JP2004080272A - Communication network system, service processing control method, provider server, and service processing apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable a subscriber user to easily and highly utilize a communication network service without the need for the subscriber user to have a skill of sophisticated communication network operations. <P>SOLUTION: A provider server 31 of a provider communication network 3 performs communication with a service processing apparatus 41 connected to a subscriber user communication network 4 to remotely control contents of a service of a service processing table used by the service processing apparatus 41 for data transfer control, and the service processing apparatus 41 performs the data transfer control on the basis of the contents of the service processing table remotely controlled by the provider server. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a communication network system, a service processing control method, a provider server, and a service processing device, and more particularly to a communication network system and a service processing control for providing an advanced communication network service to a subscriber user accessing a communication network from a user terminal. The present invention relates to a method, a provider server and a service processing device.
[0002]
[Prior art]
2. Description of the Related Art In recent years, communication networks such as the Internet have become widespread at a rapid rate with the use of information transfer technology, information browsing technology, and broadband communication lines. When using such a communication network, a general user needs to conclude a service contract with a provider that provides the communication service in advance and become a subscriber of the communication network system of the provider.
In addition, a subscriber user edge node such as a router is installed as a device for terminating a communication path of the communication network system, and the subscriber user edge node subscribes to the subscriber user edge node via a subscriber user communication network such as a LAN. By connecting to the computer of the other user, the computer connects to the communication path via the subscriber user edge node and receives a desired communication service.
[0003]
Conventionally, in such a communication network system, the subscriber user edge node of the subscriber user is managed by the subscriber user itself.
For example, when a subscriber user intends to prevent unexpected access to a harmful Web site in WWW access, the subscriber user generates information to be set as to what kind of Web site is a harmful site, and subscribes. In this case, an entry is set in the address filtering table of the user edge node.
[0004]
[Problems to be solved by the invention]
However, in such a conventional communication network system, since the subscriber user needs to manage the subscriber user edge node of the subscriber user, the subscriber user tries to use the communication service to a high degree. In such a case, there is a problem in that a high communication network operation skill is required for the subscriber user, and the communication service cannot be easily utilized by the subscriber user.
Further, even if information on a harmful Web site that changes from moment to moment can be obtained from a provider or a third party, each time the subscriber user sets an entry in the address filtering table of the subscriber user edge node. As a result, there is a problem that the work load for operating the communication network for the subscriber user increases.
[0005]
In addition, a method of installing the address filtering function of the subscriber user edge node in the provider communication network is also conceivable, and according to this, the subscriber user does not require advanced communication network operation skills. However, address filtering information specific to each subscriber user is described in a communication device shared between subscriber users, and the communication performance of the entire communication network is reduced due to the enlargement of the address filtering table. There is a problem of deterioration.
The present invention is intended to solve such a problem, and a communication network system and a service processing control method capable of easily and highly utilizing a communication service without requiring an advanced communication network operation skill for a subscriber user. , A provider server and a service processing device.
[0006]
[Means for Solving the Problems]
In order to achieve such an object, a communication network system according to the present invention is provided with a plurality of subscriber user communication networks including user terminals of subscriber users and managed by the subscriber users. In a communication network system configured by connecting networks with a provider communication network managed by a provider, user data transmitted and received between a user terminal and the provider communication network is installed in each subscriber user communication network. By performing data transfer control based on its own service processing table, a service processing apparatus that provides various data communication services to the user terminal, and a service processing apparatus installed in a provider communication network, perform data communication with the service processing apparatus, The A service server for remotely controlling the contents of a service processing table used for data transfer control by the service processing device, wherein the service processing device is provided with a subscriber defined at a connection point between the provider communication network and the subscriber user communication network. Means for executing a transfer procedure for transferring user data transmitted and received between user communication networks, wherein the service processing device and the provider server are predefined at a connection point between the provider communication network and the subscriber user communication network. Further, there is provided a means for executing a control procedure for remotely controlling the contents of the service processing table of the service processing apparatus from the provider server by data communication.
[0007]
Further, the service processing control method according to the present invention includes a plurality of subscriber user communication networks including a user terminal of a subscriber user and managed by the subscriber user, and the subscriber user communication network is managed by the provider. Is connected to the provider communication network and is installed in each subscriber user communication network, and performs data transfer control for user data transmitted and received between the user terminal and the provider communication network based on its own service processing table. By doing so, a service processing device that provides various data communication services to the user terminal, and a service process that is installed in the provider communication network, performs data communication with the service processing device, and uses the service processing device for data transfer control Table contents A service processing control method used in a communication network system including a remotely controlled provider server, wherein the provider server performs a service processing control method based on a control procedure predefined at a connection point between the provider communication network and the subscriber user communication network. By performing data communication with the service processing device, the contents of the service processing table possessed by the service processing device are remotely controlled, and the service processing device defines in advance a connection point between the provider communication network and the subscriber user communication network. Based on the transfer procedure, user data transmitted and received between subscriber user communication networks is transferred, and data transfer control for the user data is performed based on the contents of its own service processing table remotely controlled from the provider server. It is obtained by the.
[0008]
At this time, when the provider server remotely controls the contents of the service processing table of the service processing device, the contents set in the service processing table are compared with the contents to be set in the service processing table, and both are compared. When a difference is detected, remote control for replacing the content of the service processing table with the content to be set may be executed.
[0009]
Further, when remote control is performed on the service processing device by the provider server, a communication path connecting the provider server to each service processing device and a communication path used by the user terminal are logically connected. May be used.
Further, the service processing device may restrict access to the remote control of the service processing table, thereby permitting only access from the provider server.
[0010]
As the service processing table, a routing table that manages control information for controlling a transfer route of data transmitted and received through the provider communication network may be used, or as a service processing table, transmission and reception through the provider communication network may be performed. A filtering table for managing control information for controlling data transfer / discard may be used.
[0011]
In addition, as the service processing table, an address conversion table that manages control information for controlling conversion of transmission / reception addresses of data transmitted / received via the provider communication network may be used, or the provider processing network may be used as the service processing table. A quality class classification table that manages control information for controlling the communication quality of data transmitted and received via the Internet may be used.
[0012]
Further, the provider server according to the present invention includes a plurality of subscriber user communication networks including user terminals of the subscriber users and managed by the subscriber users, and the provider manages these subscriber user communication networks. Performing data transfer control based on its own service processing table for user data transmitted and received between the user terminal and the provider communication network, which is configured by being connected by a provider communication network and installed in each subscriber user communication network A service processing device that provides various data communication services to the user terminal and a service processing table that is installed in the provider communication network, performs data communication with the service processing device, and uses the service processing device for data transfer control. Content A provider server used in a communication network system having a provider server for remote control, wherein the data communication with a service processing device is performed based on a control procedure predefined at a connection point between the provider communication network and a subscriber user communication network. And a remote control unit for remotely controlling the contents of a service processing table of the service processing device via data communication by the communication unit.
[0013]
An entry acquisition unit that acquires the contents of the service processing table of each service processing device using data communication by the communication unit, an entry state management unit that manages the contents of the service processing table of each service processing device, May be provided.
Further, the remote control unit includes, based on service information indicating a data communication service provided by each service processing device, entry generation means for generating the contents of a service processing table to be set in the service processing device; Service entry management means for managing the contents of the generated service processing table may be provided.
[0014]
Alternatively, the remote control unit may use data communication by the communication unit to acquire the contents of the service processing table of each service processing apparatus, and the entry state management of managing the contents of the service processing table of each service processing apparatus. Means, an entry generating means for generating the contents of a service processing table to be set in the service processing apparatus based on service information indicating a data communication service provided by each service processing apparatus, and a service generated by the entry generating means Service entry management means for managing the contents of the processing table, contents of the service processing table of the service processing apparatus managed by the entry state management means, and service processing of the service processing apparatus managed by the service entry management means Compare the contents to be set in the table The comparing means and the entry setting means for executing remote control for replacing the contents of the service processing table of the service processing apparatus with the contents to be set when a difference between the contents is detected by the comparing means may be provided. Good.
[0015]
A logical communication path for setting a dedicated communication path logically separated from a communication path used for communication between user terminals as a communication path for data communication by the communication unit with each service processing device. A setting unit may be provided.
The remote control unit may be provided with charging information management means for managing the content of remote control performed on each service processing device as charging information for various data communication services for each subscriber user.
[0016]
In addition, the service processing apparatus according to the present invention includes a plurality of subscriber user communication networks including user terminals of subscriber users and managed by the subscriber users, and the subscriber user communication networks are managed by the provider. And is installed in each subscriber user communication network, and performs data transfer control on user data transmitted and received between the user terminal and the provider communication network based on its own service processing table. A service processing device that provides various data communication services to the user terminal and a service processing table that is installed in the provider communication network and performs data communication with the service processing device and that the service processing device uses for data transfer control The contents of A service processing apparatus for use in a communication network system having a provider server for remote control, comprising: a data communication system with a provider server based on a control procedure predefined at a connection point between the provider communication network and a subscriber user communication network; A communication unit having a logical connection unit for performing the communication, a remote control by data communication via the logical connection unit with the provider server, an entry setting unit for setting the contents of its own service processing table, And a service processing unit for performing data transfer control based on the service processing table having the above contents.
[0017]
An entry notification unit that notifies the provider server of the contents of the service processing table of the service processing device may be further provided.
In addition, as a communication path for data communication via the logical connection means of the communication unit, a dedicated communication path logically separated from a communication path used for communication between all user terminals is provided to the communication unit. , A logical communication path setting unit for setting with the provider server may be provided.
Alternatively, when setting a communication path for data communication via the logical connection unit in the communication unit, access restriction is imposed on remote control to the service processing table, thereby permitting only access from the provider server. You may do so.
[0018]
BEST MODE FOR CARRYING OUT THE INVENTION
Next, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of a communication network system according to one embodiment of the present invention.
The communication network system 10 includes a provider communication network 3 and service processing devices 41, 61, and 71.
The provider communication network 3 is a network that connects a plurality of subscriber user communication networks, and is provided between the subscriber user communication network 4 and the subscriber user communication networks 6 and 7, and between the subscriber user communication network 5 and the subscriber. The connection with the user communication network 8 is established.
[0019]
The service processing devices 41, 61, and 71 are devices that connect each subscriber user communication network to the provider communication network 3, respectively, and are provided at connection points between the provider communication network 3 and the subscriber user communication networks 4, 6, and 7 in advance. It performs a defined transfer procedure for transferring user data transmitted and received between these subscriber user communication networks.
The service processing device 41 connects the subscriber user communication networks 4 and 5 to the packet communication networks 1 and 2 in the provider communication network 3 via the provider communication network 3 and the access network 91. The service processing devices 61 and 71 connect the subscriber user communication networks 6 and 7 to the packet communication networks 1 and 2 via an access network 92, respectively.
[0020]
User terminals 42 and 52 are connected to the subscriber user communication networks 4 and 5, respectively. These subscriber user communication networks 4 and 5 are connected to the service processing device 41 in the access network 91 via the service processing device 41. The access control devices 11 and 21 are connected to each other by PPP (Point-to-Point Protocol) connections 94 and 95 which are connections for data transfer set between the access control devices 41 and 21.
User terminals 62 and 72 are connected to the subscriber user communication networks 6 and 7, respectively. These subscriber user communication networks 4 and 5 are connected via the service processing devices 61 and 71 and the connection device 63, respectively. The access network 91 is connected to the access control device 12 by a PPP connection 96 which is a connection for data transfer set between the connection device 63 and the access control device 12.
The subscriber user communication network 8 to which the servers 83 and 84 are connected is connected to the packet communication network 2 via a router 81, a dedicated connection line 80 and a router 22.
[0021]
The service processing device 41, the subscriber user communication networks 4 and 5 connected to the service processing device 41, and the user terminals 42 and 52 connected to the subscriber user communication networks 4 and 5 are a single subscriber user. Managed by
Similarly, the service processing device 61, the subscriber user communication network 6 connected to the service processing device 61, and the user terminal 62 connected to the subscriber user communication network 6 are managed by a single subscriber user. You.
Further, the service processing device 71, the subscriber user communication network 7 connected to the service processing device 71, and the user terminal 72 connected to the subscriber user communication network 7 are managed by a single subscriber user. .
The router 81, the subscriber user communication network 8 connected to the router 81, and the servers 83 and 84 connected to the subscriber user communication network 8 are managed by a single subscriber user.
[0022]
The provider communication network 3 managed by the provider includes a plurality of packet communication networks 1 and 2 and various control devices for controlling the packet communication networks 1 and 2 to realize the connection.
The provider communication network 3 includes a provider server 31, access control devices 11, 12, 21 and a router 22 as control devices.
The provider server 31 remotely controls entries (control information) of various service processing tables provided in each of the service processing devices 41, 61, and 71 connected to the subscriber user communication network.
[0023]
The access control devices 11 and 21 connect the service processing device 41 on the subscriber user communication networks 4 and 5 and the packet communication networks 1 and 2 via the PPP connections 94 and 95 of the access network 91, and It controls transfer or discard of packets exchanged between the networks 4 and 5 and the packet communication networks 1 and 2.
The access control device 12 connects the service processing devices 61 and 71 on the subscriber user communication networks 6 and 7 and the packet communication network 1 via the PPP connection 96 and the connection device 63 of the access network 92, and performs the subscriber user communication. It controls transfer or discard of packets exchanged between the networks 6 and 7 and the packet communication network 1.
[0024]
These PPP connections are used to identify a plurality of connections between the subscriber user communication network and the packet communication network. In addition, for example, an IEEE 802.1Q VLAN tag can be used.
[0025]
The router 22 is connected to the router 81 of the subscriber user communication network 8 via the dedicated connection line 80, and transfers packets exchanged between the subscriber user communication network 8 and the packet communication network 2.
The connection device 63 connects the services 61 and 71 to the access control device 12 via the PPP connection 96 of the access network 92. At this time, in the connection device 63, the packet to the subscriber user communication network 6 is transferred to the service processing device 61, and the packet to the subscriber user communication network 7 is transferred to the service processing device 71.
[0026]
The service processing device 41 connects to the access control devices 11 and 21 via the access network 91, and connects the subscriber user communication networks 4 and 5 connected to the service processing device 41 to the packet communication network 1.
At this time, the service processing device 41 controls transfer or discard of the packet with reference to the filtering table among the various service processing tables, and performs address conversion control of the packet with reference to the address conversion table.
[0027]
The service processing devices 61 and 71 connect to the access control device 12 via the connection device 63 and the access network 92, and connect the subscriber user communication networks 6 and 7 connected to the service processing devices 61 and 71 to the packet communication network 1. Connected. At this time, the service processing devices 61 and 71 perform packet transfer or discard control with reference to the filtering table among the various service processing tables, and perform packet address translation control with reference to the address translation table.
The contents of the various service processing tables of these service processing devices 41, 61, 71 are updated by remote control from the provider server 31 as needed. Each of the service processing devices 41, 61, and 71 performs data transfer control for data exchanged between the user terminal and the provider communication network 3 based on the updated contents.
[0028]
In the present embodiment, IP addresses A1, A2, and A3 that can be used in the packet communication network 1 are assigned to the user terminals 42, 62, and 72, and are used for packet transmission and reception.
Further, IP addresses D1, D3, and D4 usable in the packet communication network 2 are allocated to the user terminal 52 and the servers 83 and 84, and are used for packet transmission and reception.
[0029]
FIG. 2 is an explanatory diagram showing an example of a routing table set in the service processing device 41. The IP address A0 indicates a network address to which A1, A2, and A3 belong. Prefix is a value indicating the part of the address to be referred to when searching the table. The IP address D0 indicates a network address to which D1, D3, and D4 belong.
The service processing device 41 has a routing table 401 used for transfer control between the subscriber user communication network 4 and the PPP connection 94 based on these IP address assignments, and a routing table 401 between the subscriber user communication network 5 and the PPP connection 95. And the routing table 501 used for the transfer control of the above.
[0030]
Thus, the user terminal 42 connected to the subscriber user communication network 4 can use the basic communication service provided by the packet communication network 1. The user terminals 62 and 72 connected to the subscriber user communication networks 6 and 7 can use the basic communication service provided by the packet communication network 1. Further, the user terminal 52 connected to the subscriber user communication network 5 can use the basic communication service provided by the packet communication network 2. The servers 83 and 84 connected to the subscriber user communication network 8 can use the basic communication service provided by the packet communication network 2.
[0031]
With such a basic communication service for realizing data communication between user terminals, each subscriber user communication network is connected to the provider communication network 3 and communication between the subscriber user communication networks becomes possible. In the present embodiment, an independent closed network (virtual private network: hereinafter, referred to as VPN / Virtual Private Network) is configured by connecting to independently configured packet communication networks 1 and 2.
FIG. 3 is an explanatory diagram showing a configuration example of a VPN formed by the basic communication service. The packet communication networks 1 and 2 constitute a VPN 100 and a VPN 200 together with a subscriber user communication network to be connected and terminals connected thereto.
[0032]
In the VPN 100, the subscriber user communication network 4 and the subscriber user communication networks 6 and 7 are connected via the packet communication network 1, and a user terminal 42 connected to the subscriber user communication network 4 and a subscriber user communication network 6 , 7 are connected to user terminals 62 and 72 for data communication.
In the VPN 200, the subscriber user communication network 5 and the subscriber user communication network 8 are connected via the packet communication network 2, and a user terminal 52 connected to the subscriber user communication network 5; Data communication is performed with the servers 83 and 84 connected to.
[0033]
In the communication network system 10 capable of performing communication using the basic communication service, the service processing devices 41, 61, and 71 execute data transfer control on the user data packet transferred as the basic communication service based on the service processing table. And provide value-added services to subscriber users.
[0034]
Next, an operation of the communication network system 10 according to the present exemplary embodiment will be described with reference to FIG. FIG. 4 is an explanatory diagram showing a service control interface in the provider communication network.
The service control interface pre-defines a data communication control procedure to be set between the provider server 31 and the service processing devices 41, 61, 71 so that the provider server 31 performs remote control of each service control device. It is a logical connection.
After the basic communication service becomes available, a connection is made as a logical connection for the service control interface between the provider server 31 and the service processing devices 41, 61, 71 using, for example, IPsec connections 104, 106, 107. I do. This IPsec (IP Security Protocol) is a group of protocols formulated by the Internet Engineering Task Force (IETF) in order to add a security function to TCP / IP, and includes protocols such as authentication headers and encryption of payload packets. Have been.
[0035]
Further, in the present embodiment, IP addresses A4, A6, and A7 are assigned to the service processing devices 41, 61, and 71, and are used for logical connection of the service control interface.
With such a logical connection of the service control interface, it is possible to eliminate a logical connection from a source other than the provider server 31, and it is also possible to prevent impersonation by other terminals, falsification of data, and eavesdropping. Therefore, security of remote control can be ensured.
[0036]
In the provider server 31, remote control of the service processing device 41 via the service control interface is performed as follows.
FIG. 5 shows a configuration example of the provider server 31. The provider server 31 includes a logical connection unit 310, a communication unit 311, a remote control unit 312, an entry acquisition unit 313, an entry state management unit 314 for managing an entry to be set in the service processing device, an entry generation unit 315, A service entry management unit 316 for managing entries to be set in the service processing apparatus, a comparison unit 317 for comparing entries, an entry setting unit 318, a charging information management unit 320, and a logical communication path setting unit 319 are provided.
[0037]
The communication unit 311 executes a control procedure for remotely controlling, by data communication, the contents of a service processing table of the service processing device 41, which is defined in advance at a connection point between the provider communication network 3 and the subscriber user communication network 4. I do.
The logical communication path setting unit 319 sets the IPsec connection 104 between the logical connection unit 310 of the communication unit 311 and the service processing device 41 as a service control interface. As a destination IP address of the IPsec connection 104, an IP address A4 assigned to the service processing apparatus 41 and used for a logical connection for a service control interface with the provider server 31 is used.
The provider server 31 similarly sets the IPsec connections 106 and 107 for the service processing devices 61 and 71.
[0038]
FIG. 6 shows a configuration example of the service processing device 41. The service processing device 41 includes a logical connection unit 410, a communication unit 411, a service processing unit 412, a service processing table 413, an entry 414, a basic communication service packet processing unit 415, an entry notification unit 416, a logical communication path setting unit 417, An entry setting means 418 is provided.
The logical communication path setting unit 417 sets the IPsec connection 104 between the logical connection unit 410 of the communication unit 411 and the provider server 31 as a service control interface.
[0039]
The communication unit 411 executes a transfer procedure for transferring user data transmitted and received between the subscriber user communication networks, which is defined in advance at a connection point between the provider communication network 3 and the subscriber user communication network 4. Further, the communication unit 411, the service processing unit 412, the entry notification unit 416, and the entry setting unit 418 determine the service processing table of the own device, which is defined in advance at the connection point between the provider communication network 3 and the subscriber user communication network 4. A control procedure for remotely controlling the contents by data communication from the provider server 31 is executed.
[0040]
When the communication unit 411 receives the packet of the IP address A4 assigned to the service processing device 41 and used for the logical connection for the service control interface with the provider server 31, the communication unit 411 passes the packet to the logical connection function 410, An IPsec 104 with the provider server 31 is established, which is isolated from the packet transfer of the basic communication service.
The service processing devices 61 and 71 also set the IPsec connection 104 with the provider server 31 in the same manner as described above.
[0041]
The service processing devices 41, 61, and 71 permit connection of the IPsec connections 104, 106, and 107 only to the provider server 31. At this time, as a method of identifying the service processing devices 41, 61, and 71 and realizing access protection for permitting and rejecting the setting of the IPsec connection, for example, an IP address assigned for a service control interface of each service processing device A4, A6, and A7 may be used to permit connection from the IP address and reject connections from other IP addresses.
Further, as a logical connection of the service control interface, a VPN may be set between the service control device and the provider server separately from the basic transfer service.
[0042]
In the provider server 31, when performing remote control of the service processing device 41, first, the entry generation unit 315 uses the service information registered in the provider server 31 as information indicating service provision contents contracted with the subscriber user in advance. , An entry of the service processing table is generated, stored in the service entry management means 316, and managed. The entry acquisition unit 313 acquires an entry from the service processing device 41 via the service control interface, stores the entry in the entry status management unit 314, and manages the entry.
The comparing means 317 compares the entries of the service entry managing means 316 and the entries of the entry state managing means 314. If a difference is detected, the entry setting means 318 sends the entry to the service processing device 41 via the service control interface. Is rewritten.
[0043]
In the charging information management function 320, the specific contents of the remote control performed from the entry setting means 318 to the service processing device 41, for example, the number of set service processing tables 413, the entry 414 set for each service processing table 413, Information indicating the number, the number of remote controls performed, the time required for the remote control, and the like is managed for each subscriber as charging information for various data communication services based on the service processing device.
[0044]
On the other hand, the entry setting means 418 of the service processing device 41 includes an information storage device such as a hard disk and its peripheral circuits, and manages the contents of service processing to be executed by the service processing device 41 as an entry 414 of the service processing table 413. I have. Then, when the entry setting means 418 receives the remote control of the provider server 31 via the service control interface, the entry is set as the entry 414 of the service processing table 413.
The set entry 414 is referred to when the basic communication service packet is transferred by the basic communication service packet processing means 415, and the service processing is performed.
When the entry acquisition unit 313 of the provider server 31 acquires the entry 414 of the service processing device 41, the entry notification unit 416 sends the contents of the entry 414 of the service processing table 413 to the provider server 31 via the service control interface. Notice.
[0045]
As described above, the provider server 31 provided in the provider communication network 3 communicates with the service processing device 41 connected to the subscriber user communication network 4 and the service processing table 413 used by the service processing device 41 for data transfer control. In order to remotely control the contents of the data communication, in addition to the provision of a transfer procedure for general data transfer as a basic communication service, a control procedure of data communication for remote control as a service control interface is defined and used in advance. Therefore, the provider server 31 can provide a service control interface simply by providing a means for executing a prescribed data communication control procedure for remote control, and can provide a service control interface to each subscriber user communication network. Remote control of service processing equipment It is possible to provide value-added services for the data transfer signal service.
[0046]
Further, the service processing device 41 can receive the remote control of the provider server 31 via the service control interface only by providing the means for executing the data communication control procedure for the remote control defined in advance. That is, in the subscriber user communication network to which the service processing device is connected, it is possible to use a value-added service for data transfer of the basic communication service.
This eliminates the need for the subscriber user to set the subscriber user edge node as in the past, and allows the subscriber user to easily utilize the communication service even if the subscriber user does not have advanced communication network operation skills. can do.
[0047]
Further, as compared with the case where service processing is performed in the provider communication network 3, processing and devices required in the provider communication network 3 can be reduced, and deterioration in communication performance and increase in device cost in the provider communication network 3 can be avoided. Provide high-performance and inexpensive communication network services.
Although the service processing device 41 has been described as an example, the contents of the service processing tables of the other service processing devices 61 and 71 may be remotely controlled from the provider server 31 in the same manner.
[0048]
Further, by setting the entries in the service processing table 413 of the service processing device 41, value-added services such as communication path selection, unauthorized access prevention, network connection by converting duplicate addresses, and appropriate communication quality selection are provided. Since the provider can provide the service and the user does not need to perform complicated settings in the service processing device 41, an entry setting work fee is collected from the subscriber user as a price for the setting work for the service processing device 41 performed by the provider. , A new service can be provided.
[0049]
Further, since the entry of the service processing table 413 is obtained from the service processing device 41, the service status for the subscriber user can be grasped, the service can be easily updated, and the maintainability of the service is improved. .
In addition, since the entry of the service processing table 413 is remotely controlled from the provider server 31, even if the service processing device 41 fails and the entry 414 of the service processing table 413 is lost, the service entry management unit 316 manages the entry. It is possible to set the correct service setting in the service processing device 41 by remote control. Thereby, the reliability of the service for the failure of the service processing device 41 is improved.
[0050]
Further, an entry of the service processing table 413 is obtained from the service processing device 41 and compared with the entry to be set in the service processing table 413 of the service processing device 41. If a difference is detected between the two, the entry should be set. Since the entry is set in the service processing table 413 of the service processing device 41, the service content can be easily updated, and even if the subscriber user makes an inappropriate setting in the service processing table 413, Can be appropriately updated, so that the provider and the subscriber user can easily manage service contents. Alternatively, even if an entry in the service processing table is lost due to a failure or the like, an appropriate entry can be set from the provider server, and the failure recovery processing becomes easy.
[0051]
In addition, since the dedicated communication path logically separated from the communication path used by the user terminal is used between the provider server 31 and the service processing apparatus 41, the service processing apparatus 41 Communication can be explicitly identified, and it is possible to prevent a communication terminal other than the provider server from impersonating the provider server and setting an entry in the service processing table of the service processing apparatus, thereby improving security in remote control of the entry. It becomes possible.
[0052]
In addition, since the service processing device 41 restricts access to the remote control of the service processing table 141 to allow only access from the provider server, it is possible to monitor a setting change by a person other than the provider. . Thereby, for example, it is possible to avoid an error such that the subscriber user mistakenly sets an entry of the service processing table 141 of the service processing apparatus 41 of the subscriber user with a provider contract, thereby improving the security of service provision to the provider. It becomes possible to do.
[0053]
Further, since the routing table of the service processing table 141 is remotely controlled from the provider server 31, even when the service processing device 41 cannot connect to a plurality of provider communication networks and cannot process the routing protocol, the provider communication network can be processed. It is possible to appropriately select the communication route on the side.
Further, since the filtering table of the service processing table 141 is remotely controlled from the provider server 31, it is possible to prevent unauthorized access to the subscriber user terminal from the provider communication network side. Also, unauthorized access from the subscriber user terminal to the provider communication network side can be prevented.
[0054]
Also, since the address conversion table of the service processing table 141 is remotely controlled from the provider server 31, the subscriber user terminal and the network device in the subscriber user communication network can be connected to another subscriber user communication network or the provider communication network. In the case where an address that is the same as the address used in (1) is used, communication can be performed by appropriately converting the address.
Further, the quality class classification table of the service processing table 141 may be remotely controlled from the provider server 31. This makes it possible to appropriately use the communication quality class supported by the provider communication network. For example, voice communication can be assigned to a communication quality class with a small delay but small allowable throughput, and stored data communication can be assigned to a communication quality class with a large delay but large allowable throughput.
[0055]
Further, in the provider server 31, specific contents of the remote control performed on the service processing device 41 are managed for each subscriber as charging information for various data communication services based on the service processing device. The service processing device 41 of the subscriber user communication network 4 can collect a service fee while performing data transfer control as a service process of various data communication services.
[0056]
Next, the content of the above-described remote control will be described in detail using a communication service between VPNs as a specific value-added service as an example.
As an example of the inter-VPN communication service, there is a service that enables communication between the VPN 100 and the VPN 200 only for the user terminal 42 and the server 83 connected to the subscriber user communication network 4.
Such an inter-VPN communication service can be provided by applying a routing table, a filtering table, and an address translation table to the service processing table 413 of the service processing device 41.
[0057]
FIG. 7 is an explanatory diagram showing an example of an entry 414 of the service processing table 413 of the service processing device 41. This entry 414 is previously stored in the service entry management means 316 of the provider server 31 when providing the above-described inter-VPN communication service, and is set in the service processing table 413 of the service processing apparatus 41 by the remote control unit 312. Is done.
[0058]
7, an IP address C1 is an IP address that can be used in the packet communication network 2, and is an IP address assigned to the user terminal 42. It is not used for the packet transmission / reception operation of the user terminal 42, but is used as an address of a packet that communicates with the user terminal 42 in the packet communication network 2. The IP addresses B3 and B4 are IP addresses that can be used in the packet communication network 1, and are IP addresses assigned to the servers 83 and 84. It is not used for the packet transmission / reception operation of the servers 83 and 84, but is used in the packet communication network 1 as an address of a packet that communicates with the servers 83 and 84.
[0059]
When the provider server 31 acquires the entry 414 of the service processing table 413 mounted on the service processing device 41 at the time of starting a service, changing a service, recovering from a failure of the service processing device 41, or the like, the acquired routing The table is stored in the entry state management means 314.
The comparing unit 317 detects a difference between each routing table stored in the entry state managing unit 314 and each of the tables 421 to 426 stored in the service entry managing unit 316. Then, each of the tables 421 to 426 is notified.
[0060]
The entry setting unit 318 communicates with the service processing device via the IPsec connection 104 which is a service control interface set by the logical connection unit 310 of the communication unit 311 and the logical connection unit 410 of the communication unit 411 of the service processing device 41. Remotely controlling the 41 entry setting means 418 to set each of the tables 421 to 426.
In response, the entry setting means 418 of the service processing device 41 sets the tables 421 to 426 in the service processing table 413.
The entry notification unit 416 notifies the entry acquisition unit 313 of the provider server 31 via the service control interface that each of the tables 421 to 426 is set, and stores it in the entry state management unit 314. .
[0061]
By such remote control of the service processing device 41 by the provider server 31, the service processing table 413 is set in the service processing device 41 as shown in FIG.
In order to provide a value-added service, routing tables 421 and 424, filtering tables 422 and 425, and address conversion tables 423 and 426 are applied and set as the service processing table 413. By referring to the tables 421 to 426 and performing the processing by the basic communication service packet processing means 415, the user terminal 42 can communicate with the servers 83 of the packet communication network 1 and the packet communication network 2.
[0062]
That is, in the communication network system 10 of FIG. 1, when the user terminal 42 assigned the IP address A1 transmits a packet to the user terminal 62 assigned the IP address A2, the service processing device 41 With reference to the packet transfer route, a PPP connection 94 is acquired. At this time, by referring to the filtering table 422 and the address conversion table 423, it is determined that there is no need for packet filtering and address conversion, and the packet is transferred without performing these processes.
By the above operation, the user terminal 42 is connected to the packet communication network 1 without performing the filtering and the address conversion processing, and can communicate with the user terminal 62 as a terminal of the same network.
[0063]
Next, when transmitting a packet to the server 83, the user terminal 42 transmits the packet with the IP address B3 usable in the packet communication network 1 as a transmission destination.
At this time, the service processing device 41 refers to the routing table 421 and acquires the PPP connection 95 as the packet transfer route based on the upper address B0. Also, the packet transfer is confirmed by referring to the filtering table 422, and the destination IP address and the source IP address are rewritten to D3 and C1, respectively, by referring to the address conversion table 423, and then the packet is transferred.
[0064]
On the other hand, when transmitting a packet to the server 84, the user terminal 42 transmits the packet with the IP address B4 usable in the packet communication network 1 as a transmission destination.
At this time, the service processing device 41 refers to the routing table 421 and acquires the PPP connection 95 as the transfer route in the same manner as described above, but discards the packet based on the upper address B0 with reference to the filtering table 422.
[0065]
When transmitting a packet to the user terminal 42, the server 83 transmits the packet with the IP address C1 usable in the packet communication network 2 as a destination.
At this time, the service processing device 41 refers to the routing table 424, and acquires the subscriber user communication network 4 as the packet transfer route based on the address C1. At this time, by referring to the filtering table 425, it is determined that the packet transfer is possible based on the upper address A0, and by referring to the address conversion table 426, the destination IP address and the source IP address are rewritten to A1 and B3, respectively, and then transferred. I do.
[0066]
With the above operation, the user terminal 42 can communicate with the server 83 of the subscriber user communication network 8, and the communication with the server 84 is rejected. Therefore, it is possible to provide a desired inter-VPN communication service by remotely controlling the service processing device 41 by the provider server 31.
Note that the present invention is not limited to the above configuration. It is also possible to connect the access control devices 12 and 21 as one device, and to use logically independent VPNs as a plurality of packet communication networks.
[0067]
【The invention's effect】
As described above, the present invention provides a service processing table used by a provider server provided in a provider communication network to communicate with a service processing apparatus connected to a subscriber user communication network and to use the service processing apparatus for data transfer control. In the service processing apparatus, the data transfer control is performed based on the contents of the service processing table remotely controlled by the provider server. There is no need to set up nodes, and the subscriber user can easily and highly utilize the communication service even if the subscriber user does not have advanced communication network operation skills.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a configuration of a communication network system according to an embodiment of the present invention.
FIG. 2 is an explanatory diagram showing an example of a routing table set in a service processing device.
FIG. 3 is an explanatory diagram showing a configuration example of a VPN formed by a basic communication service.
FIG. 4 is a diagram illustrating an example of a service control interface.
FIG. 5 is a block diagram illustrating a configuration example of a provider server.
FIG. 6 is a block diagram illustrating a configuration example of a service processing device.
FIG. 7 is an explanatory diagram showing an example of a service processing table managed by a provider server.
FIG. 8 is an explanatory diagram illustrating an example of a service processing table set in the service processing apparatus.
[Explanation of symbols]
1, 2, ... packet communication network, 11, 12, 21 ... access control device, 22, 81 ... router, 3 ... provider communication network, 31 ... provider server, 4, 5, 6, 7, 8 ... subscriber user communication network , 41, 61, 71 ... service processing device, 63 ... connection device, 42, 52, 62, 72 ... user terminal, 91, 92 ... access network, 94, 95, 96 ... PPP connection, 80 ... dedicated connection line, 83 , 84 ... server, 100, 200 ... VPN, 104, 106, 107 ... IPsec connection, 401, 501, 421, 424 ... routing table, 422, 425 ... filtering table, 423, 426 ... address conversion table, 310 ... logical connection Means, 311 communication unit, 312 remote control unit, 313 entry acquisition means, 3 4 entry state management means 315 entry creation means 316 service entry management means 317 comparison means 318 entry setting means 319 logical communication path setting unit 320 charging information management means 410 logical connection Means 411 communication unit 412 service processing unit 413 service processing table 414 entry 415 basic communication service packet processing means 416 entry notification unit 417 logical communication path setting unit 418 entry setting means.

Claims (19)

A plurality of subscriber user communication networks including a user terminal of the subscriber user and managed by the subscriber user are installed, and the subscriber user communication networks are connected by a provider communication network managed by a provider. In communication network systems,
It is installed in each of the subscriber user communication networks, and by performing data transfer control based on its own service processing table for user data transmitted and received between the user terminal and the provider communication network, A service processing device for providing various data communication services through
A provider server installed in the provider communication network, performing data communication with the service processing device, and remotely controlling the contents of a service processing table used by the service processing device for the data transfer control;
The service processing device executes a transfer procedure for transferring the user data transmitted and received between the subscriber user communication networks, which is predefined at a connection point between the provider communication network and the subscriber user communication network. Having means to
The service processing device and the provider server transmit the contents of the service processing table of the service processing device, which is defined in advance at a connection point between the provider communication network and the subscriber user communication network, by data communication from the provider server. A communication network system comprising means for executing a control procedure for remote control. A plurality of subscriber user communication networks including a user terminal of the subscriber user and managed by the subscriber user are installed, and the subscriber user communication networks are connected to each other by a provider communication network managed by the provider.
It is installed in each of the subscriber user communication networks, and by performing data transfer control based on its own service processing table for user data transmitted and received between the user terminal and the provider communication network, A service processing device for providing various data communication services through
A service used in a communication network system comprising a provider server installed in the provider communication network, communicating data with the service processing device, and remotely controlling the contents of a service processing table used by the service processing device for the data transfer control. A processing control method,
In the provider server,
By performing data communication with the service processing device based on a predetermined control procedure at a connection point between the provider communication network and the subscriber user communication network, the contents of the service processing table possessed by the service processing device Remote control,
In the service processing device,
Transferring the user data transmitted and received between the subscriber user communication networks based on a transfer procedure predefined at a connection point between the provider communication network and the subscriber user communication network;
A service processing control method, comprising: performing data transfer control for the user data based on the contents of a service processing table of the self remotely controlled by the provider server. The service processing control method according to claim 2,
When the content of the service processing table of the service processing device is remotely controlled by the provider server, the content set in the service processing table is compared with the content to be set in the service processing table, and a difference is found between the two. A remote control that replaces the contents of the service processing table with the contents to be set when the is detected. The service processing control method according to claim 2 or 3,
When the provider server performs remote control on the service processing device, a communication path connecting the provider server and each of the service processing devices, and a communication path used by the user terminal A service processing control method characterized by using a logically isolated dedicated communication path. In the service processing control method according to any one of claims 2 to 4,
A service processing control method, wherein the service processing apparatus restricts access to remote control to the service processing table, thereby permitting only access from the provider server. The service processing control method according to any one of claims 2 to 5,
A service processing control method, wherein a routing table that manages control information for controlling a transfer route of data transmitted and received via the provider communication network is used as the service processing table. The service processing control method according to any one of claims 2 to 5,
A service processing control method, wherein a filtering table for managing control information for controlling transfer / discard of data transmitted / received via the provider communication network is used as the service processing table. The service processing control method according to any one of claims 2 to 5,
A service processing control method, wherein an address conversion table that manages control information for controlling conversion of a transmission / reception address of data transmitted / received via the provider communication network is used as the service processing table. The service processing control method according to any one of claims 2 to 5,
A service processing control method, wherein a quality class classification table for managing control information for controlling communication quality of data transmitted and received via the provider communication network is used as the service processing table. A plurality of subscriber user communication networks including a user terminal of the subscriber user and managed by the subscriber user are installed, and the subscriber user communication networks are connected to each other by a provider communication network managed by the provider.
It is installed in each of the subscriber user communication networks, and by performing data transfer control based on its own service processing table for user data transmitted and received between the user terminal and the provider communication network, A service processing device for providing various data communication services through
A provider used in a communication network system comprising: a provider server installed in the provider communication network, performing data communication with the service processing device, and remotely controlling the contents of a service processing table used by the service processing device for the data transfer control. A server,
A communication unit that performs data communication with the service processing device based on a control procedure predefined at a connection point between the provider communication network and the subscriber user communication network;
A provider server, comprising: a remote control unit that remotely controls the contents of a service processing table of the service processing device via data communication by the communication unit. The provider server according to claim 10, wherein
The remote control unit includes:
Using data communication by the communication unit, entry acquisition means for acquiring the contents of the service processing table of each service processing device,
A provider server having entry state management means for managing the contents of a service processing table of each service processing device. The provider server according to claim 10, wherein:
The remote control unit includes:
Entry generation means for generating the contents of a service processing table to be set in the service processing device based on service information indicating a data communication service provided by each service processing device;
A service entry management means for managing the contents of the service processing table generated by the entry generation means. The provider server according to claim 10, wherein
The remote control unit includes:
Using data communication by the communication unit, entry acquisition means for acquiring the contents of the service processing table of each service processing device,
Entry state management means for managing the contents of the service processing table of each service processing device;
Entry generation means for generating the contents of a service processing table to be set in the service processing device based on service information indicating a data communication service provided by each service processing device;
Service entry management means for managing the contents of the service processing table generated by the entry generation means;
A comparison that compares the contents of the service processing table of the service processing device managed by the entry state management unit with the contents to be set in the service processing table of the service processing device managed by the service entry management unit. Means,
When a difference is detected between the two contents by the comparing means, there is provided an entry setting means for executing remote control for replacing the contents of the service processing table of the service processing device with the contents to be set. Provider server. The provider server according to any one of claims 10 to 13,
As a communication path for data communication by the communication unit, a dedicated communication path logically separated from a communication path used for communication between the user terminals is set between each of the service processing devices. A provider server further comprising a logical communication path setting unit. In the provider server according to any one of claims 10 to 14,
The remote control unit includes:
A provider server comprising: charging information management means for managing, for each subscriber user, the content of remote control performed on each of the service processing devices as charging information for the various data communication services. A plurality of subscriber user communication networks including a user terminal of the subscriber user and managed by the subscriber user are installed, and the subscriber user communication networks are connected to each other by a provider communication network managed by the provider.
It is installed in each of the subscriber user communication networks, and by performing data transfer control based on its own service processing table for user data transmitted and received between the user terminal and the provider communication network, A service processing device for providing various data communication services through
A service used in a communication network system comprising a provider server installed in the provider communication network, communicating data with the service processing device, and remotely controlling the contents of a service processing table used by the service processing device for the data transfer control. A processing device,
A communication unit having logical connection means for performing data communication with the provider server based on a control procedure predefined at a connection point between the provider communication network and the subscriber user communication network;
An entry setting unit that sets the content of its own service processing table in accordance with remote control by data communication with the provider server via the logical connection unit;
A service processing unit for performing the data transfer control based on the service processing table having the contents set by the remote control. The service processing device according to claim 16,
A service processing apparatus further comprising an entry notification unit for notifying the provider server of the contents of a service processing table of the service processing apparatus. The service processing device according to claim 16 or 17,
As a communication path for data communication via the logical connection means of the communication unit, a dedicated communication path logically separated from the communication path used for communication between all user terminals is used for the communication unit. A service processing apparatus, further comprising a logical communication path setting unit for setting the communication path with the provider server. The service processing device according to any one of claims 16 to 18,
The communication unit, when setting a communication path for data communication via the logical connection unit, restricts access to remote control to the service processing table, thereby limiting access only from the provider server. A service processing device characterized by permitting.

Images