Two-tier authentication system where clients first authenticate with independent service providers and then automatically exchange messages with a client controller to gain network access

摘要

A method and apparatus to control a client in a communication network accessed by the client through a service provider independent of a client controller. In one embodiment, a hardware capable Internet Service Provider (ISP) functions as the communications network service provider. A virtual ISP operates the client controller, leases Internet access time from the hardware capable ISP, and resells Internet services to users. A client accesses the network through a two stage authentication process. First, the hardware capable ISP authenticates the client using a user-provided ID and password. After successfully logging on to the hardware capable ISP, the client automatically sends a start session message containing user identity information to the client controller. In response, the client controller sends a control message to the client authorizing use of the network for a predetermined time period. When the client stops accessing the network, the client informs the client controller using an end session message. If the client wants to access the network beyond the predetermined time period, the client informs the client controller using a continue session message. If no end session or continue session message is received, the client controller assumes that the client is no longer accessing the network at the end of the predetermined time. The client controller can initiate communication with the client by sending other control messages, such as display and download commands.