US20070219881A1 - Method and system for tracking computer system usage through a remote access security device - Google Patents

Images

Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
  • G06F21/16—Program or content traceability, e.g. by watermarking
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/55—Detecting local intrusion or implementing counter-measures
  • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q10/00—Administration; Management
  • G06Q10/10—Office automation; Time management
  • G06Q10/109—Time management, e.g. calendars, reminders, meetings or time accounting
  • G06Q10/1091—Recording time for administrative or management purposes
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/08—Payment architectures
  • G06Q20/10—Payment architectures specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
  • G06Q20/102—Bill distribution or payments
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q30/00—Commerce
  • G06Q30/02—Marketing; Price estimation or determination; Fundraising
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q30/00—Commerce
  • G06Q30/04—Billing or invoicing
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
  • G06Q40/12—Accounting
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
  • G06Q40/12—Accounting
  • G06Q40/123—Tax preparation or submission
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
  • G06Q50/06—Energy or water supply
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L12/00—Data switching networks
  • H04L12/02—Details
  • H04L12/14—Charging, metering or billing arrangements for data wireline or wireless communications
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
  • H04L63/102—Entity profiles
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/2101—Auditing as a secondary aspect
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/2135—Metering
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/2151—Time stamp

Definitions

• the present invention relates to a system and method for monitoring access to each of a plurality of unrelated host computer networks. More particularly, the present invention relates to a system and method of tracking computer usage, and costs associated with the computer usage, by authorized users of different computer networks.
• each organization's computer facility tracks computer usage internally and generates various reports based on that information. Also, the costs associated with remotely dialing up an organization's computer facilities, such as the telephone line charges, are reported separately by each of the one or more long distance line carriers utilized by the remotely located computer users. Additional costs of maintaining a remotely accessible computer network, such as supporting an information services person or department to handle difficulties with remote access by authorized users, may take up significant resources particularly in smaller organizations.
• FIG. 1 illustrates a preferred embodiment of a system for monitoring computer usage and costs associated with remote access according to the present invention.
• FIG. 2 is a flow chart showing a preferred method of monitoring computer usage and costs using the system of FIG. 1 .
• An advantage of the present invention is consolidation of usage and billing information in a single report.
• Another advantage of the present invention is the ability to manipulate the usage and billing data for each of a number of different host computer networks by individual user and by predetermined groups or departments of users at each organization.
• the preferred method and system cooperate with a system for securing access between remotely located computer users and the computers of different organizations for which they are permitted access.
• FIG. 1 illustrates a preferred system 10 for securing access between remotely located computer users and computers of different organizations in addition to monitoring access and maintaining billing records for each host computer system.
• the system 10 includes at least one remotely located user computer 12 .
• a secure identification card 14 is associated with the user and the user computer 12 .
• a user computer 12 preferably communicates over standard telephone lines, also known as plain old telephone service (POTS) lines 17 , via modem 16 through the public switched telephone network (PSTN) 18 .
• POTS plain old telephone service
• PSTN public switched telephone network
• the system 10 of the present invention may use other commonly available communication devices, such as an ISDN terminal adapter or a communications server, in place of the analog modem.
• the user computer may be a personal computer or another computer network.
• One suitable secure ID card is available from Security Dynamics, Inc. of Cambridge, Mass. and includes a display showing a time variant pass code for use by an authorized user in accessing a host computer network.
• a communications server 20 which may be a router such as a Cisco 5200, is in communication with a security service bureau 22 over a frame relay network 18 .
• the security service bureau 22 may be a local area network (LAN) 26 that includes at least one administrative workstation 28 for monitoring operation of the security service bureau 22 .
• a suitable administrative workstation 28 may be any of a number of commonly available personal computers.
• a network access server (NAS) 30 is also connected to the LAN 26 .
• the LAN 26 of the service bureau 22 connects to the frame relay network 24 via a firewall 32 .
• the firewall may be a personal computer, such as those available from SUN Microsystems, running software available from SOLARIS to provide protection to the service bureau LAN 26 from outside corruption.
• the NAS 30 may be any of a number of servers available from Hewlett Packard, such as the HP712, HP755, or the HP720.
• the NAS 30 of the service bureau 22 controls access of remote users, through the communication server 20 and frame relay network 24 , to the multiple host computer networks 34 or stand alone computers.
• each of the host computer networks or stand alone computers utilize the service bureau to authenticate remote users at various computers 12 .
• One system and method for authenticating users through a service bureau is disclosed in a commonly assigned U.S. application Ser. No. 09/008,527, filed Jan. 16, 1998, and is hereby incorporated by reference in its entirety.
• the system 10 also includes an integrated service center (ISC) 35 and an enterprise service system (ESS) 37 .
• the ISC 35 preferably includes a computer configured to accept all service requests from various end user host computer networks desiring to add or remove computer use monitoring services or change the list of authorized users for the network. Additionally, the ISC 35 receives telephone calls from end users 12 seeking help relating to remote access services. The ISC 35 assigns help requests to the appropriate party in the system 10 .
• the ISC 35 is a vertically integrated service center and help desk for video, audio, and data communications.
• the ESS 37 is a master database containing lists of periodic user charges, also known as “per seat” charges, for the various host computer systems serviced by the system 10 .
• the ESS 37 also contains a list of field service fees associated with a respective host computer network 34 and records any extra services used by a host computer network 34 and its authorized users.
• the fees for each particular host computer network are negotiated prior to beginning services to a particular host computer network and associated authorized users.
• the negotiated fees may be stored as tables in the ESS.
• the ESS 37 may be a server running UNIX software such as a SPARC Server available from SUN Microsystems.
• the ESS receives updates on authorized users and subscribing host computer networks from the ISC.
• a network management center (NMC) 39 is in communication with the ISC 35 and a private corporate intranet 19 via the ESS 37 .
• the NMC 39 receives help requests from the ISC and provides a help desk for network infrastructure problems, performance issues and chronic desktop problems.
• the NMC 39 uses a pre-entered user definition and information to create a trouble record for resolving issues associated with remote access services provided to the host computer networks 34 .
• Each trouble call is stored at the NMC 39 .
• the NMC serves to provide proactive surveillance of all physical lines and communications servers in the system as well as handling trouble calls passed on from the ISC.
• a customer service center (CSC) 40 is also linked to the system 10 via the ESS and the private corporate intranet 19 .
• the CSC 40 manages the ordering of POTS services and repairs of business lines (e.g. DS 1 , ISDN, etc.).
• a billing application communicates over the corporate intranet 19 , via the ESS 37 , with the NAS 30 and other system 10 components to obtain necessary billing information concerning host computer networks 34 and their respective users.
• the billing application is a software application running within the ESS containing logic necessary to organize cost data by per user and per entity within a particular client's (host computers) organization.
• the billing application may be a discrete billing computer 42 executing the necessary logic to obtain and manipulate billing information.
• Each computer network 34 provides an associated list of authorized users that is maintained at the ISC, ESS, and NAS 30 (at step 50 ).
• An authorized user accessing a host computer exchanges the information with the NAS 30 , via the communication server, each time the user dials in to gain access to his respective host computer network 34 .
• a starting time stamp is created at the beginning of each remote access call received from a user at the communication server 20 (at step 52 ).
• the remote user accesses his respective host computer network by dialing in through the PSTN 18 using a modem 16 or other communication device to reach a network communications server 20 .
• the communication server 20 forwards information on the call through the frame relay network 24 to the service bureau 22 .
• the NAS 30 authenticates the user through the exchange of a user name and a pass code.
• the pass code preferably consists of a fixed personal identification number and a time variable security token.
• the security token may be a soft token, such as a software application on each authorized user's computer, or a hard token, such as a secure ID card 14 available from Security Dynamics, Inc. Each authorized user preferably has her own security token and the security token may be a sequence of numbers, letters, or other type of symbol.
• the security token is obtained by the user from a display that generates a new security token at predetermined time increments.
• the NAS 30 containing an identical security token generating algorithm synchronized with the secure ID card 14 generates the same security token to verify that the user is an authorized user.
• the communication server 20 connects the user computer 12 to the appropriate host computer 34 for the duration of the call.
• the NAS 30 receives an ending time stamp from the communication server 20 at the conclusion of the remote access call when the user hangs up or otherwise disconnects from the host computer network 34 (at step 54 ).
• the service bureau stores the starting and ending time stamps in the NAS memory.
• the starting and ending time stamps are associated in the user log with the list of authorized users so that the user log contains a record of computer time usage for each authorized user (at step 56 ).
• the user log is transmitted from the service bureau in a discrete file generated at the NAS to the billing computer 42 (at step 58 ).
• the billing period may be any desired length of time, such as a month or a year.
• the list of host computer networks and associated list of authorized users for a host computer network is also transmitted to the billing computer (at step 60 ) from the NAS over the frame relay network.
• the billing computer then generates a billing summary for each of the subscribing customer host computer networks (at step 62 ).
• a long distance carrier invoice is electronically transmitted to the billing computer from a long distance telephone service provider.
• the long distance service provider may be any one of a number of available service providers, such as Ameritech, selected by the host computer network.
• the long distance telephone service provider transmits a minutes of use invoice for the long distance access number used by authorized users of a given host computer network to access the security service bureau.
• the long distance access number may be an “800” number or other telephone number dedicated for use by authorized users to communicate with the appropriate host computer through the system 10 .
• the billing computer can use the unique pass code each user possesses to distribute the minutes of use charge to the appropriate.
• the long distance charges are distributed appropriately among the users of each host computer network based on a user's percentage of computer access time for that billing period.
• the ESS 39 provides fixed expense information to the billing computer 42 by way of monthly per seat charges and incident charges. Incident charges refer to the fees assessed to calls by authorized users to the system help desk at the CSC.
• a bill may be generated that breaks up authorized users into the various departments to which they are assigned within a customer's organization. For each authorized user in the department a predetermined group of information may be displayed. This information may include per seat charges, the cost of long distance telephone usage (distributed among authorized users based on the amount of time a user was communicating with the host computer network), any equipment charges, maintenance charges, and miscellaneous charges.
• the per seat charges refer to fixed service charges associated with supporting each authorized user.
• the miscellaneous costs may include incidental security cost such as replacing secure ID cards, or for particular pieces of software necessary for enabling remote users to access their host network through the security service bureau 22 .
• incidental security cost such as replacing secure ID cards, or for particular pieces of software necessary for enabling remote users to access their host network through the security service bureau 22 .
• Optionally included in the per seat charges are the local exchange and other incidental charges.
• Another aspect of the presently preferred invention is that computer usage information may be provided to the customer and the service provider maintaining the security service bureau 22 so that computer resources may be optimized for usage patterns.
• the billing computer may generate monthly or annual reports dividing up the usage for each individual authorized user by total time used per a given period or by time of day or week so that host computer network 34 or service bureau 22 resources can be properly allocated for particularly heavy usage.
• the method includes maintaining a list of host computer networks and associated list of authorized users for each network, creating a starting and ending time stamp for remote access calls, transmitting the starting and ending time stamps in the user log to a billing computer in addition to other billing information, and generating a billing summary of costs and usage at the billing computer.
• the system preferably includes a security service bureau providing secure remote access between remotely located authorized users and their respective proprietary host networks.
• the NAS preferably records time stamps and a user log indicating usage of resources by individual authorized users.
• a billing computer is also included in the system having the logic necessary to compile information from the user log in the security service bureau and cost information received from outside sources to generate a periodic bill indicating cost per individual user and/or department.

Landscapes

• Engineering & Computer Science (AREA)
• Business, Economics & Management (AREA)
• Theoretical Computer Science (AREA)
• Accounting & Taxation (AREA)
• Finance (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• Strategic Management (AREA)
• Development Economics (AREA)
• Economics (AREA)
• General Business, Economics & Management (AREA)
• Computer Security & Cryptography (AREA)
• Marketing (AREA)
• Human Resources & Organizations (AREA)
• Software Systems (AREA)
• Computer Hardware Design (AREA)
• General Engineering & Computer Science (AREA)
• Signal Processing (AREA)
• Computer Networks & Wireless Communication (AREA)
• Entrepreneurship & Innovation (AREA)
• Technology Law (AREA)
• Tourism & Hospitality (AREA)
• Computing Systems (AREA)
• Health & Medical Sciences (AREA)
• Primary Health Care (AREA)
• Water Supply & Treatment (AREA)
• General Health & Medical Sciences (AREA)
• Public Health (AREA)
• Multimedia (AREA)
• Game Theory and Decision Science (AREA)
• Educational Administration (AREA)
• Data Mining & Analysis (AREA)
• Operations Research (AREA)
• Quality & Reliability (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)
• Meter Arrangements (AREA)

Abstract

Description

Claims (7)

Priority Applications (1)

Applications Claiming Priority (4)

Related Parent Applications (1)

Publications (1)

Family

ID=21731090

Family Applications (4)

Family Applications Before (3)

Country Status (3)

Cited By (5)

Families Citing this family (82)

Citations (67)

Family Cites Families (11)

• 1998
  • 1998-01-16 US US09/008,344 patent/US6349289B1/en not_active Expired - Fee Related
• 1999
  • 1999-01-14 AU AU23191/99A patent/AU2319199A/en not_active Abandoned
  • 1999-01-14 WO PCT/US1999/000779 patent/WO1999036875A1/en active Application Filing
• 2001
  • 2001-12-18 US US10/024,734 patent/US7020628B2/en not_active Expired - Fee Related
• 2005
  • 2005-11-04 US US11/267,245 patent/US7181421B2/en not_active Expired - Fee Related
• 2007
  • 2007-01-05 US US11/650,300 patent/US20070219881A1/en not_active Abandoned

Patent Citations (80)

Also Published As

Similar Documents

Legal Events