DE10152572A1 - Authenticated access method for data network has identification information provided by station requiring access to data network authenticated in external network for provision of access password - Google Patents

Abstract

The authenticated access method has an identification information provided by a station requiring access to the data network and verified by an authentication device within an external network, for allowing a password to be supplied to the station upon positive authentication, used for accessing the data network via an access point. Also included are Independent claims for the following: (a) a charging method for services in a data network; (b) a data network or radio-assisted data network; (c) a modem or access point for station access to a data network; (d) an authentication and/or charging system for a data network

Description

The invention relates to a method for accessing a data network or devices for performing a such a process with the generic features of Claim 9. Furthermore, the invention relates to a through the authentication of possible charging procedures.

For communication or the transmission of data is one Many different types of telecommunications and Data networks known. It is basically between two differentiate between different network types. On the one hand there is the telecommunications networks, for example according to the Standard GSM (Global System for Mobile Telecommunications) or the UMTS (Universal Mobile Telecommunications System), where participants log into the corresponding network be authenticated and authorized. Advantageous such networks is that through authentication too charging for claimed services is possible. Furthermore, these generally offer cellular networks Possibility of high mobility, as a participant with can move its station from network cell to network cell.

A disadvantage of such cellular Telecommunications systems that the administrative burden very much is high. In addition, these telecommunications networks Radio interfaces to the subscriber station only one low data rate available.

On the other hand, there are data networks that act as local data networks or local radio data networks (WLAN: Wireless Local Area Network) are designed. Such data networks offer for stations on the subscriber side are very administratively easy access. Another advantage is that Compared to telecommunication networks considerably higher Data rate on the interfaces to the subscriber side Station. A disadvantage of such data networks is, however the lack of authentication options and thus one lack of billing or charging options.

As local data networks with radio-based subscriber access seem almost at the moment, especially in the US and Europe only products based on the IEEE 802.11 family enforce, using appropriate ethernet connections already in many computers and portable computers (laptop, Notebook, PDA,. , .) are provided by default. The Radio interface defined according to the IEEE 802.11b standard Functionally, access to local data networks corresponds to one wired connection to local area networks (LAN), the have become the standard in offices these days. Interface cards for radio-based access to local Data networks that are also known as NICs (Network Interface Cards) from an architectural point of view are like standardized ethernet cards manufactured and with the today's operating systems via so-called plug & play use. Portable computers come with appropriate Interface cards can be easily retrofitted if they are not already in the factory with an integrated connection for one wired or radio access to local Data networks are delivered. The next Operating system generations (e.g. Windows XP from Microsoft), fully integrated support from local radio Data networks provided.

With data rates of currently 11 Mbit / s and 50 Mbit / s in the future data rates are available to participants that are significantly higher than the data rates that are provided by the next, third mobile radio generation (UMTS) will be offered can. So for the transfer of large amounts of data, especially in connection with internet access to radio-based local data networks for high bit rate Prefer connections.

Disadvantageously, the radio-based local Data networks no authentication option for not Stations or computers already registered in the system Offer. Operator of radio-based local data networks however, for example in an airport area Access for a variety of different participants offer different regions. To a participant To be able to authenticate, the operator of the radio-supported local data network so-called cross-license Agreements with all possible Internet service providers (ISP: Internet Service Providers) complete what it is however, there are currently over 60,000 in Germany alone.

Without authentication of participants or However, stations on the subscriber side cannot either Services used are billed because they are already it is unknown to whom an invoice could be sent. Access to local radio-based data networks is therefore essential either free of charge or with prepayment as so-called prepaid service using a credit card statement or the like are offered.

Another way of authentication and billing enable, is a billing company or Intermediate so-called clearing house, which the appropriate contacts to as many internet Service providers worldwide. The problem is however, that then a large part of the operator's revenue a radio-based local data network to the clearinghouse is to be dissipated. The clearinghouse must also succeed actually everyone or at least a large number of To be able to address Internet service providers yourself to conclude a variety of contracts. That is also this solution is very difficult to handle. Looking at the There is increasing unauthenticated access to data networks also the problem that unauthenticated content or so-called unauthorized content from participants radio-supported local data networks is provided. Just authentication could prevent extremist or youthful information about the corresponding local data networks and Internet access can be accessed.

With the operators of those described above Cellular networks are these problems in a simple way and Way solvable. The cellular cellular networks have a large number of participants that can be authenticated. These mobile networks also have a billing or billing system. About a so-called international Roaming can also be used and authenticated by subscribers be registered with another mobile operator or are subscribed. Since much of these days Consumers in industrialized countries are mobile subscribers, In principle, a mobile operator can do almost anyone Consumers themselves or with the help of other mobile operators address.

Approaches as to how a mobile operator uses a radio local data network into its own cellular cellular network can integrate are diverse. With the current one The state of discussion is basically between fixed and loose A distinction is made between tight and loose coupling. Under full UMTS integration becomes a fixed link understood, d. H. one only uses the physical layer (Layer) of the radio-supported local data network, while otherwise all higher protocol layers are taken over by UMTS and be customized. This solution is not now discussed more since they don't prove to be economical has proven to be sensible and technically difficult to implement.

In the case of the loose coupling variants, the two are currently infrastructure-based coupling variants in the public Discussion (e.g. ETSI BRAN) based on the use of a registered identification card (SIM: Subscriber Identification Module) or the RADIUS PROTOCOL (RADIUS: Remote Access Dial-In User Access). With the SIM based variant is in a notebook or a Network access card for this a so-called SIM card used. The local radio-based data network system appears logically as a local visitor register (VLR: Visitor Local Register) of the telecommunications network and is about the so-called MAP (Mobile Application Part) to the Telecommunication network connected. An economical one Success for the operator of the telecommunications network depends however strongly depends on whether in future every card for access a standard SIM for radio-supported local data networks Card will include. This would require computer manufacturers as well as the standardization committees for data networks and Telecommunications networks develop common standards or A cellular operator would need these special types of NICs subsidize.

The telecommunications network appears in the RADIUS version as authentication, authorization and billing Server, causing a modification of the subscriber equipment is not required.

Looking at the hardware currently available Access points (AP), which are based on the standard IEEE 802.11b are based as analog modems for connection to a telephone line, as ISDN cards for connection to one So-Bus, as DSL modems for connection to a DSL line, topologically as ethernet bridges with a local data network Connection for connection to a local data network and in other versions as a so-called cable modem for Connection to a cable television network and as a router, for example with an Ethernet connection without a bridge function known. These access points consist of one Radio access section for controlling access to the Radio interface and an interface for connection the wired telecommunications or data network. The Radio access section and the interface for the wired connection are with hardware connected, also the corresponding Configuration management functions, etc.

The object of the invention is a method and Devices for authenticated access to local Data networks, in particular local radio data networks to provide, which simplify authentication and in particular the possibility of billing with the help services used by the local radio network facilitate.

This task is authenticated by a process Access to local data networks with the characteristics of Claim 1, a charging procedure for data network compatible stations with the features of claim 6, a data network device with the features of Claim 10, a network access device with the Features of claim 11 or charging systems solved with the features of claim 17.

Advantageous refinements are subject and dependent sibling claims.

An authenticated access is, in particular, a Access to a data network, data or the like too understand where the accessing station or their Operators can be identified directly or indirectly.

Data networks are in particular local data networks according to e.g. B. Ethernet, IEEE 802.11 or HiperLAN2. Data Network-compatible Computers, notebooks and the like, which is a cable or radio-based Have an interface to such a data network. For the Access serves as access points for such a data network, including hubs, bridges, network cards in computers and the like are to be understood.

The identification information can be a device number, a assigned phone number, a password-like string and the like, that of the station or its operator assigned. The identification information, e.g. B. a password on the other hand, by initiating authentication Data network facility provided. As opposite Manipulation protected way to an authenticated The transmission path of a short message is set up, a call or the like is listed as an example. The Transmission of the identification information to the access point or Data network can e.g. B. by reading one Mobile phone display, fax or the like by people but also automatically through infrared interfaces or Cable connections are made.

To determine the authenticity of a participant or A procedure is special for a station on the subscriber side advantageous, on the part of the data network Identification information via a secure route to a data network external installation of a system with authentication of the Participant or subscriber stations is transmitted. The Participants can receive those received at such a facility Identification information by hand after being shown on a display or via automatic interface, e.g. B. via a Cable connection or an infrared connection on the mobile Transfer host or computer. This can on the one hand secure authentication information from another system are accessed, from which at least the access identifier of the clearly assignable setup of the system with Authentication in the data network is known. In advantageous However, manner does not have to be directly connected to other internal networks Facilities of the other system with the Authentication function can be accessed. The data network and the other systems with authentication function remain thus completely decoupled and still allow one secure authentication of the mobile host or station, with which the data network is accessed because the operation this station only by one in the other system Authenticable participants can be carried out.

The identification information is expediently stored in the Access point of the data network or another Setup of the data network from the available Standard character set generated randomly. But it is also possible the selection of identification information from a list with an large variety of passwords, so that to simplify the Transfer words of the usual vocabulary of users can be used.

The transfer of the identification information to the establishment of the Systems with authentication can be particularly easily through Use of the short message service (SMS: Short Message System). This procedure is with the current and future cellular Telecommunications systems with a very wide spread in the relevant user groups for data network access easy to implement. Under the transmission of the identification information without direct use of authentication functions in the data network external system is therefore preferred understood that the operator of this foreign network only a data transfer comparable to a normal one Allow phone call or short message delivery got to.

The transmission of the Identification information without direct use of the actual authentication functions in the data network external system. 9 Direct communication with an or several of the facilities and functions of the external Systems is not required.

It is particularly advantageous to use the identification information a mobile station and / or a SIM card of a cellular To transmit mobile radio system.

After the authentication of the participant or the on the A station accessing the data network can have one in the data network itself Collection of data relevant to billing when the Station over the data network to a particular service or be made over a certain period of time. This can expediently be detected fee-relevant data according to a procedure with independent inventive design to a separate Fee center or a fee center of the system external to the network.

Such methods are particularly local Data network or radio-based local data network can be carried out, if this next to an interface for access through a station on the subscriber side, one Access control device with expediently one Authentication memory and a first interface for additional access from the data network to an external network a special access control device for generating a Identification information and sending this identification information on the external network is equipped. About a second Network device interface can the identification information from external network to the station connected to the data network are transmitted, thereby simultaneously authenticating the Station is made possible by the access control device.

To carry out such a method in such a way equipped data network are particularly modems or Network access devices that have appropriate Interfaces to the data network, e.g. B. an Ethernet Connection, and to the external network, e.g. B. a telephone line as well as appropriate hardware and software to perform have a corresponding authentication.

Such a point expediently Access control device all for authentication necessary facilities and functions as well as a Interface module, wherein the interface module as modular device for connection to at least one third party Communication system or communication network with secure Authentication is designed so that through an exchange an adaptation of the interface module various external networks without large structural Effort is possible.

In the other, external communication system or Communication network with authentication function are low or no changes required. Because of the Authentication on a local radio data network Accessing subscriber station this only for transport authentication-relevant information is used regarding subscriber authentication in this external No additional effort to the network. The transfer of Billing information from one Access control device of a local radio data network another, external communication system takes place sensibly in the format and via the interfaces, the information relevant for the transfer of fees are common within this network or to this network.

Can be adapted to a wide variety of payment systems either in the external network or in the local radio-based Data network.

The implementation of this procedure or the introduction Appropriate technical equipment is minimal Effort. In particular, even the smallest local Data networks or local radio data networks are included, so that the sum of many small and very small installations Train the entire network to which potential radio data network Customers can access. In such scenarios there is none Main operator required of a large financial Takes risk, and the investment of each Access providers, for example hairdressing salons, restaurants, Airport operators are easy to implement low. In particular, this also enables mobile operators access to such markets, with the Mobile operators themselves have corresponding data network access can provide or third party data network access for can make use of.

Essentially, the installation is simple commercially available bulk goods used by the Holders of portable computers and the like with small Costs can be purchased. Because of the low required additional functions and additional equipment the data network access points are also those Installation costs on the part of the data network operator low and with less than 500 euros plus monthly internet Access fees portable. Even if there is no charge is carried out, the use of such a system Appropriate look at the possible customer loyalty.

Billing procedures are particularly good on various Systems divisible when in a first, inexpensive available charging facility Basic charging information collected and sent to a second cost-intensive but can be operated centrally Fee facility are transmitted, which from the Basic information on charges to be charged certainly.

Areas of application are due to the use of the unlicensed radio band private land, shops and Divisions.

While with known systems prior registration and in the case of charges, the involvement of Charging companies or instances were required can authentications and thus carried out clear participant identification if the data network is on another system or network can access with the appropriate information. In particular, this can also be the authorship of content checked in the network.

There is access to cellular telecommunications networks particularly advantageous because the mobile operator over the currently have the largest number of participants worldwide currently the most accepted form of the world Apply subscriber authentication and with their Payment platform via a simple collection system for Third parties.

Another advantageous feature is that although the mobile operator itself is the responsibility of Access authentication of subscribers and subscriber devices completely transferred to a third service provider, he also with z. B. modems or Network access devices provide exactly the mechanisms it can be the easiest way for this service provider enable this authentication to be secure and reliable perform.

On the hardware side, the corresponding facilities in the form of a Providing modems is particularly advantageous since one Participant only has to make simple connections and set up like a common modem for Access to telecommunications networks easily and without large can install technical effort yourself.

Particular advantages are therefore that two different networks complement each other in the one high bit rate data network indirectly on functions of a low bit rate telecommunications network with Authentication functions can access. A data network radio data network in particular can thus autonomously Authenticate a subscriber station and connected to a wide variety of networks. The connection to external networks can be done in such a way that from the point of view of the external network, a network-internal station accesses or a third party to one for this provided standard interface accesses.

Mobile operators can use third-party data network providers Offer connection to your payment system and so with access to your mobile customers with minimal effort offer on local data networks without being forced to set up access points for data networks themselves.

In this context, the connection of Access control devices of local radio data networks so-called fee and payment systems are an advantage. These systems can be found in telecommunications, but above all in cellular mobile radio networks when one Billing information from non-network service providers to be transmitted. So it is z. B. possible the acquisition of Selling articles over the cellular network. In one In case the seller of articles uses the participation of the customer at a mobile operator, so the buyer well, instead of e.g. B. a credit card, via his Mobile operator can bill. So the seller uses the collection functions, the mobile operators third Provide service providers. Here is the Seller to the mobile operator in the obligation to ensure that only billing information from fully authenticated participants. The same can be done for. B. are regulated in a contract that the claimant (seller) of Billing services of a mobile operator in principle for the amounts of money used liable. About this well-known in other areas Procedures used in commercial payment systems find, e.g. B. the Siemens Pay @ Once System, it is one Mobile operators possible, but not chargeable services only to offer itself, but to its mobile customers additional services from third parties, not the mobile operator associated companies (untrusted partners) to let.

There is a significant advantage of the described method in that the paid access to a local Radio network can be offered by third parties whose Billing takes place via the mobile network without the Mobile operators themselves for the radio-based local Devices such as base stations require radio network access must provide.

A mobile operator can therefore give his customer there himself provide access to data networks where this service is already being offered by another, third party. the He can provide the necessary facilities and third parties Selling or giving functions.

Third party operators, e.g. B. Content providers can be motivated access to local data networks themselves offer because these third operators the possibility of Authentication and collection of a mobile network easy to use.

For the authentication of the data network operator a third party as a charging center or the like expediently an independent authentication be used.

An embodiment is shown below with reference to the drawing explained in more detail. Show it:

. Figure 1 illustrates schematically components of a data network with access capability to a foreign, authentication-capable communication system;

Fig. 2 schematically shows the flow of an authentication procedure in such a system;

Fig. 3 is a flow chart for such a method;

Fig. 4 shows an arrangement for charging and

Fig. 5 shows a modular radio access point.

As can be seen from FIG. 1, an exemplary local data network, in the preferred exemplary embodiment local wireless data network WLAN (Wireless Local Area Network), consists of a large number of devices which are connected to one another by corresponding lines. Facilities include routers and bridges to distribute data across a variety of network devices. Although such local data networks WLAN can also be operated without a controlling network device if the connected stations, in particular hosts, computers and the like, have an appropriate functionality for access control, in the preferred exemplary embodiment, however, the local data network has temporary addresses in accordance with the Internet protocol IP a so-called DHCP server. This can be connected directly to a network line or an access router AR (Access Router) or can be part of such. Furthermore, the local data network has access points AP (Access Points) for the access of radio-based stations to the local data network. Such radio-supported stations can be computers, notebooks and the like which are equipped with a radio interface, for example a so-called NIC (Network Internet Card), that is to say a network access card. The communication thus takes place from the station via its network access card NIC and the radio interface V1 to one of the access points AP to the local radio-supported data network WLAN.

As a further structural unit, the radio-based local Data network WLAN a network interface NI (Network Interface) on having access to a communication network Internet access enabled. The network interface can connected in an advantageous manner to the access router AR or also be integrated into this. But is possible also an integration in any other at the local Wireless data network WLAN connected computer or like.

In the loose coupling procedure described below the local radio data network WLAN to a mobile network, in illustrated embodiment, a cellular network according to the Standard GSM, is based on additional facilities and functions accessed. The authentication and the Billing both from one another and from a direct one Communication with the foreign network or GSM system decoupled. In the below the pictorial network representation sketched symbol representation is the corresponding Architecture of a preferred local radio data network system shown, which by the decoupling of Authentication and charging to a wide variety of networks can be coupled. Examples are next to Access to the GSM Access to PLMN HLR / HSS (Public Land Mobile network; HLR: Home Location Register (home Place Register) / Home Subscriber System), electronic Trading systems (eCommerce), ISP AAA (Internet Service Provider Authentication Authorization Accounting), intelligent micro payment network systems (IN Micropayment Systems) etc.

The connection of these different systems or networks to the Data network WLAN takes place via a network interface has the corresponding interface module. The remaining schematically illustrated blocks can for the various third-party networks or third-party systems unchanged be used. The generic building blocks exist from a subscriber station or subscriber application, e.g. B. a notebook with a radio network card and one Internet browser, a radio access device, e.g. B. one Radio access point according to the IEEE 802.11b standard, which is connected to a local data network LAN, one Access control device or access control function, which recognizes whether a participant is already authenticated or not and which authentication if necessary enforces, and an authentication function or Authentication device, which the authentication performs. Furthermore, a charging function or a Fee system, which fee information based on the time used for the service, based on the amount of data transferred or based on the type of data used Service subscriber-related fee records created, be provided, such functions and systems however, can also be included in the network interface.

The generic blocks and functions can both in terms of their logical functions as well as in terms of their physical entities can be used unchanged. The term generic is therefore particularly one To understand the facility regarding its physical Design and its logical function used unchanged can be connected to the this generic device is connected. The single ones Facilities and functions can be considered as different from each other separate facilities or functions provided can be part of other network devices or also in a subsequent service selection gateway SSG (Service Selection Gateway) designated facility be summarized. The authentication function is supposed to embodiment described below by a Network server or web server are provided.

The process sequence for network access by a station WH and the corresponding authentication of this station or of the user assigned to it is also described with reference to FIGS. 2 and 3. In a first step S1, the station WH on the subscriber side has radio access via the radio interface V1 to the access point AP of the local radio data network WLAN, which is installed, for example, at an airport. After the assignment of an IP address (IP: Internet Protocol) to be used for station WH by the DHCP server according to standardized functions for local data networks, authentication is initiated when the IP address or is used for the first time the network access card's own, globally unique MAC address (MAC: Medium Access Control) to a service, e.g. B. Internet access is accessed.

The access control function or access control device has a memory in which a list is kept, which IP addresses WH-IP or MAC addresses WH-MAC already as authenticated participants or authenticated Subscriber stations are listed (step S2).

If it is determined in a step S3 that the Checked IP address WH-IP or MAC address WH-MAC for one already authenticated subscriber or subscriber terminal include access to the services you want offered with the help of or from the local data network be released. Otherwise, e.g. B. access to toll-free, local services, e.g. B. Departure tables on Airport, restricted, or any data access prevented, or re-authentication stimulated become.

For all unauthenticated IP or MAC addresses, from the service selection gateway SSG or the one located therein Access control device instead of the desired one Website imported a portal page, which the Requests participants or operators of the WH station, unique identifiers, e.g. B. Participant name and Password to enter. These parameters become one Authentication used. If this is successful, then the access control function instructed the subscriber unlock, d. H. him access to the one you want Allow website so that this one free Has access to the desired service or the Internet.

When sending the portal page in a step S4 in addition to or instead of the clear Identification features in particular also one Access number for a telephone, in particular cellular telephone of the participant. After entering the Access number or telephone number (mobile number) for one Step S5 by the participant or operator of the station WH the identification number or telephone number is sent via the Access point AP to the service selection gateway SSG in one Step S6 sent.

In a subsequent step S7, the service selection Gateway in the event that with the information none Authentication is possible, but such Phone number is given, a password. The password will as identification information about the corresponding to the Communication network assigned to the telephone number appropriate phone transmitted. Instead of a phone other suitable data terminals can also be used such as fax machines. It is essential that the Identification information via a telecommunications network, data network or system is transmitted, which is a unique and allows reliable participant assignment, for which the specified phone number clearly as a specific person Associated with or assigned as a specific data terminal is. Only this person can and can receive the identification information become.

In the illustrated embodiment, the Identification information at a step S8b Telecommunications network as a short message SMS (Short Message Service) to a mobile station, especially a Cellular phone of the GSM network with the assigned mobile call No. MSISDN transmitted. In parallel, from Service selection gateway SSG in a step S8a Password request sent to station WH as portal page.

In a next step S9, the subscriber reads from his Cellular telephone the identification information and gives it in his station WH a. After confirmation is in a Step S10 the identification information or this password from the Station WH via the access point AP to the service selection Gateway SSG sent.

In the next step S11 is in the service selection gateway SSG checks whether the identification information or the password is included the password originally generated and sent matches or in a permissible form by, for example Encryption was changed. If no, one will Error message in step S12 output to station WH and the process ends or a new request from Authentication information initiated at step S4.

If the identification information is OK in step S11, the station WH is released for the step S13 desired or permitted access to special services and / or the internet. A limitation of Connection duration can be provided.

Optionally, a detection of Charging information is initiated in a step S14 become. Such billing information is in one Step S15 to a corresponding billing service z. B. a third party or the operator of the for the Authentication used network or system transmitted (Step S15).

When selecting the password or the identification information can a random procedure can be used, but is also possible the use of a large variety of memory Terms from which randomly each one Term selected and via the authentication network or system is transferred.

Alternatively or additionally, passwords can be preset be, e.g. B. for airport staff at the airport, which of Authentication participants either directly can be entered, or to give them e.g. B. in the case of Forgetting to be able to be sent again via SMS.

Briefly summarized, the participant or operator gives one station WH to be connected to the local radio data network WLAN instead of a password his mobile number (MSISDN) in the portal page on, the authentication function generates a Password and sends this as identification information via Short message service SMS to a mobile radio terminal (GSM Terminal). The participant transmits the received password to the station and can therefore Authentication function in the service selection gateway SSG be clearly authenticated.

In this way, the operator of the data network although only a phone number as unique Allocation to the participant, however, is at Need, e.g. B. incorrectly specified by the station user personal address data, via a corresponding later Access to the databases of the telecommunications system further assignment to the participant is possible. This will ultimately take the participant to the present day most reliable and trustworthy way at the same time compared to the authentication function of the local radio Authenticated data network. It is also possible to Interim billing information Fee service, a corresponding Billing organization or the operator of the Cellular network to the subscriber put. In particular, only a relationship of trust needs between the authentication server and the Telecommunications network, which for authentication was interposed, but not between the participants and the operator of the data network.

As a fee organization or fee service can a so-called wallet server can also be interposed, which acts like a collection agency. The usage the mobile radio system is just a means for Purpose of authentication and is not meant to be any other Exclude network connection.

The authentication and access control functions can be physically in an entity, e.g. B. a calculator, can be accommodated, but can also be separated in one central and / or several satellite devices be provided. This is shown in the figure by the Distribution in a WEB server i-noc to carry out the Authentication and an access device i-sat with the Access control device shown. The Radio access device and the access control device among other things, collect information for charges.

If the authentication function in a separate Setup i-noc is set up, such Authentication device i-noc also multiple access Supply i-sat control devices. Then in particular it is advantageous, the authentication device i-noc on one Location near or at an external network with more reliable independent authentication function or at the operator a charging system, e.g. B. at the operator of a Mobile network GSM or a broker to install. This enables the provision of an elaborate Authentication device i-noc at a central point and connecting a variety of simple and inexpensive access control devices i-sat individual local area networks WLAN or access points AP. For the connection between separate access Control devices i-sat and one Authentication device i-noc expediently becomes a secure IP-based connection according to e.g. B. RADIUS or HTTP-S (Hypertext Transmission Protocol-Secure).

In addition to the transmission of billing information to a so-called wallet server, the billing information can also be transmitted directly to the operator of, for example, a mobile radio network used for authentication, wherein existing billing or payment platforms can be used there. The latter exist, for example, as intelligent network functions for so-called micropayment solutions. Such charging is described below with reference to FIG. 4.

Current mobile networks have one intelligent network (IN), with the help of which they so-called Auxiliary or supplementary services for your Mobile customers can offer such. B. Call forwarding on a voicebox. These systems usually consist of a service switching point SSP (Service Switching Point) and a service control point (SCP). The former recognizes, for example, from the dialed number, that an IN service is desired, the latter recognizes the desired service, enables deployment and Billing of the same. Service control points are in the SCP Usually implemented on server platforms.

Mobile operators can now access this in third parties usually give very complex system if third party own Offer services and the payment system of the Want to use the mobile operator as a kind of collection system, where the term micropayment comes from. For this the Connection to a payment platform or a payment server provided, the interface on a simple usually based on IP protocol, rather than complex To use protocols according to, for example, CCS7 or INAP. In such a system, however, the exact same thing occurs Trust problem on, as in the prior art. If the seller of services or data network access such a charging system connects and at the same time one Is a 100% subsidiary of the mobile operator, so can Fee requests accepted by the seller become. The seller then receives one in the payment server so-called account. However, it is not one trustworthy seller, e.g. B. an unknown Data network operator, usually becomes a wallet server interposed. This can now do additional billing to banks or trusted sellers directly to that Payment system or fee system of the Transmit operator.

To make this possible, the WEB server is used in the above Embodiment by a corresponding extended Network interface added. This allows Fee information in corresponding messages of the Cellular debt collection system can be transmitted incorporated.

In order to be able to determine the end of the charge, for example a connection to IN services, for example a weather service, which a Enable time monitoring.

Using the procedure described above and Devices can be a radio-based local data network autonomous authentication of connected stations or perform assigned participants, where Authentication information from various networks and systems with correspondingly secure Authentication options can be used. On Mobile operators can offer third-party providers of local data networks connect his fee or payment system and so access to its own mobile phone customers with minimal effort offer on local data networks without being forced to provide access points and data networks themselves. Furthermore, a mobile operator can contact its customers Provide access to local data networks where this service is already offered by another third party by giving it the necessary facilities and Software functions sold or donated. Can continue third operator, e.g. B. motivates so-called content providers access to radio-based local ones Offer data networks, as this offers the possibility of Authentication and thus the collection of a mobile network can take advantage of.

As seen from Fig. 5, is a particularly preferred radio access point of a modular device. A radio part is used to connect external radio-based stations to a local radio data network according to e.g. B. the Ethernet standard. A modem part is also connected to the Ethernet line. The modem part has the devices and functions of the service selection gateway, ie the access control device and function, a connection or connection section and modularly interchangeable interface devices for connection to an external communication system or network. Such a modular device hides the service functionality, looks like a modem and offers, depending on the construction, connection options to a variety of different communication systems and networks, such as. B. ISDN or DSL. The latter connection options serve for the authentication described above, but also for providing Internet access or other physical connections between the different types of systems. A wide variety of network types can thus be connected to the external interface, with access for sending short messages SMS to a mobile radio device of the GSM network, e.g. B. can take place over a 2 Mbit line of an intermediate so-called IP backbone.

Claims (21)

1. Method for authenticated access by a station (WH) compatible with a data network (WLAN), in which
the station accesses an access point (AP) for such a data network (WLAN) (S1),
the station (WH) transmits identification information (mobile call number) to the access point (AP) (S4),
Identification information (password) is provided on the access point side or on the network side and is transmitted via an interface (SSG, AR, NI) to an authenticated device (MS) of a non-access point system or network (GSM) with an authentication function (S7, S8b), the identification information (mobile number) is directly assigned to the device (MS) authenticated in the external system or network (GSM) and in particular access to data from the authenticated device (MS) at the location of the station (WH) or the access point ( AP) is available,
the identification information (password) sent to the authenticated device (MS) is transmitted to the station (WH),
the station (WH) transmits the identification information to the access point (AP),
an access point-side or network-side instance (SSG) which compares the transmitted with the transmitted identification information (password) and,
if the comparison is positive, the station's (WH) access to certain or all access point-side or network-side services and functions is enabled. 2. The method according to claim 1, wherein the identification information (password) in or another Access point-side or network-side instance (SSG) randomly generated or randomly from a list with one A large number of predetermined passwords is selected. 3. The method according to claim 1 or 2, wherein the transmission of the identification information (password) by means of a Short message service (SMS) is carried out. 4. The method according to any preceding claim, in which the transmission of the identification information (password) by a indirect use of authentication functions (AAA) in the system or network external to the access point or data network (GSM) performed with the authenticated device (MS) becomes. 5. The method according to any preceding claim, in which as the authenticated device (MS) of the access point or data network external system or network one Mobile radio station (MS) or a Subscriber identification card (SIM) of a cellular Mobile radio system (GSM) is used. 6. Fee procedure, especially after a previous claim, in which after authentication of a to a data network (WLAN) compatible station (WH) based on a data network typical Access point (AP) accesses, on the access point side or in an access point-side data network (WLAN) through the or an independent entity (SSG; i-sat) charge-relevant data when accessing the station (WH) on the access point (AP), on the data network (WLAN) and / or certain services accessible via it are recorded. 7. The charging method according to claim 6, in which in a first charging facility (i-sat) Basic charging information recorded and sent to a second Billing facility (i-noc) are transmitted, which to be offset from the basic fee information Fees determined. 8. charging method according to claim 6 or 7, in which the billing-relevant data to an external Third party billing authority or a Charging facility (AAA) one for authentication intermediate access point external or data network external system or network (GSM) are forwarded, either the third party or the charging facility are not involved in the authentication or the Authentication independent of the charging procedure between station (WH) and access point (AP) or one Access point-side instance (SSG) is performed. 9. charging method according to claim 6, 7 or 8, in which Fee information of a fee-relevant Connection as charging access to an IN-based Payment (payment) system. 10. Data network or radio-supported data network (WLAN) with
at least one interface-like access point (AP) for access to the data network by subscriber-side data network-compatible stations (WH),
an access control device (SSG) with an authentication memory in which authorized stations (WH) are registered,
a first external network interface (NI) for access by the data network (WLAN) to an external, data network-incompatible system or network (GSM),
marked by
the access control device (SSG), which is set up to generate identification information and transmit it via the external system or network (GSM), and
a transmission device for transmitting the identification information (password) transmitted via the external network or system to an authenticated device (MS) of this external network or system to the station (WH) and via this to authenticate the station (WH) to the access control device ( SSG). 11. Modem or access point (AP), in particular an access point (AP) according to a preceding claim for access by subscriber-side data network-compatible stations (WH) to a data network (WLAN) with
a typical data network interface (ACMI, Ethernet),
at least one further interface (ExtI) for access to a data network external network or system (GSM) and
an access control device (ACM; SSG) for independently checking the authentication status of the station (WH) and, in the case of insufficient authentication, for initiating authentication of the station (WH). 12. Modem or access point (AP) according to claim 11 with modular structure, in which the access control device when insufficient Authentication to either connect a separate authentication device or independent authentication training is. 13. Modem or access point (AP) according to claim 11 or 12, with a modular structure, in which the typical data network interface (ACMI, AP; Ethernet) either to connect a data network (WLAN) with one of the Stations or for the direct connection of one of the stations (WH) is trained. 14. Modem or access point (AP) according to claim 11, 12 or 13 with a modular structure, in which the at least one other interface (ExtI) as retrofittable or interchangeable module is formed that to a specific data network external network or system (GSM) is adjusted. 15. Modem or access point (AP) according to any one of claims 11-14, wherein the access control device
to generate identification information after receipt of identification information (mobile number, MSISDN) via the interface from the data network and
to send the identification information (password) via the interface to the external network or system (GSM) and
for later receipt of the identification information (password) transmitted via the external network or system via the local data network (WLAN) and
is designed to compare the transmitted and received identification information (password) for deciding whether to allow access to the data network (WLAN). 16. Data network or radio data network (WLAN) according to claim 11 or modem or network access device (AP) according to one of the Claims 12-15, wherein the access control device (SSG) all for the Authentication required facilities and functions and an interface module (ExtI), the Interface module as a modular device for connection to at least one non-data network communication system or Network (GSM) is designed with secure authentication. 17. Authentication and / or charging system for a data network (WLAN), in particular in connection with a method, system or device according to one of the preceding claims, in which
a data network compatible station (WH) accesses the data network (WLAN),
On the data network side, an authentication of the station (WH) is checked and initiated autonomously in such a way that a direct or indirect assignment to an authenticated device (MS) or an authenticated subscriber of a system or network external to the data network (GSM) is made possible. 18. Authentication and / or charging system for a data network (WLAN), in particular in connection with a method, system or device according to one of the preceding claims, in which
a data network compatible station (WH) accesses the data network (WLAN),
identification information (password) is sent from the data network via a system or network (GSM) external to a data network to an authenticated station (MS) of the external system or network (GSM) outside the network,
the identification information is transmitted from the authenticated station (MS) to the station (WH) and from there to the data network (WH) and
a comparison of the sent and received identification information is carried out in the data network for indirect authentication. 19. charging and authentication system according to claim 17 or 18 for a data network in which
a first authentication of the system (WLAN, SSG), in which charges are incurred, with regard to the authenticity of a data network-compatible station (WH) accessing the data network (WLAN) and
a second authentication with respect to the authenticity of the system in which charges are incurred is initiated with respect to a further system (GSM) receiving charging data. 20. Fee system for a data network (WLAN) in Connection to a method, system or device according to any preceding claim, in which from the data network (WLAN) billing information to a Accessing station (WH) for charging to a data network third-party facility to be sent, with a charge regardless of the authentication of the station (WH) is carried out. 21. charging system for a data network (WLAN) or for an access point (AP) for a data network-compatible station (WH), in particular in connection with a method, system or device according to any preceding claim, in which
a service provider offers access to a data network compatible station (WH) and
independently stimulates or carries out authentication of the accessing data network-compatible station (WH) and
Billing data transmitted to a billing facility of a third-party system or to a billing organization.