Access network authorization

• US 6,697,806 B1
• Filed: 05/19/2000
• Issued: 02/24/2004
• Est. Priority Date: 04/24/2000
• Status: Expired due to Fees

• Current Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Cook, Fred S.
• Primary Examiner(s): Homere, Jean R.
• Assistant Examiner(s): Ali, Mohammad
• Application Number:
  US09/574,978
• Time in Patent Office: 1,376 Days
• Field of Search: 707/1-3, 707/9-10, 707/4, 707/104.1, 709/223-227, 709/219, 709/203
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

An access communication system provides access between a user system and a plurality of communication networks. The plurality of communication networks provide services to a user in the user system. An access communication system includes a local database system and an access server that is connected to the user system and the plurality of communication networks. The local database system receives a user logon. The local database system then processes the user logon to determine if the user is allowed access to the access communication system based on a local database system. The local database system then provides access to the access communication system to the user in response to the determination that the user is allowed access based on the local database system. The local database system then generates an authorization query for a second database system external to the local database system in response to the determination that the user is not allowed access based on the local database system. The local database system receives and processes an authorization response indicating whether the user is allowed to use the access system from the second database system. The local database system then provides access to the access communication system to the user in response to the authorization response that allows the user to use the access communication system.

Claims

1. A method of operating an access system including an access server to provide access between a user system and a plurality of communication networks that provide services to a user, the method comprising:

receiving a user logon into the access server;

processing the user logon to determine if the user is allowed access to the access system based on a local database system;

providing access to the access system to the user in response to the determination that the user is allowed access based on the local database system;

generating an authorization query for a second database system external to the local database system in response to the determination that the user is not allowed access based on the local database system;

in the second database system, receiving and processing the authorization query to determine whether the user is allowed access;

in the second database system, generating and transmitting an authorization response to the local database system;

receiving and processing the authorization response indicating whether the user is allowed to use the access system from the second database system; and

providing access to the access system to the user in response to the authorization response that allows the user to use the access system.

2. The method of claim 1 further comprising generating and transmitting a logon query.

3. The method of claim 1 wherein processing the user logon to determine if the user is allowed access to the access system based on a local database system is based on a user access profile.

4. The method of claim 1 further comprising determining if the second database system exists.

5. The method of claim 1 further comprising disconnecting a user'"'"'s network device from the access server in response to the determination that the user is not allowed to use the access system.

6. The method of claim 1 wherein the logon reply includes an access card account code.

7. The method of claim 1 wherein the logon reply includes foreign network account information and further comprising identifying the second external database based on the foreign network account information.

8. The method of claim 1 further comprising:

receiving a request for access into a service control point;

processing the request for access to determine the destination for the request;

generating and transmitting a reply to route the request to the access server.

9. The method of claim 1 further comprising logging contract and settlement information.

10. An access system for providing access between a user system and a plurality of communication networks that provide services to a user, the access system comprising:

an access server connected to the user system and the plurality of communication networks and configured to receive and transmit a user logon from the user system to a local database system;

the local database system connected to the access server and configured to receive the user logon, process the user logon to determine if the user is allowed access to the access system based on the local database system, provide access to the access system to the user in response to the determination that the user is allowed access based on the local database system, generate an authorization query for a second database system external to the local database system in response to the determination that the user is not allowed access based on the local database system, receive and process an authorization response indicating whether the user is allowed to use the access system from the second database system, and provide access to the access system to the user in response to the authorization response that allows the user to use the access system; and

the second database system connected to the local database system and configured to receive and process the authorization query to determine whether the user is allowed access and generate and transmit the authorization response for the local database system.

11. The access system of claim 10 wherein the access server is configured to generate and transmit a logon query.

12. The access system of claim 10 wherein the local database system is configured to process the user logon to determine if the user is allowed access to the access system based on a user access profile.

13. The access system of claim 10 wherein the local database system is configured to determine if the second database system exists.

14. The access system of claim 10 wherein the access server is configured to disconnect a user'"'"'s network device in response to the determination that the user is not allowed to use the access system.

15. The access system of claim 10 wherein the logon reply includes an access card account code.

16. The access system of claim 10 wherein the logon reply includes foreign network account information and the local database system is configured to identify the second external database based on the foreign network account information.

17. The access system of claim 10 further comprising:

a service control point connected to the user system configured to receive a request for access, process the request for access to determine the destination for the request, and generate and transmit a reply to route the request to the access server.

18. The access system of claim 10 wherein the local database system is configured to log contract and settlement information.

19. A software product for providing access between a user system and a plurality of communication networks that provide services to a user, the software product comprising:

database software operational when executed by a processor to direct the processor to receive the user logon, process the user logon to determine if the user is allowed access to an access system based on a local database system, provide access to the access system to the user in response to the determination that the user is allowed access based on the local database system, generate an authorization query for a second database system external to the local database system in response to the determination that the user is not allowed access based on the local database system, receive and process an authorization response indicating whether the user is allowed to use the access system from the second database system, and provide access to the access system to the user in response to the authorization response that allows the user to use the access system; and

a software storage medium operational to store the database software.

20. The software product of claim 19 wherein the database software is operational when executed by the processor to direct the processor to process the user logon to determine if the user is allowed access to the access system based on a user access profile.

21. The software product of claim 19 wherein the database software is operational when executed by the processor to direct the processor to determine if the second database system exists.

22. The software product of claim 19 wherein the logon reply includes an access card account code.

23. The software product of claim 19 wherein the logon reply includes foreign network account information and the database software is operational when executed by the processor to direct the processor to identify the second external database based on the foreign network account information.

24. The software product of claim 19 wherein the database software is operational when executed by the processor to direct the processor to log contract and settlement information.