WO2007020185A1

WO2007020185A1 - Access control of devices in a data transmission network

Info

Publication number: WO2007020185A1
Application number: PCT/EP2006/064881
Authority: WO
Inventors: Mohammad Vizaei
Original assignee: Siemens Aktiengesellschaft
Priority date: 2005-08-19
Filing date: 2006-08-01
Publication date: 2007-02-22
Also published as: DE102005039343B4; DE102005039343A1

Abstract

The invention relates to a method, wherein the amount of data transmitted by or to a data processing system (22) is determined based on a device characteristic contained in the data packets which are to be transmitted. The amount of determined data is examined using a predetermined amount of data in order to distribute an amount of data which is available in a local data transmission network (20).

Description

description

ACCESS CONTROL OF DEVICES TO A DATA TRANSMISSION NETWORK

The invention relates inter alia to a method for transmitting data packets, for example with the steps:

Predetermining a first device identifier for a first data processing system, wherein the first data processing device can be reached in a local data transmission network under the device identifier,

Predetermining a second device identifier IP2 for a second data processing system, the second data processing system being accessible in the local data transmission network under the second device identifier,

- Transferring data packets from a main data transmission network to a third data processing system, which determines for each data packet, for which data processing system the data packet is determined and which for the first data processing system specific data packets to the first data processing system indicating the first device identifier forwards and which for the second Data processing system transmits certain data packets to the second data processing system, indicating the second device identifier. Alternatively or additionally, data packets sent by the first data processing system into the main data transmission network are also included in the method.

The first data processing system and the second data processing system are, for example, personal computers, portable computers (laptops) or handheld computers. The computers each include at least one processor that executes instructions from programs stored in a memory of the computer. The two

Data processing systems are operated in a local data transmission network, for example in an Ethernet LAN (Local Area Network) or in a so-called WLAN (Wireless Local Area Network). The local data transmission network can also consist of two individual local data transmission networks, for example an Ethernet and a WLAN.

A common protocol for the transmission of data in local communication networks is the Internet Protocol or the Protocol TCP / IP (Transmission Control Protocol / Internet Protocol) or the protocol UDP / IP (User Datagram Protocol), the IETF (Internet Engineering Task Force ). However, other protocols can also be used to transmit data packets in the local communication networks. In general, a data packet contains a packet header with address information and a packet body with payload data, e.g. Signaling data, program data, music data, voice data, image or video data, etc.

In the case of the Internet Protocol, for example, the device identifiers are addresses that are structured like Internet addresses but need not be publicly known. However, other device identifiers may be used, e.g. the so-called MAC address (Media Access Control Address), which is usually stored non-volatile in network units by the manufacturer of the network unit.

The third data processing system is for example a so-called LAN router, which performs a switching function based on network or Internet addresses. For example, the LAN router allows the two data processing systems to access the main data transmission network, e.g. the Internet, without the two data processing systems must have their own Internet address or network address in the main data transmission network. Such methods are referred to as port and address translation (PAT). Alternatively, we speak of Network Address and Port Translation (NAPT). In this method is, for example, a

Internet service provider only the Internet address of the third data processing system known, ie, for example, the outer Internet address of the LAN router, but not the internal network addresses of the first data processing system and the second data processing system.

It is an object of the invention to provide a simple method for the transmission of data packets, which allows the use of the main data transmission network to be monitored from the side of the local data transmission network, for example by specifying time limits for the individual data processing systems or by specifying data volume limits for the individual data processing systems of the local data transmission network. In addition, a data processing unit is to be specified, which is particularly suitable for carrying out the method.

The task related to the method is by a

Data processing system solved with the method steps specified in claim 1. Further developments are specified in the subclaims.

In addition to the method steps mentioned at the outset, the following steps are carried out, for example, in the method according to the invention:

for the first data processing system, specifying a first limit value which may not be exceeded during the data transmission from the main data transmission network to the first data processing system,

- Based on the device identifier contained in the forwarded data packets detecting an actual value indicating the amount of data transmitted to the first data processing system or a time in which the first data processing system has the ability to receive data from the main data transmission network or in the first data processing system data from the Main data transmission network has been received, - Comparison of actual value and limit value,

Generating a first message or blocking the data transmission to the first data processing system when the first limit value is exceeded. The invention is based on the consideration that the data transmission to the data processing systems can be monitored in a simple manner on the basis of the device identifier. Thus, an available amount of data for the reception of data from the main data transmission network or a time available for it in a simple way to the data processing systems of the local data transmission network. The distribution of an available amount of data or time of use provides an incentive for the efficient use of resources.

For example, the message is sent to a system administrator of the local communication network. The blocking of the data transmission to or from the first data processing system including the main data transmission network can be achieved, for example, by the fact that this data processing system may no longer make requests to the main data transmission network with which data is requested.

In one embodiment, the amount of data or the time of use with respect to the second data processing system is also detected. For example. a second limit value is specified for the second data processing system, wherein the second limit value may not be exceeded in the data transmission from the main data transmission network to the second data processing system. A second actual value is detected, which indicates the data volume transmitted to the second data processing system or the time relevant for the second data processing system. The second actual value and the second limit value are also compared and a second message is generated or the data transmission to the second data processing system is blocked when the second limit value is exceeded. In particular, through the inclusion of all data processing equipment of the local data transmission network, access to the main data transmission network, it is possible to ensure compliance with the stipulated division of the data volume or time of use.

In a development of the method, an assignment is stored in the third data processing system in which a first port address is assigned to the first device identifier and a second port address is assigned to the second device identifier. If a data packet from the main data transmission network arrives in the third data processing system, a port address specified in the data packet is read. With the help of the assignment, the data processing system is determined for which the data packet is determined. The recipient address in the data packet is changed according to the determined address. Such methods are performed especially in routers. A router is particularly suitable for carrying out the method according to the invention, because the method can be carried out there in a simple manner.

In a next development, the data packets are transmitted in accordance with the Internet protocol, in particular according to the TCP / IP protocol, see RFC (Request For Comments) 791 and 793 of the IETF.

In another development, the detection of the amount of data or the time in the third data processing system, in particular in a router, performed, in particular in a router that forwards data packets according to Internet Protocol.

In a next development, the third data processing system, in which detection is preferably carried out, is connected to a double line or a two-wire line, for example to two copper lines. Via the lines, the third data processing system can be connected to a fourth data processing system which allows access to the Internet, for example with an access data processing system of an Internet service provider. The double lines allow a broadband data transmission with a Data transmission rate of, for example, greater than 500 kilobits per second. Depending on the length of the double line, however, the data transmission rate is also limited to the top and, for example, less than 2.5 megabits per second. The broadband transmission of data over

Double-line methods are also known as XDSL (X - Digital Subscriber Line). So the following standardized procedures are used:

- Asymmetrical Digital Subscriber Line (ADSL), - High Data Rate Digital Subscriber Line (HDSL), and

Very High Data Rate Digital Subscriber Line (VDSL).

Broadband data transmission allows many times the bandwidth of traditional Internet connections with modems that allow a data transmission rate of, for example, less than 64 kilobits per second. Due to the large bandwidth, simultaneous access from several data processing systems via a DSL connection is possible. A distribution of the available amount of data or time to this data processing system from the side of the local data transmission network indirectly also allows an efficient use of the bandwidth.

In another development, the detection is carried out in the third data processing system, wherein the third data processing system can forward less than 10 megabits per second. This is a small router, such as used in small corporate networks with less than 10 data processing systems or in local home networks, for example, where fewer than five computers are connected to multiple family members. Unlike routers used, for example, by Internet service providers, minors have different requirements, especially with regard to setting parameters and ease of programming. In a next development, the device identifiers are:

- network addresses,

Identification of network units already specified by the manufacturer of a network unit, in particular MAC addresses,

- or license plate, which consist of a network address and a license plate of a network unit.

In another development, for example, a limit indicates a maximum amount of data that is to be transmitted in a unit of time to the first data processing system, for example within one month. The data volume transferred to the first data processing system is summed up in a next development in order to determine the actual value. At the end of the month, the accumulated value is reset to zero. For this, the well-known NTP Protocol RFC 958 or SNTP Simple Network Time Protocol RFC 1361 of a server can be used on the Internet to automatically detect the end of a month. Alternatively, the data to and / or from the first data processing system including the

Data stream transferred from the main data transmission network from a value indicating the remaining amount of data.

In an alternative development, for example, a limit value indicates a maximum useful life in which the main data transmission network can be used by the first data processing system in a predetermined time interval, for example in one month. In particular, in the case of a WLAN, the actual value can be determined in a simple manner by logging on and off the first data processing system at the router. Also in this case, the times used by the first data processing system are totaled or subtracted from a value indicating the remaining usage time. At the end of the time unit, the sum value is set to zero or a starting value for subtracting or subtracting is specified again. To reset Determining the sequence of the time unit, eg at the end of the month, or to determine the times can be used so-called NTP (Network Time Protocol). These methods enable the third data processing system to query the date and time of the Internet after logging on.

The invention also relates to a data processing unit which contains a monitoring unit which monitors the amount of data or the time specified for a data processing system based on device identifiers specified in the data packets to be forwarded.

In further developments of the data processing unit, the unit contains a unit for carrying out a method step of the method according to the invention or one of its developments. Thus, the above-mentioned technical effects also apply to the data processing unit.

In the following, embodiments of the invention will be explained with reference to the accompanying drawings. 1 shows the structure of a local network behind a

router,

FIG. 2 shows method steps when carrying out a monitoring method, and

FIG. 3 shows the structure of a data processing unit in which the method steps can be carried out.

FIG. 1 shows a computer network 10 which contains the following components:

- An ISP computer 14 (Internet Service Provider) connected to the Internet 12, which allows a large number of subscribers access to the Internet 12, eg more than 100 or more than 1000 subscribers, - a telephone line 16 connected between the computers 14 and a router 18 is switched and uses only two wires for data transmission, which are, for example, twisted, a local data transmission network 20, for example an Ethernet, which contains the router 18 and, for example, three local data processing systems 22, 24 and 26 or other data processing systems (not shown). The data processing systems 22 to 26 are via network connections 30 to 34 with the

Router 18 connected. The data processing systems 22, 24, 26 have in this order in the local data transmission network 20 internal network addresses IPl, IP2 or IP3 and so-called MAC addresses MACl, MAC2 and MAC3. The network addresses IP1 to IP3 and the MAC addresses MAC1, MAC2 and MAC3 are not known in the computer 14 of the Internet service provider. In the computer of the Internet service provider only an external Internet address IPR of the router 18 is known. The router 18 has an internal network address in the local communication network 20 that is different from the Internet address IPR.

FIG. 2 shows method steps in the implementation of a monitoring method in which the amount of data that is transmitted to the data processing system 22, which is also referred to as a data processing system DVA1, is monitored. The method begins in a method step S36. In a following method step S38, limit values GW1 and GW2 are specified for the data processing system 22 and the data processing system 24, which is also referred to as data processing system DVA2. For example, the GWl limit is 20 megabytes per month and the GW2 limit is 40 megabytes per month. The limit values GW1 and GW2 are preferably stored in the router 18.

In a method step S40, the router 18 receives a data packet from the computer 14, which is transmitted in accordance with the Internet protocol. With the aid of the known methods PAT (Port and Address Translation) or NAPT (Network Address and Port Translation), the router determines in a method step S42 the data processing system 22 to 26 for which the data packet which has been received in step S40 is determined. In this case, for example, stored in the router 18 Used routing table. In step S42, the router 18 also determines whether it is a data packet destined for a data processing facility 22, 24 to be included in the monitoring process. If this is not the case, for example because the data packet is intended for the data processing system 26 of the local data transmission network 20 that is not included in the monitoring process, immediately after the method step S42 follows a method step S44, in which the router 18 forwards the data packet to the data processing system 26. After step S44, step S40 is again followed by another data packet.

If, on the other hand, it is determined in method step S42 that the data packet received in method step S40 is intended for data processing system 22 or 24, a method step S46 follows immediately after method step S42. In method step S46, a counter value is incremented in the router 18 which indicates the data volume transmitted to the data processing system 22 or 24.

Subsequently, in a method step S47, the router 18 checks whether the limit value GW1 has been exceeded in the case of a data packet for the data processing system 22 or the limit value GW2 in the case of a data packet intended for the data processing system 24. If the limit value GW1 or GW2 has not yet been reached or has not yet been exceeded, method step S44, in which the data packet is forwarded via the local data transmission network 20, follows immediately after method step S47.

If, on the other hand, it is determined in method step S47 that limit value GW1 or GW2 has been exceeded or reached, immediately after method step S47, a method step S48 follows in which a message is generated for the system administrator of local data transmission network 20. The message indicates that the limit has been exceeded. When evaluating the message, the sys- temadministrator block downloads from the relevant data processing system. Alternatively, the system administrator turns to the user of the relevant data processing system 22 or 24. In the exemplary embodiment, after the method step S48, the method step S44 follows, in which the data packet is forwarded to the relevant data processing system 22 or 24.

In an alternative method, the data packet is not forwarded after the message S48, but the method is continued directly in step S40. Thus, the forwarding of data packets to the data processing system 22 is prevented, see dashed line 49th

In an alternative method, instead of the amount of data, the available usage time for the data processing systems 22, 24, 26 is detected. Monitoring the time is particularly easy if the local data transmission network is a WLAN.

FIG. 3 shows the structure of a data processing unit 18a that can be used instead of the router 18. In a first embodiment, the data processing unit 18a does not include a processor that executes instructions of a program. As a result, the data processing unit 18a contains only electronic circuits which perform the function of the data processing unit 18a, wherein the method steps explained with reference to FIG. 2 are carried out. The data processing unit 18a contains: a transmission / reception unit 50 enabling the connection of the local data transmission network 20,

a transmitting / receiving unit 52 enabling the connection to the telephone line 16, the telephone line 16 being connected, for example, to a so-called splitter for frequency division, in particular directly, that is to say in the form of a splitter. without the interposition of further units,

a monitoring unit 54 which carries out the method steps explained with reference to FIG. 2, a routing table 56 used to forward the data packets arriving from the Internet or over the telephone line 16,

Memory units for storing the addresses IP1, IP2, etc., the limit values GW1, GW2, and the actual values IW1, IW2, etc.

However, in an alternative embodiment, the data processing unit 18a includes a processor 58 which executes instructions of a program stored in a memory unit of the data processing unit 18a. In both cases, the units of the data processing unit 18a are internally interconnected, for example via a bus system, see arrow 60.

In summary, a user can be specified individual download or time limit in the router 18, 18a. This is in the broadest sense, the billing of a data transfer affected, for example, the so-called Internet charging. Cost summary and cost control for Internet download limits on a time or volume basis is also available for broadband connections used by multiple machines that are not known to Internet service providers. This solves the problem that a number of computers connected to a router can individually be given a usage limit or in which one

Usage limit for Internet access is shared among multiple users. This method can be used in addition to methods in which the Internet service provider prescribes a usage limit that is assigned to a specific user ID (identification) under a password, this usage limit having no reference to individual users of a local network whose computer supports the user network. Share ID and password. Furthermore, the method can also be used in addition to a program on a computer of the local network 20, are carried out with the aggregate evaluations of download activities of all or individual connected computers. The inventive method also works when this computer is turned off. In the illustrated embodiment, the endpoints, ie hard and soft IP clients, a private Internet protocol network, for example, by using DSL routers or wireless routers, or Bluetooth routers networked. In these

In this case, it is not necessary to turn on the host PC (personal computer) before switching from another PC, e.g. a laptop, which causes access to the Internet, as many routers independently log on to the Internet service provider and thus the Internet. The program in such

Routers will be expanded in the manner explained above:

- 1.) Definition of thresholds for amounts of time or data per user. For example, the main user may administratively set time and / or download limits for each user depending on the model used, e.g. per day, per week, per month, per quarter or similar define. Many routers also have NTP (Network Time Protocol) mechanisms. As a result, the router is able to query the date and time after signing up on the Internet without any additional programs. Thus, an automatic reset of the used counter values, e.g. on the first of each month, done automatically.

- 2.) Counting of data volumes or online time per connected user. Once the thresholds have been defined, the router can capture or measure the current usage per user.

- 3.) Trigger the software alarm when the defined limits are reached or another action is taken. If a limit has been reached or exceeded, a software alarm can be triggered, eg in the form of an e-mail. The user's lock is also easily possible since the router is technically capable of no longer sending packets to the user from the Internet or ignoring all received packets that are to be forwarded to the Internet. However, local services are not affected so that the user in question can continue to use the local data transmission network 20 without restrictions. With this simple extension, the router owner can always determine the current Internet usage per user.

Claims

claims

1. A method for transmitting data packets, comprising the steps of: predetermining a first device identifier (IPI) for a first data processing system (22), wherein the first data processing system (22) in a local data transmission network (20) under the first device identifier (IPL) can be reached , Specifying a second device identifier (IP2) for a second data processing system (24), wherein the second data processing system (24) in the local data transmission network (20) under the second device identifier (IP2) can be reached for the first data processing system (22) specifying a data amount or usage time, which may not be exceeded during data transmission with a main data transmission network (12) involving the first data processing system (S38), detecting the amount of data transmitted to and / or from the first data processing system (22) on the basis of the data to be forwarded Data packages contained device identifier ode r detecting a usage time in which the first data processing facility has the ability to receive and / or transmit data from the master data transmission network (12) or in which the first data processing facility (22) has received and / or transmitted data (S46),

Checking the acquired data amount or usage time using the predetermined amount of data or usage time (S47), generating a first message or blocking the data transfer to and / or from the first data processing system (22) when exceeding the predetermined amount of data or usage time (S48).

2. The method according to claim 1, characterized by the steps: in a third data processing system storing an association (56) in which a first port address the first Device identifier (IPl) and a second port address to the second device identifier (IP2) is assigned, Use the assignment for the data transmission of the first data processing system and the second Datenverarbeitungs- anläge with the main data transmission network (12).

3. The method according to claim 2 or 3, characterized in that the detection in the third or in a third data processing system (18) is performed, in particular in a router.

4. The method according to claim 2 or 3, characterized in that the third data processing system (18) to the main data transmission network (12) is connected to a subscriber terminal on which data is transmitted via a double-wire line, in particular according to an XDSL method.

5. The method according to any one of the preceding claims, characterized in that the data packets are transmitted in accordance with Internet Protocol, in particular according to TCP / IP.

6. The method according to any one of the preceding claims, characterized in that the third data processing system (18) can forward only less than 10 megabits per second.

7. The method according to any one of the preceding claims, characterized in that the device identifier (IPl, IP2) are network addresses, or that the device identifier (MACl, MAC2) are characteristics of network units that are already stored non-volatile in the production of network units in the network unit or that the device identifiers each contain a network address (IP1, IP2) and a license plate number of a network unit (MAC1, MAC2).

8. The method according to any one of the preceding claims, characterized in that the predetermined amount of data indicates a maximum amount of data that can be transmitted in a unit of time to the first data processing system.

9. The method according to any one of the preceding claims, characterized in that the amount of data transmitted to the first data processing system is added up or subtracted from a value indicating the remaining amount of data.

10. The method according to any one of the preceding claims, characterized in that the predetermined usage time indicates a maximum useful life, in which the main data transmission network during a time unit (12) can be used by the first data processing system or used.

11. The method according to any one of the preceding claims, characterized in that the first data processing system is operated in a WLAN and / or on a Bluetooth interface and that the time of logging the first data processing system in the WLAN and / or added to a Bluetooth interface or is deducted from a value indicating the remaining usage time.

12. The method according to any one of the preceding claims, characterized in that the first Datenverarbeitungsan- läge and the second data processing system (22, 24)

Part of a wired part of the local data transmission network (20) or that the local data transmission network (20) is a wired data transmission network (20).

13. The method according to any one of the preceding claims, characterized in that it is for splitting at a Internet access available amount of data or usage time is used on multiple users.

14. Data processing unit (18a), with a first transmitting / receiving unit (52), which can transmit data packets to or from a main data transmission network (12), with a second transmitting / receiving unit (50), the data packets to or from a first data processing system (22), with a forwarding unit (56) which forwards data packets received by the one transmitting / receiving unit (50, 51) according to predetermined forwarding rules using the respective other transmitting / receiving unit (50), with a memory unit for the first data processing system (22) a device identifier (IPI) and a value are stored, which may not be exceeded in the data transmission from and / or to the first data processing system (22) or is still available and the amount of data or the usage time for the first data processing system (22), and with a monitoring unit (54) which detects the data processed by the first data processing system (22) monitoring the amount of data or time of use consumed.

15. Data processing unit (18a) according to claim 14, characterized by a unit for carrying out a method step according to one of claims 1 to 13.