Two-tier authentication system where clients first authenticate with independent service providers and then automatically exchange messages with a client controller to gain network access

A method using a client controller to monitor a client's access to use a communications network, the client accessing the client controller through a service provider independent of the client controller, comprising the steps of:

• receiving from the client a start session message containing user identity information, the start session message being received by the client controller using the communication network in accordance with a client control protocol, the start session message being sent automatically upon the client being logged on to the service provider independent of the client controller;
• recording in a communications network usage log information associated with the user identity information and information associated with the time that the start session message was received;
• and
• sending to the client, in response to the start session message, a control message to control the client's access to use the communications network.

A client controller to control a client's access to use a communications network the client accessing the client controller through a service provider independent of the client controller, the client controller comprising:

• a communications port capable of receiving from the client a start session message containing user identity information, the start session message being received by the client controller using the communications network in accordance with a client control protocol, the start session message being sent automatically upon the client being logged on to the service provider independent of the client controller;
• a user database containing information associated with the user identity information;
• and
• a client control processor coupled to said communications port and said user database, said client control processor being configured to send a control message to the client to control the client's access to use the communications network, the control message being sent from the client controller using the communications network in accordance with the client control protocol and in response to the start session message.

An apparatus to control a client's access to use a communications network, the client accessing the client controller through a service provider independent of a client controller, comprising:

• means for receiving from the client a start session message containing user identity information, the start session message being received by the client controller using the communications network in accordance with a client control protocol, the start session message being sent automatically upon the client being logged on to the service provider independent of the client controller;
• means for determining if the client is authorized to access the communications network;
• and
• means for sending to the client a session authorization message, the session authorization message to control the client's access to use the communications network being sent from the client controller using the communications network in accordance with the client control protocol and in response to the start session message.

A method of using a communications network having a client controller, comprising the stops of:

• accessing the client controller though a service provider independent of the client controller;
• sending to the client controller a start session message containing user identity information, the start session message being sent automatically upon being logged on to the service provide;
• and
• receiving from the client controller a control message to control whether the client is authorized or denied access to use the communications network, the control message being received by the client using the communications network in accordance with a client control protocol and in response to the start session message.

An article of manufacture comprising a computer-readable medium having stored thereon instructions adapted to be executed by a processor, the instructions which, when executed, define a series of steps to use a communications network having a client controller, said steps comprising:

• accessing the client controller through a service provider independent of the client controller;
• sending to the client controller a start session message containing user identity information, the start session message being sent automatically upon being logged on to the service provider;
• and
• receiving from the client controller a control message to control whether the client is authorized or denied access to use the communications network, the control message being received by the client using the communications network in accordance with a client control protocol and in response to the start session message.