JP2010178178A - Ip network communication system and sni configuration method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a variety of services by performing flexible SNI (Application Server Network Interface) matched to a system construction of a service providing dealer network and by the service providing dealer utilizing a network service function of an IP network. <P>SOLUTION: An interface part for connecting a first IP network and a second IP network and a third IP network has an SNI configuration, which includes: a function for connecting a user terminal to the service providing server of the second IP network or a service providing server of the third IP network via the first IP network; and a function for allowing the service providing server of the second IP network to act the access processing proxy of the user terminal by a network service function part of the first IP network. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  In the present invention, a service provider connected to an IP network uses a network service function (for example, an authentication function or a billing function of a user terminal) of the IP network via an SNI (Application Server Network interface) of the IP network. The present invention relates to an IP network communication system and an SNI configuration method for providing services.

  The next-generation network (hereinafter referred to as “NGN (Next Generation Network)”) is a base network that provides telephone services, services that combine fixed and mobile communications, and new information and communications services that will be developed in the future (non- Patent Document 1).

  To develop this NGN, it is important to make it easy for service providers to use various network service functions (for example, user terminal authentication function and billing function) provided on the NGN side, that is, to improve openness. is there. To that end, it is easy for service providers that connect to NGN using a connection method that conforms to the SNI defined by NGN carriers, and to provide a variety of services to NGN users by utilizing NGN network service functions. It is necessary to. The same applies to the SNI of the conventional IP network.

  For example, when the service provider has an authentication server in its own network, the user terminal accesses the service provider server of the service provider network via the SNI of the IP network and provides the service by the authentication server. Get the approval of whether or not. For this purpose, it is necessary to allow the SNI configuration of the IP network to take a flexible form in accordance with the system configuration (service providing server or authentication server) of the service provider network.

  On the other hand, since a service provider that does not have an authentication server cannot authenticate a user terminal via the SNI of the IP network, the network service function (user terminal authentication) provided by the communication provider that provides the IP network is not possible. Function).

  However, the network service function provided by the telecommunications carrier that provides the IP network is accommodated in the telecommunications carrier's IP network as a unique interface. In this case, it is not easy for the service provider to use the network service function of this IP network, and if the service provider tries to use it, a new function based on the unique interface for each network service function will be newly provided on the service provider side. There was a need to build. Therefore, there is a need for an SNI configuration that can be easily used by a service provider that connects the network service function of the IP network to the IP network.

  The present invention enables flexible SNI according to the system configuration of a service provider network, and enables IP network communication that allows a service provider to provide various services by utilizing the network service function of the IP network. It is an object to provide a system and an SNI configuration method.

  The IP network communication system of the first invention uses a first IP network including a network service function unit that accommodates user terminals and performs access processing of the user terminals, and a network service function unit included in the first IP network. Then, the access processing of the user terminal is performed, the second IP network including a service providing server that provides a predetermined service to the user terminal, and the access processing of the user terminal within the own network is performed, A third IP network including a service providing server that provides a predetermined service, and an interface unit that connects the first IP network, the second IP network, and the third IP network is provided by a user terminal. A function of connecting to a service providing server of the second IP network or a service providing server of the third IP network via the first IP network, and a service providing server of the second IP network to the first Characterized in that the network service function portion of the IP network is a SNI configuration and a function of proxy access processing in the user terminal.

  The network service function unit of the first IP network in the IP network communication system of the first invention is a first means for receiving a service connection request from a user terminal, and the service connection request is a service providing server for the second IP network. The second means for determining whether the service is provided by the service providing server of the third IP network, and the service connection request is a service provided by the service providing server of the second IP network. The access processing of the user terminal is performed on behalf of the service providing server of the second IP network, and when the service connection request is a service provided by the service providing server of the third IP network, the service connection request of the user terminal is And third means for sending to a service providing server of a third IP network.

  The third means connects the user terminal to the service providing server of the second IP network when the connection is permitted when the access processing of the user terminal is performed in place of the service providing server of the second IP network. The user terminal is configured to perform a process for connecting to the service providing server of the second IP network including the access information.

  The third means is configured to transmit the access information including the access information for connecting to the service providing server of the third IP network when the service connection request of the user terminal is transmitted to the service providing server of the third IP network. It is.

  Also, the second IP network or the third IP network includes a filter function unit that performs filtering using access information for connecting to each service providing server.

  According to a second aspect of the present invention, a user terminal is accommodated by using a first IP network including a network service function unit that accommodates a user terminal and performs access processing of the user terminal, and a network service function unit included in the first IP network. Access processing of the user terminal in the second IP network including the service providing server that performs access processing and provides a predetermined service to the user terminal and the user terminal, and provides the predetermined service to the user terminal And a third IP network including a service providing server that connects the first IP network, the second IP network, and the third IP network. A function of connecting to the service providing server of the second IP network or the service providing server of the third IP network via the network, and the service providing server of the second IP network to the network of the first IP network And having a function of proxy access processing in the user terminal in over click service functional unit.

  In the SNI configuration method of the second invention, the network service function unit of the first IP network includes a first procedure for accepting a service connection request from a user terminal, and a service providing server for the service connection request of the second IP network. In the case of the second procedure for determining whether the service is provided or the service provided by the service providing server of the third IP network, and the service connection request is a service provided by the service providing server of the second IP network, The access processing of the user terminal is performed on behalf of the service providing server of the second IP network, and when the service connection request is a service provided by the service providing server of the third IP network, the service connection request of the user terminal is And a third procedure for sending to the service provider server of the third IP network.

  In the present invention, the service provider of the second IP network uses the SNI configuration that connects the first IP network, the second IP network, and the third IP network. A variety of services can be provided by utilizing the function section.

  In addition, since the service provider of the second IP network can utilize the network service function unit of the first IP network, it is not necessary to provide a function for user terminal access processing in its own network, and the cost is low. In addition, a predetermined service can be provided easily.

  In addition, since the communication service provider that provides the first IP network can provide various services by the service provider of the second IP network or the third IP network, the first IP network An increase in the number of user terminals accommodated by the network and an increase in traffic can be expected.

  A service managed by the network service function unit of the first IP network when the user terminal connects to the service providing server of the second IP network or the third IP network via the first IP network. By using the access information of the providing server, access control by IP address, port filtering, etc. is possible, and security can be improved.

It is a figure which shows the structural example of Example 1 of the IP network communication system of this invention. It is a figure which shows the structural example of SNI-SSE14. It is a figure which shows the example of the connection sequence in the IP network communication system of Example 1. FIG. It is a figure which shows the specific example of the connection sequence in the IP network communication system of Example 1. FIG. It is a figure which shows the structural example of the authentication server 13 of NGN10 in Example 1. FIG. 3 is a flowchart illustrating a processing procedure of an authentication server 13 of the NGN 10 in the first embodiment. It is a figure which shows the structural example of Example 2 of the IP network communication system of this invention.

  FIG. 1 shows a configuration example of Embodiment 1 of the IP network communication system of the present invention. Here, an example in which an authentication function of a user terminal is used as a network service function provided in a telecommunications carrier that provides NGN will be described. The following description is not limited to NGN, and the same applies to the case where a charging function is used, for example.

  In the figure, the NGN 10 has a proxy authentication function of user identification information for the requested service of the user terminal 1a and the user terminal 1b connected and accommodated in the NGN, and the SIP server 12 that transmits and receives the SIP signal via the information transfer path 11. In this configuration, an authentication server 13 and an SNI-SSE (Subscriber Service Edge) 14 having a connection interface function with a service provider are connected. The SNI-SSE 14 is connected to a service providing server 21A of a service A providing provider network 20A that provides service A and a service providing server 21B of a service B providing provider network 20B that provides service B. Connected to the service providing server 21B is an authentication server 22 having a function of authenticating user identification information for the service provided by the service B provider network 20B.

FIG. 2 shows a configuration example of the SNI-SSE 14.
In the figure, the SNI-SSE 14 includes a layer 1 function unit 141 having 100BASE-TX and 1000BASE-T, a layer 2 function unit 142 having ARP (Address Resolusion Protocol) / MAC (Media Access Control), and IPv4 / Layer 3 function unit 143 with IPv6, Layer 4 function unit 144 with TCP (Transmission Control Protocol) / UDP (User Datagram Protocol), SIP (Session Initiation Protocol) / RTSP (Real Time Streaming Protocol) / RTP Each functional unit conforming to the OSI reference model including the layer 5 functional unit 145 having (Real-time Transport Protocol) / RTCP (RTP Control Protocol) is provided. Therefore, the service provider can connect to the SNI-SSE 14 by providing each function based on the OSI reference model.

FIG. 3 shows an example of a connection sequence in the IP network communication system of the first embodiment.
First, when the service provision server 21A of the service A provider network 20A does not hold the service provision availability determination function for each user terminal in the own network and uses the authentication function provided in the NGN 10, the user terminal 1a , 1b makes a service A connection request.

  The service providing server 21A sends service A providing information (1a: permission) for permitting a service A connection request from the user terminal 1a contracted to provide the service A to the authentication server of the NGN 10 via the SNI-SSE14. 13 is registered in the service A provision list (S1).

  The user terminal 1a transmits a service A connection request including its own user identification information (ID = 1a) to the SIP server 12 of the NGN 10 (S2). In the user identification information, a password may be set together with the user ID. The SIP server 12 makes an inquiry to the authentication server 13 in order to determine whether or not the service A connection of the user terminal 1a is possible (S3). The authentication server 13 determines whether or not service A provision information for the user terminal 1a is set in the service A provision list. Here, the user terminal 1a in which the service A provision information is registered from the service provision server 21A is “permitted”. Accordingly, the authentication server 13 determines “permitted” in response to the service A connection request from the user terminal 1a, and returns a connection permission response including the access information of the service providing server 21A to the user terminal 1a via the SIP server 12. (S4, S5).

  The access information of the service providing server 21A includes a logical identifier assigned to each layer, such as the IP address and port number of the service providing server 21A, and is used for filtering described in the second embodiment to enhance security. May be.

  Thereafter, the user terminal 1a connects to the service providing server 21A of the service A provider network 20A via the SNI-SSE 14 of the NGN 10 and receives the service A (S6).

  On the other hand, the user terminal 1b transmits a service A connection request including its own user identification information (ID = 1b) to the SIP server 12 of the NGN 10 (S7). The SIP server 12 makes an inquiry to the authentication server 13 to determine whether or not the service A connection of the user terminal 1b is possible (S8). The authentication server 13 determines whether service A provision information for the user terminal 1b is set in the service A provision list. Here, since provision information for the user terminal 1b is not set in the service A provision list, the authentication server 13 determines “not permitted” and returns a connection rejection response to the user terminal 1b via the SIP server 12. (S9, S10). Therefore, the user terminal 1b cannot connect to the service providing server 21A and cannot receive the service A.

  Next, a case where the user terminals 1a and 1b make a service B connection request when the service provision server 21B of the service B provider network 20B holds a service provision availability determination function for each user terminal in the own network will be described. To do.

  The service providing server 21B uses the service B providing information (1a: permission) for permitting a service B connection request from the user terminal 1a contracted to provide the service B as the service B of the authentication server 22 in its own network. Register in the provided list (S11).

  The user terminal 1a transmits a service B connection request including its own user identification information (ID = 1a) to the SIP server 12 of the NGN 10 (S12). The SIP server 12 makes an inquiry to the authentication server 13 to determine whether or not the service B connection of the user terminal 1a is possible (S13). Since the authentication server 13 does not have a service B provision list, the authentication server 13 searches for the logical address of the service provision server 21B of the service B provider network 20B, and sends the service B connection request of the user terminal 1a via the SNI-SSE14. The service B is transmitted to the service providing server 21B of the service provider network 20B (S14). The service providing server 21B makes an inquiry to the authentication server 22 to determine whether or not the service B connection is possible (S15). Since the provision information of the user terminal 1a is set in the service B provision list, the authentication server 22 sends a connection permission response to the user via the service provision server 21B, the SGN-SSE 14 of the NGN 10, the authentication server 13, and the SIP server 12. A reply is made to the terminal 1a (S16 to S19). Thereafter, the user terminal 1a connects to the service provision server 21B of the service B provider network 20B via the SNI-SSE 14 of the NGN 10 and receives provision of the service B (S20).

  Although omitted in FIG. 3, when the user terminal 1b transmits a service B connection request in which the user identification information (ID = 1b) is set, the authentication server 13 of the NGN 10 and the service B provider Since the service B provision information for the user terminal 1b is not set in any of the authentication servers 22 of the network 20B, a connection rejection response is returned.

FIG. 4 shows a specific example of a connection sequence in the IP network communication system of the first embodiment.
In the figure, the VOD service providing server of the VOD service provider network that provides the VOD service to the user terminal a uses the SIP signal to use the NGN authentication function, and the VOD service of the user terminal a to the NGN authentication server. Registration of permission is performed (S21).

  The user terminal a transmits its own user identification information (ID = a) and the SIP signal in which the VOD service request is set to the authentication server via the NGN SIP server (S22, S23). The authentication server refers to the VOD service provision list, determines whether the user terminal a can provide the VOD service, and returns a connection permission response including access information of the VOD service provision server via the SIP server because it is permitted. (S24, S25).

  The user terminal a transmits / receives content information acquisition, transmission method determination and playback control to / from the VOD service provider server of the VOD service provider network via SNI-SSE using the RTSP signal (S26 to S28). The VOD is viewed with the signal (S29). When the viewing ends, the stop control is performed using the RTSP signal to the VOD service provider server of the VOD service provider network via the SNI-SSE (S30), and the SIP signal is disconnected (S31).

  FIG. 5 shows a configuration example of the authentication server 13 of the NGN 10 in the first embodiment. FIG. 6 shows a processing procedure of the authentication server 13 of the NGN 10 in the first embodiment.

  In FIG. 5, the authentication server 13 includes a service provision information holding unit 131, a connection request receiving unit 132, a service provision information presence / absence judgment unit 133, an authentication processing unit 134, a service provision server access information issuing unit 135, and a service provision server access. An information holding unit 136, an authentication result notification unit 137, a service type determination unit 138, and a service providing server search unit 139 are configured.

  In FIG. 6, the service provision information holding unit 131 receives registration of user identification information that is contracted to provide the service from the service provision server of the service provider network, and retains it as service provision information (S 51). The connection request reception unit 132 receives a service connection request in which user identification information and service type information of the user terminal are set (S52). The service provision information presence / absence determination unit 133 determines the presence / absence of service provision information for authenticating the service connection request to the service provision information holding unit 131 (S53). Here, if there is service provision information for authenticating the service connection request, the authentication processing unit 134 refers to the service provision information holding unit 131 to perform authentication processing based on the user identification information, and permits or disallows the user identification information. The permission is determined (S54).

  Here, if the user identification information is not permitted, the authentication result notifying unit 137 transmits a rejection response to the user terminal (S55). On the other hand, if the user identification information is permitted, the access information issuing unit 135 acquires the access information of the service providing server from the access information holding unit 136 and issues it to the authentication result notifying unit 137 (S56). The authentication result notifying unit 137 transmits an authorization response including access information of the service providing server that provides the service to the user terminal (S57).

  The user terminal that has received this permission response connects to a service providing server corresponding to the access information and receives provision of a required service (FIG. 3: S6).

  In step S53, if there is no service providing information for authenticating the service connection request, the service type determination unit 138 determines the service type of the service connection request (S58). The service providing server search unit 139 searches for the logical address of the service providing server corresponding to the service type of the service connection request, and transmits a service connection request (user identification information) to the service providing server (S59). At this time, the access information issuing unit 135 acquires the access information of the service providing server from the access information holding unit 136 and issues it to the service providing server search unit 139 so that the service connection request to be transmitted includes the access information of the service providing server. Also good.

  Upon receiving this service connection request, the service providing server 21B accesses the authentication server 22 in its own network to determine whether or not the service can be provided based on the user identification information, and performs authentication processing. To the user terminal (FIG. 3: S16 to S19). The user terminal that has received the permission response from the service providing server connects to the service providing server and receives the required service (FIG. 3: S20).

FIG. 7 shows a configuration example of Example 2 of the IP network communication system of the present invention.
In the figure, the second embodiment includes a FW (Fire Wall) and a connection between the service A provider network 20A and the service B provider network 20B and the SNI-SSE 14 of the NGN 10 in the IP network communication system of the first embodiment. It is characterized by having filtering function units 23A and 23B by NAT (Network Address Translation).

  The authentication server 13 and the filtering function units 23A and 23B share access information including a logical identifier assigned to each layer such as an IP address and a port number of the service providing servers 21A and 21B. Then, the authentication server 13 includes the access information of the service providing server in the permission response notified to the user terminal that has made the service connection request, and the user terminal accesses the service providing server using the access information of the service providing server. As a result, the filtering function units 23A and 23B can perform access control by IP address and port filtering, thereby improving security.

1a, 1b User terminal 10 NGN
11 Information transfer path 12 SIP server 13 Authentication server 14 SNI-SSE
20A Service A provider network 20B Service B provider network 21A, 21B Service provider server 22 Authentication server 23A, 23B Filter function section

Noritaka Uji, “NGN to Build a Rich Broadband Ubiquitous Society”, NTT Technology Journal 2007.12

Claims (7)

A first IP network including a network service function unit that accommodates a user terminal and performs access processing of the user terminal;
A second IP network including a service providing server that performs access processing of the user terminal using the network service function unit of the first IP network and provides a predetermined service to the user terminal;
A third IP network including a service providing server that performs access processing of the user terminal in its own network and provides a predetermined service to the user terminal;
An interface unit that connects the first IP network, the second IP network, and the third IP network is configured so that the user terminal can provide a service of the second IP network via the first IP network. A function to connect to the providing server or the service providing server of the third IP network, and the service providing server of the second IP network performs the access processing of the user terminal by the network service function unit of the first IP network. An IP network communication system, characterized by having an SNI (Application Server Network interface) configuration having a function of proxying. The IP network communication system according to claim 1,
The network service function unit of the first IP network is:
First means for receiving a service connection request from the user terminal;
A second means for determining whether the service connection request is a service provided by a service providing server of the second IP network or a service provided by a service providing server of the third IP network;
If the service connection request is a service provided by the service providing server of the second IP network, the service connection request is performed on behalf of the service providing server of the second IP network, and the service connection request And a third means for sending a service connection request of the user terminal to the service providing server of the third IP network when the service is provided by the service providing server of the third IP network. An IP network communication system. The IP network communication system according to claim 2,
The third means may allow the user terminal to connect the second IP network when connection permission is granted when the user terminal performs access processing on behalf of the second IP network service providing server. It is configured to notify access information for connecting to the service providing server,
The IP network communication system, wherein the user terminal is configured to perform processing for connecting to the service providing server of the second IP network including the access information. The IP network communication system according to claim 2,
The third means includes access information for connecting to the service providing server of the third IP network when the service connection request of the user terminal is sent to the service providing server of the third IP network. An IP network communication system characterized by being configured to transmit. In the IP network communication system according to claim 3 or 4,
The IP network communication system, wherein the second IP network or the third IP network includes a filter function unit that performs filtering using access information for connecting to each service providing server. A first IP network including a network service function unit that accommodates a user terminal and performs access processing of the user terminal;
A second IP network including a service providing server that performs access processing of the user terminal using the network service function unit of the first IP network and provides a predetermined service to the user terminal;
A third IP network including a service providing server that performs access processing of the user terminal in its own network and provides a predetermined service to the user terminal;
In an SNI (Application Server Network Interface) configuration method for connecting the first IP network, the second IP network, and the third IP network,
A function for the user terminal to connect to a service providing server of the second IP network or a service providing server of the third IP network via the first IP network;
A service providing server of the second IP network has a function of proxying access processing of the user terminal by the network service function unit of the first IP network. The SNI configuration method according to claim 6,
The network service function unit of the first IP network is:
A first procedure for receiving a service connection request from the user terminal;
A second procedure for determining whether the service connection request is a service provided by a service providing server of the second IP network or a service provided by a service providing server of the third IP network;
If the service connection request is a service provided by the service providing server of the second IP network, the service connection request is performed on behalf of the service providing server of the second IP network, and the service connection request And a third procedure for sending a service connection request of the user terminal to the service providing server of the third IP network when the service is provided by the service providing server of the third IP network. A featured SNI configuration method.

Images