JP2002185451A - Remote access system, exchange and subscriber terminal - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide such a remote access system that a call is not charged when connection is rejected between a subscriber terminal connected with a public network and a computer included in a data network. SOLUTION: The remote access system accepts a call setup request including information required for user authentication from a subscriber terminal, extracts the authentication information from the call setup request, and transmits that authentication information to a server for authenticating the subscriber terminal. Subsequently, the remote access system receives an access admission or an access rejection for the authentication information. When an access admission is received, a call setup processing for granting access of the subscriber terminal and connecting the subscriber terminal is performed. When an access rejection is received, a disconnection for rejecting access of the subscriber terminal is performed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an interconnection between a subscriber terminal accommodated in a communication network such as a public network and a computer accommodated in a data network which performs communication using the Internet protocol or the like. Regarding remote access system.

[0002]

2. Description of the Related Art Conventionally, a subscriber terminal such as a computer housed in a public communication network is connected to a data network such as the Internet, and information is exchanged between the computer housed in the data network. As a device for
There is a remote access system having a remote access function.

By installing a remote access system between a communication network and a data network, a subscriber terminal accommodated in the communication network connects to the data network via the remote access system and is accommodated in the data network. It becomes possible to communicate with a computer. As a means for determining whether communication between the subscriber terminal and the data network is permitted, the telephone number of the calling subscriber terminal and authentication information such as a user name and a domain name used by the calling user in the data network are used. Is stored in an authentication server in a data network, these authentication information is received at the time of a connection request from a communication network, and a comparison is made with the authentication information held in the authentication server to determine whether connection is possible or not. ing.

[0004]

In the prior art, when a user name or a domain name is used for judging whether connection is possible or not, a VPN / VLAN textbook (ASCII Publishing, edited by Multimedia Communication Study Group), Chapter 3, 3. As shown in item 2, to establish a communication line between the remote access system and the subscriber terminal, start data transmission and reception between the subscriber terminal and the remote access system, and determine whether connection is possible. The authentication information such as the user name and domain name of the caller used for the communication is notified from the subscriber terminal to the remote access system using the established communication line to determine whether connection is possible. In this case, in the communication network, charging for the subscriber terminal originating when a communication line between the subscriber terminal and the remote access system is established is started. Therefore, even if the user name or domain name notified from the subscriber terminal is incorrect and the connection is finally refused, the connection is established between the subscriber terminal and the telephone network and charging is started. As a result, the subscriber is charged a communication network connection fee. That is, even if the subscriber is not connected to a computer accommodated in the data network, the telephone network communication line has been established for authentication and charging has been started. Would. Since a connection has already been established between the subscriber terminal and the communication network, the subscriber is charged a connection fee for the communication network.

[0005] The present invention relates to a remote access system, a switch, and a subscriber in which, when a connection between a subscriber terminal connected to a public network and a computer accommodated in a data network is rejected due to authentication, the connection is not charged. The purpose is to realize a terminal.

[0006]

A remote access system receives a call setting request from a subscriber terminal including authentication information necessary for user authentication, extracts authentication information from the call setting request, and extracts the authentication information. , To the authentication server that authenticates the subscriber terminal. Thereafter, an access permission or an access denial for the authentication information is received from the authentication server. When you receive permission,
A call setting process for permitting the access of the subscriber terminal and connecting the subscriber terminal to the terminal is performed. When an access rejection is received, a disconnection process is performed to reject the access of the subscriber terminal. .

Before the communication network starts charging a subscriber terminal, the remote access system is notified of authentication information, and a user name and a domain name are transmitted and received between the remote access system and the authentication server. Therefore, when the connection is rejected, the communication line can be disconnected before collecting the connection fee to the subscriber terminal in the communication network.

[0008]

Embodiments of the present invention will be described below.

FIG. 1 is a network configuration diagram showing a relationship between a remote access system, a communication network and a data network. In FIG. 1, a public telephone network is applied to a communication network accommodating subscriber terminals, an Internet network is applied to a data network accommodating a computer to communicate with, and a control network accommodating a remote access system and an authentication server. The figure shows a case in which they are installed independently of these.

In FIG. 1, a remote access system 1 has a remote access device 2 for establishing a communication line and a remote access control device 3 for transmitting and receiving control signals.

The remote access system 1 includes a communication network 6
And the control network 7. The remote access control device 3 is connected to the communication network 6 and transmits and receives a control signal for controlling a call to and from the communication network 6. The remote access device 2 is connected to the communication network 6 and has a function of setting a communication line with the subscriber terminal 4.

The remote access system 1 receives a call setting request including authentication information necessary for user authentication from a subscriber terminal, and authenticates the call setting request when the receiving unit receives the call setting request. Extracting means for extracting information, transmitting means for transmitting the authentication information extracted by the extracting means to an authentication server for authenticating the subscriber terminal, and receiving permission or denial of access to the authentication information from the authentication server. And a call setting process for permitting access of the subscriber terminal and connecting the subscriber terminal to the terminal when the access permission is received by the receiving means, and receiving the access denial by the receiving means. Processing means for performing a disconnection process in order to deny access of the subscriber terminal when the access is performed. Authentication server 5
Is communicated via the control network 7. When the authentication server 5 determines that the connection is permitted, the remote access system 1 forms a communication line between the computer 9 and the subscriber terminal 4 via the control network 7 and the data network 8. The remote access device 2 and the remote access control device 3 may be constituted by one device.

Next, the configuration of the remote access system 1 will be described with reference to FIGS. FIG. 5 is a block diagram of the remote access device 2 included in the remote access system 1. FIG. 6 shows a block diagram of the remote access control device 3.

In FIG. 5, remote access device 2
Forms a communication line with the communication network 6 by the communication network side line interface circuit 202. Further, in order to connect to the communication network 6 via a communication line, the remote access device 2 sends a signal from the communication network side line interface circuit 202 to the packet conversion processing device 204 via the line connection circuit 203, and To a packet signal that can be transmitted to The converted packet signal is sent to the data network 8 using the data network side interface circuit 205. Further, the remote access device 2 communicates with the remote access control device 3 via the remote access control device communication circuit 206. In the remote access device 2, the communication network side line interface circuit 20
2. The control circuit 201 controls the line connection circuit 203, the packet conversion processing 204, the data network side interface circuit 205, and the remote access control device communication circuit 206.

In FIG. 6, the remote access control device 3 sends and receives control signals to and from the communication network 6 by the communication network side control signal circuit 302. In the remote access control device 3, the control circuit 301 analyzes the content of the control signal from the communication network 6 received from the communication network control signal circuit 302 and communicates with the remote access device 2 using the remote access device communication circuit 303. Exchange of control signals.

Next, the configuration of the subscriber terminal 4 will be described.
FIG. 9 shows a configuration diagram of the subscriber terminal 4. In FIG. 9, the subscriber terminal is a personal computer or the like, and a network interface unit 401 connected to the communication network 6.
A CPU 402 of a control unit, a memory 410 for storing software, an input unit 411 such as a keyboard and a mouse,
A display unit 412 such as a display. The authentication information necessary for user authentication for connection to the terminal is stored in the memory 41.
It is held at 0 in advance. The CPU 402 receives a connection request to the terminal from the user via the input unit 411, and
10 is instructed to transmit a call setting request including the authentication information held in the network interface unit 401.
More specifically, a SETUP signal 2001 for call setting in which the user name and the domain name of the authentication information are set in the user / user information (UUI) is transmitted to the communication network 6. The authentication information may include a password.

Next, a sequence between the devices will be described with reference to FIG. FIG. 2 shows a control sequence diagram among the subscriber terminal 4, the communication network 6, the remote access system 1, and the authentication server 5 when the connection from the subscriber terminal 4 is rejected.

In FIG. 2, when a calling user requests transmission to a computer 9 accommodated in a data network 8, the subscriber terminal 4 sends the user name and domain name information to the communication network 6 by the user / user. A SETUP signal 2001 for call setting set in the user information (UUI) is transmitted.

In the communication network 6, the SETUP from the subscriber terminal 4
When receiving the signal 2001, the UUI information set in the SETUP signal 2001 is extracted, and the control signal 2002 of the connection request in which the UUI information is transparently set is transmitted to the remote access system 1. The remote access system 1 receives the connection request 2002 from the communication network 6 and refers to the contents of the UUI information set in the connection request 2002,
Extract user name and domain name. Next, the remote access system 1 transmits an access request 2003 in which the extracted user name and domain name are set to the authentication server 5 via the control network 7.

The authentication server 5 searches whether or not the received user name and domain name are registered in the management data held in the authentication server 5. FIG. 4 is an explanatory diagram of management data indicating the IP address of the connection destination computer corresponding to the user name and the domain name held by the authentication server 5. Upon receiving the access request 2003 from the remote access system 1, the authentication server 5 extracts the information of the user name and the domain name set in the access request 2003, and combines the information with the user name and the domain name that match the management data. Search for whether or not it holds. As a result of the search, when matching data is held, it is determined that the connection is permitted, and the access permission 2007 in which the corresponding connection destination IP address is set is returned to the remote access system 1. If no matching data is held, it is determined that the connection is rejected, and an access rejection 2004 is returned to the remote access system 1.

FIG. 2 shows a case where the user name and the domain name notified from the remote access system 1 are not stored as a result of the search.
Access rejection 20 to reject connection to data network 8
04 to the remote access system 1.

When the remote access system 1 receives the access rejection 2004 from the authentication server 5, the remote access system 1 does not send the response signal 2008 to the communication network 6 but sends the disconnection signal 2
005 is sent.

In the communication network 6, since the disconnection signal 2005 is received without receiving the response signal 2008 from the remote access system 1, the communication is terminated without starting the charging for the subscriber terminal 4.

FIG. 3 shows a control sequence when connection from the subscriber terminal 4 is permitted.

In FIG. 3, when a calling user requests a calling to the computer 9 accommodated in the data network 8, the subscriber terminal 4 sends authentication information of the user name and the domain name to the communication network 6. A SETUP signal 2001 for call setting set in the user / user information (UUI) is transmitted.

In the communication network 6, the SETUP from the subscriber terminal 4
When receiving the signal 2001, the UUI information set in the SETUP signal 2001 is extracted, and the control signal 2002 of the connection request in which the UUI information is transparently set is transmitted to the remote access system 1. The remote access system 1 receives the connection request 2002 from the communication network 6 and refers to the contents of the UUI information set in the connection request 2002,
Extract user name and domain name.

The remote access system 1 sets an access request 200 in which the extracted user name and domain name are set.
3 is sent to the authentication server 5 via the control network 7.

The authentication server 5 searches whether or not the received user name and domain name are registered in the management data held in the authentication server 5.

The operation up to this point is the same as the processing for rejecting the connection described in FIG.

If the user name and the domain name notified from the remote access system 1 as a result of the search are stored as management data, the authentication server 5
Allows access to the data network 8 and includes an access permission 2007 including access information to the computer 9 to be connected to.
Is notified to the remote access system 1.

Upon receiving the access permission 2007 from the authentication server 5, the remote access system 1 sends a response signal 2008 to the communication network 6, based on the access information to the computer 9 notified from the authentication server 5. Then, a connection is established between the computer 9 via the control network 7 and the data network 8.

In the communication network 6, upon receiving the response signal 2008 from the remote access system 1, the subscriber terminal 4
Sends a CONNECT signal 2009 prompting the establishment of a communication line, and starts charging the subscriber terminal 4.

When a communication line is established between the subscriber terminal 4 that has received the CONNECT signal 2009 and the remote access system 1, the subscriber terminal 4 is connected to the subscriber terminal 4 via the remote access system 1, the control network 5, and the data network 8. Communication is established with the computer 9 accommodated in the data network 8.

Next, a processing flow in the remote access device 2 and the remote access control device 3 will be described. FIG. 7 shows the control circuit 201 of the remote access device 2.
3 shows a control flow of the control. FIG. 8 shows a control flow in the control circuit 301 of the remote access control device 3.

In FIG. 7, the remote access device 2
Receives the call notification 2101 from the remote access control device 3 in the initial state 401,
01, a user name and a domain name are extracted (step 411). The remote access device 2 creates an access request 2003 in which the user name and domain name extracted from the call notification signal 2101 are set (step 41).
2) Send an access request 2003 to the authentication server 5.

Next, upon receiving a response from the authentication server 5,
The contents are analyzed, and the subsequent processing branches (step 4).
13). The response from the authentication server 5 is the access permission 200
If it is 7, a response request signal 2102 to the remote access control device 3 is created (step 414), sent to the remote access control device 2, and the communication state 402
Transitions to.

If the response from the authentication server 5 is an access rejection 2004, the remote access control device 3
Request signal 2103 is generated (step 41).
5) Send to the remote access control device 3 and transition to the initial state 401 again.

In FIG. 8, the remote access control device 3 receives the connection request 20 from the communication network 6 in the initial state 501.
02, the user name and the domain name are extracted from the connection request 2002 (step 511). In the remote access control device 3, the call notification signal 21 in which the user name and the domain name extracted from the connection request 2002 are set.
01 (step 512), and the call notification signal 210
1 to the remote access device 2.

Next, the response from the remote access device 2 is received, the content is analyzed, and the subsequent processing branches (step 513). If the response from the remote access device 2 is the response request 2102, a response signal 2008 to the communication network 6 is created (step 514), transmitted to the communication network 6, and transited to the communicating state 502. If the response from the remote access device 2 is the disconnection request 2103, a disconnection signal 2005 to the communication network 6 is created (step 515), sent to the communication network 6, and the initial state 50 is returned.
Transitions to 1.

As described above, by performing the authentication before establishing the communication line, if the user name or the domain name is incorrect, the user terminal 4 is disconnected before starting charging. It is possible to do.

According to the present embodiment, before the communication network starts charging for the subscriber terminal, the user name and the domain name are notified to the remote access system, and the communication between the remote access system and the authentication server is performed. If the connection is refused, disconnect the communication line before collecting the connection fee to the subscriber terminal by enabling the transmission and reception of the user name and domain name etc. Becomes possible.

Next, a second embodiment will be described. In the second embodiment, the SETUP signal 200
A case where the authentication information is transmitted in the server device when the authentication information including the authentication information is not transmitted in 1 will be described. Second
FIG. 11 shows a configuration according to this embodiment. In FIG. 11, a holding device 10 as a server device is connected to a control network 7 in addition to the first embodiment. The holding device is a holding device that is connected to a public network and holds authentication information necessary for user authentication for connection of a subscriber terminal that communicates with a terminal connected to the data network for connection to the terminal. A memory of a holding unit for holding the identification information of the subscriber terminal and the authentication information of the subscriber terminal in association with each other; a receiving unit for receiving the identification information of the subscriber terminal from outside; And transmitting means for transmitting the authentication information held in the holding means. The receiving unit and the transmitting unit are provided in the interface unit. In FIG.
Indicates the contents held in the memory. In FIG. 10, the subscriber number of the subscriber terminal, the subscriber number of the connection destination, the user name, and the domain name are stored in association with each other.

In the present embodiment, when the calling user requests calling to the computer 9 accommodated in the data network 8, the subscriber terminal 41 includes the connection destination subscriber number.
A SETUP signal is transmitted to the remote access system 11 via the communication network 6. The remote access system 11 accepts a connection request from the communication network 6 and extracts the source subscriber number and the destination subscriber number set in the connection request. Next, the remote access system 11 sends an authentication request in which the extracted source subscriber number and connection destination subscriber number are set via the control network 7 to the holding device 1.
Send to 0.

The holding device 10 extracts the corresponding user name and domain name from the received source subscriber number and connection destination subscriber number, and substitutes the extracted user name and domain name with the source subscriber number. It is transmitted to the remote access system 11 together with the user number and the connection destination subscriber number. The remote access system 11 receives the user name and the domain name from the holding device, and transmits an access request 2003 in which the user name and the domain name are set to the authentication server 5 via the control network 7. Subsequent procedures are the same as in the first embodiment.

According to the second embodiment, authentication is performed before a communication line is established without changing a subscriber terminal by holding a user name and a domain name in a holding device. Can be. Further, the function of the holding device may be provided in the remote access system. In this case, the inquiry to the holding device can be omitted. Further, the exchange in the communication network may be provided with the function of the holding device. In this case, when the exchange receives the SETUP signal from the subscriber terminal 4, the exchange extracts the source subscriber number and the connected subscriber number set in the SETUP signal, and stores the corresponding user number stored in the holding means. Name and domain name, and the detected user name and domain name are included in the control signal of the connection request together with the source subscriber number and connection destination subscriber number, and are transmitted to the remote access system 1. it can. Thereby, the inquiry to the holding device can be omitted.

[0046]

According to the present invention, there is provided a remote access system in which a connection between a subscriber terminal connected to a public network and a computer accommodated in a data network is not charged if the connection is rejected by authentication. An exchange and a subscriber terminal can be realized.

[Brief description of the drawings]

FIG. 1 is a network configuration diagram illustrating a relationship between a remote access system, a communication network, and a data network according to a first embodiment.

FIG. 2 is a sequence diagram among a subscriber terminal, a communication network, a remote access system, and an authentication server when a connection to a data network is rejected.

FIG. 3 is a sequence diagram between a subscriber terminal, a communication network, a remote access system, and an authentication server when connection to a data network is permitted.

FIG. 4 is an explanatory diagram showing a management database of user names, domain names, and connection destination IP addresses held in an authentication server.

FIG. 5 is a block diagram of a remote access device.

FIG. 6 is a block diagram of a remote access control device.

FIG. 7 is a flowchart showing processing contents of the remote access device.

FIG. 8 is a flowchart showing processing contents of the remote access control device;

FIG. 9 is a configuration diagram of a subscriber terminal 4;

FIG. 10 is an explanatory diagram showing contents held in a memory;

FIG. 11 is a network configuration diagram showing a relationship between a remote access system, a communication network, and a data network according to the second embodiment;

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Remote access system 2 ... Remote access device 3 ... Remote access control device 4 ... Subscriber terminal provided with the function to connect to a data network 5 ... Authentication server 6 ... Communication network accommodating a subscriber terminal and a remote access system 7 ... Control network accommodating the remote access system and the authentication server 8 Data network 9 Computer accommodated in the data network 201 Control circuit of the remote access device 202 Communication line interface circuit 203 Communication connection circuit 204 Packet conversion processing Device 205: Data network side interface circuit 206: Remote access control device communication circuit 301: Remote access control device control circuit 302: Telephone network side control signal circuit 303: Remote access device communication circuit 2001: User name and domain name in UUI parameters Feelings SETUP to notify the call from the subscriber terminal but has been set
Signal 2002: Connection request control signal from the communication network in which the user name and domain name information is set in the UUI parameter to the remote access device 2003: From the remote access system in which the user name and domain name information is set to the authentication server Access request signal 2004: Access denial signal from the authentication server to the remote access system 2005: Disconnect signal from the remote access system to the communication network 2006: DISCONNECT signal for notifying the subscriber terminal of the call from the communication network 2007: Authentication An access permission signal from the server to the remote access system 2008 A response signal from the remote access system to the communication network 2009 A CONNECT signal for notifying the subscriber terminal from the communication network to the subscriber terminal 2101 A remote signal from the remote access control device Access A call notification signal 2102 for requesting a device to connect a call A response request signal for requesting a response from the remote access device to the remote access control device 2103 A request for disconnection from the remote access device to the remote access control device Disconnect request signal.

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Tsutomu Hirao 216 Totsuka-cho, Totsuka-ku, Yokohama-shi, Kanagawa Prefecture Inside the Communications Division, Hitachi, Ltd. (72) Takahiro Sakuragi 180 Totsuka-cho, Totsuka-ku, Yokohama, Kanagawa, Japan F term (reference) in Ritsumeikan Communication System Co., Ltd. 5B085 AC04 AE02 AE23 BC00 5J104 AA07 KA01 MA01 NA05 PA07 PA11 5K024 CC09 DD03 GG08 5K048 AA09 BA31 DA03 DC03 DC07

Claims (5)

[Claims] 1. A remote access system having a remote access function for causing a subscriber terminal connected to a public network and a terminal connected to a data network to communicate with each other, which is required for user authentication from the subscriber terminal. Receiving means for receiving a call setting request including appropriate authentication information; extracting means for extracting the authentication information from the call setting request when the receiving means receives the call setting request; and authentication information extracted by the extracting means. Transmitting means for transmitting an access permission or an access denial to the authentication information from the authentication server, and receiving the access permission by the receiving means. When performing a call setting process for permitting access to the subscriber terminal and connecting the subscriber terminal to the terminal. Remote access system characterized upon receiving an access denied by the receiving means, having a processing means for performing a cutting process in order to deny access to the subscriber terminal. 2. A remote access system having a remote access function for causing a subscriber terminal connected to a public network to communicate with a terminal connected to a data network, comprising: identification information of the subscriber terminal; Holding means for holding authentication information necessary for user authentication of the terminal in association with the terminal; receiving means for receiving a call setting request from the subscriber terminal; and a subscriber when the call setting request is received by the receiving means. Extracting means for extracting the identification information of the terminal, reference means for the holding means, detecting means for detecting authentication information corresponding to the identification information extracted by the extracting means, and authentication information detected by the detecting means, Transmitting means for transmitting to the authentication server for authenticating the subscriber terminal; and permitting or denying access to the authentication information from the authentication server. Receiving means for receiving an access permission by the receiving means, performing call setting processing for permitting access to the subscriber terminal and connecting the subscriber terminal to the terminal, A remote access system for performing a disconnection process in order to deny access of the subscriber terminal when receiving an access rejection. 3. An exchange for connecting a subscriber terminal connected to a public network and a remote access system, wherein the identification information of the subscriber terminal is associated with authentication information required for user authentication of the subscriber terminal. Holding means for holding; receiving means for receiving a call setting request from the subscriber terminal; extracting means for extracting identification information of the subscriber terminal when the call setting request is received by the receiving means; , Detecting means for detecting authentication information corresponding to the identification information extracted by the extracting means, and transmitting the authentication information detected by the detecting means to the remote access system in a call setting request. And an exchange. 4. A subscriber terminal connected to a public network and communicating with a terminal connected to the Internet network, comprising: holding means for holding authentication information necessary for user authentication for connection to the terminal; Receiving means for receiving a connection request from a user from a user, and transmitting means for transmitting a call setting request including authentication information held in the holding means when the connection request is received by the receiving means. Subscriber terminal to do. 5. A holding device for holding authentication information required for user authentication for connection of a subscriber terminal connected to a public network and communicating with a terminal connected to a data network for connection to the terminal, Holding means for holding the identification information of the subscriber terminal and the authentication information of the subscriber terminal in association with each other; receiving means for receiving the identification information of the subscriber terminal from outside; and receiving the identification information by the receiving means. And a transmission unit for transmitting the authentication information stored in the storage unit corresponding to the identification information.