Initiation module for initiating network-based services

CROSS REFERENCE TO RELATED APPLICATION

P-0001[0001] This application claims the benefit under 35 U.S.C. §120 of patent application Ser. No. 10/213,043, entitled “System And Method For Setting Up User Self-Activating Network-Based Services”, by Bellinger et al., filed Aug. 5, 2002 (the subject matter of which is incorporated herein by reference), which in turn claims the benefit under 35 U.S.C. §119 of the provisional application serial No. 60/354,268, entitled “Software Platform For Managing Network-Based Services', by Bellinger et al., filed Feb. 4, 2002 (the subject matter of which is incorporated herein by reference).

TECHNICAL FIELD

P-0002[0002] The present invention relates to setting up network-based services, and more particularly to a method by which a subscriber quickly self-activates network-based services.

CROSS REFERENCE TO COMPACT DISC APPENDIX

P-0003[0003] Compact Disc Appendix, which is a part of the present disclosure, includes one recordable Compact Disc (CD-R) containing information that is part of the disclosure of the present patent document. A portion of the disclosure of this patent document contains material that is subject to copyright protection. All the material on the Compact Disc is hereby expressly incorporated by reference into the present application. The copyright owner of that material has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights.

BACKGROUND

P-0004[0004] Providing a network-based service generally involves provisioning both hardware and software. An example of such a network-based service is offering different levels of access to the Internet (referred to as “Quality of Service (QoS)”) through a service provider's network.

P-0005[0005] When a subscriber wishes to subscribe to the service, typically a person at the service provider manually configures the hardware and software components of the necessary network elements to allow the subscriber to consume the service. Such configuration might, for example, involve setting up configuration files on a QoS server and configuring a gateway and a firewall to allow information from the subscriber to pass through the service provider's network and reach the Internet. This can be a time-consuming task.

P-0006[0006] A product is provided that facilitates and automates this configuration process. A service provider can use this product to publish an offering of various networked-based services to subscribers. The subscriber can choose to subscribe to the service. Once the subscriber has agreed to subscribe, the product is used to register the subscriber for the service so that the necessary configuration operations can be performed on the network elements automatically. An example of such a product is the xAuthority software system available from Atreus Systems Corp., of Ottawa, Ontario.

P-0007[0007] Typically service provider personnel use the xAuthority system to publish a service offering to a subscriber. When the subscriber expresses interest in a particular service, service provider personnel use the xAuthority system to subscribe the subscriber to the service. Once subscription has taken place, the subscriber registers for the service. Thereafter, the service is initiated. The subscriber registers by accessing a service portal of the xAuthority system and provides inputs to a preconfigured state machine. After the subscriber is registered, the state machine initiates the service by provisioning network elements to provide the service to the subscriber.

P-0008[0008] The registration process contains many steps and can be quite complex. Delays occur during this process, which involves many events. Initiating a service is slowed when numerous complex registration steps are repeated prior to each time a subscriber intermittently uses a service. Impatient subscribers wait while all of the registration steps are repeated when those subscribers wish to return to the service. An impatient subscriber may therefore be dissuaded from using the services. A solution is desired.

SUMMARY

P-0009[0009] A system allows a subscriber quickly to self-activate network-based services by automatically configuring network elements. A service provider preconfigures a state machine on a core server. The state machine is run through publication steps, subscription steps, registration steps and initiation steps, and the subscriber self-activates the services using the state machine.

P-0010[0010] During the initiation steps, activations are sent to policy distribution points (PDPs) that translate the activations into device-specific instructions, which in turn configure network elements to provide the services. The speed of self-activation is increased by generating activations faster in the core server, by translating activations into device-specific instructions faster in the PDPs, and/or by configuring network elements faster through performing registration operations before the initiation steps.

P-0011[0011] Activations are generated in the core server and are translated in the PDPs by modules of web server software that are compiled together with the rest of the web server software on the core server and PDPs. The modules operate faster because they are compiled together with the web server software. Writing configuration files and other registration information to databases is performed during the registration steps. The initiation steps are performed by an initiation module. The initiation steps are performed faster because they are focused on configuring network elements and do not involve writing to databases. When the subscriber intermittently uses a service, for example, by switching back and forth between services, the initiation module efficiently and automatically performs the initiation steps each time the subscriber begins and ends the service. The initiation module performs dynamic service selection by dynamically generating activations used to start and stop services.

P-0012[0012] In one embodiment, an interface is provided whereby the service provider identifies a network element used to provide a service to the subscriber. The service provider defines configuration information that is sent to the network element in the event the subscriber elects to start the service. Thereafter, a second interface is provided whereby the subscriber registers for the service and initiates the service without action by the service provider. The subscriber registers once for the service and thereafter is able to initiate the service multiple times, starting and stopping the service at will. Starting the service involves generating an activation from the configuration information and sending the activation to a policy distribution point. The policy distribution point converts the activation into device-specific instructions that provision the network element to start the service for the subscriber.

P-0013[0013] In another embodiment, a system by which networked-based services are self-activated includes a billing system, a network element used to provide a service, a core server and two policy distribution points (PDPs). The network element can be a networking device or a computing device. The core server includes a user database, a first part, and a second part.

P-0014[0014] The first part generates a first activation, and the second part generates a second activation. The first PDP receives the first activation, translates the first activation into first device-specific instructions, sends the first device-specific instructions to the billing system, which is configured to provide the first service to the subscriber. The second PDP receives the second activation, translates the second activation into second device-specific instructions, sends the second device-specific instructions to the network element, which is configured to provide the first service to the subscriber. The first part sends the first activation during the registration steps, and the second part sends the second activation during the subsequent initiation steps.

P-0015[0015] Other embodiments are also disclosed in the detailed description below. This summary does not purport to define the invention. The invention is defined by the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

P-0016[0016] The accompanying drawings, where like numerals indicate like components, illustrate embodiments of the invention.

P-0017[0017]FIG. 1 is a diagram of a system that allows a subscriber to self-activate network-based services.

P-0018[0018]FIG. 2 is a block diagram showing a core server of FIG. 1 in more detail.

P-0019[0019]FIGS. 3A and 3B are a flowchart illustrating a method of initiating a network-based service in accordance with a specific embodiment of the present invention.

P-0020[0020]FIG. 4 is a screenshot of an initiation tab of the system used by a service provider to preconfigure initiation steps.

P-0021[0021]FIG. 5 is a screenshot provided by the system for the service provider to define start actions of the initiation steps.

P-0022[0022]FIG. 6 is a screenshot provided by the system for the service provider to define more details of start actions indicated in FIG. 5.

P-0023[0023]FIG. 7 is a screenshot provided by the system for the service provider to define stop actions of the initiation steps.

P-0024[0024]FIG. 8 is a screenshot provided by the system to a subscriber confirming that a service has been started.

P-0025[0025]FIG. 9 is a screenshot provided by the system to the subscriber showing the services that are available to the subscriber and providing links to start and stop those services.

P-0026[0026]FIG. 10 is a screenshot provided by the system to the subscriber confirming that a service has been stopped.

P-0027[0027]FIG. 11 is a simplified block diagram of one embodiment of a policy distribution point.

P-0028[0028]FIG. 12 is a simplified block diagram of another embodiment of a policy distribution point.

DETAILED DESCRIPTION

P-0029[0029] Reference will now be made in detail to some embodiments of the invention, examples of which are illustrated in the accompanying drawings.

P-0030[0030]FIG. 1 is a diagram of a system <b>1</b> in accordance with some embodiments of the present invention. A system is provided that allows subscriber <b>2</b> quickly to self-activate network-based services provided by a service provider through the networks of carriers <b>3</b> and <b>4</b>. In the example of FIG. 1, the service provider provides equipment and connectivity within dashed boundary <b>5</b>. This equipment includes DSL modems <b>6</b> and <b>7</b>, DSL access multiplexers <b>8</b> and <b>9</b>, a policy distribution point (PDP) <b>10</b>, a gateway <b>11</b>, a firewall <b>12</b>, a service portal server <b>13</b>, an xAuthority core server <b>14</b>, a customer relationship management (CRM) system <b>15</b>, a billing system <b>16</b> and a PDP <b>17</b>. Gateway <b>11</b> is a networking device and can-be an edge router. Firewall <b>12</b> can also be a router. Gateway <b>11</b> and firewall <b>12</b> are together part of an IP services switch <b>18</b>.

P-0031[0031] In the example of FIG. 1, two network-based services are made available to subscriber <b>2</b> on his computer <b>19</b>. The first of these services is offering different levels of access to Internet <b>20</b> through the network of first carrier <b>3</b>, i.e., offering different quality of service (QoS) levels. First carrier <b>3</b> offers different QoS levels, wherein each level provides a different maximum available bandwidth to subscriber <b>2</b>. For example, subscriber <b>2</b> can pay more to obtain “Gold Access” having greater bandwidth and a higher QoS level than, for example, “Silver Access.”

P-0032[0032] The second network-based service made available to subscriber <b>2</b> is use of a hosted application executing on application server <b>21</b>, a computing device. The application is hosted by the service provider, and access to the application on application server <b>21</b> is provided through the network of second carrier <b>4</b> (for example, AT&amp;T), as well as through the network of first carrier <b>3</b>. The application may, for example, be the Microsoft Exchange program that provides email and calendaring functions for individual or office use.

P-0033[0033]FIG. 2 shows the xAuthority core server <b>14</b> of FIG. 1 in more detail. xAuthority core server <b>14</b> includes web server software <b>22</b>, user database <b>23</b>, single sign-on engine <b>24</b>, billing log file <b>25</b> and system log file <b>26</b>. Web server software <b>22</b> in turn includes an AUTHAPI module <b>27</b>, a MOD_PERL module <b>28</b> and an initiation module <b>29</b>. The application offered in the second service is launched using single sign-on engine <b>24</b>.

P-0034[0034] In the present example, web server software <b>22</b> is a software web server program called the Apache HTTP Server Project, available from the Apache Software Foundation. Initiation module <b>29</b> is a module of web server software <b>22</b>, as opposed to an external program that is stored in a separate memory. Initiation module <b>29</b> is compiled together with the other modules of web server software <b>22</b>. Initiation module <b>29</b> is written in C and C++ as a plurality of components using the methodology set forth in the book entitled “Writing Apache Modules With Perl And C,” by Lincoln Stein and Doug MacEachern, March 1999, which is hereby incorporated by reference. In this example, the plurality of components comprising initiation module <b>29</b> includes: an interface component <b>30</b> that interfaces with the remainder of the Apache web server software, a presentation component <b>31</b>, an authentication component <b>32</b>, an authorization component <b>33</b>, a service listing component <b>34</b>, and an initiation component <b>35</b>.

P-0035[0035]FIGS. 3A and 3B are a flowchart illustrating a method of quickly initiating a network-based service in accordance with a first embodiment of the present invention. Initially (step <b>100</b>), the service provider installs the equipment and connectivity used to provide a service. In order to provide the first service “Gold Access,” for example, the service provider installs the following network elements within boundary <b>5</b>: DSL modem <b>6</b>, DSL access multiplexer <b>8</b>, PDP <b>10</b>, gateway <b>11</b>, firewall <b>12</b>, service portal server <b>13</b>, xAuthority core server <b>14</b>, billing system <b>15</b> and CRM system <b>16</b>.

P-0036[0036] Next (step <b>101</b>), a system administrator <b>36</b> of the service provider uses a display <b>37</b> (as shown in FIG. 1) connected to xAuthority core server <b>14</b> to access a service creation mechanism executing on xAuthority core server <b>14</b>. The service creation mechanism includes a state machine. The service creation mechanism allows system administrator <b>36</b> to preconfigure publication steps, subscription steps, registration steps and initiation steps in order to set up the first service (Gold QoS Internet access) and the second service (Microsoft Exchange application). The steps correspond to states of the state machine. For additional information on the service creation mechanism, see patent application Ser. No. 10/213,043, entitled “System And Method For Setting Up User Self-Activating Network-Based Services”, by Bellinger et al., filed Aug. 5, 2002 (the subject matter of which is incorporated herein by reference).

P-0037[0037] Next (step <b>102</b>), system administrator <b>36</b> selects an initiation tab of the service creation mechanism that relates to initiations steps. FIG. 4 shows a screenshot of an initiation tab <b>44</b> that system administrator <b>36</b> sees on display <b>37</b>. When system administrator <b>36</b> clicks on initiation tab <b>44</b>, a state table for defining initiation steps is presented. The arrow symbol <b>45</b> on the left of the “Initiated” icon <b>46</b> represents actions (start actions) to be performed at the beginning of initiation of the first service and the second service. The square symbol <b>47</b> on the right of the “Initiated” icon <b>46</b> represents actions (stop actions) to be performed when the subscriber terminates the initiation. To define the start actions, system administrator <b>36</b> clicks on symbol <b>45</b>.

P-0038[0038]FIG. 5 shows a screenshot that the service creation mechanism presents to system administrator <b>36</b> when system administrator <b>36</b> clicks on symbol <b>45</b>. System administrator <b>36</b> uses the drop menu <b>48</b> to identify the type of information to be added, such as billing log information (relating to billing events), system log information (relating to regular events), and information relating to activations.

P-0039[0039] Portion <b>49</b> of the screen is used to define a message that is written into billing log file <b>25</b> (as shown in FIG. 2) when subscriber <b>2</b> starts the initiation of the first service. Billing log file <b>25</b> is maintained on xAuthority core server <b>14</b>. In this example, an XML document describing the billing event is written into billing log file <b>25</b>. The priority “5” indicates the priority with respect to other start initiation actions.

P-0040[0040] Portion <b>50</b> of the screen is used to define system log information that is written into a system log file when subscriber <b>2</b> starts the initiation of the first service. System log file <b>26</b> is maintained on xAuthority core server <b>14</b>, as shown in FIG. 2. In this example, the parameters in the message string “[userName]@[domainName] is starting service from ?ipAddress?” are filled in, and the string is logged in the system log file <b>26</b>. System administrator <b>36</b> can use this system log file <b>26</b> to determine that the first service has been initiated.

P-0041[0041] Portion <b>51</b> of the screen is used to define an activation that will be sent to PDP <b>10</b> when subscriber <b>2</b> initiates the first service. FIG. 6 is a more detailed diagram of portion <b>51</b>. Portion <b>51</b> is labeled “Action”. In this example, the action performed by the activation is to configure gateway <b>11</b> with a network cross-connection to enable the first service. The network cross-connection is a TCP/IP connection between the computer <b>19</b> of subscriber <b>2</b> and an Internet access point on network <b>3</b>. An add instruction is being defined using portion <b>51</b>. The add instruction is to “add” an object of the type “[auto type]” with the name “ip_[auto name]” to “Service Acceptor”. The service acceptor in this case has been previously defined to be gateway <b>11</b>. This add instruction, once defined, will be sent in the form of an activation to PDP <b>10</b> when subscriber <b>2</b> starts initiation of the first service. The PDP <b>10</b> will then convert the activation into device-specific instructions that are understood by gateway <b>11</b>. For a more detailed treatment of PDPs and how they configure network elements that are used to provide network-based services, see U.S. patent application Ser. No. 10/223,846 entitled “Policy Distribution Point For Setting Up Network-Based Services,” by Bellinger et al., filed Aug. 19, 2002, which is incorporated herein by reference.

P-0042[0042] Gateway <b>11</b> may alternatively be configured by PDP <b>17</b>, which lies outside LAN <b>42</b> (as shown in FIG. 1). PDP <b>17</b> can be used to configure devices on LAN <b>42</b> where activations cannot be sent through firewall <b>12</b> to reach PDP <b>10</b>. In the network configuration shown in FIG. 1, activations can travel through a secure network path <b>43</b> from xAuthority core server <b>14</b> to PDP <b>10</b>.

P-0043[0043]FIG. 7 shows a screen that is presented when system administrator <b>36</b> clicks symbol <b>47</b> of the initiation tab state table in FIG. 5. System administrator <b>36</b> clicks on symbol <b>47</b> to define the stop actions. System administrator <b>36</b> uses the drop menu <b>52</b> to identify the type of information to be added, such as billing log information (relating to billing events), system log information (relating to regular events), and information relating to activations.

P-0044[0044] Portion <b>53</b> of the screen is used to define a message that is written into billing log file <b>25</b> when subscriber <b>2</b> terminates use of the first service. An XML document describing the billing event is written into billing log file <b>25</b>. The priority “3” indicates the priority with respect to other stop initiation actions.

P-0045[0045] Portion <b>54</b> of the screen is used to define regular log information that is written into the system log file <b>26</b> when subscriber <b>2</b> terminates his use of the first service. The parameters in message string “[userName]@[domainName] is stopping service from ?ipAddress?” are filled in, and the string is logged in the system log file <b>26</b>. System administrator <b>36</b> can use this system log file <b>26</b> to determine that use of the first service has been terminated.

P-0046[0046] Portion <b>55</b> of the screen is used to define an activation that will be sent to PDP <b>10</b> when subscriber <b>2</b> terminates use of the first service. The action performed by the activation is to configure gateway <b>11</b> to disconnect the network cross-connection that had enabled the first service. In FIG. 7, a delete instruction is being defined using portion <b>55</b>. The delete instruction causes PDP <b>10</b> to delete the changes made by the previously-defined start activations. This delete instruction, once defined, will be sent in the form of an activation to PDP <b>10</b> when subscriber <b>2</b> terminates use of the first service. PDP <b>10</b> will then convert the delete instruction into device-specific instructions that are understood by gateway <b>11</b>. The device specific instructions cause gateway <b>11</b> to terminate the TCP/IP connection between computer <b>19</b> and the Internet access point on network <b>3</b>.

P-0047[0047] Next (step <b>103</b> in FIG. 3A), system administrator <b>36</b> performs the publication, subscription and registration of the first service to subscriber <b>2</b>. Once this is complete, subscriber <b>2</b> is able to initiate, use and terminate use of the first service. In a similar fashion, system administrator <b>36</b> defines the initiation start and stop steps, publishes the second service, subscribes subscriber <b>2</b> to the second service and registers the second service for subscriber <b>2</b>. No more action is required by system administrator <b>36</b>.

P-0048[0048] Next (step <b>104</b>), subscriber <b>2</b> logs onto the service provider's network. Subscriber <b>2</b> uses computer <b>19</b> to initialize DSL modem <b>6</b> such that DSL modem <b>6</b> can communicate with the service provider's network, including gateway <b>11</b>. A username and password is then passed through DSL modem <b>6</b>, through DSL access multiplexers <b>8</b> to gateway <b>11</b>. An authentication mechanism within IP services switch <b>18</b> uses this information to authenticate subscriber <b>2</b>. Login to the network is then complete.

P-0049[0049] Next (step <b>105</b>), subscriber <b>2</b> opens a browser executing on computer <b>19</b>. The browser requests by default a web page. This HTTP request is redirected (step <b>106</b>) by gateway <b>11</b> to service portal server <b>13</b>.

P-0050[0050] Next (step <b>107</b>), service portal server <b>13</b> acts as a proxy to xAuthority core server <b>14</b>. Service portal <b>13</b> is a subscriber-facing HTML interface driven by a J2EE web container. The HTTP request is received onto interface component <b>30</b> of initiation module <b>29</b> on xAuthority core server <b>14</b>. Interface component <b>30</b> handles HTTP requests for specified URLs on xAuthority core server <b>14</b> and forwards the requests to other components of initiation module <b>29</b>. Authorization component <b>33</b> of initiation module <b>29</b> examines the HTTP request looking for an authorization token. Because no valid authorization token is found, initiation module <b>29</b> generates an HTML login page. xAuthority core server <b>14</b> sends the HTML login page through service portal server <b>13</b>, through gateway <b>11</b>, and back to the subscriber's browser executing on computer <b>19</b>. The login page is displayed to subscriber <b>2</b> prompting the subscriber for username, password, and domain name.

P-0051[0051] Next (step <b>108</b>), subscriber <b>2</b> enters his username, password and domain name. In the present example, a set of subscribers is situated within building <b>56</b>. This set of subscribers has its own domain name. This domain name is used to distinguish subscribers within building <b>56</b> from other subscribers within the service provider's entire network. The username, password and domain name of subscriber <b>2</b> are sent by the browser to service portal server <b>13</b>. Service portal server <b>13</b> in turn forwards the subscriber credentials to xAuthority core server <b>14</b>. Initiation module <b>29</b> receives the credentials.

P-0052[0052] Next (step <b>109</b>), initiation module <b>29</b> consults user database <b>23</b> containing a plurality of user objects <b>57</b>, <b>58</b> and <b>59</b>. Initiation module <b>29</b> compares the credentials (username, password, domain name) received with credentials stored in the object <b>57</b> of subscriber <b>2</b>. For subscriber <b>2</b>, the username stored in object <b>57</b> is “username#1,” the password stored is “password,” and the domain name stored is “domain.” In the present example, the credentials received match the credentials stored in object <b>57</b>. This indicates that object <b>57</b> is the object for subscriber <b>2</b>.

P-0053[0053] Due to the match, authentication component <b>32</b> of initiation module <b>29</b> generates an authorization token, and service listing component <b>34</b> retrieves a list of registered services from object <b>57</b>. In the example, there are two services listed in object <b>57</b>, the first service and the second service. Configuration data <b>60</b> for the first service includes configuration data to provision gateway <b>11</b> to provide the QoS Internet access (Gold Access) via the network of first carrier <b>3</b>. Configuration data <b>61</b> for the second service includes configuration data to provision gateway <b>11</b> to provide access to the application on application server <b>21</b> through the network of second carrier <b>4</b>, as well as through the network of first carrier <b>3</b>. Initiation module <b>29</b> returns the authorization token in the form of an HTTP cookie and a list of registered services as an HTML document via service portal server <b>13</b> and gateway <b>11</b> to the browser executing on computer <b>19</b>. The registered services are displayed on the subscriber's computer <b>19</b>. The authorization token in the form of an HTTP cookie is valid only for one log-on session. The authorization token is discarded when the browser is closed.

P-0054[0054] Next (step <b>110</b>), subscriber <b>2</b> selects a service to initiate by clicking on the displayed service. In this example, subscriber <b>2</b> selects the first service. The browser on computer <b>47</b> then sends (step <b>111</b>) the authorization token in the form of an HTTP cookie and the name of the service being initiated (“first service”) in HTML via the service portal server <b>13</b> to initiation module <b>29</b>. Authorization component <b>33</b> of initiation module <b>29</b> validates the authorization token. In another example, where authorization component <b>33</b> cannot validate the authorization token, subscriber <b>2</b> is returned to step <b>108</b> and-asked to re-authenticate.

P-0055[0055] Next (step <b>112</b>), initiation module <b>29</b> retrieves the configuration data <b>60</b> for the first service from object <b>57</b>. The configuration data <b>60</b> includes the activation, the billing log information and the system log information previously defined by system administrator <b>36</b> for the first service.

P-0056[0056] Next (step <b>113</b>), initiation component <b>35</b> of initiation module <b>29</b> sends the activation in the form of an XML document to the particular policy distribution point associated with the device to be configured. In this example, the device to be configured is gateway <b>11</b>, and the activation is sent to PDP <b>10</b>.

P-0057[0057] Next (step <b>114</b>), initiation module <b>29</b> uses the billing log information to log a billing event into billing log file <b>25</b> on the xAuthority core server <b>14</b>.

P-0058[0058] Next (step <b>115</b>), initiation module <b>29</b> uses the system log information to log a system log event into the system log file <b>26</b> on the xAuthority core server <b>14</b>.

P-0059[0059] Next (step <b>116</b>), PDP <b>10</b> converts the activation into device-specific instructions. The device-specific instructions are sent to the device to be configured (in this case, gateway <b>11</b>).

P-0060[0060] In the case of the first service (QoS access to Internet <b>20</b> (“Gold Access”) via the network of first carrier <b>3</b>), gateway <b>11</b> completes a network cross-connection for subscriber <b>2</b>. This network cross-connection is a TCP/IP connection between computer <b>19</b> and an Internet access point on the network of first carrier <b>3</b>. Before the configuration of gateway <b>11</b>, gateway <b>11</b> prevents subscriber <b>2</b> from having access to the network of first carrier <b>3</b> because the necessary network cross-connection has not been completed. (Subscriber <b>2</b> also does not have access to application server <b>21</b> for the second service before the network cross-connection has been completed.)

P-0061[0061] Next (step <b>117</b>), PDP <b>10</b> reports successful provisioning by generating an XML response that is sent to initiation module <b>29</b> on xAuthority core server <b>14</b>.

P-0062[0062] Next (step <b>118</b>), initiation module <b>29</b> receives the response from PDP <b>10</b> and in turn generates an HTML page indicating that the selected service was successfully initiated.

P-0063[0063]FIG. 8 is a screenshot showing an HTML page <b>62</b> that subscriber <b>2</b> will see after the first service has been initiated. HTML page <b>62</b> is sent via service portal server <b>13</b> and gateway <b>11</b> to the subscriber's browser on computer <b>19</b>. The first service is now available for use for subscriber <b>2</b>. In step <b>119</b>, subscriber <b>2</b> consumes the selected service, in this example, Gold Access to the Internet <b>20</b>.

P-0064[0064]FIG. 9 is a screenshot of an HTML page <b>63</b>, the “my services” page, that is presented to subscriber <b>2</b> as he is consuming services. HTML page <b>63</b> shows that two services have been registered for subscriber <b>2</b>: “Gold Access” and “Silver Access”. Subscriber <b>2</b> also has access to a directory of users under the “Directory” link. Subscriber <b>2</b> can initiate the services that have already been registered in the registration steps. In this example, “initiate” can encompass instantiating single sign-on engine <b>24</b>, as well as starting and stopping services, which involves sending activations to configure network elements, such as networking devices and computing devices. Initiation component <b>35</b> of initiation module <b>29</b> both sends activations and instantiates single sign-on engine <b>24</b>.

P-0065[0065] HTML page <b>63</b> in FIG. 9 also shows the two services (“Gold Access” and “Silver Access”) that subscriber <b>2</b> is potentially consuming, as well as “[stop]” links next to the name of each service. When subscriber <b>2</b> no longer wishes to consume the first service (“Gold Access”), subscriber <b>2</b> clicks on the stop link next to the service name. Subscriber <b>2</b> thereby uses the initiation module <b>29</b> to select the service to be terminated. When subscriber <b>2</b> clicks on the stop link, a message is sent from the browser of subscriber <b>2</b>, through service portal server <b>13</b>, to initiation module <b>29</b>. Initiation module <b>29</b> retrieves the configuration data in the object of subscriber <b>2</b> and obtains billing log information, system log information and activations. Initiation module <b>29</b> generates a billing event that is logged to billing log file <b>25</b>, a system log event that is logged to system log file <b>26</b>, and an activation that is sent to PDP <b>10</b>. The activation is converted by PDP <b>10</b> into device-specific instructions, which cause gateway <b>11</b> to disconnect the network cross-connection, thereby disabling the first service for subscriber <b>2</b>.

P-0066[0066]FIG. 10 is a screenshot showing an HTML page <b>64</b> that is sent to subscriber <b>2</b> confirming that the first service has been terminated. HTML page <b>64</b> is sent to subscriber <b>2</b> after PDP <b>10</b> replies to initiation module <b>29</b> confirming successful termination of the first service.

P-0067[0067] After the first service has been configured by system administrator <b>36</b>, the entire process of initiating the first service and terminating the first service occurs automatically without any person other than subscriber <b>2</b> performing any action. Moreover, the only action performed by subscriber <b>2</b> to launch the first service is to supply his/her credentials and to click on the desired service. The only action performed by subscriber <b>2</b> to terminate the first service is to click on a stop link beside the service to be terminated on the “my services” page. Individual subscribers can therefore launch services and terminate services without additional input from any third party.

P-0068[0068]FIG. 11 is a simplified diagram of a first embodiment of PDP <b>10</b>. PDP <b>10</b> includes web server software <b>65</b> and a service driver infrastructure <b>68</b>. Web server software <b>65</b> has not only the typical SERVICE AGENT module <b>66</b>, but it also has the MOD_AGENT module <b>67</b> that allows PDP <b>10</b> to receive request <b>73</b> from xAuthority core server <b>14</b> at a fast rate.

P-0069[0069] Web server software <b>65</b> interacts with service driver infrastructure <b>68</b> through a standard CGI agent interface <b>69</b>. Customized individual service drivers <b>70</b>-<b>72</b> are plugged into the service driver infrastructure <b>68</b>. For additional information on policy distribution point architecture, see patent application Ser. No. 10/223,846, entitled “Policy Distribution Point For Setting Up Network-Based Services”, by Bellinger et al., filed Aug. 19, 2002 (the subject matter of which is incorporated herein by reference).

P-0070[0070] In operation, an activation is received by PDP <b>10</b> on web server software <b>65</b> as an XML document within an HTTP request <b>73</b>. Web server software <b>65</b> in turn forwards the request to CGI agent interface <b>69</b> of service driver infrastructure <b>68</b>. The appropriate service driver is invoked such that the associated networking element is configured. Web server software <b>65</b> and CGI agent interface <b>69</b> are separate programs executing in two different memory spaces. The web server software <b>65</b> passes the information of HTTP request <b>73</b> to the service driver infrastructure <b>68</b>. This movement of information takes time.

P-0071[0071]FIG. 12 is a simplified diagram of a second embodiment of PDP <b>10</b>. In the second embodiment, processing of the information in the activation is accelerated by incorporating the service driver infrastructure functionality into web server software <b>65</b>. This is accomplished by writing the service driver infrastructure as a web server module <b>74</b> that is compiled into the web server program. Web server module <b>74</b> is not a separate program from web server software <b>65</b>. It shares the same memory space as web server software <b>65</b>. Because it shares the same memory space, information in the activation does not need to be transferred from one memory space to another. Web server module <b>74</b> simply accesses the web server's memory space to use the information in the activation that came in HTTP request <b>73</b>.

P-0072[0072] In the second embodiment, web server software <b>65</b> is a software web server program called the Apache HTTP Server Project, available from the Apache Software Foundation. Web server module <b>74</b> is written in C and C++ using the methodology set forth in the book entitled “Writing Apache Modules With Perl And C,” by Lincoln Stein and Doug MacEachern, March 1999.

P-0073[0073] In a second embodiment of the present invention, the second service is initiated using steps similar to those shown in FIGS. 3A and 3B. In the second embodiment, for example, the service provider initially installs the connectivity and equipment, including application server <b>21</b>, used to provide the second service, access to the Microsoft Exchange program.

P-0074[0074] The embodiments of the present invention increase the speed of self-activation of network-based services in three ways: generating activations faster in xAuthority core server <b>14</b>, translating activations into device-specific instructions faster in PDP <b>10</b>, and separating the complex registration steps from the provisioning of network elements, thereby allowing the provisioning to be performed faster. Faster self-activation, in turn, allows subscriber <b>2</b> to turn services on and off faster.

P-0075[0075] Initiation module <b>29</b> reduces the delay experienced by subscriber <b>2</b> in self-activating the first service by allowing activations to be generated faster in xAuthority core server <b>14</b>. Because initiation module <b>29</b> is a module of web server software <b>22</b> and is compiled together with the other modules of web server software <b>22</b>, initiation module <b>29</b> generates an activation for PDP <b>10</b> faster than if initiation module <b>29</b> were an external program stored in a separate memory.

P-0076[0076] PDP <b>10</b> reduces the delay experienced by subscriber <b>2</b> in self-activating the first service by translating the activation it receives from initiation module <b>29</b> faster from XML into device-specific instructions for gateway <b>11</b>. Because service driver infrastructure <b>74</b> is a module of web server software <b>65</b> and is compiled together with the other modules of web server software <b>65</b>, PDP <b>10</b> translates the activation received from initiation module <b>29</b> faster from XML into device-specific instructions for gateway <b>11</b> than if service driver infrastructure <b>74</b> were a program external to web server software <b>65</b> and were stored in a separate memory.

P-0077[0077] The embodiments described above allow subscriber <b>2</b> to initiate and terminate network-based services more quickly than with service creation mechanisms that run through predefined publication steps, subscription steps, registration steps and initiation steps all at the same time. A service creation mechanism that employs initiation module <b>29</b> allows the initiation steps to be decoupled from the other steps and thereby to be performed faster. The registration steps need not be performed each time subscriber <b>2</b> starts and stops a service, for example, when subscriber <b>2</b> switches back and forth between Gold Access and Silver Access to Internet <b>20</b>. Subscriber <b>2</b> might choose, for example, to surf the Internet <b>20</b> using Silver Access, but might want periodically to download videos, music or pictures using Gold Access.

P-0078[0078] The service provider might permit subscribe <b>2</b> to perform the registration steps of authentication and authorization only once per log-on session. This is accomplished in another embodiment by writing the authorization component <b>33</b> as a shared library in C++ so that it can optionally be replaced by another shared library in order to change the authorization behavior of the entire initiation module <b>29</b>. For example, the service provider wishes to use the fact that subscriber <b>2</b> is already connected and authenticated in LAN <b>42</b>. Due to this fact, the service provider wishes to allow subscriber <b>2</b> to initiate the first service without authenticating against initiation module <b>29</b> as set forth above. The service provider can do this by replacing authorization component <b>33</b> (now written as a shared library) with a custom version of the library. Such a custom version can be immediately executed on the xAuthority core server <b>14</b> without recompiling initiation module <b>29</b> simply by restarting the web server software <b>22</b> of the xAuthority core server <b>14</b>.

P-0079[0079] Thus, service initiation can be made faster in part by permitting subscriber <b>2</b> to input registration information only once per log-on session and not each time initiation steps are performed. Registration steps, however, involve more than subscriber <b>2</b> inputting registration information. During the registration steps, registration information is also stored and validated, and database objects, billing objects and CRM objects are generated. There are two types of databases that are accessed during the registration steps: relational databases, such as billing system <b>15</b> and CRM system <b>16</b>, which can employ Oracle databases, and LDAP directory databases, such as user database <b>23</b>, which can employ an iPlanet directory. Many reads and writes are performed on the user database <b>23</b>, the billing system <b>15</b> and the CRM system <b>16</b> during the registration steps. Writing to and manipulating these databases can be time consuming. Interaction with these databases is therefore made a part of the registration steps. By decoupling the initiation steps from the registration steps, initiation module <b>29</b> can initiate services faster because it performs only database reads.

P-0080[0080] The initiation steps are limited to provisioning network elements and thereby turning on and off networked-based services. Because the time consuming steps of manipulating the databases has already been performed before the initiation steps are undertaken, subscriber <b>2</b> experiences smaller delays when turning on and off a service.

P-0081[0081] For example, subscriber <b>2</b> can consume the first service shortly after the initiation module <b>29</b> sends an activation to PDP <b>10</b>. Subscriber <b>2</b> does not have to wait until database objects, billing objects and CRM objects are generated and written to user database <b>23</b>, billing system <b>15</b>, and CRM system <b>16</b>; the required objects have already been generated and written to databases and external systems in the registration steps. The activation that is sent to PDP <b>10</b> was substantially completed during the registration steps. Only timely unique identifiers, such as the IP address of subscriber <b>2</b>, are added to the activation during the initiation steps. This permits the first service to be provisioned for the real-time location of subscriber <b>2</b>, for the event that subscriber <b>2</b> uses a computer other than computer <b>19</b>.

P-0082[0082] Although initiation module <b>29</b> does not create billing objects, it does generate billing events that it logs in billing log file <b>25</b>. The logging of billing events in billing log file <b>25</b> within xAuthority core server <b>14</b> is, however, much faster than writing billing objects to an external billing system.

P-0083[0083] Although the speed of initiating services in the embodiments described above is increased by making initiation module <b>29</b> a module of web server software <b>22</b>, the speed can also be increased by incorporating other software as modules of web server software <b>22</b>. For example, in another embodiment, single sign-on engine <b>24</b> is a module of web server software <b>22</b>, as opposed to an external program stored in a separate memory. Subscriber <b>2</b> is automatically signed on to use the email and calendaring functions of Microsoft Exchange faster because single sign-on engine <b>24</b> can generate the required HTTP sign-on packet more quickly. The faster automatic sign-on is in addition to the faster configuration of application server <b>21</b> to provide the second service.

P-0084[0084] Although in some embodiments, interaction with the user database <b>23</b>, the billing system <b>15</b> and the CRM system <b>16</b> is made a part of the registration steps so that initiation module <b>29</b> can initiate services faster without database writes, in other embodiments a minimal number of database writes (for example, one) are performed during the initiation steps. The speed of initiating services in the other embodiments is somewhat slower.

P-0085[0085] Compact Disc Appendix

P-0086[0086] The Compact Disc contains: the directory file AMP, 1.07 MB, written to disc Mar. 4, 2003; the directory file INITIATION, 300 KB, written to disc Mar. 4, 2003; the directory file PORTAL, 1.35 MB, written to disc Mar. 4, 2003; the directory file XLINK, 1.69 MB, written to disc Mar. 4, 2003; and the file CD Appendix Title Page.txt, 304 bytes, written to disc Mar. 4, 2003. The AMP and XLINK directories contain xAuthority core server source code written primarily in XML and Perl. The INITIATION directory contains the source code for the initiation module <b>29</b>. The PORTAL directory contains source code for the service portal server. The PORTAL source code is mostly HTML pages containing Javascript, Perl scripts and Bash script. All the material on the Compact Disc is hereby expressly incorporated by reference into the present application.

P-0087[0087] Although the present invention has been described in connection with certain specific embodiments for instructional purposes, the present invention is not limited thereto. For example, the first service is Internet access provided at different QoS levels through a gateway, which is a networking device. Other embodiments can start and stop other services, e.g., streaming video, that are also provided using networking devices, such as edge routers or firewall routers from Cisco Systems. The second service is access to email and calendaring applications executing on an email server, which is a computing device. Other embodiments can start and stop other services that are also provided using computing devices, such workstations running the Solaris operating system from Sun Microsystems. Accordingly, various modifications, adaptations, and combinations of various features of the described embodiments can be practiced without departing from the scope of the invention as set forth in the claims.