Method and apparatus providing prepaid billing for network services using explicit service authorization in an access server

• US 7,720,960 B2
• Filed: 03/04/2003
• Issued: 05/18/2010
• Est. Priority Date: 03/04/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Murty, Kotha Subba Rama Chandra, Centemeri, Marco Cesare, Ravindranath, Vinodh Kumar, Agarwal, Navneet, King, Matthew Lawrence, Fitzgerald, John, Hess, Tanja, Hovey, David, Phadnis, Amit, Pruss, Richard Manfred, Ajai, Tirumali Seetharam, Grayson, Mark
• Primary Examiner(s): PHILLIPS, HASSAN A
• Application Number:
  US10/382,347
• Publication Number:
  US 20040193513A1
• Time in Patent Office: 2,632 Days
• Field of Search: 709/200, 709/202, 709/203, 709/205, 709/217, 709/219, 709/223, 709/225, 709/227, 705/412
• US Class Current: 709/224
• CPC Class Codes: G06Q 20/28 Pre-payment schemes, e.g. "pay before"
• CPC Class Codes: G06Q 20/29 characterised by micropayments
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04M 15/68 Payment of value-added services
• CPC Class Codes: H04M 15/75 Account location specifications
• CPC Class Codes: H04M 15/765 Linked or grouped accounts, e.g. of users or devices
• CPC Class Codes: H04M 15/7655 shared by technologies
• CPC Class Codes: H04M 15/772 per service, e.g. prepay or post-pay
• CPC Class Codes: H04M 15/773 per technology, e.g. PSTN or wireless
• CPC Class Codes: H04M 15/775 Account specifications on parallel communications
• CPC Class Codes: H04M 15/79 Virtual purses
• CPC Class Codes: H04M 15/8228 Session based
• CPC Class Codes: H04M 17/00 Prepayment of wireline communication systems, wireless communication systems or telephone systems using a coded card to authorise calls from a telephone set H04M1/675
• CPC Class Codes: H04M 2215/0196 Payment of value-added services, mainly when their charges are added on the telephone bill, e.g. payment of non-telecom services, e-commerce, on-line banking
• CPC Class Codes: H04M 2215/32 Involving wireless systems
• CPC Class Codes: H04M 2215/72 Account specifications
• CPC Class Codes: H04M 2215/724 Linked accounts
• CPC Class Codes: H04M 2215/725 : Shared by technologies, e.g. one account for different access technologies
• CPC Class Codes: H04M 2215/7263 : per service, e.g. prepay and post-pay
• CPC Class Codes: H04M 2215/7268 : per technology, e.g. PSTN or wireless
• CPC Class Codes: H04M 2215/7277 : Account specifications on parallel communications
• CPC Class Codes: H04M 2215/7833 : Session based
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 4/24 : Accounting or billing

Abstract

A method is disclosed for authorizing a prepaid network service in a data network. A network end station issues a request for a prepaid network service. At a network node, such as a router serving as a gateway for selecting services, a determination is made about whether a user associated with the end station is authorized to access the prepaid network service. Network traffic from the end station is forwarded to a service provider only when the user is authorized to use the prepaid network service. Specific embodiments provide message flows among a mobile station, gateway support node, router, and authentication server that support providing prepaid services in a packet-switched network for mobile communication. In certain embodiments, a connection is held open for an end station while a prepaid quota value is refreshed at a portal, thereby reducing overhead and precluding the need to repeat user logon steps. Further, unused quota amounts can be returned to the authentication server for use in association with multiple concurrent connections of the same device.

Claims

1. A method implemented by a service selection gateway for authorizing prepaid mobile network services, the method comprising the steps of:

receiving from a GPRS Gateway Support Node (GGSN) a first request to authenticate a mobile station for activating the mobile station'"'"'s Packet Data Protocol (PDP) context;

forwarding to an authentication server the request to authenticate the mobile station;

receiving a first response to the request from the authentication server;

in response to receiving the first response, preparing and sending a second response to the GGSN, wherein the second response comprises a set of attributes identified in the first request from the GGSN;

receiving a second request for a prepaid network service from the mobile station;

requesting the authentication server to provide a prepaid quota value associated with the prepaid network service and the mobile station;

receiving the prepaid quota value from the authentication server;

forwarding network traffic associated with the prepaid network service from the mobile station to a service provider only when the prepaid quota value is nonzero;

monitoring traffic communicated by the mobile station for the prepaid network service associated with the quota value;

determining that the traffic is discontinued or inactive;

returning an unused portion of the quota value to the authentication server;

allowing the mobile station to concurrently access a plurality of different services using the mobile station'"'"'s PDP; and

allotting the unused portion of the quota value to a plurality of different concurrent connections of the mobile station that are respectively associated with the plurality of different services concurrently accessed by the mobile station;

wherein a router performs all the preceding steps.

2. A method as recited in claim 1, wherein the authentication server is an authorization, authentication and accounting (AAA) server;

and

wherein the first response comprises a service profile for the mobile user, which service profile indicates whether service authorization is required for the prepaid network service.

3. A method as recited in claim 1 further comprising the steps of:

determining that the prepaid quota value is approximately zero as a result of usage of the prepaid network service by the mobile user;

requesting the authentication server to re-authorize usage of the prepaid network service; and

determining that the mobile user is authorized to continue accessing the prepaid network service only when the authentication server re-authorizes usage of the prepaid network service.

4. A method as recited in claim 3, further comprising the step of redirecting the traffic of the mobile station associated with the prepaid network service to a portal page that facilitates replenishment of the prepaid network service quota value when the authentication server fails to re-authorize usage of the prepaid network service.

5. A method as recited in claim 1, further comprising the steps of:

creating and storing a PDP context data structure in association with the mobile station;

requesting the authentication server to provide a service profile associated with the mobile user; and

performing the determining step for each service that is identified in the service profile.

6. A method as recited in claim 1 further comprising the steps of:

receiving, from the authentication server, a new portion of the quota value in association with authorization for a new connection of the mobile station for use with a new prepaid network service.

7. A method as recited in claim 6, wherein receiving a new portion of the quota value further comprises placing the connection in a waiting state, determining that the mobile station has re-initiated communication of traffic on the connection, and receiving, from the authentication server, a new portion of the quota value in association with authorization for the connection.

8. A method as recited in claim 1, wherein the determining step further comprises the steps of:

sending an authorization request to the authentication server;

redirecting network traffic associated with the prepaid network service to a portal page that provides user credit status and information about replenishing the quota value; and

maintaining a connection of the mobile station to the prepaid network service while concurrently blocking traffic directed to the prepaid network service.

9. A method as recited in claim 8, further comprising the steps of:

receiving a message from the authentication server specifying re-authorization for the connection; and

performing the steps of claim 1 with respect to monitoring, determining, returning and allotting.

10. A volatile or non-volatile computer-readable medium carrying one or more sequences of instructions for authorizing prepaid mobile network services, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving from a GPRS Gateway Support Node (GGSN) a first request to authenticate a mobile station for activating the mobile station'"'"'s Packet Data Protocol (PDP) context;

forwarding to an authentication server the request to authenticate the mobile station;

receiving a first response to the request from the authentication server;

in response to receiving the first response, preparing and sending a second response to the GGSN, wherein the second response comprises a set of attributes identified in the first request from the GGSN;

receiving a second request for a prepaid network service from a mobile station;

requesting the authentication server to provide a prepaid quota value associated with the prepaid network service and the mobile station;

receiving the prepaid quota value from the authentication server;

forwarding network traffic associated with the prepaid network service from the mobile station to a service provider only when the prepaid quota value is nonzero;

monitoring traffic communicated by the mobile station for the prepaid network service associated with the quota value;

determining that the traffic is discontinued or inactive;

returning an unused portion of the quota value to the authentication server;

allowing the mobile station to concurrently access a plurality of different services using the mobile station'"'"'s PDP; and

allotting the unused portion of the quota value to a plurality of different concurrent connections of the mobile station that are respectively associated with a plurality of different services concurrently accessed by the mobile station;

wherein a router performs all the preceding steps.

11. An apparatus for authorizing prepaid mobile network services, comprising:

a network interface that is coupled to the data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

receiving from a GPRS Gateway Support Node (GGSN) a first request to authenticate a mobile station for activating the mobile station'"'"'s Packet Data Protocol (PDP) context;

forwarding to an authentication server the request to authenticate the mobile station;

receiving a first response to the request from the authentication server;

in response to receiving the first response, preparing and sending a second response to the GGSN, wherein the second response comprises a set of attributes identified in the first request from the GGSN;

receiving a second request for a prepaid network service from a mobile station;

requesting the authentication server to provide a prepaid quota value associated with the prepaid network service and the mobile station;

receiving the prepaid quota value from the authentication server;

forwarding network traffic associated with the prepaid network service from the mobile station to a service provider only when the prepaid quota value is nonzero;

monitoring traffic communicated by the mobile station for the prepaid network service associated with the quota value;

determining that the traffic is discontinued or inactive;

returning an unused portion of the quota value to the authentication server;

allowing the mobile station to concurrently access a plurality of different services using the mobile station'"'"'s PDP; and

allotting the unused portion of the quota value to a plurality of different concurrent connections of the mobile station that are respectively associated with a plurality of different services concurrently accessed by the mobile station;

wherein the apparatus is a router.

12. An apparatus as recited in claim 11, wherein the authentication server is an authorization, authentication and accounting (AAA) server;

wherein the first response comprises a service profile for the mobile user, which service profile indicates whether service authorization is required for the prepaid network service.

13. An apparatus as recited in claim 11 further comprising instructions which, when executed by the processor, cause the processor to carry out the steps of:

determining that the prepaid quota value is approximately zero as a result of usage of the prepaid network service by the mobile user;

requesting the authentication server to re-authorize usage of the prepaid network service; and

determining that the mobile user is authorized to continue accessing the prepaid network service only when the authentication server re-authorizes usage of the prepaid network service.

14. An apparatus as recited in claim 13, further comprising instructions which, when executed by the processor, cause the processor to carry out the step of redirecting the traffic of the mobile station associated with the prepaid network service to a portal page that facilitates replenishment of the prepaid network service quota value when the authentication server fails to re-authorize usage of the prepaid network service.

15. An apparatus as recited in claim 11, further comprising instructions which, when executed by the processor, cause the processor to carry out the steps of:

creating and storing a PDP context data structure in association with the mobile station;

requesting the authentication server to provide a service profile associated with the mobile user; and

performing the determining step for each service that is identified in the service profile.

16. An apparatus as recited in claim 11 further comprising instructions which, when executed by the processor, cause the processor to carry out the steps of:

receiving, from the authentication server, a new portion of the quota value in association with authorization for a new connection of the mobile station for use with a new prepaid network service.

17. An apparatus as recited in claim 16, wherein receiving a new portion of the quota value further comprises placing the connection in a waiting state, determining that the mobile station has re-initiated communication of traffic on the connection, and receiving, from the authentication server, a new portion of the quota value in association with authorization for the connection.

18. An apparatus as recited in claim 11, wherein the determining step further comprises the steps of:

sending an authorization request to the authentication server;

redirecting network traffic associated with the prepaid network service to a portal page that provides user credit status and information about replenishing the quota value; and

maintaining a connection of the mobile station to the prepaid network service while concurrently blocking traffic directed to the prepaid network service.

19. An apparatus as recited in claim 18, further comprising instructions which, when executed by the processor, cause the processor to carry out the steps of:

receiving a message from the authentication server specifying re-authorization for the connection; and

performing the steps of claim 18 with respect to monitoring, determining, returning and allotting.

20. A method implemented by a service selection gateway for authorizing prepaid mobile network services, the method comprising the steps of:

receiving from a GPRS Gateway Support Node (GGSN) a first request to authenticate a mobile station for activating the mobile station'"'"'s Packet Data Protocol (PDP) context;

forwarding to an authentication server the request to authenticate the mobile station;

receiving a first response to the request from the authentication server;

in response to receiving the first response, preparing and sending a second response to the GGSN, wherein the second response comprises a set of attributes identified in the first request from the GGSN;

receiving from the mobile station a second request for a prepaid network service;

authorizing the second request for the prepaid network service;

forwarding network traffic associated with the prepaid network service from the mobile station to a service provider;

monitoring traffic communicated by the mobile station for the prepaid network service; and

allowing the mobile station to concurrently access a plurality of different services using the mobile station'"'"'s PDP;

wherein a router performs all the preceding steps.

21. A method as recited in claim 20,

wherein the authentication server is an authorization, authentication and accounting (AAA) server;

wherein the first response comprises a service profile for the mobile user, which service profile indicates whether service authorization is required for the prepaid network service.

22. A method as recited in claim 20, further comprising:

creating and storing a PDP context data structure in association with the mobile station;

requesting the authentication server to provide a service profile associated with the mobile user; and

performing the determining step for each service that is identified in the service profile.

23. A method as recited in claim 20, wherein the determining step further comprises the steps of:

sending an authorization request to the authentication server;

redirecting network traffic associated with the prepaid network service to a portal page that provides user credit status and information about replenishing the quota value; and

maintaining a connection of the mobile station to the prepaid network service while concurrently blocking traffic directed to the prepaid network service.

24. A method as recited in claim 23, further comprising:

receiving a message from the authentication server specifying re-authorization for the connection; and

monitoring traffic communicated by the mobile station for the prepaid network service.

25. A volatile or non-volatile computer-readable medium carrying one or more sequences of instructions for authorizing prepaid mobile network services, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving from a GPRS Gateway Support Node (GGSN) a first request to authenticate a mobile station for activating the mobile station'"'"'s Packet Data Protocol (PDP) context;

forwarding to an authentication server the request to authenticate the mobile station;

receiving a first response to the request from the authentication server;

in response to receiving the first response, preparing and sending a second response to the GGSN, wherein the second response comprises a set of attributes identified in the first request from the GGSN;

receiving from the mobile station a second request for a prepaid network service;

authorizing the second request for the prepaid network service;

forwarding network traffic associated with the prepaid network service from the mobile station to a service provider;

monitoring traffic communicated by the mobile station for the prepaid network service; and

allowing the mobile station to concurrently access a plurality of different services using the mobile station'"'"'s PDP;

wherein a router performs all the preceding steps.

26. An apparatus for authorizing prepaid mobile network services, comprising:

a network interface that is coupled to the data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

receiving from a GPRS Gateway Support Node (GGSN) a first request to authenticate a mobile station for activating the mobile station'"'"'s Packet Data Protocol (PDP) context;

forwarding to an authentication server the request to authenticate the mobile station;

receiving a first response to the request from the authentication server;

in response to receiving the first response, preparing and sending a second response to the GGSN, wherein the second response comprises a set of attributes identified in the first request from the GGSN;

receiving from the mobile station a second request for a prepaid network service;

authorizing the second request for the prepaid network service;

forwarding network traffic associated with the prepaid network service from the mobile station to a service provider;

monitoring traffic communicated by the mobile station for the prepaid network service; and

allowing the mobile station to concurrently access a plurality of different services using the mobile station'"'"'s PDP;

wherein the apparatus is a router.

27. An apparatus as recited in claim 26,

wherein the authentication server is an authorization, authentication and accounting (AAA) server;

wherein the first response comprises a service profile for the mobile user, which service profile indicates whether service authorization is required for the prepaid network service.

28. An apparatus as recited in claim 26, further comprising instructions which, when executed by the processor, cause the processor to carry out the steps of:

creating and storing a PDP context data structure in association with the mobile station;

requesting the authentication server to provide a service profile associated with the mobile user; and

performing the determining step for each service that is identified in the service profile.

29. An apparatus as recited in claim 26, wherein the determining step further comprises the steps of:

sending an authorization request to the authentication server;

redirecting network traffic associated with the prepaid network service to a portal page that provides user credit status and information about replenishing the quota value; and

maintaining a connection of the mobile station to the prepaid network service while concurrently blocking traffic directed to the prepaid network service.

30. An apparatus as recited in claim 29, further comprising instructions which, when executed by the processor, cause the processor to carry out the steps of:

receiving a message from the authentication server specifying re-authorization for the connection; and

monitoring traffic communicated by the mobile station for the prepaid network service.