WO2006116908A1

WO2006116908A1 - A method and interface apparatus for authentication and charging

Info

Publication number: WO2006116908A1
Application number: PCT/CN2006/000753
Authority: WO
Inventors: Haitao Pan
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-04-30
Filing date: 2006-04-21
Publication date: 2006-11-09
Also published as: CN1859338A; CN100417146C

Abstract

A method and apparatus for authentication and charging, the method comprises the steps: the external user transmits a request for accessing or content services to the local system; the local system authenticates the user and transmits the user authentication message according to the preset relation between the user and the home operator, the external user interface gateway determines the communication type with the home operator according to the home operator information in the authentication message, and interacts with the home operator by the communication type to authenticate; after the authentication is successful, the local system charges for the external user accessing the local system or accepting the content services. Only storing one copy of user’s data in the local system, the present invention realizes sharing the user resource, access resource and content services resource between different operators.

Description

Method for authentication and charging and for authentication and billing

Interface device

Technical field

The present invention relates to the field of network communication technologies, and in particular to a method and apparatus for authentication and charging. Background technique

With the increase in the use of domestic Internet services, Internet broadband data services are constantly evolving, and more and more operators are providing and developing broadband data services. However, with the continuous deepening of business operations, the operators' respective battles are constantly being broken, and the mutual cooperation among the operators is complemented by each other to provide users with advantageous services.

In the initial stage of the operator's access service, the user accessing the AAA (Authent icat ions Authorization) is limited to the users developed by the carrier; , and can only use the business launched by this operator. However, with the development of the diversified operators, external users also want to use the AAA system provided by the carrier to access services or consume the content services provided by the carrier. However, the user information of the external users is not in the carrier system. The registration makes it unable to access and consume these content services, thus limiting the resource sharing of access or services, which is not conducive to mutual cooperation and resource sharing among operators.

In order to solve this problem, the prior art solution is to synchronize user data between operators, that is, if the user of the B operator can access the A-operator's AAA system or consume content services, the user needs to When the B operator opens an account, the user data is also placed in the AAA system of the operator A, and the AAA system of the operator A is also notified at the same time when the user data is modified in the B operator AAA system. Through this solution, user resources can be shared, and users of the B operator can be allowed to access or consume content services in the A-operator's AAA system. But it also brings the following disadvantages:

1. When users open an account, they need to open accounts in two or more carrier systems, which increases the operating costs of the operators.

² , need to synchronize the user data from time to time, resulting in user data can not be used for a period of time Consistent, resulting in inaccurate user data;

3. Due to the non-real-time synchronization of user data, the user balance may not be true, so the solution can only support post-paid users and cannot support pre-paid users. Summary of the invention

The main purpose of the present invention is to provide a method and an interface device for authenticating and charging, so that sharing user data in a local carrier system enables user resources to be shared and accessed between different operators. Sharing and sharing of content business resources.

To achieve the above objective, the present invention provides a method for authentication and charging, including the steps of:

A. The external user sends an access request or a content service request to the local system;

B. The local system authenticates the external user according to a correspondence between the preset user and the home operator.

C. The local system accesses the local system through the authenticated external user or provides content service to the external system, and charges the external user.

When the external user is a prepaid user, after the authentication is passed, the local system further sends a fee reservation charging message to apply for a fee reservation to the home operator user data system, and allows the user to access the local system only when the reservation is successful. Or provide content services to them.

When the user ends the access or accepts the content service, the local system settles the user fee, deducts it from the reserved fee, and returns the remaining fee to the external user account of the home operator, and provides the external user with Billing Information.

The header of the authentication message and the fee reservation charging message includes destination node information of the external data source and local source node information, and the message body includes user information.

When the external user is a post-paid user, when the user ends the access or accepts the content service, the local system settles the user fee, provides a consumption report message, and sends the message to the home operator user data system of the external user.

The local system communicates with the user data system of the home operator by accessing the database in a structured query language, accessing the database through a stored procedure, accessing the database in a lightweight directory access protocol, or by means of message notification.

The correspondence between the user and the home operator is set by setting a user card number segment and a home carrier identity relationship table or establishing a user domain name and a home carrier identity relationship table in advance. The local system authenticates or provides a consumption report message for the correspondence between the user and the home operator. The message header of the authentication and consumption report message includes the destination node of the external data source, the destination automaton, the local source node, and the local automaton. Number information, the message body includes user information o

The invention also provides an interface device for authentication and charging, comprising a core process module, an application program interface module, a directory database operation module, a message processing system module; the core process module and an application program interface module, a directory database The operation module and the message processing system module are connected, and are used to call the core process, process, forward, and process the interaction between the local system and the external user;

The application interface module is connected to an external relational database for accessing an external relation database;

The directory database operation module is connected to an external directory database for operating external user data stored in the directory database;

The message processing system module is configured to communicate with an external message processing system or a message gateway.

The interface device further includes a relational database operation module and a WEB module, wherein the relational database operation module is configured to access an external user letter in the relational database

The WEB module is connected to the home server's web server, receives external messages and converts them into agreed protocol messages for processing.

The interface device further includes a monitoring module and a log module, wherein:

The monitoring module is configured to start or stop the interface device, check an internal process execution situation, and re-execute the related process when the process is abnormal;

The log module is used to perform the function of turning the log on or off.

By adopting the method provided by the invention, it is not necessary to open an account at the access or content service consumption place, and only need to open an account on the operator system to which the user belongs, thereby reducing the operation cost of the operator.

According to the solution of the present invention, the user's data is only kept on the system where the user belongs, so there is no problem that the user data is inconsistent; When the AAA system of other operators accesses or consumes the content service, the user communicates with the home AAA in real time through the external user interface gateway to complete the user's authentication, billing, and billing (consumption reporting) functions. The user's balance is only in the user's balance. Keep a copy of the attribution, so you can flexibly support the prepaid business;

Different types of user data storage methods may be used by different operators. For example, Informix and Oracle may use storage methods such as a directory database and a file database. The present invention can support different user data storage modes. Therefore, the adapter is upgraded or expanded. Instead of upgrading the main system, you can use online expansion or upgrade. DRAWINGS

1 is a schematic structural view of a system of the present invention;

2 is a schematic structural view of an interface device according to the present invention;

3 is a schematic diagram of a flow of implementing a prepaid user according to the present invention;

FIG. 4 is a schematic diagram of a process for implementing a post-paid user according to the present invention. detailed description

In order to explain the features, characteristics and advantages of the present invention, the present invention will be further described in detail below with reference to the embodiments and the accompanying drawings.

The invention adds an interface device to the existing AAA system, here called an external user interface gateway, which is responsible for communication between the system and external users, and flexibly provides an interface with different external systems to complete external user access or Real-time authentication, billing, and billing or consumption reporting when consuming content services.

As shown in FIG. 1 , in the present invention, a non-local user is referred to as an external user when using an access or content service; an operator where an external user accounts is called a home operator; and an external user uses the carrier or the content. The local operator is called the local access system, the local operator's content system is called the local content system, the local system includes the local access system and the local content system, and the local system and the home carrier. The module that communicates with the system, that is, the interface device is an external user interface gateway.

The external user interface gateway is set in the local system to communicate with the home operator of the external user, complete user authentication, billing, and billing or consumption when the external user accesses or consumes the content service. Of course, the external user interface gateway can also be set in an independent third On the party device. The present invention provides a flexible, scalable, real-time external user to use a local access service or a content service mechanism, and the external user interface gateway can support multiple external user data storage modes. The user data storage mode of the home operator of the external user may be a relational database (such as Informix or Oracle database), may also use a directory database (such as a file database) or provide user information by using a message processing system, and correspondingly the external user interface gateway The communication method provided may be to access the database in a structured query language (SQL), access the database through a stored procedure, access the database in a Lightweight Directory Access Protocol (LDAP) manner, or notify by message. communication. The external user interface gateway is responsible for communicating with different external data sources to shield the local system from storing external data. The internal protocol can communicate with the local system and the external interface gateway. The internal protocol includes a message header and a message body, wherein the message header includes a home operating node parameter to identify the home operator of the external user, in addition to the necessary parameters of the message header of the common charging message in the industry; The necessary parameters of the message body with the charging message can be realized. The internal protocol may be redefined according to the necessary parameters included, or may be implemented by extending an existing charging message, and the extension field is a parameter of the home operating node. For example, the redefined message can use the following structure: The message header can include the message length, message type, message ID, function entity number, state machine number, and home operating node parameters. The authentication request message body may include a user account, a password flag, and a user encryption password parameter. The charging response message body may include an authentication result, a user type, and a user balance parameter. The billing request message body may include a user account, a start time, an end time, a fee, an operation type, and a session ID parameter. The billing response message body may include a user account, a billing result, an actual fee, an operation type, and a session ID parameter. The consumption report message body may include a user account, a consumption start and end time, a fee for this item, and a report type parameter. The report response includes user account and message report result parameters.

FIG. 2 is a schematic structural diagram of an external user interface gateway according to the present invention. The external user interface gateway includes a core process module, an application interface API (Appl icat ion program Interface) module, a directory database operation module, and a message processing system module. The core process module is connected to the API module, the directory database operation module, and the message processing system module, and is used to invoke the core process of the external interface gateway, and is responsible for processing and forwarding the message. The local system interacts with external users; the API module is used to access the external relational database through the API. Due to the encapsulation of the API, the external relational database type is transparent to the external user interface gateway; the directory database operation module is used to connect with the external directory database. And operating the external user data stored in the directory database; the message processing system module is used to interface with other external message processing systems or message gateways to complete the cascade of external user gateways.

The external user interface gateway may further include a monitoring module, a log module, a relational database operation module, and a WEB module. The monitoring module is used to start and stop the external user interface gateway, and check the internal process execution. When the process is abnormal, the related process is re-executed; the log module is used to perform the log tracking function on or off; when the external user interface gateway belongs to the same When the operator's message processing system belongs to the same manufacturer or communicates based on the same contract protocol, the relational database operation module is used to access the external user information in the relational database through the stored procedure, and does not directly access the user table; when the external user interface gateway When the message processing system of the home carrier belongs to the same manufacturer or communicates according to the same agreement protocol, the WEB module is used to connect with the home server of the home carrier, receive the external message and convert it into an external user interface gateway and the home operation. The agreement protocol messages between the business systems are processed.

When the external user sends a request for accessing or consuming the content to the local system, the local system performs a user authentication message according to the preset relationship between the user and the home operator, and sends the user authentication message to the external user interface gateway. The external user interface gateway determines the communication mode with the home operator according to the home operator information in the authentication message, and interacts with the home operator user data system in the communication mode to perform authentication, charging, or billing or consumption reporting.

The user relationship between the user and the home operator may be set by setting a user card number segment and a home carrier identity relationship table in advance, or the user and the home operator may be set by establishing a user domain name and a home carrier identity relationship table. Correspondence between the two. For example, the operator sets the user card number segment and the external data source association table, that is, the user data of some card number segments is stored on the designated external data source, so that the external user interface gateway determines the carrier system to which the external user belongs.

The external user interface gateway can access the data in a SQL manner with the user data system of the home operator relative to the different storage modes of the user data of the home operator user data system. Libraries, accessing databases through stored procedures, accessing databases in LDAP, or communicating by message notification. Therefore, the home operator identifier and the user data storage manner relationship table may be preset, and the external user interface gateway searches the relationship table according to the home operator information in the message header of the authentication message to determine a communication manner with the home operator. If the operator is operating, first define all external data source information interconnected with the system, including node number, data type, connection mode, etc., so that the external user interface gateway can be configured to connect to the data source of the external user. .

The local system performs authentication, accounting, or provides a consumption report message according to the correspondence between the user set by the local operator and the home carrier. These messages include a message header and a message body, and the message header may include information such as a destination node of an external data source, a destination automaton, a local source node, and a local automaton. The message body includes user information such as a user name and a user password. The number of bytes per element can be defined by itself.

If the external user is a prepaid subscriber, the charging further includes the local system providing a fee reservation charging message, and sending the message to the external user interface gateway, and the external user interface gateway according to the message in the header of the home operator The information determines the communication mode with the home operator, and communicates with the home operator to apply for fee reservation in the communication mode. If the reservation is successful, the user is allowed to access the local system or provide content service to the user, when the user ends the access or When accepting the content service, the local system settles the user fee according to the user usage parameter, deducts from the reserved fee, and returns the remaining fee through the charged balance return operation to the external user account of the home operator; The consumption report message is an external user bill.

The specific process is shown in Figure 3, including the following steps:

1. The user sends a request for accessing or consuming the content, and the local system analyzes the request to determine whether the user is an external user, and determines, according to the card number segment and the home carrier correspondence, which home operator the user belongs to;

2. The local system provides an authentication request message (including a message header and a message) according to the result of the analysis, and sends the message to an external user interface gateway connected to the local system;

3. The external user interface gateway determines the communication mode for authenticating with the home operator according to the data storage mode of the home carrier, such as accessing the home carrier database or sending a message request for authentication; 4. The external user interface gateway returns an authentication response to the local system according to the result of the authentication request, and the response message carries information such as the corresponding user type and balance;

5. According to the user type, it is judged that the user is a prepaid user, and the local system divides the budget according to the user's balance according to the budget or the maximum online duration;

6. The local system provides an accounting reservation message, and sends the message to an external user interface gateway to apply for a reservation fee;

7. The external user interface gateway accesses the home carrier database or sends a message requesting a reserved fee according to the data storage mode of the home operator;

8. The external user interface gateway returns an accounting response message to the local system according to the reservation result, where the response message carries a corresponding reservation result;

9. The local system allows users to access or consume content;

10. When the user access ends or the consumption content ends, the local system settles the user's consumption fee according to the corresponding rate, and compares it with the reserved fee. If the fee is left, the local system provides the fee returning charging message, and applies for the return of the remaining fee. ;

11. The external user interface gateway accesses the home carrier database or sends a message request return fee according to the data storage mode of the home operator;

12. The external user interface gateway returns a return fee accounting response to the local system according to the return result, and the response carries a corresponding return result;

13. The local system provides a consumption report message according to the actual consumption of the user, and sends it to the external user interface gateway to notify the user of the consumption situation;

14. The external user interface gateway accesses the home carrier database or sends a message to notify the consumption according to the data storage mode of the home operator;

15. The external user interface gateway returns a consumption report response to the local system according to the processing result, and the response carries the corresponding consumption report processing result; if there is no response, temporarily records for re-reporting.

If the user pays for the post, the local system only authenticates and issues the bill in the form of a message report, and does not need to reserve or return the balance. The specific process is shown in Figure 4, including the following steps:

1) The user issues a request to access or consume content, and the local system analyzes the request, Determining whether the user is an external user, for example, determining which home operator the user belongs to according to the card number segment and the home carrier correspondence relationship;

2) The system provides an authentication request message (including a message header and a message) according to the result of the analysis in step 1, and sends the message to an external user interface gateway connected to the local system;

3) The external user interface gateway determines the communication mode for authenticating with the home operator according to the data storage mode of the home operator, such as accessing the home carrier database or sending a message request for authentication;

4) The external user interface gateway returns a local system authentication response according to the result of the authentication request, and the response message carries information such as the corresponding user type and balance;

5) The local system allows users to access or consume content;

6) The system provides a consumption report message according to the actual consumption situation of the user, and sends the message to the external user interface gateway to notify the user of the consumption situation;

7) The external user interface gateway accesses the home operator database or sends a message to notify the consumption according to the data storage mode of the home operator;

8) The external user interface gateway returns a consumption report response to the local system according to the processing result, and the response carries the corresponding consumption report processing result; if there is no response, temporarily records, so as to re-report.

Through the invention, the external user data does not need to be saved in the local system, the local system saves the work of managing the external users, and there is no problem of data synchronization. When the user accesses or consumes the content, the user real-time and the home operator Communication, real-time query of user data, real-time deduction and real-time billing, so that user data information can be unified and prepaid users can be supported.

Claims

Rights request

A method for authentication and charging, characterized in that it comprises the steps of:

A. The external user sends an access request or a content monthly request to the local system;

C. The local system accesses or provides content services to the local system through the authenticated external user, and charges the external user.

2. The method according to claim 1, wherein when the external user is a prepaid user, after the authentication is passed, the local system further includes sending a fee reservation charging message to apply for a fee to the home operator user data system. Leave and allow users to access or provide content services to the local system only when the reservation is successful.

3. The method according to claim 2, wherein when the local system ends the access to the external user or stops providing the content service to the external user, the local system settles the fee of the external user, from the reserved fee. It deducts it and returns the remaining fee to the external user account of the home operator and provides billing information for the external user.

The method according to claim 2, wherein the header of the authentication related message and the fee reserved charging message includes destination node information of an external data source and local source node information, and the message body includes User Info.

The method according to claim 1, wherein when the external user is a post-paid user, the local system is to the external user when the local system ends the access of the external user or stops providing the content service to the external user. The fee is settled, a consumption report message is provided, and sent to the home operator's user data system of the external user.

The method according to claim 2, 3 or 5, wherein the local system communicates with the user data system of the home operator by accessing the database in a structured query language, accessing the database through the stored procedure, Access the database in a lightweight directory access protocol, or as a message notification.

The method according to claim 1, wherein the correspondence between the user and the home operator is set by setting a user card number segment and a home operator identity relationship table or establishing a user domain name and a home operator identity relationship table in advance. relationship.

The method according to claim 3 or 5, wherein the local system performs authentication or provides a consumption report message according to a correspondence between the user and the home operator, and the header of the authentication and consumption report message includes an external The destination node of the data source, the destination automaton, the local source node, and the local automaton information, and the message body includes user information.

9. An interface device for authentication and charging, comprising: a core process module, an application program interface module, a directory database operation module, and a message processing system module; the core process module and an application program interface module, The directory database operation module and the message processing system module are connected, and are used to call the core process, process, forward, and process the interaction between the local system and the external user;

The interface device according to claim 9, further comprising a relational database operation module and a WEB module, wherein

The relational database operation module is used to access an external user letter in a relational database

The interface device according to claim 9, further comprising a monitoring module and a monitoring module, wherein:

The log module is used to perform the function of turning the log on or off.