Method and circuit arrangement for verifying the authorization to gain access to a signal-processing system

The invention relates to a method and a circuit arrangement for checking the authorization of access to a signal processing system of connected therewith, designed for the delivery and possibly also for the reception of signals peripheral devices forth using one of the respective peripheral device assigned numerical and a respective for peripheral device freely selectable identification information.

In signal processing systems, can be accessed from the peripheral equipment to the forth, means are often provided, the first check with an intended access from one peripheral device associated with them from the access authorization with respect to the peripheral device in question. Examples of such signal processing systems are private and public communication systems and data processing systems through which external participants are offered specific services. For a check of access authorization can now, for example, as already mentioned in connection with the subscriber identification through a viewdata known (DE-OS 2,842,777), be to proceed such that each of the peripheral devices is assigned a certain number, a certain measure, such as that at is an intended access from one of the peripheral devices from transmitting along with a for that peripheral device freely selectable identification information to the signal processing system down. However, a check of access authorization based such a key figure and one of these associated identification information brings with it the disadvantage that distortions of metrics and associated identifying information, in particular by manipulation, can not be excluded.

It is an object of the present invention to show a way in a method and a circuit arrangement of the type mentioned a largely safe check of access authorization of peripheral devices is possible.

is solved the above-mentioned object, in a method and a circuit arrangement of the type mentioned according to the invention characterized in that for each of the peripheral devices in the signal processing system, a keyword is stored, which is in each case derived from the said code and the identification information of the respective peripheral device, and that with an intended access from one of the peripheral devices, first the forth of this for given code and the associated identification information are associated with the peripheral device associated with the relevant keyword.

The invention has the advantage that can be done by linking a plurality of information, namely, code, identification information and keyword, a check of access authorization at a high security. The security is achieved in particular in that two of the to be linked is not of the same users or the operator of the signal processing system available. So only the individual peripheral devices associated keywords are stored in the signal processing system. The procedure for the determination of these keywords is known neither the users nor the operators of the signal processing system. The identification information is finally set selectable by users of the signal processing system in the commissioning of a peripheral device and are not stored in the associated signal processing system.

The method according to the present invention can advantageously also for checking the authorization of access by an operator station of the signal processing system on this data stored information thereby apply that before accessing such data information access authorization using one of the relevant operating station assigned code, a freely selected for the operating station in question identification information and one in the signal processing system stored for the operating station in question key word is checked.

In addition, the method according to the present invention in an advantageous manner for checking the authorization of the activation of the operation of a respective control processes the signal processing system of an operator station of this signal processing system characterized is applicable that, before an activation of control sequences, the authorization with respect to the relevant operating station with reference to a this allocated code, one for the service station concerned freely selectable identification information and a stored in the signal processing system for the operator station in question keyword is checked.

In the aforementioned two applications, the advantage of the invention is that only one access authorized persons of the operator of the signal processing system has access to data stored in the signal processing system data information and is entitled to certain to activate the operation of the signal processing system in question control processes.

In the derivation of the keywords and checking the access authorization can also be included in addition to the mentioned figures and identifying information a set for the respective signal processing system System code. This provides the advantage of further increasing the safety when checking the access authorization to a signal processing system with it.

Furthermore, the method according to the present application is applicable advantageously to identify in a packet switch a packet switching network extending compounds included calling and / or called party locations in the relevant packet switch. Such identification is carried out in such a way that for each of the packet switch standing over a transmission channel connected subscriber station in the packet switch at start of each transmission channel, a keyword is stored, which in the packet switch of the above, freely selectable identification information and the respective subscriber station assigned number is deduced that in this structure introductory package in addition to the respective identification information corresponding to each subscriber telephone number assigned is transmitted as part of the structure of a compound and that the number transferred and the associated identification information respectively with the respective subscriber station associated keyword identification are linked.

Preferably an initiated connection setup is continued only for a fault-free identification of the respective calling and / or called subscriber station. This brings with it the advantage that on the one hand switching operations will only be handled in a packet switching center, if the respective calling and / or called party entity could be identified for subsequent charging. On the other hand has also the ability to lock, for example, by deleting keywords specific subscriber sites for building links. In each packet switch thus eliminates the need to create separate lists of banned users locations in the packet switch.

Appropriately chosen a separate identification information for each of these subscriber stations by the operator of the private branch exchange at subscriber sites that are available through a private branch exchange with the packet switch in compound. This makes it possible to easily perform a separate billing for each participant Presented PBX.

Can be taken by the individual subscriber stations different, provided by the operators of the switching networks available services in either claim, so it is advisable that also services requesting information signals are transmitted in a packet for initiating the construction of a compound of according to an identification each subscriber station are used as the current parameters. This brings with it the advantage that the questions submitted by the operators of the switching networks available services can actually be taken only by an authorized participants to complete.

A circuit arrangement for carrying out the method according to the present invention can thereby be realized with a relatively low outlay on circuitry that the signal processing system comprises a memory device having a number of peripheral devices is the corresponding number of memory cells of the peripheral devices respectively associated keywords for storing associated, that a first register for caching an output from one of the peripheral devices measure and a second register for the intermediate storage of the relevant key figure associated identification information are provided and that the said registers and the memory array, a logic circuit is connected, which you of the two registers forth supplied figures and those associated identification information associated with the metrics are based on keywords. Through drawings the invention is described for example in detail.<dl id="dl0001"><dt>figure 1</dt><dd>shows in a block diagram of a signal processing system in which the invention is applied,</dd><dt>figure 2</dt><dd>shows the structure of an identification arrangement only shown schematically in Figure 1 and</dd><dt>figure 3</dt><dd>shows a possible structure of a foreseen in the identification arrangement of FIG 2 switching circuit.</dd><dt>figure 4</dt><dd>shows a block diagram of a packet switching network as another application for the present invention.</dd></dl>

1 shows a signal processing system SVS is shown in fragmentary form. This system may, for example, a communication system of a private or public transmission network. However, this system can also form a data processing system, which can access external users for the use of certain, lying in the field of data processing services. With the signal processing system comprises a plurality of peripheral devices TE is connected. These may be formed of conventional communication devices for receiving and / or distributing data signals depending on the nature of the associated signal processing system. Moreover, with the signal processing system SVS as another peripheral device a designated BS operator station connected over which operating personnel for maintenance and operation is given access to the signal processing system.

From the signal processing system SVS a central signal processing serving processing unit VE is shown in FIG. 1 Of these, only a central control unit CPU and with this via a bus line connected from only memories ROM and read / write memories RAM are indicated existing storage unit. This processing unit VE a transmitting / receiving device SE is connected, on the condition that said peripheral equipment TE and the service station BS access to the processing unit. The processing unit and the transmitting / receiving arrangement finally is still an identification device ID associated with their input. The outcome of this identification device is connected to a control input of the transmitting / receiving arrangement.

In the following, the method will now be described for checking the authorization of access to the signal processing system SVS in detail with reference to Figures 2 and 3. FIG.

Each of the peripheral devices TE and the operator station BS is allocated by the signal processing system establishes a separate measure, in the case of a transmission system a telephone number. When starting up the signal processing system a keyword to a specified arithmetic operation is formed for each of the peripheral devices and the operator station based on the respective assigned numerical and a by the user of the respective peripheral device or the service station freely selectable, a string representing identification information. This keyword is stored in a designated in in Figure 2 SWS memory identification device ID for the duration of the connection of each peripheral device or the service station to the signal processing system or to the redefinition of a keyword. This memory has for the reception of keywords on a location input and LE is so organized that for each of the peripheral devices TE and the operator station BS, a memory cell is reserved for recording a keyword. The set of individual keywords to determine arithmetic operation is known, moreover, neither the users nor the operators of the signal processing system. In addition, the operating personnel are those defined by the users identification information inaccessible. In the case of the operator's station, the fixed identification information is known only to an access-authorized persons.

If now, for example, access to the signal processing system SVS from one of the peripheral devices here intended, the respective peripheral device for delivery of the assigned code and the associated identification information is requested. For the storage of this information two separate registers in the identification device ID shown in Figure 2 are provided, namely a code register KR and an identification information register IIR, the said information via a line system BUS1 or BUS2 from the transmitting / receiving arrangement SE ago fed condition.

Using the cached in the register KR measure now the aforementioned memory SWS is driven via a pipe system BUS3 for reading the stored in it for the designated by this measure peripheral device keyword. This read keyword that occurs on a line system BUS5 and the information stored in the registers KR and IIR provided on the one hand on the aforementioned line system BUS3 and secondly to a duct system BUS4, then a designated in Figure 2 VS logic circuit is applied , This subjects the supplied thereto as inputs input signals a specified binary arithmetic operation. This occurs at the output of the logic circuit binary output signal are thereby insight into the result of the check of access authorization for the candidate peripheral device. Equivalent as the output signal to a fixed expected value, so the candidate peripheral device for access to the signal processing system SVS is entitled.

When arithmetic operations for determining keywords and for the performed using the combination circuit VS checking access any binary arithmetic operations can be provided in the other depending on the required security for this review. Both provided arithmetic operations only need to be coordinated so that a predetermined expected value can be set in an error-free verification of an access authorization to the output of the logic circuit. An example of a possible implementation of the combination circuit VS is shown in FIG. 3 Thereafter, the logic circuit has a number of input signals respectively associated information bits in a corresponding number of AND gates G11 through G1n. These AND gates are each configured with three inputs, are on the leading them with mutually corresponding information bits lines of management systems BUS3, BUS4 and BUS5 connected. The output signals of the AND gates G11 to G1n are fed to a further AND-member, which for a number of these AND gates has corresponding number of inputs. The output of this AND gate is the output of the logic circuit VS.

The proposed access to the signal processing system SVS from one of the peripheral devices forth described above is only in an error-free check of access authorization that the transmitting / receiving device SE is shown by the combination circuit VS illustrated in Figure 2 ago, admitted.

Above, the check of access authorization has been explained using the example of a peripheral device TE. The process steps described respective process steps run from but even if an access to the signal processing system of the service station BS ago intended. Such an approach may be necessary, for example, for maintenance and service purposes. It is ensured by the above-described check of access authorization, that only a selected group of people on in the signal processing system or access certain can enable necessary control procedures for the operation of the signal processing system data stored information.

Incidentally, it should be noted that for a further increase in safety when checking the access authorization in addition to each signal processing system, a separate system code can be assigned, respectively in the successive abovementioned concerted arithmetic operations for the formation of the key words and for the means combination circuit VS performed check of access authorization is included as an additional input variable. For example, as shown in FIG. 2, the identification device having an additional ID, standing with the combination circuit VS in conjunction register Reg, in which the system code is stored.

The above-described method for checking the access authorization can be applied in the relevant packet switch also advantageously to identify running in a packet switch a packet switching network connections included calling and / or called party locations. In Figure 4, such a packet switching network is illustrated schematically. It is denoted by PN. This packet switching network may thereby for example be formed from the two packet switches standing over a transmission line connected to each other PV1 and PV2. At such packet switches generally a plurality of subscriber stations can be connected. However, only the connection of a few subscriber stations is indicated for simplicity in FIG. 4 So only one designated TS1 subscriber station is for example connected to the packet switching center PV1. In this it may be a packet-oriented subscriber station, which enables transmission of data signals in accordance with CCITT Recommendation X.25.

With the packet switching center PV2 subscriber stations are connected to TS2 TS5. The subscriber station TS2 is connected directly to the packet switch, that here there is a subscriber station, can absorb and release the data signals in packet form. The subscriber stations TS3 and TS4 are connected via a private branch exchange NST to the packet switching center PV2. This PBX may be so configured that a data signal exchange between it and the associated packet switch may take the form of packets.

With the packet switching center PV2 the subscriber station TS5 is finally connected indirectly. This subscriber station is connected to a circuit switch DV a circuit switching network. In the circuit switching network may be a telephone network, for example,. Because in such a telephone network, the connection establishment serving signals and data signals are not transferred in the form of packets, a direct transmission of these signals between the circuit switch DV and the packet switch PV2 is not possible. Rather, a signal conversion is required. For this purpose, the packet switching center PV2 to in Figure 4 designated PAD converting. This conversion device is in signal transmission from the circuit switch to packet switch toward the z. B. first in start-stop format transmitted signals into packets in order. Correspondingly, in signal transmission in the opposite direction there is a conversion of packets into signals with start-stop format. The conversion functions specified are referred to in the rest as packetizer Entpaketier functions.

Whichever is to be used in individual cases for the connection of subscriber stations to a packet switch of the above types of connection, it is for example for later billing or for the participation of an application made by the operator of the packet switch available service, for example, the service "Assignment a closed user class "required subscriber stations, of which a connection is initiated to identify clearly in the packet switch. For such identification, the two packet switches shown in Figure 4 PV1 and PV2 respectively a closer already explained above identification device ID on. This identification device is the input side transmission / reception devices SE1 and SE2 in connection, via which the respective packet switch in the form of packets absorbs or emits data signals occurring. On the output side the respective identification device is connected to control inputs of their respective associated transmission / reception devices.

When commissioning a transmission channel of a packet switch, for example, the packet switch PV2 shown in Figure 4, for the connection of a packet-oriented subscriber station or for connection of a Teilnehmertstelle via a conversion device is based on the set for the relevant subscriber station number and a selectable freely by the user of the subscriber station identification information formed a keyword in the manner already indicated above. Such a keyword is in this case stored in a corresponding memory SWS shown in Figure 2 the memory of the relevant packet switch associated identification device ID for the duration of the withdrawn just in operation or transmission channel to the redefinition of a keyword.

If now, for example of a packet-oriented subscriber station, z. B. the subscriber station TS2 in Figure 4, establish a connection to a further subscriber station that may be TS1 the subscriber station shown in Figure 4, it is first for initiating the call setup packet ( transmitted packet for an incoming call) from the calling subscriber station TS2. This package includes among others the own number of the subscriber station TS2 and the selected identification information. then carried the basis of this number and the identification information by means of the illustrated in Figures 2 and 4 identification device ID to identify the subscriber station TS2 in the already explained in connection with the check of access authorization to a signal processing system manner.

The proceedings initiated by the subscriber station TS2 connection will be continued only in an error-free identification that is displayed in this case, the transmitting / receiving facility SE1 of the logic circuit VS illustrated in Figure 2 ago. Thus, for example, ensures that only then a connection is made, if the calling subscriber station is identified for a fee collection. On the other hand, the fact that a connection is completely established only when an error-free identification of the calling subscriber station, also exploited for selective disabling of subscriber locations for outgoing calls. Because here it is possible to bring about by targeted deletion of keywords is banned for these keywords associated subscriber stations. Separate lists for blocked for outgoing calls subscriber stations are not required.

In a continuation of making connections are otherwise between the candidate subscriber stations, here the subscriber station TS2, and the packet switch packets according to CCITT Recommendation X.25 exchange. In this exchange is not received in more detail below.

Above, the identification of the calling subscriber station has only been explained using the example of the packet-oriented subscriber station TS2. The process steps described respective process steps run from but even if the identifiable subscriber stations are, for example, via a transfer device (PAD in Figure 4) with the packet switch in conjunction. In this case, a so-called zIndicates done ufenwahl. The first stage consists in the delivery of an access point for the packet switching network. After that is handled as a second stage provided for the packet switching network selection procedure. For this implementation, the phone number, the selected identification information and the phone number of the called subscriber station in the form of start-stop signals are delivered and inserted into the converting PAD in a suitable package, for example, by a person working for a asynchronous transfer mode subscriber station as an option information.

Finally, above already noted that subscriber stations via a private branch exchange can be associated with a packet switch (NST in Figure 4). Also in this case takes place an identification of a calling subscriber station in the manner already explained. For each of the devices connected to the PBX subscriber stations may be granted a special identification information, so that, for example, a subscriber provide custom billing can be carried out.

Along with the number of the calling subscriber station and the identification information even services requesting information signals can be transmitted in a packet to initiate a connection setup. In this case it is advantageous if the information signals are only used as the current parameters in the packet switch when the package donating caller location could be identified without error. Thus, for example, ensures that only an authorized user code can take certain repair.

Although the above method for identifying subscriber stations has merely been explained using the example of a calling subscriber station. However, it may also be necessary in certain cases, an identification of the called subscriber stations, for example, when fees are taken over by called party or an association called subscriber to closed user groups. Even for such identification, the method described above can be advantageously applied. The required identification information, namely, number and identification information are transmitted in this case by the respective gerufenden subscriber station with the call confirmation in response to an outgoing call to the candidate packet switch back.

Incidentally corresponding operator stations can also join the packet switches PV1 and PV2 the operator station BS shown in Figure 1 shown in Figure 4 can be connected, of which it is a select group of people able to access information stored in the respective packet switch data information or specific to the operation of each packet switch to enable necessary control operations.

LIST OF REFERENCE NUMBERS

<dl id="dl0002"><dt>BS</dt><dd>operating station</dd><dt>BUS1, ..., BUS5</dt><dd>line system</dd><dt>CPU</dt><dd>control unit</dd><dt>DV</dt><dd>Circuit switch</dd><dt>G11, ... G1n, G2</dt><dd>AND gates</dd><dt>ID</dt><dd>identification arrangement</dd><dt>IIR</dt><dd>Identification information register</dd><dt>KR</dt><dd>Code register</dd><dt>LE</dt><dd>load input</dd><dt>NST</dt><dd>PBX</dd><dt>PAD</dt><dd>converting</dd><dt>PN</dt><dd>Packet switching network</dd><dt>PV1, PV2</dt><dd>Packet switch</dd><dt>R.A.M.</dt><dd>Read / write memory</dd><dt>Reg</dt><dd>register</dd><dt>ROME</dt><dd>Read Only Memory</dd><dt>SE, SE1, SE2</dt><dd>Transmitting / receiving arrangement</dd><dt>SVS</dt><dd>Signal Processing System</dd><dt>SWS</dt><dd>memory</dd><dt>TE</dt><dd>peripheral device</dd><dt>TS1 ... TS5</dt><dd>subscriber station</dd><dt>VE</dt><dd>processing unit</dd><dt>VS</dt><dd>switching circuit</dd></dl>