CN1326065C - Differentiated connectivity in a pay-per-use public data access system - Google Patents

Abstract

This invention offers tiered application services for access to network services on a pay-per-use basis in public access networks. Using personal devices (108), the user can access different tiers of application services on demand (103, 104), without the need of any preexisting association, e.g., subscription, with the service provider of the wireless access system (111). Such on-demand access is obtained by providing a variety of personal identifiers, such as a credit card number or frequent flier identification. Moreover, the service offering allows a user through a personal device to modify, enhance or degrade the currently established tier of application services during the lifetime of the user's association with the access network. A network-level enforcement mechanism at access points within the access network ensures user access only to application services within the application service tier that they have paid for, and denies service accesses not within that tier.

Description

Discriminated connectivity in pay-per-use public data access systems

priority

This application claims priority to US application of the same title, filed March 8, 2002, assigned serial number 60/363,327.

technical field

The present invention relates to the field of computer network connections. In particular, it concerns Internet access through publicly accessible network infrastructures.

Background technique

The present invention relates to a mechanism by which users can utilize their own personal devices, such as notebook computers and personal digital assistants (PADs), to access packet-based network services provided by service providers at Such as airports, shopping malls, hotels and other public places. Such public access service providers offer a variety of wired or wireless technologies through which people connect their personal devices to the network and its associated services. With the advent of new wireless technology standards for Local Area Networks and Personal Area Networks (Wireless LAN and Wireless PAN respectively), we are seeing an increase in the number of public services provided, especially the types of services considered in the present invention. Rapid growth,. For example, public wireless access may be provided through wireless LAN technologies, such as those based on the IEEE 802.11 series of standards, or through wireless PAN technologies, such as Bluetooth wireless technology.

Typically, packet-based data service offerings require users to first pre-register, eg, subscribe, with a data service provider, such as an Internet Service Provider (ISP), thereby establishing a long-term "paid" relationship with the provider. This process is usually done offline, establishing and activating the provider-subscriber relationship before the user can access the common service. This subscriber relationship includes the definition of a user profile, which specifies the range of services that the individual user is authorized to access. ISPs typically provide a local or even toll-free phone number that allows access to the same ISP for an additional fee (in addition to the subscription fee) from many geographically remote locations. However, for accessing data services via wireless public services, this mechanism has a serious disadvantage: if users try to access a public access infrastructure operated by a provider different from those with which they have established a subscription relationship provider, those users will be denied access unless they also subscribe to the new provider. Such limitations defeat the premise of a public access infrastructure, which ideally wishes to always serve (and charge for) as many users as possible.

Furthermore, current approaches to public access to network services, often using wireless technologies, define a single class of service. For example, a typical service is simply access to the World Wide Web (or simply, "the Web"). Such a service definition does not take into account the situation where users can access certain premium services on demand through their own devices. There is no mechanism that allows a user to dynamically select one or more of these premium services at any time without pre-establishing a relationship with such services. Even if there are indeed multiple levels (or groups of services) of service offerings, users will have to select their desired level of service in advance. Moreover, the selected service level remains unchanged during the period that the user accesses the service provided by the service provider. In other words, current service offerings over public access infrastructures do not provide users with distinct and dynamically (or on-demand) adjustable service levels. Such service provision will also require a mechanism to dynamically adjust the payment policy for the user based on the set of services selected by the user. In addition, in order to complete the provision described above in real time, it should.

One possible solution in providing graded services on demand is by installing special code in the client (ie user's) device. This special code will affect the communication stack and necessitate the use of new specific protocols. Every packet generated by these client devices needs to be modified with this additional and special code. Of course, network elements in these networks must run complementary parts of the new specific protocol to be able to read these modified packets. It would be advantageous to have a method that does not require changes in the protocol stack. The method should be able to use existing TCP/IP standards without requiring client devices to implement new protocols, without requiring client devices to have to modify each of its transmissions, and without requiring devices in the network to have to modify their communication protocol stacks to Understand the newly designed protocol.

A final point worth noting is that there are other options for deploying public wireless services. For example, one system proposes the use of specialized software to be embedded on personal devices to facilitate access to public services by modifying each data packet transmitted by these devices.

It would be beneficial to have a system that does not require any changes in the personal devices used to access the wireless network and does not require any modification in the data packets transmitted by these devices in order to achieve its various . The systems described above depend on specific characteristics of the operating platform (either its server or client version). This establishes an operating assumption of communication and computational homogeneity for the devices participating in the supporting network. It would be even better to have a system that works on unchanged devices and communication protocols that can be applied in heterogeneous computing and communication environments by devices using established open communication standards, such as TCP The /IP Internet Protocol family is already supported by an overwhelming majority of personal (IP-enabled) devices running on different types of operating systems. These personal devices should be built on a software and hardware platform independent of that of the network enabled device with which they interact for its configuration. With regard to accounting, the aforementioned systems do not allow dynamic reassignment of accounting policies in the middle of an ongoing session.

Contents of the invention

Therefore, one aspect of the present invention is to allow providers of public network services to provide different levels of application services to users of these application services. Users use their own personal devices to negotiate and dynamically adjust their desired application service levels on a per-use basis and during an ongoing use session, with no specific modifications made to accommodate the teachings of the present invention .

Another aspect of the invention is an enforcement mechanism applicable in a communication infrastructure supporting said common service offering. This enforcement mechanism can be applied to components inside the infrastructure, such as router devices, or to components at the edge of the infrastructure, such as wireless access points. This enforcement mechanism ensures that individual users can only access those application services within their chosen application service level, and denies access to all application services that do not belong to that level. In some embodiments, this enforcement mechanism is supplemented by means to warn users when they attempt to access a particular application service that does not fall within their currently selected level, and by means by which users can reuse their The own device dynamically renegotiates the new desired application service level so that the user can access the new application service if desired.

Yet another aspect of the present invention is an implementation mechanism with the same purpose as the foregoing, which can be applied outside of the communication components of the infrastructure (such as routers and wireless access points), such as operating in a communication infrastructure Devices and software with a higher protocol level than those with higher protocol levels. With such an enforcement mechanism, a filter server can be used on the communication infrastructure to restrict the flow of web traffic, eg, from users, to only reach web services belonging to their selected application service class.

Yet another aspect of the present invention is to enable users to use their own devices to access dynamically selectable tiered application services offered in public on a "pay per use" basis, using various "on the spot" payment means such as credit card information, Frequent flyer information, temporary identifier information such as hotel room numbers, etc., without prior reservation to the data supply service provider.

Other aspects of the invention utilize a payment strategy where users are billed for services they have selected and accessed using their own devices. In general, these payment policies are based on various criteria, including the level of user activity expressed in terms of the number of communication streams transmitted to and/or from the user, or the duration for which a selected level of application service is provided (session time ). Also, charging policies can be changed dynamically during a session, allowing a user to update or modify his or her service level and charging policy.

Other aspects and better understanding of the invention can be realized by referring to the detailed description.

Description of drawings

These and other objects, features and advantages of the invention will become apparent from a consideration of the following detailed description of the invention when taken in conjunction with the accompanying drawings, in which:

Figure 1 shows an example of the architecture of a system for providing wireless network access, and the actions performed by the user and the system to provide the required level of application services.

Figure 2 illustrates the 3 main functional steps used in accordance with the present invention to allow individual users to specify and gain access to authorized application services. The 3 steps are:

a) registration, which allows users to specify their choices among available application services,

b) control notifications which let a particular implementing device know the appropriate access profile for a particular user, and

c) Enforcement that allows the appropriate network equipment to police individual packets, connections or sessions involving a particular user's equipment to ensure that they always correspond to authorized application services.

Figure 3 shows the steps taken by the registration-related entities (in particular, the user equipment and the registration server) in the user's registration process, including verifying the user's credentials at the network side, and accepting the user in the available application service level mechanism of choice.

Figure 4 shows an example of the steps involved in the actual implementation process, which includes a check of a particular package to verify that it complies with the application services currently authorized for that particular user, and checking for any necessary updates for billing purposes.

Figure 5 shows the steps involved in the process by which individual users can dynamically change their selected application service level.

Figure 6 shows the process by which a user terminates (logs out) their current session. This logout is used to ensure that the network releases any resources that have been reserved for a particular user, and also to ensure that users are correctly charged for their own actions (especially when users are charged based on the duration of their session).

Figure 9 shows an example of the exact mechanism (ie enforcement) of access control. It describes an example of implementing this enforcement mechanism through the use of tables in routers that list specific destinations, protocols, or combinations of the above that individual users can or cannot access.

The access control framework of Figure 9 can also be applied to enforcement mechanisms occurring at different layers and possibly at service-level entities.

Figure 10 shows a framework similar to Figure 9 for the case when access control is performed by a wireless access point or a web proxy.

Detailed ways

The present invention provides a method, apparatus and system for a user to select between multiple application service levels offered through a public network access infrastructure. It allows users to gain access to such different levels of application services even if they have no pre-provisioned subscriber relationship with the corresponding service provider. It also allows users to automatically and dynamically select and reselect their desired application service levels without service provider operator intervention. In some embodiments, such changes also result in appropriate changes in charging (or billing) mechanisms.

In the present invention, a service is defined as a destination endpoint, such as: a company's Web page, a company's server application, a company's Lotus Notes mail server, and the like. This application level of service defines a service different from the network level, such as the communication bandwidth allowed for communication on the Internet, for example 56Kbps or 128Kbps, regardless of what the destination of the communication is.

In various embodiments of the present invention, users may use their own personal data devices, such as notebook computers or personal digital assistants (PDAs). Users may also temporarily use other computing devices, such as kiosks and the like. However, for the purposes of the present invention, those other devices are assumed here to behave exactly as if they were the user's own "everyday" computing devices, without requiring the introduction of such additional software or hardware to any set of these devices components, which software and hardware components solely and exclusively enable these devices to operate in accordance with, and enable their users to obtain the benefits of, the teachings of this invention. The service provision contemplated for embodiments of the present invention is based on ubiquitous, IP-based Internet technologies; the access technology is based on wireless local communication technologies operating in unlicensed wireless frequency bands, such as IEEE 802.11b wireless LAN or Bluetooth wireless PAN . Apparently, those skilled in the art can implement other embodiments of the present invention without departing from the spirit and concept of the present invention. For example, they can use other alternative access technologies, such as infrared or Ethernet, or can use a dynamic pay-per-use arrangement as an additional charge for subscription-based customers occasionally accessing levels that are not part of their default subscription profile An approach to service levels.

Figure 1 shows the architecture of a system for providing wireless network access to mobile users and their devices at wireless hotspots in public areas such as airports. The figure also highlights the steps that need to be performed by the user to obtain the desired level of application service. The access network 101 includes routers (such as 106, 107) and wireless access points (WiAP) (such as 110, 111). A user equipment or user terminal (108), connects to this access network via a wireless connection 109 to an access point (110 in Figure 1). In addition to network layer entities such as access points and routers, the access network may also include network support services such as DHCP (Dynamic Host Configuration Protocol) server 102, DNS (Domain Name Service) server 113 and Web proxies (eg 112, 117) . DHCP and DNS entities are common components in most IP-based networks known to those skilled in the art, and provide various configuration information and query resolution support for IP-based user terminals. Web proxies are used to manage access from user terminals to web servers. In an embodiment of the present invention, the access network includes a registration server 114, which is used to interactively establish the application service levels desired by individual users.

As an example of possible levels for differentiating between application service levels, FIG. 1 shows two application service levels, Gold Service 103 and Silver Service 104 . Each application service level is defined by a collection (group) of one or more services. In this example, silver service level 104 includes access to the general Internet 105 in FIG. 1 . In addition to including all services included in the Silver service class, the Gold service class may also include services that provide video clips to user terminals. The application service classes of these levels can exist statically, ie for example the silver application service class may always include the same set of application services within it (or at least be updated rarely). On the other hand, the assignment of application services among classes can be dynamic, where the application services "assigned" into a class can change based on various criteria. In some embodiments, services are added or subtracted based on a combination of criteria, such as based on: application quality of service considerations; enforcing access admission controls; time; using different charging models for application services at different times, and the like.

After a user terminal 108 enters such a system and establishes a wireless link with an access point, it executes the DHCP protocol to obtain an IP address for the user terminal. This step is shown as item 116 in FIG. 1 . After this step, the user terminal uses a standard web browser to contact the registration server 114 using the standard HTTP protocol. The registration server provides the user terminal with a web-based list of available application service levels and their associated charges, as well as other information. The assignment of service to each tier may be static, or dynamic based on current service availability, promotional or other factors, and the like. At this point, the user enters an identifier, such as a credit card number or frequent flyer number, and the desired application service level into the browser, and sends this information to the registration server. These steps are collectively shown as item 115 in FIG. 1 . Once properly validated, the identifier provided by the user is also used to ultimately bill the user for the desired application service level. Once the identifier is accepted and validated, the registration server sends a control notification to the appropriate implementation device, informing the implementation device that the corresponding user can access those application services belonging to his/her selected service class. The enforcement device responds to the information by placing a set of controls to regulate the user's communication flow in the visited network. This step is shown as item 117 in FIG. 1 . In various embodiments, the executing device may be a router (106), an access point (110), or a web proxy (112). The control mechanism will then place traffic filters on the appropriate implementing devices. Different implementation examples of this control and enforcement mechanism will be described later.

Figure 2 illustrates the 3 functional steps used by the present invention to allow individual users to specify and gain access to authorized application services. The 3 steps are:

a) registration, which allows users to specify their choices among available application services;

b) control notifications, which let designated implementing devices know the appropriate access profile for a particular user, and

c) Enforcement that allows appropriate network equipment to police individual packets, connections or sessions related to a particular user equipment to ensure that they always correspond to authorized application services.

Figure 2 therefore highlights the steps of the invention for providing access to various levels of application services to user terminals. Specifically, the user terminal 108 first registers 201 with the registration authority 202 . During registration, among other things, the user terminal is identified by a unique identifier. This identifier should be unique during the relevant session, ie until the user terminal ends its association with the visited network (101) and the application services available through it. The access network (101) in FIG. 1 is also identified as a controllable infrastructure in FIG. 2 because the access network can be dynamically controlled, configured and/or reconfigured based on its users' application service level selections. This identifier can be fixed, such as the medium access (MAC) address of the communication hardware subsystem used by the user terminal, or temporary, such as the IP address assigned to the user terminal by the DHCP server, or provided to the user terminal running on the user terminal. Web cookies applied by your web browser. By using identifiers that are not based directly on the network interface (eg, MAC address), or based on specific configuration parameters provided by the accessing network infrastructure (eg, IP address), the registry allows the user terminal to maintain its Network connection changes (such as plugging in a new network interface, or DHCP assigning a new IP address). In these situations, the user terminal may share part of the responsibility to notify the registration server about changes in its device or network specific configuration parameters.

The registration authority 202 will record this identifier and the application service level that the user terminal has requested. Using this knowledge, the registry will adjust the communication network to suit the new user and his/her chosen application service level. The adjustment action mainly consists in passing the binding information between the identifier of the device and the service level of the application to some or all nodes of the controllable access infrastructure through the control signal 203 . As an example, a registration authority (also called a registrar) can:

a) passing the MAC address of the user terminal to the access point and the LAN switch together with the application class of service, or

b) passing the IP address of the user terminal to the network router together with the application service level, or

c) pass the web cookie/IP address along with the application service level to the web proxy in the network, or

d) Informing the application-specific server to accept or reject the communication stream from the specific user terminal.

Using this information, the appropriate network node will block, or pass, traffic 206 from the user terminal to those services 205 or from those services 205 to the user terminal.

Figure 3 shows an example of various steps in the initial interaction of the user terminal and the system. It includes functions such as obtaining an IP address (116), contacting the registration server and selecting the desired application service level (115), and the resulting control notifications, such as to the common control infrastructure (117 and 203) status is updated. This embodiment of the invention uses the standard DHCP protocol for configuring individual user terminals. After a user terminal enters the system, the physical layer of its network connection is activated and its system software is notified. As a result, the user terminal broadcasts a DHCP request on the system network (item 1 in 301). This request is processed by the machine running DHCP server 102, which sends a response back to the user terminal (item 2 in 108 and 301). The DHCP response includes the IP address assigned by the system to the user terminal, the IP address of the default node for relaying messages (gateway IP address) and the IP address of the machine running the DSN server.

A particular embodiment of the invention has the client configuration software with its default behavior modified. For example, when using the DHCP protocol, a system-specific option is added to the DHCP protocol, which can be done according to existing standards for adding options in DHCP, and the DHCP server and client software are extended to generate and interpret the new options. System-specific DHCP options include the address of the registration server. The extended DHCP client software uses this address to launch a browser directed to the registration server 304 when processing the DHCP response. This above-described embodiment of the present invention represents an example embodiment of automatic configuration of user terminals without explicit user intervention using extended DHCP client and server software. In another embodiment of the invention, no extensions are implemented to the DHCP protocol or to the DHCP client and server software (302). After the DHCP response has been processed and the network connection configured, a browser is manually launched on the user terminal and directed to the registration server. The registry server's identification can be obtained as a ULR from the browser's bookmark collection, or can be provided to the user through an out-of-band mechanism such as a visual notice (303) that can be prominently printed or displayed in public. Although DHCP is the most common mechanism for initial configuration of user terminals, other configuration protocols may be used equally effectively. For example, the next generation Internet protocol, IPv6, allows nodes to configure themselves automatically without any help from a DHCP server. Moreover, using techniques like destination redirection, a Web request from a client device to a destination Web can be redirected to any desired location, for example, a registry server, independent of where the browser user wants to go on the Internet. s position. The present invention is equally applicable to such other optional initial user terminal configuration means.

As part of the user's interaction with the registration server, the user will then select a desired application service level and provide payment-related information (305). This information is then sent by the registrar/authority to the appropriate, logically separate node for validation (306). If the information provided by the user is confirmed to be correct (307), the registration is considered successful. In this case, the billing process for the user session is initiated and the appropriate information is relayed to the normal control infrastructure components via control notification messages (308). If the information is invalid (307), the user is typically provided another opportunity to register with the system (310).

Once the system has successfully approved the user's selection of a particular application service level, the user may be expected to initiate transfer to that level of application service. Figure 4 illustrates, in an example process, the steps followed by a component of the general access controllable infrastructure (204 in Figure 2) during such a communication. After receiving a packet (request packet or any transmission from a device) 401, the packet is examined to determine its source, ie the user terminal, and the application service class 402 it belongs to. The mechanism by which the package is associated to a particular user terminal and/or application service level depends on the exact components of the controllable access infrastructure that enable this implementation. This is depicted in Figure 9 for the case of a router and in Figure 10 for the case of a wireless access point or web proxy. If the application service complies with the class of service associated with the source of the packet 403, the packet is forwarded to the next hop (hop) 404 and, if necessary, updated with the source user if the billing policy for that particular application service so requires. Accounting information 405 associated with the terminal. If the application service is not compliant 403 then either drop the packet or take appropriate remedial steps 406 . In either case, the infrastructure component starts processing the next package. If the compliance test fails 403, the system may wish to take other optional remedial actions.

In some embodiments, the execution node redirects the packet, and/or generates a failure notification to the registration server. If the packet that fails the compliance test corresponds to a web-based request, the registry server can then respond to the user terminal using the HTTP protocol with a notification that the user attempted an access that violates the user's current application service level. This Web-based notification can provide the user with the option to renegotiate the application's service level so that subsequent user access attempts are not denied.

Depending on the information provided by the user at registration and the capabilities of the system, another remedial action would be to send an "out-of-band" notification to the user. The latter case is desirable when the user is not currently using a web browser application or does not have any dedicated applications to which the system can send messages. "Out-of-band" notifications may include messaging to pagers, interactive personal email devices such as wireless personal devices, telephone calls to cell phones, SMS (Short Message Message Service) messages, and the like.

The process by which users can renegotiate or change their application service levels during an ongoing association with the public access network is described next. As already explained, this process may be used when a user finds that a particular desired application service is currently outside the user's current level of selection. Or, at a certain moment, the user may also find the need to temporarily switch to a different application service level. For example, a user may suddenly discover a need to access a premium application service that is not included in the originally selected application service level. Note that application service profiles are sometimes created and stored for users to indicate selection of preferred application service levels under certain conditions or when specific attributes such as location-based attributes are met. The user's service profile can aid in the selection of the application service level.

While embodiments of the invention described herein refer to user selection of service selections, the use of service profiles to facilitate user level selection is not outside the spirit of the invention. Figure 5 shows the steps involved in the process of changing the service level of an application associated with a user terminal. The user terminal contacts the registration server 501 by directing the browser to the registration server, requests to change the application service current level (502), and provides all necessary information 503 (similar to 305). If the information is valid 504, the change is accepted and the state 505 of the access control and accounting 506 components in the general infrastructure are updated. The process 503 of providing the necessary information may not be as detailed as the initial process 305 in FIG. 3 since the user terminal already has an existing association with the visited network (and thus a unique identifier). For example, a user may not need to re-provide personal information (e.g., a credit card number); instead, software on the user's terminal may be able to directly provide a user-specific identifier (e.g., by using a Web cookie) to the registration server, thereby helping the server to A pair of application service level change requests are associated with existing user network relationships.

Although the process for updating services described in FIG. 5 represents one embodiment of the present invention, other processes are possible without departing from the spirit of the present invention. For example, one skilled in the art could achieve the same result by having the user indicate a desired application service and the service provider respond with an appropriate registration page for the application service level including the requested application service. This latter scheme does not require the user to explicitly contact the registration server for an update. However, it achieves the same end result as the embodiment shown in FIG. 5 .

As support for dynamically defined application services is an element of the present invention, a mechanism by which service associations can be terminated should be specified. For example, this logout mechanism is useful for correct billing in situations where a user is charged based on the duration of the user's network association. Such a mechanism could also be used by the user to check current usage and billing information before making decisions about continuing or terminating the association. Figure 6 shows the steps in the (possible) final interaction of the user terminal and the public access network when the user terminal effectively closes all sessions and terminates its access to various network services. In the illustrated embodiment, the user terminal directs the browser 601 to the registration server and uses the standard HTTP protocol to request termination 602 of its session. As part of this request, the user terminal may include a user-specific unique identifier established during the registration process, see 201 in FIG. 2 . Then, the registration server extracts 603 appropriate usage statistics from the related execution devices, and provides the appropriate usage information 604 to the user terminal. Based on this usage information, the user will then decide 605 to either confirm the termination of their association or continue utilizing the publicly available service infrastructure. If the user decides to continue, the termination process is suspended and the user resumes his or her normal network access. This mechanism provides a means for users to easily verify their activity history and associated charges. However, if the user decides to terminate their current association 605, the registration server will perform the necessary steps to remove information related to the user's presence in the public access network. The registration server will first send an appropriate control notification message 606 to the executing device to prohibit any other access of the user terminal. Successful execution of such control messages effectively removes unnecessary access control information in the executing device. It also acts as a mechanism to prevent any subsequent unauthorized access attempts. After sending this notification, the registration server will also remove active user-specific information from its internal tables, such as the unique identifier associated with the user's current session, and complete the process 607 of charging the user appropriately. In addition to notifying the access control device, the registration server will also notify the DHCP server 608 so that the DHCP server can properly update its own tables and release resources.

Figure 7 illustrates another example embodiment for managing and terminating sessions without explicit user action to terminate. In this embodiment, the presence of the user terminal in the system is tracked using a web technology known as a cookie. FIG. 7 repeats the relevant parts of FIG. 1 , and additionally adds a session database 702 for saving records 703 of terminals in the system. Specifically, following the assignment 116 of an IP address to the user terminal by the DHCP server 102, the server notifies 701 the registration server 114 that a new IP address has been assigned to the user terminal. In one embodiment, the registration process enters this IP address into a "waiting" pool of IP addresses. When a user visits the registration server to register a new service, continue or update an existing service, the IP address will be removed from the waiting pool. In another embodiment, the registration server associates this IP address with a record 703 in the user session database 702 . In any case, the registrar is notified of the new IP address assignment.

New IP address assignments may indeed be given to completely new user terminals, or to terminals that may have ongoing sessions. The latter situation may occur for various reasons, such as temporary link 109 failure, user equipment reboot, change of wireless access point due to movement, access technology from e.g. wireless LAN to wired Ethernet, to Bluetooth wireless technology adjustments and more. The user equipment can obtain a brand new IP address different from that used before. However, the user may choose a payment policy that is still in effect. For example, a user may have requested a time block of 30 minutes, and a communication outage occurred between 7 and 10 minutes into that time block. In this case, the brand new IP address should not be associated to a brand new session, but used to update the session information related to the existing session.

In the embodiment shown in Figures 7 and 8, this is accomplished through the use of Web cookies. A web cookie is a small piece of information that a web server sends to a web browser interacting with that server. Web browsers store cookies locally in the user terminal running the browser. Every time the particular web browser visits the particular web server, the cookie is uploaded by the browser. This can be used to track user visits to specific Web sites. In the case of this embodiment, when the user terminal accesses the registration server after assigning it a new IP address, the cookie can be provided to the registration server again, and the registration process can use the cookie to extract the The user terminal's session record (if it exists), and updates it accordingly.

In yet another embodiment, the transmission of the new IP address from the DHCP server to the registration server is omitted. It allows session data for newly initiated sessions or ongoing sessions to be handled exclusively by the registrar. This is possible because web servers, such as registration servers, can extract a large amount of information about the user terminal, including its IP address, in addition to cookies. However, the IP address transfer in 701, or a similar address in the opposite direction, is the method used to confirm that the IP address used by the client device is a legitimate IP address assigned by the DHCP server.

Figure 8 shows an embodiment of the steps followed by a registration server to decide what to do if it receives a cookie. A cookie is said to be valid if it is associated with an active/ongoing session. To invalidate a cookie, several events 807 may work. For example, a DHCP server may invalidate an IP address. This occurs when the "lease" time associated with the IP address assigned by the DHCP server expires before the user terminal requests to renew the lease. In the embodiment in FIG. 7 , the DHCP server communicates this information by transmitting a "Remove IP Address" message 704 . The granularity of a DHCP lease dictates how precise a "pay-as-you-use" billing policy can be; for example, if leases are given in two-minute increments, a user who chooses to pay based on the duration of her session will Minutes are billed using system 2, or 4, or 6 etc. Sessions may also be invalidated if the user has chosen to pay in 30 minute time blocks and 30 minutes have elapsed. In the session record 703 in FIG. 7, the latter may be based on a session record item describing the selection time (paymentSelectionTime) of the payment policy and/or the time (paymentDuration) covered by the selected payment policy, or otherwise stored in the session record related data to calculate. The timing of selecting a payment may coincide with the timing of selecting a class of service, but this is not a general requirement. Various time intervals may further be associated with grace periods to account for the possibility of a user temporarily disconnecting. These grace periods are advantageously coordinated with the DHCP server so that the DHCP server does not assign removed IP addresses to new user terminals if the server has not updated its session records.

Due to user movement and other reasons such as temporary link failure, user equipment reboot, change of wireless access point due to movement, adjustment of access technology from e.g. wireless LAN to wired Ethernet, to Bluetooth wireless technology Wait, a brief disconnection may occur. By using cookies, which are sometimes used as session identifiers that persist after connection interruptions, users can continue to access selected levels of service without having to re-register with the registration server. Using the cookies that the user terminal sends to the registration server each time it accesses it, the registration server can restore any session information it needs, regardless of connection interruptions caused by many reasons. This capability is often referred to as service roaming.

FIG. 9 shows more details on how access control is performed by using routers in the access network 101 of FIG. 1 or equivalently the controllable infrastructure 204 of FIG. 2 . In FIG. 9, it is assumed that the user terminal 901 is assigned an IP address 10.0.0.1 using the DHCP protocol; in other embodiments, this IP address and subsequent IP addresses may be different. Additionally, assume that the service provider has defined two application service levels, Gold and Silver, which allow users to access devices with IP addresses 10.1.1.2 and 10.1.2.2, respectively. (Multiple application service classes, where each class has multiple lists of IP addresses and/or port numbers, this generalization will be straightforward to those skilled in the art.) The client then accesses the Point 902 contacts Registration Authority 903 to specify its desired application service level. The registration authority 903 provides 904 a web page listing all available application service levels and their associated charges. The user then chooses 909 between two levels of application service (Gold and Silver) and sends back 905 this choice (along with other personal credentials) to the registration server. The grouping of services into application service classes may be incremental, that is to say eg selection of the Gold service class also enables access to all services in the Silver service class.

Assume that the user terminal has selected the silver service class. One of the nodes where access control mechanisms can be implemented is router 906 . As shown in FIG. 9, the router-based access control scheme can be implemented by transmitting 907 a router a set of filtering rules based on the IP address of the user terminal and its requested application service level. After receiving these filtering rules, the router stores them in the local routing table 908 . In Figure 9, the routing table shows that the IP address 10.0.0.1 (the IP address of the user terminal in question) can access the application service provided on TCP port 80 at the destination address 10.1.2.2. This corresponds to the web server for the silver service; therefore, the user terminal associated with the IP address 10.0.0.1 can only access the silver service.

The execution mechanism can also be executed at other optional nodes in the access network infrastructure, such as wireless access points or web proxies. These other options are shown in FIG. 10, in which it is assumed, as before, that the subscriber terminal has the IP address 10.0.0.1. Furthermore, assume that the hardware (MAC) address of the wireless device associated with the user terminal is "MAC_ADDR_1". First, as shown on the left side of the figure, the registration authority 1002 may communicate a set of filtering rules 1003, 1004 to one or more wireless access points (WiAPs) 1005, 1006. Since the wireless access point distinguishes terminals by MAC address, the filter table 1007 in the wireless access point (1005 in FIG. The group allows the destination IP address and/or port number of the destination node. Furthermore, the figure shows an example in which the user terminal has selected the silver level application service 1008 (destination address 10.1.2.2).

The right side of FIG. 10 shows the situation when access control is performed by arranging filters on the Web proxy 1009 . In this case, the Registry 1002 passes the appropriate set of filtering rules 1010 to the Web Proxy. The Web proxy then updates the corresponding information in its filter table 1011. It should be understood that this is actually an application layer filtering mechanism, because the web proxy only intercepts communication streams from web-based user terminals. In this case, the user terminal can be uniquely identified either by a network layer identifier, such as an IP address (10.0.0.1 in this example), or by an application layer identifier, such as a set of Web cookies.

FIG. 10 shows a situation when the filter table 1011 identifies a user terminal by its IP address (10.0.0.1), and identifies the set of allowed destinations by a set of URLs (Uniform Resource Locators). In this particular example, assume that the user has selected the silver application service associated with the URL http://10.1.2.2/sliver.html. Uniform Resource Locators (URLs) are the standard way to name, discover, and retrieve objects on the Web.

Embodiments of the invention discussed herein relate to controlling access to selected application services using access points, routers, and web proxies. Those skilled in the art can use other network communication flow control components without departing from the essence of the present invention.

Embodiments of the invention presented so far are based on the assumption that a public access infrastructure uses a wireless LAN to allow users to connect to the network through a wireless interface. However, the principles and methods described in this invention can be applied to other wired and wireless access technologies. Those skilled in the art can easily develop other embodiments of the present invention for other access technologies, for example, using wired IEEE802.3 Ethernet technology instead of IEEE802.11 wireless LAN technology, without departing from the essence of the present invention.

The present invention can be realized in hardware, software, or a combination of hardware and software. The visualization tool according to the invention can be implemented in a centralized manner in one computer system, or in a distributed manner, where different components are distributed among several interconnected computer systems. Any kind of computer system or other apparatus adapted for carrying out the methods and/or functions described herein is suitable. A typical combination of hardware and software could be a general purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the methods described herein. The invention can also be embedded in a computer program product which comprises all the features enabling the implementation of the methods described herein and which, when loaded into a computer system, is able to carry out these methods.

Computer program means or a computer program in this context includes any expression in any language, code or symbol, of a set of instructions intended to cause a system having information processing capabilities to , codes or symbols, and/or perform specific functions after being reproduced in a different material form.

The present invention thus includes an article of manufacture comprising a computer-usable medium having embedded therein computer-readable program code means for implementing the functions described above. The computer readable program code means in the article of manufacture comprises computer readable program code means for causing a computer to implement the steps of the method of the present invention. Similarly, the present invention can also be realized as a computer program product comprising a computer-usable medium having embedded therein computer-readable program code means for realizing the functions described above. The computer-readable program code means in the computer program product includes computer-readable program code means for causing a computer to realize one or more functions of the present invention. Furthermore, the present invention can also be implemented as a program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to implement method steps for realizing one or more functions of the present invention.

It should be noted that the foregoing has outlined some of the more relevant objects and embodiments of the invention. The invention can be used in many applications. Thus, although the description has been made with respect to particular arrangements, timing and methods, the objects and concepts of the present invention are adaptable and applicable to other structural arrangements and applications. It will be apparent to those skilled in the art that modifications to the disclosed embodiments can be made without departing from the spirit and scope of the invention. The described embodiments should be considered as merely examples of some of the more salient features and applications of the invention. Other beneficial results can be realized by applying the disclosed invention in a different manner or by modifying the invention in ways known to those skilled in the art.

Claims (29)

1. method comprises: make the user use one group of standard communication protocol to visit one group of specific application service on the equipment of network being connected to, described method comprises:

Provide many described equipment of group addressable application service, at least one the described application service in each described group can be used by described equipment;

Allow described user from described a plurality of groups, to select described one group of specific application service; And

Dynamically automatically described network is configured to allow described equipment by the described one group of specific application service of described access to netwoks based on described one group of specific application service.

2. the method for claim 1 further comprises:

Make described user can from described a plurality of groups, make the selection of another being organized application service subsequently; And

Dynamically automatically described network is reconfigured to allow described equipment by described another group application service of described access to netwoks based on described the selection subsequently.

3. the method for claim 1, wherein this network uses standard tcp/ip communication agreement.

4. the method for claim 1, wherein said one group of standard communication protocol comprises standard IEEE 802 communication protocols.

5. the method for claim 1, wherein this step that provides comprises the tabulation that extracts the application service of described many groups from local data.

6. the method for claim 1, wherein this step that provides comprises by described network from the position away from the tabulations of extracting the application service of described many groups one group of device of described equipment.

7. method as claimed in claim 6, wherein this step that provides is initiated by described one group of device and is comprised by the transmission of described one group of device to the unsolicited message of described equipment.

8. method as claimed in claim 7, the content-dependent of wherein said unsolicited message is in the attribute of at least one and described device association.

9. method as claimed in claim 6, wherein the step of this extraction comprises the Web server that uses the Web browser that is connected to described equipment to use and be connected to described network.

10. the method for claim 1, wherein this step that provides comprises at least one of from the available application service tabulation described many groups of dynamic creation application service.

11. described method as claimed in claim 1 further comprises the application service of described many groups is mapped at least one network identifier.

12. method as claimed in claim 11, wherein said at least one network identifier comprises at least one identifier of taking from a group identifier, and this group identifier comprises: the IP address; The TCP/UDP port numbers; Protocol identifier; Application identifier; With these combination.

13. the method for claim 1, wherein the step of configuration is included in and sets up the communication stream filtering rule in the described network automatically, and wherein said communication stream filtering rule is related with the application service of described equipment and described particular group.

14. method as claimed in claim 13, wherein said communication stream filtering rule is set at from one group of at least one network traffic flow Control Component that is connected to described network of network communication stream Control Component, and a described group network communication stream Control Component comprises: the data access point; Bridge; Switch; Hub; Router; Gateway; Acting server; The combination of Web server and any of these.

15. method as claimed in claim 14, wherein said communication stream filtering rule are based at least one identifier from a group identifier, a described group identifier comprises: the user of equipment; Described equipment medium accessing to control address; Described many group application service Media Access Control address; Described IP address of equipment; Described many group application service IP address; Described equipment TCP/UDP port numbers; Described many group application service TCP/UDP port numbers; URL(uniform resource locator); Combination with any of these.

16. method as claimed in claim 2 further comprises: at least one the visit charge of described equipment to the application service of described many groups, wherein Shou Fei step comprises provides and by the related optional charging policy of every group of application service of user's selection.

17. method as claimed in claim 16, wherein said optional charging policy is based at least one strategy from one group of optional charging policy, and this is organized optional charging policy and comprises:

Time-based charging policy, wherein expense depends on described network maintenance configuration so that described equipment can be visited the duration of the application service of described particular group;

Time-based charging policy with time quantum of selecting in advance;

Time-based charging policy, it has dynamically to reset puts the time quantum that stops to visit the application service of described particular group up to described equipment;

Per minute, hour, day or every month service order expense;

Based on the charging policy of using, the quantity of wherein charging depends at described network and keeps configuration so that described equipment can be visited under the situation of application service of described particular group, by the communication flows between the application service of described network in the application service of described equipment and described particular group;

Based on the charging policy of using, it has the communication flows of selecting in advance; And the combination of any of these.

18. method as claimed in claim 16, wherein the step of this charge comprises that the user with expense and described equipment associates, and the step that provides from least one user ID of one group of user ID is provided in described associated steps, described one group of user ID comprises: credit card information; Flight regular guest information; Customer loyalty information; The application service ordering information; Hotel information; User ID/password information; Be embedded in personal information in the individual smart card and these combination.

19. the method for claim 1 further comprises: the application service of another group of disable access.

20. method as claimed in claim 19 further comprises:

The application service of described another group of definition is the service of forbidding;

Allow described user from described a plurality of application services, to select at least one described service of forbidding; And

Dynamically the application service based on described particular group automatically is configured to allow described equipment by described at least one the described service forbidden of described access to netwoks described network.

21. method as claimed in claim 20 further is included as the visit charge to described at least one described service of forbidding, wherein expense is conditioned based on the charging policy that is relevant to described at least one described service of forbidding that the user selects.

22. method as claimed in claim 19 comprises that further be forbidden with indication to the described visit that another organizes application service at least one described equipment and another equipment dispatch order.

23. the method for claim 1, wherein this step that provides is based at least one attribute with described device association.

24. a method comprises:

Make subscriber equipment be connected to network, described subscriber equipment uses one group of standard agreement, and described network contains: at least one network configuration service; At least one Service Management application service; At least one network traffic flow Control Component; At least two groups can be by the application service of described user equipment access;

Described at least one network configuration service is configured described subscriber equipment;

Described at least one Service Management application service offers a tabulation of the described at least two group application services of described subscriber equipment;

Allow the user of described subscriber equipment from described at least two group application services, to select at least one group; And

Dynamically described at least one network traffic flow Control Component is disposed automatically so that only can be described at least one group of application service visit.

25. a method comprises:

Provide a tabulation of many groups application service to be connected to network to subscriber equipment to respond described equipment;

Send to described equipment one group identifier, the representative of this group identifier from the application service of described many groups to the selection of specific one group of application service; And

Use described identifier to indicate at least one network traffic flow Control Component and automatically and dynamically dispose described network so as to make described equipment and described specific one group of application service between can communicate by described network.

26. a method comprises:

For equipment is provided with access permission,

Allow described choice of equipment that application service selected from many groups of obtainable application services is conducted interviews, described equipment uses one group of standard agreement and is connected to network;

The described access permission that will be used for described equipment so that described device access related with at least one identifier is from least one group described selected application services of described many groups application service; And

Use described at least one identifier so that the described described application service of having selected of access permission visit of having set up can be roamed and use to described equipment.

27. method as claimed in claim 26 also keeps the described access permission that has been provided with even further comprise when the network connection state changes.

28. a device comprises:

One server, it allows user to use and is being connected to one group of standard communication protocol on the equipment of network to visit one group of specific application service, and described server comprises:

One list block, be used to provide many groups can be by a tabulation of the application service of described device access, the described application service of at least one in described every group can be used by described equipment;

One enable module, it makes described user select described specific one group of application service from the application service of described many groups; And

One configuration module, it dynamically automatically is configured to allow described equipment by described network described visit to be carried out in described specific one group of application service described network based on described specific one group of application service.

29. device as claimed in claim 28, wherein said enable module makes described user make the selection subsequently of another being organized application service from described many groups, and wherein said configuration module dynamically automatically reconfigures to allow described equipment by described network described visit to be carried out in described another group application service described network based on described the selection subsequently; Further comprise: a record keeping module, it is charged to described visit, and wherein expense is based on the optional charging policy that is associated with every group.

Images