WO2002046983A1

WO2002046983A1 - A method for arranging accounting and a communication system

Info

Publication number: WO2002046983A1
Application number: PCT/FI2001/001066
Authority: WO
Inventors: Kimmo Lahdensivu; Olli Jussila
Original assignee: Sonera Oyj
Priority date: 2000-12-08
Filing date: 2001-12-07
Publication date: 2002-06-13
Also published as: FI20002694A; AU2002217172A1; FI20002694A0

Abstract

The invention relates to a method for arranging debiting in a communication system (1) comprising at least one communication network (9), at least one optional communicant network (4), at least one terminal server (3), and at least one database server (6). The database server (6) communicates with at least one authentication database (11) containing information for user authentication. In the method, a data processing device (2) is connected via the optional communication network (4) to the terminal server (3) of the communication system (1), and the user is authenticated from the authentication database (11). If the user is authenticated, at least one data transmission connection is set up for data transmission between the data processing device (2) and the communication network (9); at least one property is determined for the data transmission connection, and the data transmission connection is monitored to determine the value of at least one debiting parameter. In the method, the data transmission between the terminal server (3) and the database server (6) is examined to determine the moments of setting up and termination of the connection, and the value of said at least one debiting parameter is determined substantially at the moments of setting up and termination of the connection. Thus, the debiting is executed on the basis of the value of said at least one debiting parameter at the moments of setting up and termination of the connection.

Description

A method for arranging accounting and a communication system.

The present invention relates to a method for arranging debiting as presented in the preamble of the appended claim 1. The invention also 5 relates to a communication system according to the preamble of the appended claim 10.

Data processing devices can be used to set up a data transmission connection, for example via an optional communication network to 0 serving devices (servers) of various service providers. The data processing devices are thus equipped with means for logging in a communication network, such as a modem or the like. The user can, for example, browse the home pages of the service provider in the Internet, subscribe goods electronically, pay bills, etc. In addition, the 5 optional communication network can be used for setting up a remote connection to the data network of a firm. The data network can be formed, for example, as a so-called virtual private network (VPN) utilizing a public data network, such as the Internet data network. Thus, the offices of the firm are connected to each other by means of a public 0 communication network, and logging in the network is prevented from other persons than employees of the firm.

For the data transmission connection, it is possible to determine various service levels and quality classes, for example, on the basis of the 5 data transmission capacity and/or data transmission rate required for the connection. The use of different services as well as different quality classes or service levels is typically priced so that the higher the quality of service (QoS) level and/or the data transmission rate used in the connection, the more expensive it is to use the connection. However, in 0 all services, the debiting of the use of the services is not necessarily based on the connection time but on the quantity of information transmitted during the connection at each QoS level and for each sen/ice. Thus, the solutions of prior art involve the problem how to record the debiting correctly, i.e. according to the real use of services by the user.

35 In solutions of prior art, this debiting is normally based on such a method in which the device providing a service applies a counter, for example, for each service user and/or QoS level. The values of these counters are read at intervals. For example, a debiting server makes an inquiry of the values of the counters at the device providing the service, about all QoS levels, rules and other configuration units at predetermined intervals. This data is combined with the log data of the terminal server, through which the user is connected to the data system and for which the user is allocated a separate address for the time of the connection. The debiting of the total communication is performed, for example, by using information provided directly by the authentication/debiting protocol used in the connection.

The address identifies the user in the data network of the data processing device, wherein this address can be used to direct packets intended for the user to the correct data processing device. The address is, for example, a so-called IP address, which can be a static address allocated for a specific user, or it can be a dynamic address, wherein a connection-specific address is allocated for each connection, for example, in the address space of the Internet operator. The IP address can be presented in so-called dot notation format, wherein the address comprises four decimal numbers separated from each other by dots. Such an address can be exemplified with 123.255.1.198. The data network is normally also provided with a name server for storing the above-mentioned address as well as the identifying name corresponding to the address, such as www.company.fi.

Such solutions of prior art involve, for example, the problem that it is not possible to determine precisely the quantity of data transferred by the user during the connection, because it is very unlikely that the login and logout of the user would occur precisely at the sampling. Thus, a requirement for an increase in the accuracy in solutions of prior art is that the values of the counters are read so often that it is possible to achieve the desired accuracy. However, this will significantly increase the traffic between the device providing the service and the debiting server, and the debiting data may still be different from the actual situation.

It is an aim of the present invention to provide an improved debiting method and a communication system, in which the debiting data corresponds to the real situation as accurately as possible. The invention is based on the idea that the communication system is provided with a management server, through which the connections are set up and the debiting data are collected. More precisely, the method according to the present invention is primarily characterized in what will be presented in the characterizing part of the appended claim 1. The communication system according to the present invention is primarily characterized in what will be presented in the characterizing part of the appended claim 10.

Considerable advantages are achieved by the present invention when compared to methods and systems of prior art. In the method according to the invention, it is possible to detect the moments of setting up and termination of the connection in a management server which studies the values of the counters formed for the connection at the beginning of the connection and after its completion, to obtain a value describing the real situation as precisely as possible. Thus, the debiting can be allocated better according to the actual use. This will also facilitate the pricing of various services, because the actual use and the respective costs can be recorded more accurately than in systems of prior art. Furthermore, in the communication system according to the invention, the data of the counters do not need to be read as often as in systems of prior art, wherein the need for data transmission is reduced.

In the following, the invention will be described in more detail with reference to the appended drawings, in which

Fig. 1 shows a communication system according to a preferred embodiment of the invention in a reduced chart, and

Figs. 2a to 2d show the operation of the invention in the system of Fig. 1.

Figure 1 shows a communication system 1 according to an advantageous embodiment of the invention, in which the user sets up a dynamic data transmission connection from a data processing device 2 to a terminal server 3. The data processing device 2 is, for example, a personal computer (PC) comprising a modem or the like for logging in an optional communication network 4. The data processing device can also be a wireless communication device with data processing facili- ties. On the other hand, the modem used can be a radio card or a corresponding wireless modem. The communication network 4 can be either a public switched telephone network (PSTN) or a wireless communication network. The communication network 4 forms a communication channel (tunnel) between the data processing device 2 and the terminal server 3. For example, in the case of a wireless communication network, such as the GPRS (General Packet Radio Service), this communication channel is called the GPRS Tunneling Protocol (GTP). This step of setting up a connection is illustrated by arrow A1 in Fig. 2a. The terminal server 3 is, for example, a server device of an operator providing Internet services. The user has thus made a contract with the operator, wherein the user has been allocated a user identification and possibly a static address, in addition to which the user will need a password to set up a connection. It is obvious that, instead of a static address, it is possible to use a dynamic address, wherein the terminal server 3 allocates, at the beginning of each connection, an address for the user's data processing device 3 from a specific set of addresses. This address will be used in the data transmission between the data processing device 2 and the communication network 4 in a way known as such.

The terminal server 3 is arranged to communicate e.g. with the management server 5. Thus, at the moment of setting up a connection, the user identification and password are transmitted to the terminal server 3 to authenticate the user and to prevent misuse. After this, the terminal server 3 retrieves the identification data through the management server 5. The terminal server 3 preferably transmits a connection set-up message complying with an authentication protocol, such as Radius, to the management server 5. This is indicated by arrow A2 in Fig. 2b. In the connection set-up message, the user identification and the password are preferably transmitted in a format encrypted with an encryption key. The management server 5 communicates with a database server 6 which comprises an authentication database 11. The management server 5 transmits messages received from the terminal server 3 further to the database server 6 (arrow A3 in Fig. 2b). Thus, the database server 6 retrieves the identification data from the authentication database 11 on the basis of the user identification and the password (arrow A4 in Fig. 2b). The authentication database 11 contains authentication data about registered users, for example, to allow the use of the services to registered users only. After the user has been authenticated and the permission for the user to use the desired services has been verified (arrows A5, A6, A7 in Fig. 2b), the manage- ment server 5 starts to configure the connection with a serving device 7, 8. The purpose of this is to set up a data transmission connection for the use of the service between the terminal 3 and one or several serving devices 7, 8.

The management server 5 and the terminal server 3 communicate, for example, according to said Radius protocol, which is intended particularly for authentication and debiting applications. Preferably, this Radius protocol is also used by the management server 5 and the authentication database server 6 in their communication. The man- agement server 5 supervises the messages of the Radius protocol to find out which measures should be taken, primarily in relation to debiting. When the management server 5 detects that it receives a message relating to the setting up or termination of a connection, the management server 5 will take measures relating to debiting, such as inquire and/or set the value of the counters in the serving devices 7, 8. At the stage of setting up a connection, an authentication message is used, wherein the management server 5 detects this authentication message and, for example, the user identification and password included therein as parameters. Thus, the management server starts one or more counters (not shown) for the user, according to the services, QoS levels etc. set for the connection. \n practice, the management server 5 is used, for example, as a proxy between the terminal server 3 and the authentication database server 6 and as an initiator of measures relating to transactions to be debited.

After the user has been authenticated and it has been verified that the user is authorized to use one or more services requested, the configuration of the services is started. The configuration of the services between the management server 5 and the serving device 7, 8 is executed, for example, by the Simple Network Management Protocol (SNMP). In the configuration, the serving device 7 determines the class of service (CoS) set by the user or selected for the connection (arrows A8 and A9 in Fig. 2c) as well as a virtual connection to the virtual private network 12 of the firm, preferably via the terminal server 8 of the virtual private network (arrows A10 and A11 in Fig. 2c), if the user is logging in said virtual private network (VPN). After this, the user can use the virtual private network 12 of the firm in the same way as when using a work station in the office (arrows A12 and A13 in Fig. 2d). In practice, such a virtual connection may contain several nodes (not shown), via which information is transmitted between the virtual private network 12 of the firm and the user's data processing device 2.

The service to be provided for the connection can be divided into classes of service e.g. on the basis of the rate at which information is transmitted and the error rate guaranteed in the data transmission. The QoS classes which can be allocated for each user depend, for exam- pie, on the contract between the operator and the user. Furthermore, the QoS classes may be affected by the properties of the operator's own network and the way of routing the connection each time. However, in the routing of the connection, the aim is to take into account the QoS level requested for the connection at the stage of setting up the connection.

In this advantageous embodiment of the invention, the management server 5 is also used as a management station for connections. In the configuration of connections, the management server 5 uses manage- ment agents formed in connection with a device, such as a serving device 7, 8, a bridge, a router, etc., connected to the communication network 9. The management server 5 is also provided with a management database for maintaining information relating to the management of connections which are active at each time, such as user identifica- tions, data about the QoS levels, rules, or the like. The management server can communicate with the serving devices 7, 8 via said management agents. The management server s can request for status information about connections active in the serving device 7, 8, such as counter data, from the management agent. The counters can be used to maintain information, for example, about the quantity of packets transmitted in the connection and the payload information transmitted in them. When configuring the connection, the management server 5 transmits to the management agent of the serving device 7, 8 one or more configuration messages, in which a value of a resource of the management agent can be set to a desired value. The resource can be the data transmission rate corresponding to a specific QoS level requested for a service in the communication channel, the quantity of communication streams allocated for the connection, or the like. In a corresponding manner, when the connection is terminated, a configuration message is used to release resources allocated for the connection.

The user can use the data processing device 2, for example, to retrieve information from the communication network and to transmit information via the communication network, for example, to the virtual private network 8 of a firm. In the data processing device 2, the information to be transmitted is converted to a suitable format to be transferred in the communication system, and, in a corresponding manner when information is received from the communication system, the necessary conversions are made so that the information can be transferred to the use of an application, such as a browser program.

During the connection, the terminal server 3 monitors, preferably by means of its own management agent or in another way, the quantity of data to be transmitted between the user's data processing device 2 and the terminal server 3, by examining, for example, the quantity of infor- mation contained in the packets of the physical layer. For this purpose, the terminal server 3 can be provided with a management agent with a counter for each data transmission direction, or one counter which counts the quantity of data being transferred in both directions. If a separate counter is arranged for each data transmission direction, it is possible to take into account the data transmission direction in the pricing. However, when a common counter is used, the pricing of the data being transferred is irrespective of the data transmission direction. The serving devices 7, 8 are used to monitor the quantity of data transferred via the serving devices 7, 8, such as the quantity of data transferred through connections complying with different QoS levels, the quantity of data transferred in the virtual private network, and the quantity of data transferred in other services possibly used during the connection. The values of the respective counters are increased on the basis of the data transferred.

When the connection is terminated, the management server 5 detects the termination of the connection on the basis of the message traffic, after which the management server 5 makes a counter inquiry of the management agents of the terminal server 3 and the serving devices 7, 8, or arranges, in another way, the collection of service-specific traffic data from the devices 3, 7, 8 implementing the service (VPN, CoS, etc.). The terminal server 3 defines, for example, how much information has been transmitted between the system and the user's data processing device 2, and preferably transmits a Radius message to the management server 5. The message preferably contains the value of the counter which indicates the quantity of data transferred in the connection. As a response to the inquiry, the management agents of the serving devices 7, 8 transmit the current values of the counters monitoring each QoS level, respectively. These counters indicate how much certain services/QoS classes have been used in the connection. The terminal server 3 and the serving devices 7, 8 transmit the data from the counters to the management server 5 preferably as messages complying with the SNMP protocol, but it is obvious that other protocols can be used as well. On the basis of this information, the management server 5 forms a debiting transaction, separately for the use of the vir- tual private network tunnel and for each rule/QoS class. These transaction data are transmitted to the debiting system 13, from which the debiting can be performed. After the termination of the connection, the management server 5 deletes the data relating to the user's connection in the serving devices 7, 8 and resets the counters of the terminal server 3 relating to the connection. The present invention can be applied in dynamic data transmission connections, particularly in the debiting of such services, in which the debiting is based on the quantity of information to be transferred. In addition to the above-mentioned applications, some advantageous applications of the invention to be mentioned in this context include a firewall service and a web cache service intended to be used for browsing in the Internet.

It is obvious that the present invention is not limited solely to the above- presented embodiments, but it can be modified within the scope of the appended claims.

Claims

Claims:

1. A method for arranging debiting in a communication system (1) comprising at least one communication network (9), at least one termi- nal server (3) and at least one database server (6) which is in a data transmission connection with at least one authentication database (11) containing information for user authentication, in which method the user is authenticated in the authentication database (11), wherein if the user is authenticated, at least one dynamic data transmission connec- tion is set up for data transmission between a data processing device (2) and the communication network (9); at least one property is set up for the data transmission connection; and the data transmission connection is monitored for the determination of the value of at least one debiting parameter, characterized in that in the method, the data transmission between the terminal server (3) and the database server (6) is examined to determine the moments of setting up and termination of the connection, and the value of said at least one debiting parameter is determined substantially at the moments of setting up and termination of the connection, wherein the debiting is executed on the basis of the value of said at least one debiting parameter at the moments of setting up and termination of the connection.

2. The method according to claim 1 , characterized in that information is transmitted as messages between the terminal server (3) and the database server (6), the communication system (1) is provided with at least one management server (5) via which the data transmission between the terminal server (3) and the database server (6) is executed, wherein the moments of setting up and termination of the connection are determined in the management server (5) on the basis of the messages transmitted via the management server (5).

3. The method according to claim 1 or 2, characterized in that at least one property to be determined for the data transmission connection is a service to be debited according to the quantity of information to be transmitted, wherein at least one debiting parameter is determined on the basis of the quantity of information transmitted in the data transmission connection.

4. The method according to claim 3, characterized in that said service is a virtual private network.

5. The method according to claim 3, characterized in that said service is a firewall.

6. The method according to claim 3, characterized in that said service is a browsing cache.

7. The method according to claim 1, 2 or 3, characterized in that at least one property to be defined for the data transmission connection is the quality of service class.

8. The method according to claim 7, characterized in that in the method, at least two quality of service classes are determined, which have a different data transmission rate.

9. The method according to claim 7 or 8, characterized in that in the method, at least two quality of service classes are determined, which have a different error probability rate.

10. A communication system (1) comprising at least one communication network (9), at least one terminal server (3), and at least one data- base server (6) which is in a data transmission connection with at least one authentication database (11) containing information for user authentication; in which system a data processing device (2) is arranged to be connected to the terminal server (3) of the communication system (1); user authentication is arranged to be performed from the authentication database (11); wherein if the user has been authenticated, at least one data transmission connection is arranged to be set up for data transmission between the data processing device (2) and the communication network (9), for which data transmission connection at least one property is determined; and which system comprises means (3, 7, 8) for monitoring the data transmission connection to determine the value of at least one debiting parameter, characterized in that the system also comprises means (5) for examining the data transmission between the terminal server (3) and the database server (6) to determine the moments of setting up and termination of the connection; and means for determining the value of said at least one debiting parameter substantially at the moments of setting up and termina- tion of the connection; wherein the debiting is arranged to be executed on the basis of the value of said at least one debiting parameter at the moments of setting up and termination of the connection.

11. The system according to claim 10, characterized in that mes- sages are arranged to be used in the communication between the terminal server (3) and the database server (6); that the means (5) for examining the data transmission between the terminal server (3) and the database server (6) comprise at least one management server (5), through which the data transmission between the terminal server (3) and the database server (6) is arranged to be executed; wherein in the management server (5), the moments of setting up and termination of the connection are arranged to be determined on the basis of the messages transmitted via the management server (5).