essential device for the paid content service provided on the Internet, which is rapidly spreading in recent years. In addition, it is expected to be a very attractive service model for small and medium sized content providers who want to receive a recovery agency service through cooperation with large telecommunications providers.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

As described above, the present invention integrates an existing firewall function, billing data collection function for internet content billing, and a function for controlling a user's service session, and uses the same to authenticate a single user when logging in to a service by a subscriber. Sign On) function and a collection agency service providing method, the content provider who wants to provide a paid Internet content services through the present invention by renting the service session controller and the function of the local central management unit at a low cost content This can reduce the cost of services.

In addition, the present invention can avoid the hassle of entering the user ID and password every time by logging in through a single unified authentication service provided by different content providers through a single unified authentication service service Bills can be used to pay for various services, which can provide convenience to both subscribers and service providers.

On the other hand, in the present invention, the content provider can effectively limit the use of the subscriber's use of the service by collecting and calculating the service usage of the subscriber in real time in providing a prepaid content service. There is an effect that can be prevented.

In particular, the present invention does not have any means and method for active network access control until the operator reflects the change of the policy according to the security policy for the network access once defined by the function of the existing firewall system. However, there is an effect that the access to the network and the service can be actively and variably controlled according to the subscriber information of the specific subscriber, the service information of the specific service, and the availability of the service according to the service usage of the subscriber.

Claims (10)

In the collection agent service and session control method using integrated authentication and firewall function in Internet content service system, A first step of the service session controller generating a subscriber code for registration / storage and billing of subscriber information to a local central management unit, and requesting authentication of the subscriber to an integrated central management unit to receive the authentication status; If the subscriber's authentication request is successful, grant the subscriber access to the specific content service, collect the subscriber's information from the integrated central management unit, and calculate the fee based on the preset rate information. A second step of doing; And A third step of transmitting management data for access control when the service usage amount is exceeded according to whether the content service usage amount of the user is exceeded Recovery agency service and session control method using an integrated authentication and firewall function, including. The method of claim 1, According to the content service usage capacity of the user, A fourth step of maintaining the use of the content service until the user exceeds the service use, if the subscriber does not exceed the content service usage; Collection agency service and session control method using an integrated authentication and firewall function further comprising. The method according to claim 1 or 2, The second step, A fifth step of requesting a new registration to a content business manager if the subscriber is not authenticated; A sixth step of registering / storing the subscriber information in the subscriber information management unit in the local central management unit and transmitting / storing some of the subscriber information to the integrated central management unit for an integrated authentication service and a collection agency service; And A seventh step of storing the registered subscriber information in a subscriber information storage unit and generating a subscriber code for charge calculation; Recovery agency service and session control method using an integrated authentication and firewall function, including. The method of claim 3, wherein The service session controller, Under the control of the local and integrated central management unit, it accommodates both the packet filtering method and the application-type firewall function, and integrates the single sign-in authentication of the subscriber, the real-time usage of each content service per subscriber, and the session associated with the billing system. Collection agent service and session control method using the integrated authentication and firewall function, characterized in that to perform a management function. The method of claim 3, wherein The integrated central management unit, Managed by the integrated authentication and recovery agency service provider, and the subscriber's service subscription, termination and change, forcible cutting and allocation of session, rate information management, and management protocol for calculating the rate using the rate information Generation and recovery agent service and session control method using the integrated authentication and firewall function, characterized in that for controlling and managing the service session controller using the protocol. The method of claim 3, wherein The local central management unit, Collection agent service and session control method using the integrated authentication and firewall function, which is managed by the Internet content service provider, and implements a session cut and allocation of the subscriber, a charge calculation according to a predetermined rate, and a security policy. . The method of claim 4, wherein In order to control the service session controller, The local and integrated central management unit transmits management data to the service session controller, and the service session controller transmits management result data to the local and integrated central management units in response to the management data. Recovery agency service and session control method using firewall function. According to claim 7, The management data, Collection agent service and session control method using the integrated authentication and firewall function, characterized in that it comprises a search result data, state control data, security configuration data and service session management data according to the LDAP (Lightweight Directory Access Protocol). According to claim 7, The management result data, Recovery agency service and session control using integrated authentication and firewall functions, including user search request data, status control result data, service usage information data, security configuration result data, and service session management result data according to LDAAP. Way. In the Internet content service system having a large processor for the collection agent service and session control using the integrated authentication and firewall function, A first function in which a service session controller generates a subscriber code for registration / storage and billing of subscriber information to a local central management unit, and requests authentication of the subscriber to an integrated central management unit and responds to authentication; If the subscriber's authentication request is successful, grant the subscriber access to the specific content service, collect the subscriber's information from the integrated central management unit, and calculate the fee based on the preset rate information. A second function of doing; And A third function of transmitting management data for access control when the service usage amount is exceeded according to whether the content service usage amount of the user is exceeded A computer-readable recording medium having recorded thereon a program for realizing this.