WO2024038606A1

WO2024038606A1 - Communication control system, communication control method, and communication control program

Info

Publication number: WO2024038606A1
Application number: PCT/JP2022/031449
Authority: WO
Inventors: 幸司杉園; 伸也河野; 克真宮本; 浩輝加納
Original assignee: 日本電信電話株式会社
Priority date: 2022-08-19
Filing date: 2022-08-19
Publication date: 2024-02-22

Abstract

This communication control system (1) comprises a connection terminal number management device (600) which constructs and removes an overlay tunnel path which is for data transmission and is used by terminal devices (100) which belong to a connection network, in order to be connected to a dedicated network for each contract organization. In addition, the connection terminal number management device (600): uses contract information, which is information for identifying the dedicated network for each contract organization, and anchor GW identification information which is information for identifying an overlay tunnel path transmission device (300) that belongs to an area to which the terminal devices (100) are connected, to count the number of connection terminals, which is the number of the terminal devices (100) that access the dedicated network for each contract organization; and performs, on the basis of prescribed conditions, start and stop of a VPN gateway (200), setting for connecting the VPN gateway (200) and the overlay tunnel path transmission device (300) to the dedicated network for each contract organization, and removal of the setting.

Description

Communication control system, communication control method, and communication control program

The present invention relates to a communication control system, a communication control method, and a communication control program.

There are cases where mobile service providers provide cloud services to different organizations and companies. For example, a mobile service provider builds a virtual private cloud for each company within its own cloud computing, and then creates a virtual private cloud using communication equipment to access mobile services provided by the mobile service provider. Provides a means of access. As a means of accessing the above-mentioned virtual private cloud, a method is known in which an overlay tunnel is set up between a virtual private cloud access gateway and a virtual private cloud, and between a virtual private cloud access gateway and a terminal device. The former is a method that uses tunneling protocols such as GRE (Generic Routing Encapsulation) and MPLS (Multi-Protocol Label Switching).

On the other hand, the latter is a method that combines a PDU (Protocol Data Unit)/PDN (Packet Data Network) session in a mobile network and the above-mentioned tunneling protocol (see, for example, Non-Patent Document 1). Based on the technology described above, the gateway process analyzes the arriving packet data and, if the included destination belongs to the target virtual private cloud, forwards the packet to the overlay tunnel that is set up towards the target virtual private cloud. Forward.

Note that the process that executes the gateway process may be run on a general-purpose server when the gateway process is implemented as software. In that case, if you stop the general-purpose server or stop the operation of the aforementioned gateway process, you will not be able to transfer data to the corresponding virtual private cloud. As a result, the general-purpose server had to keep the gateway process running while there was a virtual private cloud service user (hereinafter referred to as "user"), which could result in increased power consumption. . Therefore, in the conventional technology, a method has been adopted in which virtual machines are collectively operated on a specific server, and the power required for operating the virtual machine is reduced by improving the server's CPU utilization rate and reducing the number of operating servers (for example, (See Patent Document 2).

In the method described above, if there are few or no users accessing the VPN via the VPN gateway, the amount of resources used by the gateway process decreases, and as a result, the number of virtual machines and containers implementing the gateway is reduced. It becomes possible to operate with Therefore, as described above, by reducing the number of servers serving as a platform, it is possible to reduce power consumption.

However, in the conventional technology, it may not be possible to count the number of communicable users existing in the network and dynamically start and stop the gateway process based on the presence or absence of users.

Specifically, current mobile network specifications make it impossible to count the number of users because there is no way to count the number of users in the mobile network for each service, and gateway processes are started and stopped based on the presence or absence of users. could not be performed dynamically. Therefore, even if the user of the virtual private cloud does not exist within the mobile network, it is necessary to continue operating the general-purpose server on which the gateway process operates, which may pose a problem.

In order to solve the above problems and achieve the objectives, the communication control system of the present invention constructs an overlay tunnel path for data transfer used for connecting a terminal device belonging to a connection network to a dedicated network for each contract organization. A communication control system having a connected terminal number management device that performs deletion, wherein the connected terminal number management device includes contract information that is information that identifies a dedicated network for each of the contracted organizations, and an area to which the terminal device connects. a counting unit that counts the number of connected terminals, which is the number of the terminal devices accessing the dedicated network for each of the contracted organizations, using anchor GW identification information that is information that identifies the overlay tunnel route transfer device to which it belongs; and the connected terminals. If the number is from 0 to 1 or more, start the VPN gateway, configure the VPN gateway and the overlay tunnel route transfer device to connect to the dedicated network for each contracted organization, and configure the a setting unit that constructs an overlay tunnel route, and when the number of connected terminals becomes 0 from 1 or more, deletes the settings of the VPN gateway and the overlay tunnel route transfer device, stops the VPN gateway, and deletes the settings of the VPN gateway and the overlay tunnel route transfer device; A deletion unit that deletes a transfer overlay tunnel route.

The present invention has the advantage of being able to count the number of communicable users existing in the network and dynamically start and stop gateway processes based on the presence or absence of users.

FIG. 1 is a diagram illustrating an example of an overview of a communication control method of a communication control system according to a first embodiment. FIG. 2 is a diagram illustrating an example of the operation of the gateway according to the first embodiment. FIG. 3 is a diagram illustrating an example of the device configuration of the terminal device according to the first embodiment. FIG. 4 is a diagram showing an example of the device configuration of the VPN gateway according to the first embodiment. FIG. 5 is a table diagram showing an example of information stored in the transfer destination storage unit of the VPN gateway according to the first embodiment. FIG. 6 is a diagram illustrating an example of the device configuration of the overlay tunnel route transfer device according to the first embodiment. FIG. 7 is a table diagram showing an example of table form 1 stored in the transfer destination storage unit of the overlay tunnel route transfer device according to the first embodiment. FIG. 8 is a table diagram illustrating an example of table format 2 stored in the transfer destination storage unit of the overlay tunnel route transfer device according to the first embodiment. FIG. 9 is a diagram illustrating an example of the device configuration of the terminal location information management device according to the first embodiment. FIG. 10 is a table diagram showing an example of information stored in the terminal device connection destination VPN storage unit of the terminal location information management device according to the first embodiment. FIG. 11 is a table diagram showing an example of information stored in the anchor GW storage unit of the terminal location information management device according to the first embodiment. FIG. 12 is a diagram showing an example of the device configuration of the contract information management device according to the first embodiment. FIG. 13 is a table diagram showing an example of information stored in the contract information storage unit of the contract information management device according to the first embodiment. FIG. 14 is a diagram illustrating an example of the device configuration of the connected terminal number management device according to the first embodiment. FIG. 15 is a table diagram showing an example of information stored in the connected terminal number storage unit of the connected terminal number management device according to the first embodiment. FIG. 16 is a diagram illustrating an example of the device configuration of the transfer information management device according to the first embodiment. FIG. 17 is a table diagram showing an example of a connected terminal number management device reply table stored in the address storage unit of the transfer information management device according to the first embodiment. FIG. 18 is a table diagram showing an example of a terminal device reply table stored in the address storage unit of the transfer information management device according to the first embodiment. FIG. 19 is a diagram illustrating an example of a flowchart of the communication control method according to the first embodiment. FIG. 20 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to Embodiment 1'. FIG. 21 is a diagram illustrating an example of the device configuration of the connected terminal number management device according to Embodiment 1'. FIG. 22 is a diagram illustrating an example of a flowchart of the communication control method according to Embodiment 1'. FIG. 23 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to the first embodiment. FIG. 24 is a diagram illustrating an example of a flowchart of the communication control method according to the first embodiment. FIG. 25 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to the second embodiment. FIG. 26 is a diagram illustrating an example of an overview of the operation of the communication control system according to the second embodiment. FIG. 27 is a diagram illustrating an example of an overview of establishing an encrypted path according to the second embodiment. FIG. 28 is a diagram illustrating an example of the device configuration of a mobile gateway according to the second embodiment. FIG. 29 is a table diagram showing an example of information stored in the VPN search table storage unit of the mobile gateway according to the second embodiment. FIG. 30 is a diagram illustrating an example of a flowchart of the communication control method (pattern 1) according to the second embodiment. FIG. 31 is a diagram illustrating an example of a flowchart of the communication control method (pattern 2) according to the second embodiment. FIG. 32 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to Embodiment 2-1. FIG. 33 is a diagram showing an example of a block diagram of various devices forming the communication control system according to Embodiment 2-1. FIG. 34 is a diagram illustrating an example of an overview of the operation of the communication control system according to Embodiment 2-1. FIG. 35 is a diagram illustrating an example of a device configuration of an overlay tunnel route transfer device for an IP network according to Embodiment 2-1. FIG. 36 is a diagram illustrating an example of a flowchart of the communication control method according to Embodiment 2-1. FIG. 37 is a diagram illustrating an example of a computer on which various devices of the communication control system according to each embodiment are implemented.

Hereinafter, modes for carrying out the present invention (hereinafter referred to as "embodiments") will be described with reference to the drawings. Note that each embodiment is not limited to the content described below.

[1. Overview of communication control system]
The communication control system 1 in each embodiment is configured so that a terminal device 100 belonging to a connection network connects to a dedicated network (for example, a virtual private cloud, etc., hereinafter simply referred to as "dedicated network") for each contract organization. Constructs and deletes overlay tunnel paths for data transfer used for data transfer.

An overview of the communication control system 1 in this embodiment will be explained in the following items. First, the counting unit 631 of the connected terminal number management device 600 included in the communication control system 1 collects contract information (hereinafter referred to as "connection destination VPN ID"), which is information that identifies the dedicated network, and the terminal device 100 connected to. Number of connected terminals, which is the number of terminal devices 100 that access the dedicated network, using anchor GW identification information (hereinafter referred to as "anchor GW ID in charge"), which is information that identifies the overlay tunnel route transfer device 300 belonging to the area. Count.

Subsequently, the determination unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has been updated from 0 to 1 or more. In that case, the setting unit 634 of the connected terminal number management device 600 starts the VPN (Virtual Private Network) gateway 200 and provides a VPN connection for the VPN gateway 200 and the overlay tunnel route transfer device 300 to connect to the dedicated network. An address (hereinafter referred to as "VPN connection address") is set, and an overlay tunnel path for data transfer is constructed.

Thereafter, the determination unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has been updated from 1 or more to 0. In that case, the deletion unit 635 of the connected terminal number management device 600 deletes the settings of the VPN connection address of the VPN gateway 200 and the overlay tunnel route transfer device 300, stops the VPN gateway 200, and deletes the overlay tunnel route for data transfer. Delete.

[2. Embodiment 1: Starting and stopping the VPN gateway according to the number of connected terminals]
From here, as a first embodiment, "starting and stopping a VPN gateway according to the number of connected terminals" realized by the communication control system 1 will be explained. First, an overview will be given using FIG. 1.

FIG. 1 is a schematic diagram showing a situation in which a terminal device 100 connected to a certain arbitrary area is connected to a dedicated network. First, the terminal device 100 sends to the terminal location information management device 400 terminal device information (hereinafter referred to as "terminal ID") that is information that identifies the terminal device 100, the connection destination VPN ID, and the above-mentioned information. and a registration request for registering the terminal location information management device 400 in the terminal location information management device 400 (see (1) in FIG. 1).

Here, if the terminal device 100 holds the connection destination VPN ID, the registration unit 433 of the terminal location information management device 400 registers the terminal ID and connection destination VPN ID received from the terminal device 100. On the other hand, if the terminal device 100 does not hold the connection destination VPN ID, the registration unit 433 of the terminal location information management device 400 acquires the connection destination VPN ID identified by the terminal ID from the contract information management device 500. and register it (see (2) in Figure 1). Then, the terminal location information management device 400 establishes a D-plane session based on the connection request, which is a D-plane session establishment request, transmitted by the terminal device 100 (see (3) in FIG. 1).

Next, the transmitter 434 of the terminal location information management device 400 transmits the assigned anchor GW ID and the connection destination VPN ID to the connected terminal number management device 600 (see (4) in FIG. 1). Then, the counting unit 631 of the connected terminal number management device 600 calculates the number of connections to the overlay tunnel route transfer device 300 that belongs to the area to which the terminal device 100 connects, based on the accepted anchor GW ID and connection destination VPN ID. Count and update the number of connected terminals.

Subsequently, based on the determination by the determining unit 632 of the connected terminal number management device 600 that the number of connected terminals has been updated from 0 to 1 or more, the acquisition unit 633 of the connected terminal number management device 600 updates the transfer information management device 700. The connection destination VPN ID is sent to the private network, and the VPN connection address corresponding to the dedicated network is obtained (see (5) in FIG. 1). Then, the setting unit 634 of the connected terminal number management device 600 starts the VPN gateway 200, sets the acquired VPN connection address to the VPN gateway 200 and the overlay tunnel route transfer device 300, and sets the acquired VPN connection address to the overlay tunnel route transfer device 300. Build a tunnel route (see (6) in Figure 1). Subsequently, the terminal device 100 connects to the dedicated network using the data transfer overlay tunnel path constructed by the communication control system 1 (see (7) in FIG. 1).

Thereafter, based on the determination by the determining unit 632 of the connected terminal number management device 600 that the number of connected terminals has been updated from 1 or more to 0, the deletion unit 635 of the connected terminal number management device 600 deletes the VPN gateway 200 and the overlay tunnel route. The settings of the transfer device 300 are deleted, the VPN gateway 200 is stopped, and the overlay tunnel route for data transfer is deleted (see (8) in FIG. 1).

From here, the configuration of the VPN according to the first embodiment will be supplementarily explained. The VPN according to the first embodiment is configured with an MEC (Multi Access Edge Cloud) and an overlay tunnel path for data transfer. Within the MEC, there is a front-end server (for example, "front-end server 10" in Figure 1) that receives data requests from users and returns results from the system to the users. It holds a connection address (the above-mentioned VPN connection address). On the other hand, the terminal device 100 is given a VPN terminal address by the transfer information management device 700.

Next, using FIG. 2, a description will be given of a mechanism in which the VPN gateway 200 and the overlay tunnel route transfer device 300 allocate data to a destination overlay tunnel route for data transfer based on the VPN connection address. First, FIG. 2 shows a terminal device 100 having a "destination: 10A", a terminal device 101 having a "destination: 10C", and a terminal device 102 having a "destination: 10B", respectively.

Here, the VPN gateway 200 and the overlay tunnel route transfer device 300 analyze the packet headers transmitted by each terminal device and distribute the packets to the overlay tunnel route for data transfer according to the destination. Specifically, the VPN gateway 200 and the overlay tunnel route transfer device 300 distribute the communication of the terminal device 100 and the communication of the terminal device 102 to the overlay tunnel route X for data transfer, and the communication of the terminal device 101 is distributed to the data transfer Allocate to transfer overlay tunnel route Y.

[2-1. Communication control system configuration]
From here, the configuration of the communication control system 1 in the first embodiment will be explained using FIGS. 3 to 18. The communication control system 1 in the first embodiment includes a terminal device 100, a VPN gateway 200, an overlay tunnel route transfer device 300, a terminal location information management device 400, a contract information management device 500, and a connected terminal number management device 600. , and a transfer information management device 700. The following items provide detailed explanations of the functional units of each device. Note that in the following description, descriptions of functional units (communication unit, storage unit, control unit, etc.) having similar functions in each device will be omitted as appropriate.

(Terminal device 100)
First, the configuration of the terminal device 100 will be explained using FIG. 3. As shown in FIG. 3, the terminal device 100 includes a communication section 110, a storage section 120, and a control section 130. Although not shown, the terminal device 100 may include an input unit (for example, a keyboard, a mouse, etc.) that accepts various operations, and a display unit (for example, a display) for displaying various information. Further, the terminal device 100 may be a desktop personal computer, a notebook PC, a smartphone, a tablet, a PDA (Personal Digital Assistant), or the like. Next, detailed functions of each part will be described below.

(Communication Department 110)
The communication unit 110 is realized by a NIC (Network Interface Card) or the like, and controls communication via a telecommunication line such as a LAN (Local Area Network) or the Internet. The communication unit 110 is connected to a network by wire or wirelessly as necessary, and can transmit and receive information in both directions.

(Storage unit 120)
The storage unit 120 stores data and programs necessary for various processing by the control unit 130. The storage unit 120 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

(Control unit 130)
The control unit 130 includes an address management unit 131 and a communication session management unit 132. The control unit 130 has an internal memory for temporarily storing programs and processing data that define various processing procedures, and includes electronic circuits such as a CPU (Central Processing Unit) and an MPU (Micro Processing Unit). It is realized by integrated circuits such as ASIC (Application Specific Integrated Circuit) and FPGA (Field Programmable Gate Array).

(Address management section 131)
The address management unit 131 receives a VPN terminal address for the terminal device given to the terminal device 100 and stores it in the storage unit 120.

(Communication session management unit 132)
The communication session management unit 132 requests the terminal location information management device 400 to establish C-plane and D-plane sessions when the terminal device 100 establishes a network connection. Furthermore, when making the above-mentioned session establishment request, the communication session management unit 132 transmits the terminal ID and the connection destination VPN ID if held by the terminal device 100 to the terminal location information management device 400. .

(VPN gateway 200)
Next, the configuration of the VPN gateway 200 will be explained using FIG. 4. As shown in FIG. 4, the VPN gateway 200 includes a communication section 210, a storage section 220, and a control section 230. Note that the functions of the communication unit 210 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted. In addition, the VPN gateway 200 controlled by the communication control system 1 may be a virtual gateway (vGW) implemented using software.

(Storage unit 220)
The storage unit 220 stores data and programs necessary for various processing by the control unit 230. The storage unit 220 includes a transfer destination storage unit 221 .

(Forwarding destination storage unit 221)
The forwarding destination storage unit 221 stores information regarding the forwarding destination as a forwarding table. Specifically, the transfer destination storage unit 221 stores the items "address" and "transfer destination tunnel" as shown in FIG. Note that the transfer destination storage unit 221 is not limited to the above-mentioned items as items to be stored, and may store other items. Furthermore, the input information for each item shown in FIG. 5 is just an example and is not limited to the information described.

(Control unit 230)
The control unit 230 includes a packet header analysis unit 231 and a transfer processing unit 232.

(Packet header analysis unit 231)
The packet header analysis unit 231 analyzes a packet header transmitted when the terminal device 100 performs communication, and extracts destination information (eg, IP address, etc.).

(Transfer processing unit 232)
The transfer processing unit 232 performs distribution to the target overlay tunnel route for data transfer based on the above-mentioned destination information.

(Overlay tunnel route transfer device 300)
Next, the configuration of the overlay tunnel route transfer device 300 will be described using FIG. 6. As shown in FIG. 6, overlay tunnel route transfer device 300 includes a communication section 310, a storage section 320, and a control section 330. Note that the functions of the communication unit 310 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted.

(Storage unit 320)
The storage unit 320 stores data and programs necessary for various processing by the control unit 330. The storage unit 320 includes a transfer destination storage unit 321.

(Forwarding destination storage unit 321)
The forwarding destination storage unit 321 stores information regarding the forwarding destination as a forwarding table. Specifically, the transfer destination storage unit 321 analyzes the packet header transmitted from the terminal device 100 and maps the included destination information (for example, IP address, etc.) to the overlay tunnel route for data transfer of the VPN gateway 200. As a table form 1 related to , as shown in FIG. 7, the items "address" and "transfer destination tunnel" are stored. Further, the transfer destination storage unit 321 stores “Mobile NW tunnel” and “Mobile NW tunnel” as shown in FIG. Store the item "Transfer destination tunnel to VPN gateway".

Note that regarding the items of table format 1 and table format 2, the transfer destination storage unit 321 is not limited to the above-mentioned items, and may store other items. Furthermore, the input information for each item shown in FIGS. 7 and 8 is merely an example, and is not limited to the information described.

(Control unit 330)
From here, we return to FIG. 6 and continue the explanation. The control unit 330 includes a packet header analysis unit 331 and a transfer processing unit 332.

(Packet header analysis unit 331)
The packet header analysis unit 331 analyzes a packet header transmitted when the terminal device 100 performs communication, and extracts destination information (eg, IP address, etc.).

(Transfer processing unit 332)
The transfer processing unit 332 performs distribution to the target overlay tunnel route for data transfer based on the destination information described above.

(Terminal location information management device 400)
Next, the configuration of the terminal location information management device 400 will be explained using FIG. 9. As shown in FIG. 9, the terminal location information management device 400 includes a communication section 410, a storage section 420, and a control section 430. Note that the functions of the communication unit 410 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted. In addition, the terminal location information management device 400 may utilize MME (Mobility Management Entity) and AMF (Access and Mobility management Function).

(Storage unit 420)
The storage unit 420 stores data and programs necessary for various processing by the control unit 430. The storage unit 420 includes a terminal device connection destination VPN storage unit 421 and an anchor GW storage unit 422.

(Terminal device connection destination VPN storage unit 421)
The terminal device connection destination VPN storage unit 421 stores a terminal device-connection destination VPN management table as information regarding the overlay tunnel route for data transfer connecting to the dedicated network. Specifically, the terminal device connection destination VPN storage unit 421 stores the items “terminal ID” and “connection destination VPN ID” as a terminal device-connection destination VPN management table as shown in FIG. Note that the terminal device connection destination VPN storage unit 421 is not limited to the above-mentioned items as information to be stored, and may store other items. Furthermore, the input information for each item shown in FIG. 10 is just an example, and the information is not limited to the information described.

(Anchor GW storage unit 422)
Anchor GW storage unit 422 stores a location management table as information for identifying overlay tunnel route transfer device 300 belonging to the area to which terminal device 100 connects. Specifically, the anchor GW storage unit 422 stores the items "terminal ID" and "in-charge anchor GW ID" as a location management table, as shown in FIG. Note that the anchor GW storage unit 422 is not limited to the above-mentioned items as information to be stored, and may store other items. Furthermore, the input information for each item shown in FIG. 11 is just an example and is not limited to the information described.

(Control unit 430)
From here, we return to FIG. 9 and continue the explanation. The control unit 430 includes a reception unit 431, a notification unit 432, a registration unit 433, and a transmission unit 434.

(Reception Department 431)
The reception unit 431 determines that the terminal device 100 holds the connection destination VPN ID. In that case, the receiving unit 431 receives terminal device information (terminal ID), which is information for identifying the terminal device 100, and contract information (connection destination VPN ID) from the terminal device 100. On the other hand, the reception unit 431 determines that the terminal device 100 does not hold the connection destination VPN ID. In that case, the reception unit 431 sends terminal device information (terminal ID) that is information that identifies the terminal device 100, terminal device information (terminal ID), and contract information (connection destination VPN ID) to the terminal location information management device. 400 is received from the terminal device 100.

Further, the reception unit 431 receives a connection request from the terminal device 100, which is a request for connection from the mobile network to the data network. Note that the reception unit 431 is not limited to the above-mentioned information, and may accept other information as necessary.

(Notification section 432)
The notification unit 432 notifies the contract information management device 500 of the terminal ID when the terminal device 100 does not hold the connection destination VPN ID. Note that the notification unit 432 is not limited to the above-mentioned information, and may notify other information as necessary.

(Registration Department 433)
If the terminal device 100 holds a connection destination VPN ID, the registration unit 433 registers the terminal device information (terminal ID) and contract information (connection destination VPN ID) received from the terminal device 100. On the other hand, if the terminal device 100 does not hold contract information, the registration unit 433 registers the contract information management device 500 using the terminal device information (terminal ID) based on the terminal ID received from the terminal device 100 and the registration request. Register the contract information (connection destination VPN ID) obtained from .

In other words, the registration unit 433 registers the terminal ID transmitted by the terminal device 100 and the connection destination VPN ID transmitted by the transmission unit 532 of the contract information management device 500, which will be described later. Note that the registration unit 433 is not limited to the above-mentioned information, and may accept other information as necessary.

(Transmission unit 434)
The transmitter 434 transmits contract information (connection destination VPN ID) and anchor GW identification information (anchor GW ID in charge) to the connected terminal number management device 600 based on the connection request. Note that the transmitter 434 is not limited to the above-mentioned information, and may transmit other information as necessary.

(Contract information management device 500)
Next, the configuration of the contract information management device 500 will be described using FIG. 12. As shown in FIG. 12, the contract information management device 500 includes a communication section 510, a storage section 520, and a control section 530. Note that the functions of the communication unit 510 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted. In addition, the contract information management device 500 may work in conjunction with an HSS (Home Subscriber Server) and a UDM (Unified Data Management).

(Storage unit 520)
The storage unit 520 stores data and programs necessary for various processing by the control unit 530. The storage unit 520 includes a contract information storage unit 521.

(Contract information storage unit 521)
The contract information storage unit 521 stores a contract management table including connection destination VPN IDs as contract information. Specifically, the contract information storage unit 521 stores items such as "terminal ID" and "connection destination VPN ID" as shown in FIG. 13 as a contract management table. Note that the information stored in the contract information storage section 521 is not limited to the above-mentioned items, and may store other items. Furthermore, the input information for each item shown in FIG. 13 is just an example, and the information is not limited to the information described.

(Control unit 530)
From here, the explanation returns to FIG. 12 and continues. The control unit 530 includes a reception unit 531 and a transmission unit 532.

(Reception Department 531)
The reception unit 531 receives the terminal ID notified by the notification unit 432 of the terminal location information management device 400. Note that the reception unit 531 is not limited to the above-mentioned information, and may accept other information as necessary.

(Transmission unit 532)
The transmitter 532 transmits the connection destination VPN ID corresponding to the terminal ID accepted by the receiver 531 to the terminal location information management device 400. Note that the transmitter 532 is not limited to the above-mentioned information, and may transmit other information as necessary.

(Number of connected terminals management device 600)
Next, the configuration of the connected terminal number management device 600 will be explained using FIG. 14. The connected terminal number management device 600 constructs and deletes an overlay tunnel path for data transfer used by the terminal device 100 belonging to the connection network to connect to a dedicated network for each contract organization. As shown in FIG. 14, the connected terminal number management device 600 includes a communication section 610, a storage section 620, and a control section 630. Note that the functions of the communication unit 610 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted.

(Storage unit 620)
The storage unit 620 stores data and programs necessary for various processing by the control unit 630. The storage unit 620 includes a connected terminal number storage unit 621.

(Number of connected terminals storage unit 621)
The number of connected terminals storage unit 621 stores a number of connected terminals management table as information used to count the number of connected terminals. Specifically, the number of connected terminals storage unit 621 stores items such as "anchor GW ID in charge", "connection destination VPN ID", and "number of connected terminals" as shown in FIG. 15 as a number of connected terminals management table. Remember. Note that the information stored by the number of connected terminals storage unit 621 is not limited to the above-mentioned items, and may store other items. Furthermore, the input information for each item shown in FIG. 15 is just an example, and the information is not limited to the information described.

(Control unit 630)
From here, the explanation returns to FIG. 14 and continues. The control section 630 includes a counting section 631, a determining section 632, an obtaining section 633, a setting section 634, and a deleting section 635.

(Counting section 631)
The counting unit 631 includes contract information (connection destination VPN ID), which is information that identifies a dedicated network for each contract organization, and anchor GW, which is information that identifies the overlay tunnel route transfer device 300 that belongs to the area to which the terminal device 100 connects. Using the identification information (anchor GW ID in charge), the number of connected terminals, which is the number of terminal devices 100 accessing the dedicated network for each contracted organization, is counted, and the number of connected terminals is updated. Note that the counting unit 631 is not limited to the above-mentioned information, and may perform counting using other information as necessary.

(Determination unit 632)
The determining unit 632 determines whether a predetermined condition is satisfied based on the connected terminal number information counted and updated by the counting unit 631. For example, the determining unit 632 determines that the setting unit 634 performs the process when the number of connected terminals is updated from 0 to 1 or more, and when the number of connected terminals is 0 for a predetermined time or more, that is, the number of connected terminals is If the value is updated from 1 or more to 0, it is determined that the deletion unit 635 performs the process. Note that the determining unit 632 may also determine that the deletion unit 635 performs the process when the number of connected terminals is updated from 1 or more to 0 and the number of connected terminals remains 0 for a certain period of time or more. Further, the determination unit 632 is not limited to the aforementioned determination conditions, and may make determinations based on other determination conditions as necessary.

(Acquisition unit 633)
The acquisition unit 633 uses the contract information (connection destination VPN ID) to obtain information (VPN connection address) for connecting to a dedicated network for each contracted organization to which the terminal device 100 connects from the transfer information management device 700. get. Note that the acquisition unit 633 is not limited to the above-mentioned information, and may acquire other information as necessary.

(Setting section 634)
When the determination result of the determination unit 632 satisfies a predetermined condition, that is, when the number of connected terminals increases from 0 to 1 or more, the setting unit 634 activates the VPN gateway 200 and transfers the VPN gateway 200 and the overlay tunnel route transfer device 300. Configure settings to connect to a dedicated network for each contracted organization, and construct an overlay tunnel path for data transfer. Specifically, when the determining unit 632 determines that the number of connected terminals has been updated from 0 to 1 or more, the setting unit 634 activates the VPN gateway 200 and sends the request to the VPN gateway 200 and the overlay tunnel route transfer device 300. Then, set the VPN connection address and construct an overlay tunnel route for data transfer. Note that the setting unit 634 is not limited to the above-mentioned information, and may use other information as necessary to perform settings for any device.

(Deletion section 635)
The deletion unit 635 deletes the settings of the VPN gateway 200 and the overlay tunnel route transfer device 300, and deletes the settings of the VPN gateway 200 and the overlay tunnel route transfer device 300 when the determination result of the determination unit 632 satisfies a predetermined condition, that is, when the number of connected terminals changes from 1 or more to 0. The gateway 200 is stopped and the overlay tunnel route for data transfer is deleted. Specifically, when the determining unit 632 determines that the number of connected terminals has been updated from 1 or more to 0, the deletion unit 635 deletes the VPN connection set for the VPN gateway 200 and the overlay tunnel route transfer device 300. address, stop the VPN gateway 200, and release the overlay tunnel route for data transfer. Note that the deletion unit 635 is not limited to the above-mentioned information, and may delete settings of any device using other information as necessary.

(Transfer information management device 700)
Next, the configuration of the transfer information management device 700 will be described using FIG. 16. As shown in FIG. 16, the transfer information management device 700 includes a communication section 710, a storage section 720, and a control section 730. Note that the functions of the communication unit 710 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted.

(Storage unit 720)
The storage unit 720 stores data and programs necessary for various processing by the control unit 730. The storage unit 720 includes an address storage unit 721.

(Address storage unit 721)
The address storage unit 721 stores a connected terminal number management device reply table and a terminal device reply table as information regarding the VPN connection address for connecting to the dedicated network. Specifically, the address storage unit 721 stores the items "connection destination VPN ID" and "VPN connection address" as a table for replying to the number of connected terminals management device, as shown in FIG.

On the other hand, the address storage unit 721 stores items such as "Service connection URI (Uniform Resource Identifier)/URL (Uniform Resource Locator)" and "VPN terminal address" as shown in FIG. 18 as a terminal device reply table. do. Note that the information stored in the address storage section 721 is not limited to the above-mentioned items, and may store other items. Furthermore, the input information for each item shown in FIGS. 17 and 18 is just an example, and the information is not limited to the information described. Further, the address storage unit 721 of the transfer information management device 700 may utilize DNS (Domain Name System) as a function of the terminal reply table.

(Control unit 730)
From here, the explanation returns to FIG. 16 and continues. The control section 730 includes a reception section 731 and a transmission section 732.

(Reception Department 731)
The reception unit 731 receives the connection VPN ID transmitted by the acquisition unit 633 of the connected terminal number management device 600. Note that the reception unit 731 is not limited to the above-mentioned information, and may accept other information as necessary.

(Transmission unit 732)
Based on the connection VPN ID received by the reception unit 731, the transmission unit 732 transmits the corresponding VPN connection address to the connected terminal number management device 600 and the corresponding VPN terminal address to the terminal device 100. Note that the transmitter 732 is not limited to the above-mentioned information, and may transmit other information as necessary.

[2-2. Procedures for communication control method]
From here, a communication control method performed by the communication control system 1 in the first embodiment will be described using FIG. 19. First, the reception unit 431 of the terminal location information management device 400 receives a terminal ID and a registration request to the C-plane of the mobile network from the terminal device 100 (step S11).

Next, the reception unit 431 of the terminal location information management device 400 determines that the terminal device 100 holds the connection destination VPN ID (Yes in step S12). In that case, the receiving unit 431 of the terminal location information management device 400 receives the connection destination VPN ID from the terminal device 100 (step S13). Subsequently, the registration unit 433 of the terminal location information management device 400 registers the terminal ID and the connection destination VPN ID corresponding to the terminal ID (step S16).

On the other hand, the reception unit 431 of the terminal location information management device 400 determines that the terminal device 100 does not hold the connection destination VPN ID (No in step S12). In that case, the notification unit 432 of the terminal location information management device 400 notifies the contract information management device 500 of the terminal ID (step S14). Then, the transmitting unit 532 of the contract information management device 500 transmits the connection destination VPN ID corresponding to the terminal ID to the terminal location information management device 400 (step S15). Subsequently, the registration unit 433 of the terminal location information management device 400 registers the terminal ID transmitted by the terminal device 100 and the connection destination VPN ID transmitted by the contract information management device 500 (step S16).

Next, the terminal location information management device 400 establishes a C-plane session with the terminal device 100 (step S17). Subsequently, the receiving unit 431 of the terminal location information management device 400 receives a connection request for establishing a D-plane session from the terminal device 100 (step S18). Subsequently, the terminal location information management device 400 determines the overlay tunnel route transfer device 300 to be connected, and establishes a D-plane session within the mobile network (step S19).

Then, the transmitting unit 434 of the terminal location information management device 400 transmits the connection destination VPN ID and the anchor GW ID in charge to the connected terminal number management device 600 (step S20). Subsequently, the counting unit 631 of the connected terminal number management device 600 counts and updates the number of connected terminals based on the received connection destination VPN ID and assigned anchor GW ID (step S21).

Then, the determination unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has been updated from 0 to 1 or more (step S22). In that case, the acquisition unit 633 of the connected terminal number management device 600 transmits the connection destination VPN ID to the transfer information management device 700 and acquires the VPN connection address (step S23). Subsequently, the setting unit 634 of the connected terminal number management device 600 starts the VPN gateway 200, sets the acquired VPN connection address for the VPN gateway 200 and the overlay tunnel route transfer device 300, and sets the acquired VPN connection address to the overlay tunnel route transfer device 300 for data transfer. A tunnel route is constructed (step S24).

Next, the transfer information management device 700 transmits the VPN terminal address to the terminal device 100 (step S25). Then, the terminal device 100 uses the VPN terminal address transmitted by the transfer information management device 700 to connect to the dedicated network via the data transfer overlay tunnel path (step S26). Thereafter, the terminal device 100 continues to connect to the dedicated network (step S27).

After that, the terminal location information management device 400 measures the non-communication time of the terminal device 100 (step S28). Then, if the non-communication time exceeds a predetermined threshold, the terminal location information management device 400 disconnects the D-plane session (step S29). Subsequently, the counting unit 631 of the connected terminal number management device 600 subtracts the number of connected terminals corresponding to the overlay tunnel route transfer device 300 via which the terminal device 100 communicates with the VPN (step S30). When the number of connected terminals is changed from 1 or more to 0 by the above-described subtraction, the determining unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has been updated from 1 or more to 0. (Yes in step S31). In that case, the deletion unit 635 of the connected terminal number management device 600 deletes the VPN connection addresses set in the VPN gateway 200 and the overlay tunnel route transfer device 300, stops the VPN gateway 200, and deletes the overlay tunnel route for data transfer. It is released, and the process ends (step S32).

On the other hand, if the number of connected terminals does not become 0, the determining unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has not been updated from 1 or more to 0 (No in step S31). In that case, the process returns and the communication control system 1 continues the process.

[2-3. effect〕
The communication control system 1 according to the first embodiment includes a connected terminal number management device 600 that constructs and deletes an overlay tunnel path for data transfer used for connecting a terminal device 100 belonging to a connection network to a dedicated network for each contract organization. In the communication control system 1 having Using anchor GW identification information (anchor GW ID in charge), which is information that identifies the tunnel route transfer device 300, the number of connected terminals, which is the number of terminal devices 100 that access the dedicated network for each contract organization, is counted, and the connected terminals are If the number is from 0 to 1 or more, start the VPN gateway 200, configure the VPN gateway 200 and overlay tunnel route transfer device 300 to connect to the dedicated network for each contract organization, and connect the overlay for data transfer. When a tunnel route is constructed and the number of connected terminals goes from 1 or more to 0, the settings of the VPN gateway 200 and overlay tunnel route transfer device 300 are deleted, the VPN gateway 200 is stopped, and the overlay tunnel route for data transfer is changed. It is characterized by deleting. Therefore, according to this embodiment, the following effects are achieved.

In the conventional method, it was necessary to prepare vGWs in all areas and further set instance information for each area in advance. In addition, it was necessary to activate the vGW in all areas, and to fix the operating server for each dedicated network. Furthermore, the general-purpose server that executes the gateway process (hereinafter referred to as the "operating server") keeps the gateway process on standby even when packet data does not arrive, and the memory is occupied by the gateway process, resulting in a low power consumption. continue to consume. Therefore, if there are multiple gateway processes, each providing gateway functions to different dedicated networks, the memory of the operating server that can be used by the active gateway processes may decrease, and packet forwarding performance may deteriorate. Ta.

However, the communication control system 1 of the first embodiment dynamically sets the gateway process according to an increase or decrease in the number of connected terminals. This provides the effect of reducing power and avoiding unnecessary occupation of resources.

[3. Embodiment 1': Selection of a server for operating a VPN gateway in consideration of the load on the server for operating a VPN gateway]
Next, Embodiment 1' will be described as another embodiment. In embodiment 1', the communication control system 1 selects the operating server to be operated in consideration of the load on the operating server of the VPN gateway 200. Specifically, the communication control system 1 in Embodiment 1' periodically acquires the CPU usage rate of the operating server and the number of VPN gateways 200 in operation as information regarding the operating status of the VPN gateways 200, A server for operation that satisfies predetermined conditions (for example, low CPU usage rate, high power efficiency, low load, etc.) is determined.

A specific example of the above-mentioned content will be explained using FIG. 20. FIG. 20 shows a situation where, as operating servers of the VPN gateway 200, there are an operating server 20A with a CPU usage rate of 20% and an operating server 20B with a CPU usage rate of 80%. First, the monitoring unit 636 of the connected terminal number management device 600 monitors the CPU usage rates of the operating server 20A and the operating server 20B, and acquires information regarding the CPU usage rate at predetermined time-series intervals (( (see 1)).

Then, the monitoring unit 636 of the connected terminal number management device 600 selects an operating server on which to operate the VPN gateway 200 based on the obtained information regarding the CPU usage rate. In the example shown in FIG. 20, since the CPU usage rate of the operating server 20A is lower than that of the operating server 20B, the monitoring unit 636 of the connected terminal number management device 600 uses the operating server 20A as the operating server. Determine.

Although the example in FIG. 20 refers to the CPU usage rate, the monitoring unit 636 of the connected terminal number management device 600 also monitors the number of VPN gateways in operation, memory usage rate, number of connected terminals, etc. The operating server to be operated may be determined using this information.

[3-1. Communication control system configuration]
From here, the configuration of the communication control system 1 in Embodiment 1' will be explained using FIG. 21. The communication control system 1 in Embodiment 1' includes a terminal device 100, a VPN gateway 200, an overlay tunnel route transfer device 300, a terminal location information management device 400, a contract information management device 500, and a connected terminal number management device 600. The device configuration includes a transfer information management device 700 and a transfer information management device 700. The following items provide detailed explanations of the functional units of each device. Note that the system configuration in Embodiment 1' is the same as in Embodiment 1, and in this article, only the monitoring unit 636 of the connected terminal number management device 600, which is a different functional unit, will be explained, and other detailed explanations will be omitted. Omitted.

(Monitoring unit 636)
The monitoring unit 636 acquires information regarding the operating status of the operating server that operates the VPN gateway 200, and determines the operating server to be operated based on the information regarding the operating status. For example, the monitoring unit 636 monitors the operating server of the VPN gateway 200, and provides information regarding the operating status of the operating server (for example, CPU usage rate, memory usage rate, memory usage amount, and the operating status of the VPN gateway 200). number of etc.). Note that the monitoring unit 636 is not limited to the above-mentioned information, and may monitor and acquire other information as necessary.

[3-2. Procedures for communication control method]
Next, a communication control method performed by the communication control system 1 in Embodiment 1' will be described using FIG. 22. First, the monitoring unit 636 of the connected terminal number management device 600 monitors the operating status of the operating server of the VPN gateway 200 (step S31). Then, the monitoring unit 636 of the connected terminal number management device 600 acquires information regarding the operating status of the operating server (step S32). Further, the monitoring unit 636 of the connected terminal number management device 600 determines the operating server to be used based on the information regarding the operating status (step S33).

[3-3. effect〕
In Embodiment 1', the communication control system 1 has the following effects.

In the conventional technology, static settings are used in which all gateway process and overlay settings are performed when a dedicated network starts to be used. In this static setting method, the server for operating the gateway process corresponding to each dedicated network is also determined at the time of setting. Therefore, in the prior art, there is no method for distributing the load of the gateway process between the operating servers depending on the operating status of the operating server and the operating status of the gateway process. Therefore, if there are a large number of terminals connected to a dedicated network handled by a gateway process running on a certain operating server, traffic may concentrate on that specific operating server, resulting in a situation where packet forwarding performance deteriorates. .

However, the communication control system 1 in Embodiment 1' dynamically selects the operating server that operates the VPN gateway 200 according to the operating status of the operating server, so the load distribution of the operating server and the packet transfer performance are improved. Provides the effect of suppressing deterioration.

[4. Embodiment 1'': Operation when changing overlay tunnel route transfer device due to area movement]
Next, Embodiment 1'' will be described as a further different embodiment. Embodiment 1'' is an embodiment in which the terminal device 100 moves between areas and the overlay tunnel route transfer device 300 in charge is changed.

Hereinafter, an overview of Embodiment 1'' will be explained using FIG. 23. FIG. 23 shows that the terminal device 100 moves between “area A” and “area B” which are logically different areas. Further, as a premise, the terminal location information management device 400 belonging to each area holds the assigned anchor GW ID of the overlay tunnel route transfer device 300 belonging to the corresponding area. Therefore, the terminal location information management device 400 and overlay tunnel route transfer device 300 in charge determine the base station to which the terminal device 100 connects when registering with the mobile network.

Specifically, area A is the terminal location information management device 400A and overlay tunnel route transfer device 300A, and area B is the terminal location information management device 400B and overlay tunnel route transfer device 300B. In other words, when the terminal device 100 moves across areas, the terminal location information management device 400 that is the registration destination changes, and as a result, the overlay tunnel route transfer device 300 that is the connection target changes.

From here, a specific example of Embodiment 1'' will be explained with continued reference to FIG. 23. First, the terminal device 100 moves across areas from area A to area B (see (1) in FIG. 23). Subsequently, the terminal location information management device 400B in the destination area B registers the terminal ID and connection destination VPN ID of the terminal device 100 (see (2) in FIG. 23).

Subsequently, similar to the procedure in Embodiment 1, the terminal location information management device 400B establishes a D-plane session within the mobile network (see (3) in FIG. 23). Although not shown in FIG. 23, the counting unit 631 of the connected terminal number management device 600 performs a process of adding up the number of connected terminals in area B. Next, when the D-plane session is established in area B, the terminal location information management device 400A terminates the D-plane session in area A (see (4) in FIG. 23). Although not shown in FIG. 23, the counting unit 631 of the connected terminal number management device 600 performs a process of subtracting the number of connected terminals in area A.

[4-1. Communication control system configuration]
From here, the configuration of the communication control system 1 in Embodiment 1'' will be explained. A communication control system 1 in embodiment 1'' includes a terminal device 100, a VPN gateway 200, an overlay tunnel route transfer device 300, a terminal location information management device 400, a contract information management device 500, and a connected terminal number management device. 600 and a transfer information management device 700. Note that the system configuration in Embodiment 1'' is the same as that in Embodiment 1, so detailed explanation will be omitted.

[4-2. Procedures for communication control method]
Next, a communication control method performed by the communication control system 1 in the first embodiment'' will be described using FIG. 24. First, the terminal device 100 moves from an arbitrary area A to a different area B (step S41). Next, the terminal location information management device 500B of the destination area B registers the terminal ID and connection destination VPN ID of the terminal device 100 that has moved between areas in the terminal location information management device 400B (step S42). Then, the terminal location information management device 400B determines the overlay tunnel route transfer device 300B to be connected to, and establishes a D-plane session within the mobile network, similarly to the procedure of the first embodiment (step S43).

Continuously, the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals in area B, adds it, and updates it (step S44). Next, after the D-plane session is established in area B, the terminal location information management device 500A terminates the D-plane session in area A (step S45). Then, the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals in area A, subtracts it, and updates it (step S46).

[4-3. effect〕
In Embodiment 1'', the communication control system 1 has the following effects.

In the communication control system 1 according to the first embodiment, even when the terminal device 100 moves between areas and the overlay tunnel route transfer device 300 in charge is changed, the terminal location information management device 400 of the area movement destination is the terminal device. Information necessary for counting the number of connected terminals is acquired from the device 100, and the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals. The setting unit 634 and deletion unit 635 of the connected terminal number management device 600 dynamically control the VPN gateway 200 and the overlay tunnel route transfer device 300, thereby saving resources of the operating server and distributing the load of the gateway process. Provides the effect of increasing efficiency.

[5. Embodiment 2: When the terminal device connects to the VPN via WiFi]
Embodiment 2 will now be described as a further different embodiment. In the second embodiment, an embodiment will be described in which the terminal device 100 connects to a VPN from WiFi via a mobile network.

First, an overview of Embodiment 2 will be explained using FIG. 25. First, the terminal device 100 that performs a WiFi connection connects to the WiFi router R (see (1) in FIG. 25). Next, the WiFi router R transfers the packet data to the mobile gateway 800 (see (2) in FIG. 25). Then, the mobile gateway 800 uses the destination information (for example, IP address etc.), determines the VPN connection address and connection destination VPN ID, and establishes a D-plane session on behalf of the terminal device 100. The mobile gateway 800 then transfers the data to the D-plane session corresponding to the destination VPN (see (3) in FIG. 25). Note that the subsequent counting of the number of connected terminals is the same as in the first embodiment, and will therefore be omitted.

From here, the detailed operation flow of the mobile gateway 800 will be further explained. First, regarding the method by which the mobile gateway 800 acquires the connection destination VPN ID, we will explain ``Case 1: The terminal device acquires the connection destination VPN ID when performing VPN authentication'' and ``Case 2: When the terminal device connects to WiFi, "Send time announcement message". First, case 1 will be explained using FIG. 26.

In FIG. 26, the terminal device 100 transmits a VPN authentication request (including a password and user ID) to the mobile gateway 800 when starting a VPN connection (see (1) in FIG. 26). Subsequently, the mobile gateway 800 further transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (see (2) in FIG. 26). Then, the VPN authentication server 900 transmits an authentication response (connection destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (see (3) in FIG. 26). ). Note that when the VPN authentication server 900 transmits the VPN terminal address, the mobile gateway 800 acquires the corresponding connection destination VPN ID from the contract information management device 500 based on the VPN terminal address (( (See 4).

Next, the mobile gateway 800 transmits the connection destination VPN ID acquired from the VPN authentication server 900 or the contract information management device 500 to the terminal location information management device 400 (see (5) in FIG. 26). The terminal location information management device 400 further transmits the connection destination VPN ID to the transfer information management device 700 and acquires the corresponding VPN connection address (see (6) in FIG. 26). Subsequently, the terminal location information management device 400 transmits the acquired VPN connection address to the mobile gateway 800 (see (7) in FIG. 26). Then, the mobile gateway 800 maps and sets the acquired VPN connection address and the held connection destination VPN ID.

From here, Case 2 will be explained using FIG. 27. First, when the terminal device 100 detects a WiFi connection, it establishes an encrypted path C with the mobile gateway 800 (see (1) in FIG. 27). Note that if the terminal device 100 cannot establish the encrypted route C within a predetermined time, the terminal device 100 stops the procedure for establishing the encrypted route C. Then, the mobile gateway 800 performs VPN authentication in the same manner as in case 1 described above, obtains the VPN connection address and the connection destination VPN ID, and sets them to itself after mapping. Subsequently, the mobile gateway 800 transmits a registration completion message to the terminal device 100 via the encrypted path C (see (2) in FIG. 27).

[5-1. Communication control system configuration]
Next, the configuration of the communication control system 1 in the second embodiment will be explained using FIG. 28. The communication control system 1 in the second embodiment includes a terminal device 100, a VPN gateway 200, an overlay tunnel route transfer device 300, a terminal location information management device 400, a contract information management device 500, and a connected terminal number management device 600. , a transfer information management device 700, and a mobile gateway 800. The following items provide detailed explanations of the functional units of each device. Note that the device configuration of the second embodiment other than the mobile gateway 800 is the same as that of the first embodiment, and in this section, only the different mobile gateway 800 will be explained, and detailed explanation of the other components will be omitted.

(Mobile gateway 800)
As shown in FIG. 28, mobile gateway 800 includes a communication section 810, a storage section 820, and a control section 830. Note that the functions of the communication unit 810 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted.

(Storage unit 820)
The storage unit 820 stores data and programs necessary for various processing by the control unit 830. The storage unit 820 has a VPN search table 821 storage unit.

(VPN search table storage unit 821)
The VPN search table storage unit 821 stores a VPN search table that maps and sets the acquired VPN connection address and connection destination VPN ID. Specifically, the VPN search table storage unit 821 stores the items "VPN connection address" and "connection destination VPN ID" as a VPN search table, as shown in FIG. Note that the information stored in the VPN search table storage section 821 is not limited to the above-mentioned items, and may store other items. Furthermore, the input information for each item shown in FIG. 29 is just an example, and the information is not limited to the information described.

(Control unit 830)
From here, the explanation returns to FIG. 28 and continues. The control unit 830 includes a distribution unit 831, a transmission unit 832, a setting unit 833, and a session establishment unit 834.

(Distribution section 831)
The distribution unit 831 assigns a VPN based on pre-held information regarding the destination address (VPN connection address), information regarding the corresponding VPN (connection destination VPN ID), and destination information (IP address) transmitted by the terminal device 100. The connection address and connection destination VPN ID are determined, and communication is distributed to the D-plane session corresponding to the destination VPN.

(Transmission unit 832)
The transmitter 832 transmits the authentication request (including the user ID, password, etc.) received from the terminal device 100 to the VPN authentication server 900. Further, the transmitter 832 transmits the connection destination VPN ID acquired from the VPN authentication server 900 to the terminal location information management device 400. Furthermore, the transmitter 832 transmits a registration completion message to the terminal device 100.

(Setting section 833)
The setting unit 833 maps and sets the VPN connection address acquired from the transfer information management device 700 and the connection destination VPN ID held by the mobile gateway 800.

(Session establishment unit 834)
The session establishment unit 834 includes contract information (connection destination VPN ID), information for connecting to a dedicated network for each contracted organization to which the terminal device 100 connects (VPN connection address), and packets transmitted by the terminal device 100. Based on the destination information included in the data, an overlay tunnel path for data transfer is established with the terminal location information management device 400 instead of the terminal device 100.

Specifically, in order to establish a D-plane session based on a D-plane session establishment request from the terminal device 100, the session establishment unit 834 performs the following steps based on the mapped VPN connection address and connection destination VPN ID. The destination VPN connection address and connection destination VPN ID are determined from the destination information (IP address) included in the packet data transmitted by the terminal device 100. Then, the session establishment unit 834 establishes a D-plane session corresponding to the corresponding destination VPN and transfers the packet data.

[5-2. Procedures for communication control method]
Next, a communication control method performed by the communication control system 1 in the second embodiment will be described. As described above, in the second embodiment, there are two methods for the mobile gateway 800 to obtain the connection destination VPN ID, so the procedures for each case will be explained separately. First, the procedure for the case corresponding to the above-mentioned case 1 will be explained using FIG. 30.

First, the terminal device 100 connects to the WiFi router R (step S51). Subsequently, the terminal device 100 transmits a VPN authentication request (including a password and user ID) to the mobile gateway 800 at the time of starting the VPN connection (step S52). Next, the transmitter 832 of the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (step S53). Then, the VPN authentication server 900 transmits an authentication response (connection destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (step S54).

Next, the transmitter 832 of the mobile gateway 800 transmits the connection destination VPN ID acquired from the VPN authentication server 900 to the terminal location information management device 400 (step S55). The acquisition unit 435 of the terminal location information management device 400 then acquires the VPN connection address from the transfer information management device 700 (step S56). Subsequently, the transmitter 434 of the terminal location information management device 400 transmits the acquired VPN connection address to the mobile gateway 800 (step S57). The setting unit 833 of the mobile gateway 800 maps and sets the acquired VPN connection address and the held connection destination VPN ID (step S58).

Next, the WiFi router R transfers the packet data to the mobile gateway 800 (step S59). Next, the session establishment unit 834 of the mobile gateway 800 determines the destination VPN connection address from the destination information included in the packet data transmitted by the terminal device 100, based on the mapped VPN connection address and connection destination VPN ID. and the connection destination VPN ID is determined (step S60). Then, the session establishment unit 834 of the mobile gateway 800 establishes a D-plane session corresponding to the corresponding destination VPN and transfers the packet data (step S61).

Next, the procedure for the case corresponding to the above-mentioned case 2 will be explained using FIG. 31. The terminal device 100 connects to the WiFi router R (step S71). At this time, the terminal device 100 establishes an encrypted path C with the mobile gateway 800 (step S72). Subsequently, the terminal device 100 transmits a VPN authentication request (including a password and user ID) to the mobile gateway 800 at the time of starting the VPN connection (step S73). Next, the transmitter 832 of the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (step S74). Then, the VPN authentication server 900 transmits an authentication response (connection destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (step S75).

Next, the transmitter 832 of the mobile gateway 800 transmits the connection destination VPN ID acquired from the VPN authentication server 900 to the terminal location information management device 400 (step S76). The acquisition unit 435 of the terminal location information management device 400 then acquires the VPN connection address from the transfer information management device 700 (step S77). Subsequently, the transmitter 434 of the terminal location information management device 400 transmits the acquired VPN connection address to the mobile gateway 800 (step S78). The setting unit 833 of the mobile gateway 800 maps and sets the acquired VPN connection address and the held connection destination VPN ID (step S79). Then, the transmitter 832 of the mobile gateway 800 transmits a registration completion message to the terminal device 100 (step S80).

Next, the WiFi router R transfers the packet data to the mobile gateway 800 (step S81). Next, the session establishment unit 834 of the mobile gateway 800 determines the destination VPN connection address from the destination information included in the packet data transmitted by the terminal device 100, based on the mapped VPN connection address and connection destination VPN ID. and the connection destination VPN ID is determined (step S82). Then, the session establishment unit 834 of the mobile gateway 800 establishes a D-plane session corresponding to the corresponding destination VPN and transfers the packet data (step S83).

[5-3. effect〕
In the second embodiment, the communication control system 1 has the following effects.

In the conventional technology, when performing WiFi communication, the terminal device 100 only has the destination IP address of the data packet to be transferred to the VPN as information for identifying the VPN to be accessed, and the mobile gateway 800 has only the destination IP address of the data packet transferred to the VPN. It was necessary to attach identifying information to the session establishment signaling message.

Furthermore, in the conventional technology, since the device corresponding to the mobile gateway 800 cannot derive information identifying the VPN to be accessed from the destination IP address of the arriving packet, it is possible to connect the device to the VPN through signaling of the mobile network as soon as the packet arrives. An overlay tunnel route for data transfer could not be established.

However, the communication control system 1 in the second embodiment searches for a mapped VPN connection address from the destination information (IP address) of packet data arriving at the mobile gateway 800, establishes an overlay tunnel path for data transfer, and connects the Provides the effect of making it possible to count the number of terminals.

[6. Embodiment 2-1: When a terminal device connects to a VPN via an IP network]
Embodiment 2-1 will now be described as a similar form to Embodiment 2. In FIG. 32, an embodiment will be described in which the terminal device 100 connects to a VPN from WiFi via an IP network.

First, FIG. 32 shows a case where the terminal device 100 connects to the fixed network access router SR via the WiFi router R, and a case where the terminal device 100 connects directly to the fixed network access router SR. In FIG. 32, when the terminal device 100 accesses via the IP network, the communication control system 1 cannot count the number of connected terminals based on D-plane session establishment and release. Therefore, the communication control system 1 in Embodiment 2-1 uses a terminal operation check performed using "heartbeat", "ping", etc. as a trigger after establishing the VPN authentication and data transfer overlay tunnel path described in Embodiment 2. and count the number of connected terminals.

Furthermore, as a premise in Embodiment 2-1, an overlay tunnel route transfer device 300 for the IP network (hereinafter referred to as "overlay tunnel route transfer device 300") is installed between the IP network and the data network. As shown in FIG. 33, the communication control system 1 communicates with a VPN authentication server 900 (hereinafter referred to as "VPN authentication server 900") for multiple IP networks in order to identify the overlay tunnel route transfer device 300. , a configuration including a plurality of access point APs (for example, a residential WiFi router, etc.).

From here, an overview of the operation of the communication control system 1 in Embodiment 2-1 will be explained using FIG. 34. First, the terminal device 100 transmits VPN connection information (user ID, password, etc.) to the VPN authentication server 900 via the WiFi router R and the fixed network access router SR, or only the fixed network access router SR (see FIG. 34). (see (1)).

Next, the VPN authentication server 900 notifies the connected terminal number management device 600 of the connection destination VPN ID and the anchor GW ID in charge (see (2) in FIG. 34). Then, the connected terminal number management device 600 counts and adds up the number of connected terminals connected to the target VPN to be connected to the dedicated network from the corresponding overlay tunnel route transfer device 300. Note that the procedure for constructing an overlay tunnel path for data transfer after addition is the same as the method described in the first embodiment.

Next, the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 performs terminal survival confirmation using "heartbeat", "ping", etc. (see (3) in FIG. 34). Then, if there is no response from the terminal device 100 as a result of the terminal survival confirmation, the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 sends the connection destination VPN ID and the anchor GW ID in charge to the connected terminal number management device 600. (See (4) in FIG. 34). Then, based on the above-mentioned notification, the connected terminal number management device 600 counts and subtracts the number of connected terminals connected to the VPN to be connected to the dedicated network. Note that the procedure for deleting the overlay tunnel path for data transfer after subtraction is the same as the method described in the first embodiment.

[6-1. Communication control system configuration]
Next, the configuration of the communication control system 1 in Embodiment 2-1 will be explained. The communication control system 1 in Embodiment 2-1 connects a terminal device 100, a VPN gateway 200, an overlay tunnel route transfer device 300 for an IP network, a terminal location information management device 400, and a contract information management device 500. This device configuration includes a terminal number management device 600 and a transfer information management device 700.

Note that the system configuration in Embodiment 2-1 other than the overlay tunnel route transfer device 300 is the same as in Embodiment 1, and in this item, only the different overlay tunnel route transfer device 300 will be explained, and other detailed explanations will be provided. Omitted. Furthermore, since the overlay tunnel route transfer device 300 in Embodiment 2-1 has the same functions as the overlay tunnel route transfer device 300 in Embodiment 1, only the terminal survival confirmation unit 333, which is a different functional unit, will be explained. will be carried out, and other explanations will be omitted.

(Control unit 330)
From here, explanation will be given using FIG. 35. The control unit 330 includes a packet header analysis unit 331, a transfer processing unit 332, and a terminal survival confirmation unit 333.

(Terminal survival confirmation unit 333)
The terminal survival confirmation unit 333 transmits an identification signal to the terminal device 100 connected to the dedicated network via the IP network, and confirms whether the terminal device 100 is currently connected to the dedicated network.

Specifically, the terminal survival confirmation unit 333 uses "heartbeat", "ping", etc. to confirm the terminal survival, and determines whether there is a response from the terminal device 100. Then, the terminal survival confirmation unit 333 notifies the connection destination VPN ID and the assigned anchor GW ID to the connected terminal number management device 600 based on the determination result of the terminal survival confirmation described above. Then, as a result of the terminal survival confirmation, if there is no response from the terminal device 100, the terminal survival confirmation unit 333 notifies the connected terminal number management device 600 of the connection destination VPN ID and the anchor GW ID in charge.

[6-2. Procedures for communication control method]
Next, the procedure of the communication control method performed by the communication control system 1 according to the embodiment 2-1 will be explained using FIG. 36. First, the terminal device 100 transmits VPN connection information (user ID, password, etc.) to the VPN authentication server 900 via the WiFi router R and the fixed network access router SR or only the fixed network access router SR (step S91). . Further, the VPN authentication server 900 notifies the connected terminal number management device 600 of the connection destination VPN ID and the anchor GW ID in charge (step S92).

The number of connected terminals management device 600 then determines the number of connected terminals that connect to the target VPN via the corresponding overlay tunnel route transfer device 300 based on the connection destination VPN ID and the anchor GW ID in charge notified by the VPN authentication server 900. are counted, added, and updated (step S93). Subsequently, the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 uses "heartbeat", "ping", etc. to confirm the terminal survival (step S94).

Then, the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 determines that there is no longer a response from the terminal device 100 (Yes in step S95). In that case, the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 notifies the connected terminal number management device 600 of the connection destination VPN ID and the assigned anchor GW ID (step S96). Then, the counting unit 631 of the number of connected terminals management device 600 calculates the number of connected terminals connected to the target VPN based on the connection destination VPN ID and the anchor GW ID in charge notified by the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300. is counted, subtracted, and updated (step S97).

On the other hand, the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 determines that there is a response from the terminal device 100, and the process continues (No in step S95).

[6-3. effect〕
In the embodiment 2-1, the communication control system 1 has the following effects.

In the communication control system 1, the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 performs terminal survival confirmation on the terminal device 100, and subtracts the number of connected terminals based on the response result from the terminal device 100. Thereby, the communication control system 1 can count the number of connected terminals even in the case of a connection via an IP network where the number of connected terminals cannot be counted using the method described in Embodiment 1. This provides the effect of enabling dynamic control of the tunnel route transfer device 300.

[7. Hardware configuration]
Each component of each device shown in the drawings is functionally conceptual, and does not necessarily need to be physically configured as shown in the drawings. In other words, the specific form of distributing and integrating each device is not limited to what is shown in the diagram, and all or part of the devices can be functionally or physically distributed or integrated in arbitrary units depending on various loads and usage conditions. Can be integrated and configured. Furthermore, all or any part of each processing function performed by each device can be realized by a CPU and a program that is analyzed and executed by the CPU, or can be realized as hardware using wired logic.

Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can also be performed manually using a known method. In addition, information including processing procedures, control procedures, specific names, and various data and parameters shown in the drawings can be arbitrarily changed unless otherwise specified.

[program]
As one embodiment, various devices constituting the communication control system 1 can be implemented by installing a display program that executes the above-described learning into a desired computer as package software or online software. For example, by causing an information processing device to execute the above display program, it can be made to function as various devices constituting the communication control system 1. The information processing device referred to here includes a desktop or notebook personal computer. In addition, information processing devices include mobile communication terminals such as smartphones, mobile phones, and PHSs (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants).

FIG. 37 is a diagram showing an example of a computer on which various devices constituting the communication control system 1 are implemented. Computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These parts are connected by a bus 1080.

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). Hard disk drive interface 1030 is connected to hard disk drive 1090. Disk drive interface 1040 is connected to disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into disk drive 1100. Serial port interface 1050 is connected to, for example, mouse 1110 and keyboard 1120. Video adapter 1060 is connected to display 1130, for example.

The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the various devices constituting the communication control system 1 is implemented as a program module 1093 in which code executable by a computer is written. Program module 1093 is stored in hard disk drive 1090, for example. For example, a program module 1093 for executing processing similar to the functional configuration of various devices making up the communication control system 1 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

Further, the setting data used in the processing of the embodiment described above is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 and program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as necessary, and executes the processing of the embodiment described above.

Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN, WAN (Wide Area Network), etc.). Program module 1093 and program data 1094 may then be read by CPU 1020 from another computer via network interface 1070.

[8. others〕
Although the present embodiment has been described above, the present embodiment is not limited by the description and drawings that form part of the disclosure. That is, all other embodiments, examples, operational techniques, etc. made by those skilled in the art based on this embodiment are included in the scope of this embodiment.

1 Communication control system 10 Front-end server 10A Front-end server 10B Front-end server 10C Front-end server 20A Operation server 20B Operation server 100 Terminal device 101 Terminal device 102 Terminal device 110 Communication unit 120 Storage unit 130 Control unit 131 Address management unit 132 Communication session management unit 200 VPN gateway 210 Communication unit 220 Storage unit 221 Transfer destination storage unit 230 Control unit 231 Packet header analysis unit 232 Transfer processing unit 300 Overlay tunnel route transfer device 300A Overlay tunnel route transfer device 300B Overlay tunnel route transfer device 310 Communication section 320 Storage section 321 Transfer destination storage section 330 Control section 331 Packet header analysis section 332 Transfer processing section 333 Terminal survival confirmation section 400 Terminal location information management device 400A Terminal location information management device 400B Terminal location information management device 410 Communication section 420 Storage unit 421 Terminal device connection destination VPN storage unit 422 Anchor GW storage unit 430 Control unit 431 Reception unit 432 Notification unit 433 Registration unit 434 Transmission unit 435 Acquisition unit 500 Contract information management device 510 Communication unit 520 Storage unit 521 Contract information storage unit 530 Control unit 531 Reception unit 532 Transmission unit 600 Connected terminal number management device 610 Communication unit 620 Storage unit 621 Connected terminal number storage unit 630 Control unit 631 Counting unit 632 Judgment unit 633 Acquisition unit 634 Setting unit 635 Deletion unit 636 Monitoring unit 700 For transfer Information management device 710 Communication section 720 Storage section 721 Address storage section 730 Control section 731 Reception section 732 Transmission section 800 Mobile gateway 810 Communication section 820 Storage section 821 VPN search table storage section 830 Control section 831 Distribution section 832 Transmission section 833 Setting Part 834 Session establishment part 900 VPN authentication server R WiFi router SR Fixed network access router AP Access point DN Data network MN Mobile network 1000 Computer 1010 Memory 1011 ROM
1012 RAM
1020 CPU
1030 Hard disk drive interface 1040 Disk drive interface 1050 Serial port interface 1060 Video adapter 1070 Network interface 1080 Bus 1090 Hard disk drive 1091 OS
1092 Application program 1093 Program module 1094 Program data 1100 Disk drive 1110 Mouse 1120 Keyboard

Claims

A communication control system comprising a connected terminal number management device that constructs and deletes an overlay tunnel path for data transfer used for terminal devices belonging to a connection network to connect to a dedicated network for each contract organization,
The connected terminal number management device includes contract information that is information that identifies a dedicated network for each contracted organization, and anchor GW identification information that is information that identifies an overlay tunnel route transfer device that belongs to an area to which the terminal device connects. a counting unit that counts the number of connected terminals, which is the number of terminal devices accessing the dedicated network for each contracted organization, using the
When the number of connected terminals increases from 0 to 1 or more, start up the VPN gateway, configure the VPN gateway and the overlay tunnel route transfer device to connect to the dedicated network for each contracted organization, and a setting unit that constructs an overlay tunnel route for data transfer;
a deletion unit that deletes the settings of the VPN gateway and the overlay tunnel route transfer device, stops the VPN gateway, and deletes the overlay tunnel route for data transfer when the number of connected terminals changes from 1 or more to 0; and has
A communication control system characterized by:
The communication control system further includes a terminal location information management device,
The terminal location information management device receives terminal device information, which is information for identifying the terminal device, the contract information, and a connection request, which is a request for connection from a mobile network to a data network, from the terminal device. Department and
a registration unit that registers the terminal device information and the contract information;
a transmitter configured to transmit the contract information and the anchor GW identification information to the connected terminal number management device based on the connection request;
The communication control system according to claim 1, characterized in that:
The communication control system further includes a terminal location information management device and a contract information management device,
The terminal location information management device receives terminal device information that is information for identifying the terminal device, a registration request that is a request to register the terminal device information and the contract information in the terminal location information management device, and a request from the mobile network. a reception unit that receives a connection request, which is a request for connection to a data network, from the terminal device;
a registration unit that registers the terminal device information and the contract information acquired from the contract information management device using the terminal device information based on the registration request;
a transmitter configured to transmit the contract information and the anchor GW identification information to the connected terminal number management device based on the connection request;
The communication control system according to claim 1, characterized in that:
The connected terminal number management device includes an acquisition unit that uses the contract information to acquire information for connecting to a dedicated network for each of the contracted organizations to which the terminal device is connected, from a transfer information management device;
further comprising a monitoring unit that acquires information regarding the operating status of the operating server that operates the VPN gateway, and determines the operating server to be operated based on the information regarding the operating status;
The communication control system according to claim 1, characterized in that:
The communication control system further includes a mobile gateway,
The mobile gateway, based on the contract information, information for connecting to a dedicated network for each contract organization to which the terminal device connects, and destination information included in packet data transmitted by the terminal device, further comprising a session establishment unit that establishes an overlay tunnel path for data transfer with the terminal location information management device instead of the terminal device;
The communication control system according to claim 1, characterized in that:
The overlay tunnel route transfer device transmits an identification signal to the terminal device connected to the dedicated network via an IP network, and confirms whether the terminal device is connected to the dedicated network. further comprising a confirmation section;
The communication control system according to claim 1, characterized in that:
A communication control system comprising a connected terminal number management device that constructs and deletes an overlay tunnel path for data transfer used for terminal devices belonging to a connection network to connect to a dedicated network for each contract organization,
The connected terminal number management device includes contract information that is information that identifies a dedicated network for each contracted organization, and anchor GW identification information that is information that identifies an overlay tunnel route transfer device that belongs to an area to which the terminal device connects. counting the number of connected terminals, which is the number of terminal devices accessing the dedicated network for each contracted organization, using
When the number of connected terminals increases from 0 to 1 or more, start up the VPN gateway, configure the VPN gateway and the overlay tunnel route transfer device to connect to the dedicated network for each contracted organization, and constructing an overlay tunnel path for data transfer;
a step of deleting the settings of the VPN gateway and the overlay tunnel route transfer device, stopping the VPN gateway, and deleting the overlay tunnel route for data transfer when the number of connected terminals changes from 1 or more to 0; , has
A communication control method characterized by:
A communication control system comprising a connected terminal number management device that constructs and deletes an overlay tunnel path for data transfer used for terminal devices belonging to a connection network to connect to a dedicated network for each contract organization,
The connected terminal number management device includes contract information that is information that identifies a dedicated network for each contracted organization, and anchor GW identification information that is information that identifies an overlay tunnel route transfer device that belongs to an area to which the terminal device connects. counting the number of connected terminals, which is the number of terminal devices accessing the dedicated network for each contracted organization, using
When the number of connected terminals increases from 0 to 1 or more, start up the VPN gateway, configure the VPN gateway and the overlay tunnel route transfer device to connect to the dedicated network for each contracted organization, and constructing an overlay tunnel path for data transfer;
If the number of connected terminals changes from 1 or more to 0, deleting the settings of the VPN gateway and the overlay tunnel route transfer device, stopping the VPN gateway, and deleting the overlay tunnel route for data transfer; , has
A communication control program characterized by: