US20070219881A1 - Method and system for tracking computer system usage through a remote access security device - Google Patents

Abstract

A system and method for monitoring remote computer access and associated costs is provided. The system includes a remotely located communication server in communication with multiple host computer networks and in communication with a network access server. First and second memory devices contain a list of authorized users for the host computer networks and a user log for use by a billing computer to generate bills. The method includes the steps of creating starting and ending time stamps for each authorized user accessing a respective one of the multiple host computer networks and creating a user log to generate bills and monitor host computer network usage.

Description

RELATED APPLICATIONS
• This application is a continuation of U.S. application Ser. No. 11/267,245, filed Nov. 4, 2005, pending, which is a continuation of U.S. application Ser. No. 10/024,734, filed Dec. 18, 2001, now U.S. Pat. No. 7,020,628, which is as continuation of U.S. application Ser. No. 09/008,344, filed Jan. 16, 1998, now U.S. Pat. No. 6,349,289, and the entirety of each of these applications is incorporated herein by reference.
BACKGROUND OF THE INVENTION
• The present invention relates to a system and method for monitoring access to each of a plurality of unrelated host computer networks. More particularly, the present invention relates to a system and method of tracking computer usage, and costs associated with the computer usage, by authorized users of different computer networks.
• Many organizations, both in government and in private industry, rely on access to centralized computer facilities. Use of remote access capabilities to centralized computer facilities is generally desirable in order to facilitate use of computer resources and improve productivity. Remotely located individuals who are, for example, traveling on business, often need to access their organization's computer. A concern of many organizations is monitoring the costs of remote users accessing the host computer or computer network of the company, in addition to tracking the usage of computer time and various costs associated with that time.
• Typically, each organization's computer facility tracks computer usage internally and generates various reports based on that information. Also, the costs associated with remotely dialing up an organization's computer facilities, such as the telephone line charges, are reported separately by each of the one or more long distance line carriers utilized by the remotely located computer users. Additional costs of maintaining a remotely accessible computer network, such as supporting an information services person or department to handle difficulties with remote access by authorized users, may take up significant resources particularly in smaller organizations.
BRIEF DESCRIPTION OF THE DRAWINGS
• FIG. 1 illustrates a preferred embodiment of a system for monitoring computer usage and costs associated with remote access according to the present invention.
• FIG. 2 is a flow chart showing a preferred method of monitoring computer usage and costs using the system ofFIG. 1.
DETAILED DESCRIPTION OF THE PRESENTLY PREFERRED EMBODIMENTS
• An advantage of the present invention is consolidation of usage and billing information in a single report. Another advantage of the present invention is the ability to manipulate the usage and billing data for each of a number of different host computer networks by individual user and by predetermined groups or departments of users at each organization. The preferred method and system cooperate with a system for securing access between remotely located computer users and the computers of different organizations for which they are permitted access.
• FIG. 1 illustrates apreferred system10 for securing access between remotely located computer users and computers of different organizations in addition to monitoring access and maintaining billing records for each host computer system. Thesystem10 includes at least one remotely locateduser computer12. Asecure identification card14 is associated with the user and theuser computer12. Auser computer12 preferably communicates over standard telephone lines, also known as plain old telephone service (POTS) lines17, viamodem16 through the public switched telephone network (PSTN)18. Thesystem10 of the present invention may use other commonly available communication devices, such as an ISDN terminal adapter or a communications server, in place of the analog modem. The user computer may be a personal computer or another computer network. One suitable secure ID card is available from Security Dynamics, Inc. of Cambridge, Mass. and includes a display showing a time variant pass code for use by an authorized user in accessing a host computer network.
• Acommunications server20, which may be a router such as a Cisco 5200, is in communication with asecurity service bureau22 over aframe relay network18. Thesecurity service bureau22 may be a local area network (LAN)26 that includes at least oneadministrative workstation28 for monitoring operation of thesecurity service bureau22. A suitableadministrative workstation28 may be any of a number of commonly available personal computers. A network access server (NAS)30 is also connected to theLAN26. TheLAN26 of theservice bureau22 connects to theframe relay network24 via afirewall32. The firewall may be a personal computer, such as those available from SUN Microsystems, running software available from SOLARIS to provide protection to the service bureau LAN26 from outside corruption. The NAS30 may be any of a number of servers available from Hewlett Packard, such as the HP712, HP755, or the HP720. The NAS30 of theservice bureau22 controls access of remote users, through thecommunication server20 andframe relay network24, to the multiplehost computer networks34 or stand alone computers. In the example ofFIG. 1, each of the host computer networks or stand alone computers utilize the service bureau to authenticate remote users atvarious computers12. One system and method for authenticating users through a service bureau is disclosed in a commonly assigned U.S. application Ser. No. 09/008,527, filed Jan. 16, 1998, and is hereby incorporated by reference in its entirety.
• Thesystem10 also includes an integrated service center (ISC)35 and an enterprise service system (ESS)37. The ISC35 preferably includes a computer configured to accept all service requests from various end user host computer networks desiring to add or remove computer use monitoring services or change the list of authorized users for the network. Additionally, the ISC35 receives telephone calls fromend users12 seeking help relating to remote access services. TheISC35 assigns help requests to the appropriate party in thesystem10. In one embodiment, the ISC35 is a vertically integrated service center and help desk for video, audio, and data communications.
• The ESS37 is a master database containing lists of periodic user charges, also known as “per seat” charges, for the various host computer systems serviced by thesystem10. The ESS37 also contains a list of field service fees associated with a respectivehost computer network34 and records any extra services used by ahost computer network34 and its authorized users. The fees for each particular host computer network are negotiated prior to beginning services to a particular host computer network and associated authorized users. The negotiated fees may be stored as tables in the ESS. The ESS37 may be a server running UNIX software such as a SPARC Server available from SUN Microsystems. The ESS receives updates on authorized users and subscribing host computer networks from the ISC.
• A network management center (NMC)39 is in communication with theISC35 and a privatecorporate intranet19 via the ESS37. The NMC39 receives help requests from the ISC and provides a help desk for network infrastructure problems, performance issues and chronic desktop problems. The NMC39 uses a pre-entered user definition and information to create a trouble record for resolving issues associated with remote access services provided to thehost computer networks34. Each trouble call is stored at theNMC39. The NMC serves to provide proactive surveillance of all physical lines and communications servers in the system as well as handling trouble calls passed on from the ISC.
• A customer service center (CSC)40 is also linked to thesystem10 via the ESS and the privatecorporate intranet19. The CSC40 manages the ordering of POTS services and repairs of business lines (e.g. DS1, ISDN, etc.). A billing application communicates over thecorporate intranet19, via theESS37, with theNAS30 andother system10 components to obtain necessary billing information concerninghost computer networks34 and their respective users. Preferably, the billing application is a software application running within the ESS containing logic necessary to organize cost data by per user and per entity within a particular client's (host computers) organization. Alternatively, the billing application may be adiscrete billing computer42 executing the necessary logic to obtain and manipulate billing information.
• Utilizing thesystem10 described above, a preferred method of monitoring access to each of the host computer networks subscribing to the system security services is illustrated inFIG. 2. Eachcomputer network34 provides an associated list of authorized users that is maintained at the ISC, ESS, and NAS30 (at step50). An authorized user accessing a host computer exchanges the information with theNAS30, via the communication server, each time the user dials in to gain access to his respectivehost computer network34. A starting time stamp is created at the beginning of each remote access call received from a user at the communication server20 (at step52). In a preferred embodiment, the remote user accesses his respective host computer network by dialing in through thePSTN18 using amodem16 or other communication device to reach anetwork communications server20. Thecommunication server20 forwards information on the call through theframe relay network24 to theservice bureau22. At theservice bureau22, theNAS30 authenticates the user through the exchange of a user name and a pass code.
• The pass code preferably consists of a fixed personal identification number and a time variable security token. The security token may be a soft token, such as a software application on each authorized user's computer, or a hard token, such as asecure ID card14 available from Security Dynamics, Inc. Each authorized user preferably has her own security token and the security token may be a sequence of numbers, letters, or other type of symbol. Using thesecure ID card14, the security token is obtained by the user from a display that generates a new security token at predetermined time increments. TheNAS30, containing an identical security token generating algorithm synchronized with thesecure ID card14 generates the same security token to verify that the user is an authorized user. On authentication, thecommunication server20 connects theuser computer12 to theappropriate host computer34 for the duration of the call. TheNAS30 receives an ending time stamp from thecommunication server20 at the conclusion of the remote access call when the user hangs up or otherwise disconnects from the host computer network34 (at step54). Following the conclusion of the remote access call, the service bureau stores the starting and ending time stamps in the NAS memory. Preferably the starting and ending time stamps are associated in the user log with the list of authorized users so that the user log contains a record of computer time usage for each authorized user (at step56).
• After the end of the predetermined billing period, the user log is transmitted from the service bureau in a discrete file generated at the NAS to the billing computer42 (at step58). The billing period may be any desired length of time, such as a month or a year. The list of host computer networks and associated list of authorized users for a host computer network is also transmitted to the billing computer (at step60) from the NAS over the frame relay network. The billing computer then generates a billing summary for each of the subscribing customer host computer networks (at step62).
• As part of the process of developing a periodic bill for customers subscribing to the system, a long distance carrier invoice is electronically transmitted to the billing computer from a long distance telephone service provider. The long distance service provider may be any one of a number of available service providers, such as Ameritech, selected by the host computer network. The long distance telephone service provider transmits a minutes of use invoice for the long distance access number used by authorized users of a given host computer network to access the security service bureau. The long distance access number may be an “800” number or other telephone number dedicated for use by authorized users to communicate with the appropriate host computer through thesystem10.
• Because each authorized user of a given host computer network is provided with the same telephone number, the billing computer can use the unique pass code each user possesses to distribute the minutes of use charge to the appropriate. Preferably, the long distance charges are distributed appropriately among the users of each host computer network based on a user's percentage of computer access time for that billing period. TheESS39 provides fixed expense information to thebilling computer42 by way of monthly per seat charges and incident charges. Incident charges refer to the fees assessed to calls by authorized users to the system help desk at the CSC.
• Using all the information gathered, the billing computer based on the subscribed for services and the usage of each individual authorized user, various usage information and billing forms will be created. For example, in one preferred embodiment a bill may be generated that breaks up authorized users into the various departments to which they are assigned within a customer's organization. For each authorized user in the department a predetermined group of information may be displayed. This information may include per seat charges, the cost of long distance telephone usage (distributed among authorized users based on the amount of time a user was communicating with the host computer network), any equipment charges, maintenance charges, and miscellaneous charges. The per seat charges refer to fixed service charges associated with supporting each authorized user. The miscellaneous costs may include incidental security cost such as replacing secure ID cards, or for particular pieces of software necessary for enabling remote users to access their host network through thesecurity service bureau22. Optionally included in the per seat charges are the local exchange and other incidental charges. Once the billing summary has been generated, the billing computer can transmit the billing summary directly to the appropriate host computer network. The transmission may be done via e-mail over an internet connection, via facsimile, or through other means.
• Another aspect of the presently preferred invention is that computer usage information may be provided to the customer and the service provider maintaining thesecurity service bureau22 so that computer resources may be optimized for usage patterns. For example, the billing computer may generate monthly or annual reports dividing up the usage for each individual authorized user by total time used per a given period or by time of day or week so thathost computer network34 orservice bureau22 resources can be properly allocated for particularly heavy usage.
• From the above, a new system and method of monitoring access and fees for host computer networks with relocated users is provided. The method includes maintaining a list of host computer networks and associated list of authorized users for each network, creating a starting and ending time stamp for remote access calls, transmitting the starting and ending time stamps in the user log to a billing computer in addition to other billing information, and generating a billing summary of costs and usage at the billing computer. The system preferably includes a security service bureau providing secure remote access between remotely located authorized users and their respective proprietary host networks. In one preferred embodiment, the NAS preferably records time stamps and a user log indicating usage of resources by individual authorized users. A billing computer is also included in the system having the logic necessary to compile information from the user log in the security service bureau and cost information received from outside sources to generate a periodic bill indicating cost per individual user and/or department.
• It is intended that the foregoing detailed description be regarded as illustrative rather than limiting, and that it be understood that the following claims, including all equivalents, are intended to define the scope of this invention.

Claims (7)

1. In a system for providing secure remote access between a plurality of unrelated host computer networks and a plurality of authorized users via a network access server, a method of monitoring access to each of the unrelated host computer networks comprising the steps of:

receiving at a communication server a request from a remotely located computer user to access one of the plurality of unrelated host computer networks;

automatically transmitting information regarding the request from the communication server to the network access server, the information comprising identification information for the remotely located computer user;

determining at the network access server if the user is authorized to access the one of the plurality of unrelated host computer networks;

establishing a connection between the remotely located computer user and the one of the plurality of unrelated host computer networks via the communication server if the remotely located user is an authorized remotely located user for the one of the plurality of unrelated host computer networks;

storing computer usage time for the authorized remotely located computer user in a user log at the network access server after the authorized remotely located computer user disconnects from the one of the plurality of unrelated host computer networks whereby the user log contains a record of computer time usage for each authorized user;

for each of the plurality of unrelated host computer networks, generating a billing and computer time usage summary, each billing and computer time usage summary listing charges and computer time usage for a respective one of the plurality of unrelated host computer networks; and

electronically transmitting each billing and computer usage summary to an appropriate one of the plurality of unrelated host computer networks.

2. The method ofclaim 1, wherein generating a billing and computer time usage summary further comprises generating a list of fixed charges and generating a list of help desk charges for each of the unrelated host computer networks.

3. The method ofclaim 1, wherein generating a billing and computer time usage summary further comprises receiving a long distance telephone company report containing charges associated with each of the respective unrelated host computer networks.

4. The method ofclaim 3, further comprising listing, in the billing and computer time usage summary for a particular unrelated host computer network, charges from the long distance company report for each remotely located computer user of the particular unrelated host computer network.

5. The method ofclaim 4, wherein listing charges from the long distance company report comprises calculating a percentage of computer use time attributable to each of the remotely located computer users for the particular host computer network and distributing the charges from the long distance company report to appropriate remotely located computer users in the billing summary for the particular host computer network according to the calculated percentage of computer use time.

6. The method ofclaim 1, wherein storing computer usage time for the authorized remotely located computer user comprises recording starting and ending time stamps for a remote access call to the one of the plurality of unrelated host computer networks in the user log.

7. A system for providing secure remote access between a plurality of unrelated host computer networks and a plurality of authorized users, the system comprising:

a first processor configured for communication with the plurality of unrelated host computer networks;

first processor logic executable by the first processor comprising instructions for executing the following steps:

in response to receipt of identification information for a remotely located user seeking to access one of the plurality of unrelated computer networks, determining if the user is authorized to access the one of the plurality of unrelated host computer networks;

establishing a connection between the remotely located computer user and the one of the plurality of unrelated host computer networks via a communication device if the remotely located user is an authorized remotely located user for the one of the plurality of unrelated host computer networks; and

storing computer usage time for the authorized remotely located computer user in a user log after the authorized remotely located computer user disconnects from the one of the plurality of unrelated host computer networks whereby the user log contains a record of computer time usage for each authorized user;

a second processor in communication with the first processor; and

second processor logic executable by the second processor comprising instructions for executing the following steps:

generating a billing and computer time usage summary for each of the plurality of unrelated host computer networks, each billing and computer time usage summary listing charges and computer time usage for a respective one of the plurality of unrelated host computer networks; and

electronically transmitting each billing and computer usage summary to an appropriate one of the plurality of unrelated host computer networks.

Images