Method and system for associating a plurality of transaction data records generated in a service access system

• US 7,469,341 B2
• Filed: 04/05/2002
• Issued: 12/23/2008
• Est. Priority Date: 04/18/2001
• Status: Active Grant

• Current Assignee: Channel IP BV
• Original Assignee: Ipass Incorporated (Pareteum Corp.)
• Inventors: Edgett, Jeff Steven, Sunder, Singam
• Primary Examiner(s): Smithers; Matthew
• Application Number:
  US10/118,380
• Publication Number:
  US 20030056092A1
• Time in Patent Office: 2,454 Days
• Field of Search: 713/176, 726/28, 705/75, 705/67, 705/64
• US Class Current: 713/176
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

A method of, and system for, associating a plurality of transaction data records generated in a service access system including a plurality of service providers is provided. The transaction data records are generated in response to a user accessing the system during a single user session. The method includes generating a unique session identification that is uniquely associated with the single user session and which is receivable by the service providers. The unique session identification is included in the transaction data record. The plurality of transaction data records is received at a transaction processing facility from the service providers and processes using the unique session identification of each transaction data record. In certain embodiments, the unique session identification is provided in a user identification string of each transaction data record when the user session is authentication.

Claims

1. A method of associating a plurality of transaction data records generated in a service access system including at least one service provider, the transaction data records being generated in response to a user accessing the service access system during a single user session, the method including:

allowing commencement of the single user session only if the user is positively authenticated by the service access system, and upon positive authentication, storing a unique session identification in a session identification field in an authentication transaction storage area at a transaction processing facility;

generating the unique session identification that is uniquely associated with the single user session and which is receivable by the at least one service provider, the unique session identification being included in the transaction data record;

providing the unique session identification in a user identification string of each transaction data record when the single user session is authorized;

generating a unique code that is uniquely associated with the single user session and including the unique code in the user identification string;

retrieving the transaction data records from the at least one service provider and storing each transaction data record in an accounting transaction storage area based on unique session identification data;

receiving the transaction data records at a transaction processing facility from the at least one service provider;

processing the transaction data records using the unique session identification of each transaction data record; and

using the unique session identification to identify at least one of duplicate alias records, ISDN dual-channel records, invalid session length records, and overlapping accounting records.

2. The method of claim 1, further including:

retrieving the transaction data records from the at least one service provider and storing each transaction data record in an accounting transaction storage area based on the unique session identification data.

3. The method of claim 1, wherein the user identification string has a maximum length of 63 characters.

4. The method of claim 1, further including:

generating three alphanumeric digits to define the unique code;

providing a five-digit connection application identification that uniquely identifies a connection application; and

providing an eleven-character user identification string that identifies the user.

5. The method of claim 1, further including:

constructing a modified transaction record data from at least one of the unique session identification, a customer identification from an authenticating service provider, customer data, customer routing data for internal customer routing, user identification data, customer domain data used by the user for internal routing, and non routing data customer data of a transaction data record.

6. The method of claim 1, further including:

periodically receiving batch loading transaction data records from the at least one service provider;

constructing modified session identification data records; and

storing the modified session identification data records in a session identification field in a batch history storage area.

7. The method of claim 1, further including:

receiving Service Quality Monitor (SQM) transaction data records;

constructing modified transaction data records from the SQM data records; and

storing the modified transaction data records in a session identification field in an SQM storage area.

8. The method of claim 1, further including:

comparing session identification data in the authentication transaction storage area and the accounting transaction area to identify missing accounting records.

9. The method of claim 1, further including:

identifying each transaction data record without a unique session identification in the accounting transaction storage area to identify transaction data records provided by the at least one service provider which were not authenticated.

10. The method of claim 1, further including:

searching for duplicate session identification data in the accounting transaction storage area to identify duplicate transaction data records.

11. A system for processing transaction data records generated in a service access system including at least one service provider, the transaction data records being generated in response to a user accessing the system during a single user session, the system including:

a session identification generator to generate a unique session identification that is uniquely associated with the single user session and which is receivable by the at least one service provider, the unique session identification being included in ones of the transaction data records, the session identification generator further to provide unique session identification data in a user identification string of each transaction data record when the user session is authorized, the session identification generator further to generate a unique code that is uniquely associated with the single user session, the unique code being included in the user identification string; and

a transaction processing facility to process the transaction data records received from the at least one service provider using the unique session identification of each record, the transaction processing facility further to store the unique session identification in a session identification field in an authentication transaction storage area, the storing performed upon positive authentication of the user by the system, the authentication to allow commencement of the session, the transaction processing facility further to receive transaction data records from the at least one service provider and stores each transaction data record in an accounting transaction storage area based on the unique session identification data, the transaction processing facility further to periodically receive batch loading transaction data records from the at least one service provider to construct modified session identification data records, and to store the modified session identification data records in a session identification field in a batch history storage area.

12. The system of claim 11, in which the transaction processing facility receives Service Quality Monitor (SQM) transaction data records;

constructs modified transaction data records from the SQM transaction data records; and

stores the modified transaction data records in a session identification field in an SQM storage area.

13. The system of claim 11, wherein the session identification generator is implemented by a software application on a connection application via which the user requests access and the unique code is combined with a connection application identification which identifies the connection application.

14. The system of claim 11, wherein the session identification generator is a counter that generates the unique code.

15. The system of claim 11, wherein the user identification string has a maximum length of 63 characters.

16. The system of claim 11, wherein the unique code is provided by three alphanumeric digits randomly generated, wherein the connection application identification is provided by five-digits that uniquely identifies the connection application, and wherein the user identification string that identifies the user is provided by eleven-characters.

17. The system of claim 11, wherein commencement of the session is allowed only if the user is positively authenticated the by system, and upon positive authentication, the transaction processing facility is to store the unique session identification in a session identification field in an authentication transaction storage area.

18. A method of processing a plurality of transaction data records generated in a service access system including at least one service provider, method including:

receiving the transaction data records from the at least one service provider, each transaction data record being generated in response to a user accessing the system during a single user session; and

identifying transaction data records associated with the single user session based on a session identification included in each transaction data record, each session identification uniquely identifying a single user session;

identifying the unique session identification in a user identification string of each transaction record;

identifying a unique code that is uniquely associated with the single user session and included in the user identification string,

storing each transaction data record received from the service providers in an accounting transaction storage area based on the unique session identification data; and

comparing session identification data in the authentication transaction storage area and the accounting transaction area to identify missing accounting records.

19. The method of claim 18, further including:

identifying each transaction data record without a unique session identification in the accounting transaction storage area to identify transaction data records provided by the at least one service provider which were not authenticated.

20. The method of claim 18, further including:

identifying a connection application identification that identifies a connection application via which the user requests access and that has generated the unique code.

21. The method of claim 18, further including:

extracting the unique session identification from the user string, wherein the user string has a maximum length of 63 characters.

22. The method of claim 18, further including:

identifying the unique code from three alphanumeric digits;

identifying a connection application from a five-digit connection application identification; and

identifying the user from an eleven-character user identification string.

23. The method of claim 18, further including:

constructing a modified transaction record data from at least one of the unique session identification, a customer identification from the authenticating service provider, customer data, customer routing data for internal customer routing, user identification data, customer domain data used by the user for internal routing, and non routing data customer data of a transaction data record.

24. The method of claim 18, further including:

storing the unique session identification in a session identification field in an authentication transaction storage area at a transaction processing facility.

25. The method of claim 18, further including:

periodically receiving batch loading transaction data records from the at least one service provider;

constructing modified session identification data records from the transaction data records; and

storing the modified session identification data records in a session identification field in a batch history storage area.

26. The method of claim 18, further including:

receiving Service Quality Monitor (SQM) transaction data records;

constructing modified transaction data records from the modified transaction data records; and

storing the modified transaction data records in a session identification field in an SQM storage area.

27. The method of claim 18, further including:

searching for duplicate session identification data in the accounting transaction storage area to identify duplicate transaction records.

28. The method of claim 18, further including:

using the unique session identification to identify at least one of duplicate alias records, ISDN dual-channel records, invalid session length records, and overlapping accounting records.

29. A transaction processing facility for processing a plurality of transaction data records generated in a service access system including at least one service provider, the transaction processing facility arranged to:

receive the transaction data records from the at least one service provider, each transaction data record being generated in response to a user accessing the system during a single user session;

identify transaction data records associated with the single user session based on a unique session identification included in each transaction data record, each session identification uniquely identifying a single user session;

identify the unique session identification in a user identification string of each transaction record;

store each transaction data record received from the at least one service provider in an accounting transaction storage area based on the unique session identification; and

search for duplicate session identifications in the accounting transaction storage area to identify duplicate transaction records.

30. The transaction processing facility of claim 29, further arranged to:

use the unique session identification to identify at least one of duplicate alias records, ISDN dual-channel records, invalid session length records, and overlapping accounting records.

31. The transaction processing facility of claim 29, further arranged to:

identify a connection application identification that identifies a connection application that generated the unique code and via which the user gains access.

32. The transaction facility of claim 29, further arranged to:

extract the unique session identification from the user string, the user string with a maximum length of 63 characters.

33. The transaction facility of claim 29, further arranged to:

identify the unique code from three alphanumeric digits;

identify the connection application from a five-digit connection application identification; and

identify the user from an eleven-character user identification string.

34. The transaction facility of claim 29, further arranged to:

construct a modified transaction record data record from at least one of the unique session identification, a customer identification from the authenticating service provider, customer data, customer routing data for internal customer routing, user identification data, customer domain data used by the user for internal routing, and non routing data customer data of a transaction data record.

35. The transaction facility of claim 29, further arranged to:

store the unique session identification in a session identification field in an authentication transaction storage area at the transaction processing facility.

36. The transaction facility of claim 29, further arranged to:

store each transaction data record received from the at least one service provider in an accounting transaction storage area based on the unique session identification data.

37. The transaction facility of claim 29, further arranged to:

periodically receive batch loading transaction data records from the at least one service provider from which it constructs modified session identification data records that are stored in a session identification field in a batch history storage area.

38. The transaction facility of claim 29, further arranged to:

receive Service Quality Monitor (SQM) transaction data records and constructs modified transaction data records from the SQM transaction data records and stores them in a session identification field in an SQM storage area.

39. The transaction facility of claim 29, further arranged to:

compare session identification data in the authentication transaction storage area and the accounting transaction area to identify missing accounting records.

40. The transaction facility of claim 29, further arranged to:

identify each transaction data record without a unique session identification in the accounting transaction storage area to identify transaction data records provided by the at least one service provider which were not authenticated.

41. A method of connecting a user to an access service provider, the method including:

creating a unique session identification associated with a single user session during which the user accesses the access service provider, the unique session identification being provided in a user identification string of a transaction data record when the user session is authorized;

generating a unique code that is uniquely associated with the single user session and including the unique code in the user identification string; and

providing the unique session identification in a format suitable for communication using a protocol from one of Point-to-Point Protocol (PPP), Password Authentication Protocol (PAP), Challenge-Handshake Authentication Protocol (CHAP), Remote Authentication Dial In User Service (RADIUS) protocol, Terminal Access Controller Access Control System (TACACS) protocol, Lightweight Directory Access Protocol (LDAP), NT Domain authentication protocol, Unix password authentication protocol, HyperText Transfer Protocol (HTTP), HyperText Transfer Protocol over Secure sockets layer (HTTPS), Extended Authentication Protocol (EAP), Transport Layer Security (TLS) protocol, Token Ring protocol and Secure Remote Password protocol (SRP), the unique session identification being provided within a user string with a maximum length of 63 characters.

42. The method of claim 41, which includes randomly generating three alphanumeric digits to define the unique code;

providing a five-digit connection application identification that uniquely identifies the connection application; and

providing an eleven-character user identification string that identifies the user.

43. The method of claim 41, further including:

generating the unique code at a connection application via which the user gains access and combining the unique code with a connection application identification which identifies the connection application.

44. The method of claim 41, further including:

generating the unique code by means of a counter.

45. A connection apparatus for connecting a user to an access service provider, the apparatus including:

a session identification generator to create a unique session identification associated with each session that is authorized, the session identification generator further to generate a unique code that is uniquely associated with a single user session, the unique code being included in a user identification string, the unique session identification being provided in a format suitable for communication using a protocol from one of Point-to-Point Protocol (PPP), Password Authentication Protocol (PAP), Challenge-Handshake Authentication Protocol (CHAP), Remote Authentication Dial In User Service (RADIUS) protocol, Terminal Access Controller Access Control System (TACACS) protocol, Lightweight Directory Access Protocol (LDAP), NT Domain authentication protocol, Unix password authentication protocol, HyrperText Transfer Protocol (HTTP), HyperText Transfer Protocol over Secure sockets layer (HTTPS), Extended Authentication Protocol (EAP), Transport Layer Security (TLS) protocol, Token Ring protocol and Secure Remote Password protocol (SRP), the unique session identification being provided within a user string with a maximum length of 63 characters.

46. The connection apparatus of claim 45, in which the session identification generator randomly generates three alphanumeric digits to define the unique code;

provides a five-digit connection application identification that uniquely identifies the connection apparatus; and

provides for an eleven-character user identification string to identify the user.

47. The connection apparatus of claim 45, wherein the session identification generator is further to combine the unique code with a connection apparatus identification that identifies a connection application.

48. The connection apparatus of claim 45, in which the session identification generator generates the unique code by means of a counter.

49. A machine-readable medium including instructions, which when executed by a machine, cause the machine to perform a method of associating a plurality of transaction data records generated in a service access system including at least one service provider, the transaction data records being generated in response to a user accessing the system during a single user session and method including:

generating a unique session identification that is uniquely associated with the single user session and which is receivable by the at least one service provider, the unique session identification being included in the transaction data record;

providing the unique session identification in a user identification string of each transaction data record when the user session is authorized, the unique session identification being provided in a format suitable for communication using a protocol from one of Point-to-Point Protocol (PPP), Password Authentication Protocol (PAP), Challenge-Handshake Authentication Protocol (CHAP), Remote Authentication Dial In User Service (RADIUS) protocol, Terminal Access Controller Access Control System (TACACS) protocol, Lightweight Directory Access Protocol (LDAP), NT Domain authentication protocol, Unix password authentication protocol, HyperText Transfer Protocol (HTTP), HyperText Transfer Protocol over Secure sockets layer (HTTPS), Extended Authentication Protocol (EAP), Transport Layer Security (TLS) protocol, Token Ring protocol and Secure Remote Password protocol (SRP);

generating, by means of a counter, a unique code at a connection application via which the user requests access;

combining the unique code with a connection application identification which identifies the connection application;

receiving the plurality of transaction data records at a transaction processing facility from the at least one service provider;

processing the transaction data records using the unique session identification of each transaction data record; and

constructing a modified transaction record data from at least one of the unique session identification, a customer identification from an authenticating service provider, customer data, customer routing data for internal customer routing, user identification data, customer domain data used by the user for internal routing, and non routing data customer data of a transaction data record.

50. A machine-readable medium including instructions, which when executed by a machine, cause the machine to perform a method of processing a plurality of transaction data records generated in a service access system including at least one service provider, the method including:

receiving the transaction data records from the at least one service provider, each transaction data record being generated in response to a user accessing the system during a single user session; and

identifying transaction data records associated with the single user session based on a session identification included in each transaction data record, each session identification uniquely identifying a single user session;

identifying the unique session identification in a user identification string of each transaction record;

identifying a unique code that is uniquely associated with the single user session and included in the user identification string;

storing each transaction data record received from the service providers in an accounting transaction storage area based on the unique session identification data;

periodically receiving batch loading transaction data records from the at least one service provider;

constructing modified session identification data records from the transaction data records; and

storing the modified session identification data records in a session identification field in a batch history storage area.

51. A machine-readable medium including instructions, which when executed by a machine, cause the machine to perform a method for processing a plurality of transaction data records generated in a service access system including at least one service provider, the method including:

receiving the transaction data records from the at least one service provider, each transaction data record being generated in response to a user accessing the system during a single user session;

identifying transaction data records associated with the single user session based on a session identification included in each transaction data record, each session identification uniquely identifying a single user session;

identifying the unique session identification in a user identification string of each transaction record; and

constructing a modified transaction record data record from at least one of the unique session identification, a customer identification from the authenticating service provider, customer data, customer routing data for internal customer routing, user identification data, customer domain data used by the user for internal routing, and non routing data customer data of a transaction data record.