JP2004247835A - Communication control method, relaying apparatus, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology capable of efficiently relaying data transmitted from a mobile station in a mobile communication network without losing the user-friendliness of the mobile station even when the mobile station makes communication via a different relaying apparatus (router) attended with its movement. <P>SOLUTION: An own AR 50 particularizes another AR 50 for managing other communication area in which a wireless terminal 10 moving to a communication area managed by the own AR 50 has been resident with high possibility. When receiving a packet transmitted from the wireless terminal 10 in the communication area managed by the own AR 50, the own AR 50 particularizes the wireless terminal 10 being a sender of the packet, when authentication information of the wireless terminal 10 is not stored in the own AR 50, the own AR 50 inquires of the other AR 50 having been particularized in advance about the presence / absence of the authentication information of the wireless terminal 10, and when the other AR 50 receiving the inquiry informs the own AR about the possession of the authentication information, the own AR 50 transmits the packet transmitted from the wireless terminal 10 to the destination of the packet. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a technique for relaying data transmitted from a mobile terminal in a mobile communication network.
[0002]
[Prior art]
For example, as shown in FIG. 10, there is a mobile communication network 100 having base stations 110a to 110d, a router 120a having base stations 110a and 110b under its control, and a router 120b having base stations 110c and 110d under its control. Each router has an authentication function for authenticating the wireless terminal 130, and a memory for holding authentication information of the wireless terminal 130 authenticated by the authentication function. Whether to relay the transmitted data is determined depending on whether or not the authentication information of the wireless terminal 130 that is the transmission source of the data is stored in the memory in the router.
[0003]
In such a mobile communication network 100, for example, the communicating wireless terminal 130 moves from the wireless area of the base station 110c under the router 120b to the wireless area of the base station 110b under the router 120a, If communication is to be performed via a different router 120a than before, the router 120a that has newly relayed the communication of the wireless terminal 130 does not hold the authentication information of the wireless terminal 130, It is necessary to perform an authentication process for the wireless terminal 130. For this reason, in the wireless terminal 130, when communication is performed via a different router 120 as the mobile terminal 130 moves, the communication is temporarily interrupted for the authentication process, and the usability of the wireless terminal 130 is impaired. There was a problem.
[0004]
As a reference technique for solving such a problem, there is a technique in which authentication information of a terminal held by each router can be exchanged between routers in a mobile communication network (for example, Patent Document 1). reference).
[0005]
According to this patent document 1, in a micro mobility network, the highest router 10 holds authentication information of each mobile terminal 40, and each router 20 under the highest router 10 updates a route from the mobile terminal 40. When the information is received, if the authentication information of the mobile terminal 40 that is the transmission source is not held in the own device 20, the presence or absence of the authentication information is inquired to the highest router 10, and as a result of the inquiry, It describes that when there is authentication information, the route information of the mobile terminal 40 is updated, and when there is no authentication information, the received route update information is discarded.
[0006]
Japanese Patent Application Laid-Open No. H11-163873 discloses that when the router 20 transmits a message for inquiry in order to inquire of the highest router 10 whether or not authentication information of the mobile terminal 40 exists, each router on the transfer route of the message is transmitted. Monitors the contents of the message and, if it holds the authentication information for which the presence / absence is being inquired by this message, stops the transfer of this message and replaces this authentication information with the The transmission to the router 20 is described.
[0007]
[Patent Document 1]
JP-A-2002-281010
[0008]
[Problems to be solved by the invention]
However, in the technology described in Patent Literature 1, since the inquiry from each router 20 is always made to the highest router 10, traffic to the highest router 10 is concentrated. When receiving the above message, all routers in the transfer route from the inquiry source router 20 to the highest router 10 analyze the contents of the message and hold the authentication information for which the presence / absence has been inquired. You have to make sure that you do. As described above, the technology described in Patent Literature 1 reduces communication efficiency in a micro-mobility network, such as concentration of traffic to the highest-level router 10 and a large processing load for inquiring authentication information in each router 20. Problem.
[0009]
The present invention has been made in view of the circumstances described above, and an object of the present invention is to improve the usability of a mobile station even when the mobile station communicates via a different relay device (router) as it moves. And to efficiently relay data transmitted from a mobile station in a mobile communication network.
[0010]
[Means for Solving the Problems]
In order to solve the above problems, the present invention provides a mobile communication network that transfers data transmitted from a mobile station in a communication area controlled by a relay device to a communication partner via the relay device. Any one of the relay devices of the relay device is, among the plurality of relay devices, a mobile station moving to a communication area controlled by the own device is likely to have been located in another A first step of identifying a relay device that has jurisdiction over the communication area;
A second process in which the one relay device receives data transmitted from a mobile station in a communication area controlled by the relay device;
The one relay device specifies a mobile station that is a source of data received in the second process, and stores information indicating that the mobile station has been authenticated in the mobile communication network in its own device. A third step of determining whether or not it is held;
A fourth step of inquiring the relay apparatus identified in the first step about the presence or absence of the information, when the one relay apparatus determines that the information is not held in the third step; When,
When the one relay device is notified that the information is held by the relay device that has made the inquiry in the fourth process, the data received in the second process is The fifth step of forwarding to the destination
And a communication control method having the following.
[0011]
Also, the present invention provides a mobile communication network comprising: a plurality of relay devices constituting a mobile communication network for transferring data transmitted from a mobile station in a communication area controlled by the relay device to a communication partner via the relay device. In any one of the relay devices,
A plurality of relay devices constituting the mobile communication network are controlled by a relay device which controls another communication area in which a mobile station moving to a communication area controlled by the one relay device is likely to have been located. Specifying means for specifying from among the relay devices;
Receiving means for receiving data transmitted from a mobile station in a communication area controlled by the one relay device;
Identify the mobile station that is the source of the data received by the receiving means, and determine whether the one relay device holds information indicating that the mobile station has been authenticated in the mobile communication network. Determining means for determining;
When it is determined that the information is not held by the determining unit, a transmitting unit that transmits a message inquiring about the presence or absence of the information to the relay device specified by the specifying unit,
A transfer unit that transfers the data received by the reception unit to a destination of the data, when notified that the information is held from the relay device that has made an inquiry using the message;
And a relay device having the same.
[0012]
Further, the present invention provides any one of the plurality of computers constituting a mobile communication network for transferring data transmitted from a mobile station in a communication area controlled by the computer to a communication partner via the computer. On one computer,
The computer that controls the other communication area where the mobile station moving to the communication area controlled by the one computer is likely to be located is a computer of the plurality of computers configuring the mobile communication network. A first process of identifying from within,
A second step of receiving data transmitted from a mobile station in a communication area controlled by the one computer;
Specifying a mobile station that is a transmission source of the data received in the second step, and determining whether the one computer holds information indicating that the mobile station has been authenticated in the mobile communication network; A third step of determining whether
A fourth step of transmitting, to the computer specified in the first step, a message inquiring about the presence or absence of the information when it is determined that the information is not held in the third step;
A fifth step of transferring the data received in the second step to a destination of the data when it is notified that the information is held from the computer that has made the inquiry using the message;
Provide a program to execute
Of course, the program may be recorded on a recording medium, and the program may be distributed using the recording medium.
[0013]
According to the present invention, the relay device (computer) may have a possibility that a mobile station moving to a communication area controlled by the own device is present among a plurality of relay devices constituting a mobile communication network. A relay device that controls another high communication area is specified. When receiving data transmitted from a mobile station in a communication area under its control, the relay device identifies the mobile station that is the source of the data, and the mobile station has been authenticated in the mobile communication network. If the information indicating that the information is present is not stored in the own device, the relay device specified in advance is inquired about the presence or absence of the information, and the relay device that has inquired is notified that the information is stored. In this case, the data transmitted from the mobile station is transferred to the destination of the data.
[0014]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that the same reference numerals are given to common parts in each drawing.
[A-1. Configuration of Embodiment]
<1. Overall configuration of communication system>
[0015]
FIG. 1 is a block diagram illustrating a configuration of a communication system 1 according to the embodiment of the present invention. In this communication system 1, for example, IPv4 (Internet Protocol Version 4) or IPv6 is used as a communication protocol for transmitting and receiving data to and from the wireless terminal 10.
[0016]
Hereinafter, in this specification, each of the base stations 20a to 20f is referred to as a "base station 20," and each of the radio access communication networks 30a and 30b is referred to as a "radio access communication network 30," unless otherwise required. Each of the ARs 50a and 50b is described as “AR50”. Also, in FIG. 1, two radio access communication networks 30 and two ARs 50 are shown in order to prevent the drawing from being complicated, but actually two or more radio access communication networks 30 and AR 50 are used. The communication system 1 is provided.
[0017]
The wireless terminal 10 (mobile station) is, for example, a notebook personal computer 12 (hereinafter, referred to as “PC 12”) to which a mobile phone 11 having a packet communication function is connected. For example, as shown in FIG. 1, when the wireless terminal 10 can communicate with the base station 20d, the wireless terminal 10 can access the Internet via the base station 20d, the wireless access communication network 30b, the AR 50b, and the carrier communication network 40. It can perform packet communication with a communication device connected to the communication network 70 or another communication network 80.
[0018]
The base station 20 performs wireless communication with the wireless terminal 10 located in the wireless area covered by the own station 20. The wireless access communication network 30 relays data transmitted and received between the subordinate base station 20 and the carrier communication network 40.
[0019]
The carrier communication network 40 is operated / managed by a communication carrier and is a communication network for providing a mobile packet communication service to a user using the wireless terminal 10. In addition to the wireless access communication network 30 and the Internet 70, for example, a business communication network operated by another communication business or another communication network 80 such as an in-house LAN is connected to the business communication network 40. ing. Further, the carrier communication network 40 has an AR (Access Router) 50 and an AR management server 60.
[0020]
The AR 50 is a relay device that relays data (packets) transmitted and received by the wireless terminal 10. For example, in FIG. 1, the AR 50a has base stations 20a, 20b, and 20c under its control. Therefore, the AR 50a controls a wireless area covered by the base station 20a, a wireless area covered by the base station 20b, and a wireless area covered by the base station 20c. That is, these three wireless areas are communication areas controlled by the AR 50a, and the AR 50a relays packets transmitted and received by each wireless terminal 10 located in the communication area controlled by the AR 50a.
[0021]
In addition, the AR 50 transmits a packet transmitted from the wireless terminal 10 in the communication area under its control to the wireless terminal 10 serving as the transmission source of the packet in units of one packet. It has a function of determining whether or not the terminal has subscribed to the packet communication service and has already been authenticated by any of the ARs 50 in the carrier communication network 40. Also, the AR 50 determines that the wireless terminal 10 that is the packet transmission source has subscribed to the mobile packet communication service and is a terminal that has already been authenticated by any of the ARs 50 by this determination function. Then, the packet transmitted from the wireless terminal 10 is transferred to an appropriate destination according to the destination address and the route information added to the packet.
[0022]
In this specification, for the sake of convenience, it is assumed that the wireless terminal 10 checks whether or not the mobile packet communication service has been subscribed and whether or not the mobile terminal 10 has been authenticated. This may be performed for a user using the terminal 10. In this way, if the user subscribes to the mobile packet communication service provided by the carrier communication network 40, the user uses another wireless terminal 10 other than the wireless terminal 10 owned by the user. Also, packet communication can be performed via the carrier communication network 40.
[0023]
The AR management server 60 is a server for managing each AR 50 provided in the carrier communication network 40. In the memory of the AR management server 60, the same data can be sent to all the ARs 50 in the carrier communication network 40 in one transmission by using, for example, the IP address and the transmission address of each AR 50. A multicast address and the like are stored. The AR management server 60 and each AR 50 can transmit and receive data to and from each other.
[0024]
<2. Structure of AR>
FIG. 2 is a block diagram illustrating a hardware configuration of the AR 50.
The CPU 501 controls each unit of the device connected via the bus 506 by executing a program stored in the ROM 502 or the HD (Hard Disk) 505. Further, the CPU 501 has a function of measuring the current time. The ROM 502 stores programs and the like that control the basic control of each unit of the apparatus. The RAM 503 is used as a work area of the CPU 501. The communication interface 504 controls, for example, communication performed between the AR management server 60, another AR 50, and the wireless access communication network 30. Note that the AR 50 may further include an operation input unit, a display unit, and the like.
[0025]
The HD 505 stores an authentication information registration DB (Data Base) 505a and a counting table 505b in addition to software such as an OS. In the authentication information registration DB 505a, authentication information of the wireless terminal 10 authenticated by the AR 50 and authentication information of the wireless terminal 10 acquired from another AR 50 are registered. The authentication information registration DB 505a has, for example, a data configuration shown in FIG. 3, and as authentication information, for example, a terminal ID capable of uniquely specifying the wireless terminal 10, or a subscribed mobile packet communication service. A subscriber ID that can uniquely specify a user who is present is registered in association with a retention period indicating a period for retaining this authentication information in the authentication information registration DB 505a.
[0026]
The terminal ID may be, for example, an e-mail address used as a communication address of the wireless terminal 10, a MAC address of the PC 12, a telephone number of the mobile phone 11, or the like. The retention period of the authentication information is set to a date and time that is a predetermined time (for example, three hours or one day) ahead of the current time when the authentication information is registered in the authentication information registration DB 505a. You. If the authentication information is not used by the retention time set in this way, the authentication information is deleted from the authentication information registration DB 505a, and if the authentication information is used by the retention time, Is updated so that the retention period of the authentication information is set to a date and time earlier by a predetermined time from the current time when the authentication information is used.
[0027]
In the counting table 505b, for example, as shown in FIG. 4, a numerical value indicating the number of times is stored for each AR 50 in the carrier communication network 40. Each time the AR 50 inquires of each AR 50 in the carrier communication network 40 about the presence or absence of the authentication information of the wireless terminal 10, the AR 50 specifies the AR 50 which has returned that the authentication information is held, and corresponds to the AR 50 in the counting table 505b. The count value of AR50 is incremented (+1).
[0028]
[A-2. Operation of Embodiment]
Next, the operation of the present embodiment will be described.
In the following description of the operation, a case will be described in which a total of four ARs 50 are provided in the carrier communication network 40 (AR50a, AR50b, AR50c, AR50d), of which the AR50a is the main entity of the operation.
[0029]
The HD 505 of the AR 50a stores the IP address of the AR 50a, a common key unique to the AR 50a (hereinafter, referred to as “common key [AR50a]”), and the IP address of the AR management server 60. And In the memory of the AR management server 60, the IP address of the AR management server 60, the IP addresses of the ARs 50a to 50d, the common keys [AR50a] to the common keys [AR50d] of the ARs 50a to 50d, and the ARs 50a to 50d are stored. It is assumed that a common key [ALL] shared by 50d and a multicast address [ALL] including each AR 50a to 50d as its destination are stored.
[0030]
However, when the communication system 1 has a DNS (Domain Name System) server, the domain name of the AR management server 60 or each of the ARs 50a to 50d is used instead of the IP address of the AR management server 60 or each of the ARs 50a to 50d. Can be used.
[0031]
<1. Registration mode>
FIG. 5 is a sequence chart illustrating the operation of the AR 50a and the AR management server 60 in the registration mode. The AR 50a starts the processing shown in the figure when instructed to shift to the registration mode.
[0032]
First, the AR 50a transmits an AR-Registration Request message encrypted using the common key [AR50a] read from the HD 505 to the AR management server 60 (Step S101). Upon receiving the AR-Registration Request message, the AR management server 60 specifies from the source address of the message that the source of the message is the AR 50a. Next, the AR management server 60 reads the common key [AR50a] from the memory, decrypts the AR-Registration Request message using the common key [AR50a], and authenticates the message (step S102).
[0033]
As a result, when the AR-Registration Request message cannot be decrypted using the common key [AR50a] (Step S103: No), the AR management server 60 returns an AR-Registration Reject message to the AR 50a as an authentication failure. (Step S104). On the other hand, when the AR-Registration Request message can be decrypted using the common key [AR50a] (step S103: Yes), the AR management server 60 returns an AR-Registration Response message to the AR 50a assuming that the authentication is successful (step S103). Step S105).
[0034]
This AR-Registration Response message includes a multicast address [ALL], a common key [ALL], and an AR-ID assigned to the AR 50a. The AR-ID is identification information assigned by the AR management server 60 to identify each of the ARs 50a to 50d in the carrier communication network 40.
[0035]
Upon receiving the AR-Registration Response message, the AR 50a stores the multicast address [ALL], the common key [ALL], and the AR-ID included in the message in the HD 505 (Step S106). Thereafter, the AR 50a returns an AR-Registration Response message encrypted using the common key [ALL] to the AR management server 60 (Step S107). When receiving the AR-Registration Response message, the AR management server 60 decrypts the message using the common key [ALL], and confirms that the registration processing in the AR 50a has been completed.
[0036]
<2. Packet relay processing (learning mode)>
FIG. 6 is a sequence chart illustrating the operation of the packet relay process in the learning mode. Two types of modes, a learning mode and a normal mode, are prepared for the packet relay processing, and the operation content differs in each mode. Here, the operation of the packet relay processing in the learning mode will be described first.
[0037]
First, when the AR 50a receives a packet transmitted from the wireless terminal 10 in the communication area under its control (step S201), the AR 50a determines from the source address or the like included in this packet the wireless source that is the source of the packet. The terminal 10 is specified. Next, the AR 50a searches the authentication information registration DB 505a (Step S202), and checks whether or not the authentication information of the specified wireless terminal 10 is registered in the authentication information registration DB 505a.
[0038]
As a result, when the authentication information corresponding to the authentication information registration DB 505a has been registered (step S203: No), the AR 50a determines that the wireless terminal 10, which is the transmission source of the packet received in step S201, has the carrier communication If the terminal has subscribed to the mobile packet communication service provided by the network 40 and has already been authenticated by any of the ARs 50a to 50d in the operator communication network 40, then the authentication information registration DB 505a searches for The retention period of the target authentication information is updated so as to be a predetermined date and time ahead of the current time (step S212). Then, the AR 50a transfers the packet received in step S201 to an appropriate destination according to the destination address and the route information added to the packet (step S213), and then executes the processing shown in FIG. Finish.
[0039]
On the other hand, as a result of the search in step S202, if the authentication information corresponding to the authentication information registration DB 505a is not registered (step S203: Yes), the AR 50a first transmits the multicast address [ALL] and the common key from the HD 505. Read [ALL]. The AR 50a also obtains information (for example, a terminal ID of the wireless terminal 10 and a subscriber ID) for identifying the authentication information of the wireless terminal 10 that is about to inquire of the other ARs 50b to 50d. . Then, the AR 50a transmits an Authentication-State Request message including information for specifying the authentication information to be inquired and encrypted using the common key [ALL], using the multicast address [ALL] as the destination address ( Step S204). Since the Authentication-State Request message uses the multicast address [ALL] as the destination address, it is transmitted to each of the ARs 50a to 50d.
[0040]
When each of the ARs 50b to 50d receives the Authentication-State Request message, it first decrypts the Authentication-State Request message using the common key [ALL] read from the HD 505, and authenticates the message (step S205). As a result, when the Authentication-State Request message cannot be decrypted using the common key [ALL], each of the ARs 50b to 50d returns an Authentication-State Reject message to the AR 50a, assuming that the authentication has failed.
[0041]
On the other hand, when the Authentication-State Request message can be decrypted using the common key [ALL], each of the ARs 50b to 50d next searches the authentication information registration DB 505a (step S206), and receives an inquiry based on the decrypted message. It is checked whether the authentication information is registered in the authentication information registration DB 505a. In this way, each of the ARs 50b to 50d confirms whether or not the authentication information inquired from the AR 50a is held in the own device, and then includes information indicating whether or not the AR 50a has the authentication information. An Authentication-State Response message is returned to the AR 50a by unicast (step S207). Note that the Authentication-State Response message is also encrypted using the common key [ALL].
[0042]
Upon receiving the Authentication-State Response message from each of the ARs 50b to 50d, the AR 50a authenticates the received message using the common key [ALL] (Step S208), analyzes the contents of each message, and eventually Then, it is determined whether or not one or more ARs 50b to 50d has returned a response indicating that they have the requested authentication information (step S209).
[0043]
As a result, when the AR 50a is returned from any of the ARs 50b to 50d not having the requested authentication information (step S209: No), that is, the AR 50a becomes the transmission source of the packet received in the step S201. If the wireless terminal 10 is an unauthenticated terminal, it is further determined whether or not the wireless terminal 10 is a terminal subscribed to the mobile packet communication service provided by the carrier communication network 40. When the AR 50a determines that the wireless terminal 10 is a terminal that has subscribed to the mobile packet communication service, the AR 50a performs an authentication process for the wireless terminal 10, while the wireless terminal 10 subscribes to the mobile packet communication service. If it is determined that the terminal is not a terminal, the packet received in step S201 is discarded (step S210), and the process shown in FIG. 6 is ended.
[0044]
On the other hand, when the AR 50a is returned from any one or more of the ARs 50b to 50d that it has the queried authentication information (step S209: Yes), it first replies that it has the authentication information. The AR 50 is specified from the source address of the Authentication-State Response message and the like. Next, the AR 50a increments (+1) the number of times of the AR 50 that has returned the authentication information this time in the counting table 505b, and updates the counting table 505b (step S211). By updating the count table 505b each time the authentication information is inquired in this way, the AR 50 that frequently returns that it has the authentication information in response to the inquiry from the AR 50a is one of the ARs 50b to 50d. You can identify which one.
[0045]
Next, the AR 50a registers, in the authentication information registration DB 505a, the authentication information of the wireless terminal 10 notified of having the authentication information from the other AR 50 and the retention period thereof (step S212), and receives the information in step S201. After performing the packet transfer process (step S213), the process illustrated in FIG. 6 is completed. Note that the authentication information registered in the authentication information registration DB 505a in step S212 may be authentication information generated based on information obtained from the packet received in step S201, or a notification that authentication has been performed. Authentication information obtained from another AR 50 that has been obtained may be used.
[0046]
In step S207, each of the inquired ARs 50b to 50d returns an Authentication-State Response message to the inquiring AR 50a. However, among the inquired ARs 50b to 50d, the inquired ARs 50b to 50d are inquired. Only the AR 50 having the authentication information may return an Authentication-State Response message to the AR 50a. In this way, traffic in the carrier communication network 40 can be reduced. However, in such a configuration, after transmitting the Authentication-State Request message in step S204, the AR 50a starts time counting, and even if a predetermined time has elapsed, any of the ARs 50b. If the Authentication-State Response message is not returned from 〜50d, it is determined that the wireless terminal 10 that is the transmission source of the packet received in step S201 is an unauthenticated terminal.
[0047]
<3. Processing for Determining AR50 to Be Inquired>
FIG. 7 is a sequence chart illustrating an operation of a process involved in determining the AR 50 to be an inquiry destination. The AR 50a starts the processing shown in FIG. 4 when determining one or more ARs 50 to inquire of the presence or absence of authentication information from among the ARs 50b to 50d.
[0048]
First, the AR 50a refers to the counting table 505b shown in FIG. 4, and among the ARs 50b to 50d, the number of times that the AR 50a has returned authentication information in response to an inquiry from the AR 50a is, for example, 5 or more. The AR 50 is determined as the AR 50 for inquiring about the presence or absence of the authentication information (step S301). Note that the value of 5 times used as the threshold value is merely an example, and can be set to an arbitrary value. Instead of using a threshold value, among the number of times of each of the ARs 50b to 50d, the top two AR50s having a relatively large number of times may be determined as the AR50 for inquiring about the presence or absence of the authentication information.
[0049]
By the way, the AR 50 that frequently returns that it has the authentication information in response to the inquiry from the AR 50a may be the AR 50 that controls the communication area adjacent to the communication area controlled by the AR 50a. Is high. In other words, the AR 50 that frequently returns that it has the authentication information in response to the inquiry from the AR 50a is the base station 20 whose wireless area is adjacent to the base stations 20a to 20c belonging to the AR 50a. Is likely to be AR50 having
[0050]
For example, in FIG. 1, the wireless area of the base station 20c under the AR 50a and the wireless area of the base station 20d under the AR 50b are adjacent to each other. The wireless terminal 10 often moves from the wireless area of the base station 20d to the wireless area of the base station 20c, or conversely, moves from the wireless area of the base station 20c to the wireless area of the base station 20d. Occur.
[0051]
However, for example, when the user carrying the wireless terminal 10 travels a relatively large distance in a short time using a subway where radio waves from each of the base stations 20a to 20f do not reach, Is temporarily turned off, the user moves a relatively large distance in a short period of time using a car or the like, and turns on the wireless terminal 10 at the destination. May be returned.
[0052]
Further, when the user carrying the wireless terminal 10 is traveling by car, the AR 50 that controls the vicinity of the tunnel entrance as a communication area and the AR 50 that controls the vicinity of the tunnel exit as a communication area. The communication area is not always adjacent to the existing AR 50. Further, the AR 50 that returns that it has the authentication information in response to the inquiry from the AR 50a transmits the communication area where the wireless terminal 10 that has moved to the communication area under the jurisdiction of the AR 50a has been located immediately before. There may be a case where the AR 50 has jurisdiction over not only the AR 50 that has jurisdiction but also another communication area that has been located before that. As described above, even if the AR 50 frequently returns that it has authentication information in response to an inquiry, the communication areas are not necessarily adjacent.
[0053]
When the AR 50a determines one or more ARs 50 for inquiring about the presence or absence of the authentication information in the above step S301, the AR 50a then uses the multicast address [ Neighbor / AR 50a] is registered (step S302).
[0054]
For example, when the AR 50b and the AR 50c are determined as the AR 50 of the inquiry destination in the above-described step S301, the AR 50a includes the AR 50b and the AR 50c as destinations, that is, the multicast group [Neighbor / AR 50a ] Can be created. Note that each AR 50 can have only one such multicast address [Neighbor / AR50X] (X = a, b, c, d), and the multicast address [Neighbor / AR50X] of another AR 50. In order to distinguish the multicast address [Neighbor / AR50X], the multicast address [Neighbor / AR50X] is created using the AR-ID.
[0055]
Of course, in step S302, the AR 50a needs to perform not only the process of registering the multicast address [Neighbor / AR 50a], but also the process of joining the multicast group in the AR 50 that is the inquiry destination. Therefore, the AR 50a transmits a MC-Registration Request message including the multicast address [Neighbor / AR 50a] by unicast to each AR 50 determined as the inquiry destination in the above step S301 (step S303). The MC-Registration Request message is encrypted using the common key [ALL]. Further, the sequence chart illustrated in FIG. 7 illustrates a case where the AR 50b and the AR 50c are determined as the AR 50 of the inquiry destination.
[0056]
Upon receiving the MC-Registration Request message from the AR 50a, the ARs 50b and 50c authenticate the message using the common key [ALL] (step S304), and then return an Ack to the MC-Registration Request message to the AR 50a. (Step S305). Next, as in the case of the AR 50a, the ARs 50b and 50c refer to the counting table 505b to perform processing for registering the multicast address [Neighbor / AR50X] for the own device (step S306). If the multicast address [Neighbor / AR50X] for the own device has already been created, it is checked whether or not AR50a is included in the multicast group. If AR50a is not included, the multicast group is identified. The multicast address [Neighbor / AR50X] may be updated to include the AR 50a.
[0057]
Thereafter, the ARs 50b and 50c unicast the MC-Registration Request message including the multicast address [Neighbor / AR50X] for the own device to the AR 50a (step S307). Further, the ARs 50b and 50c perform a process for joining the multicast group [Neighbor / AR50a] registered by the AR 50a to the multicast group (Step S308).
[0058]
On the other hand, upon receiving the MC-Registration Request message from the ARs 50b and 50c in step S307, the AR 50a authenticates the message using the common key [ALL] (step S309), and then transmits the message to the ARs 50b and 50c. Ack is returned (step S310). Then, the AR 50a performs a process for joining the multicast address [Neighbor / AR 50b] registered by the AR 50b to the multicast group, and also joins the multicast address [Neighbor / AR 50c] registered by the AR 50c to the multicast group. A process is performed (step S311).
[0059]
The multicast address used here is, for example, “239.0.0.0” to “239.255.255.255” for IPv4, and Site Local Scope or Organization Local Scope for IPv6. For example, an IP address in a range not used in a normal case is used.
[0060]
<4. Packet relay processing (normal mode)>
8 and 9 are sequence charts illustrating the operation of the packet relay processing in the normal mode. The AR 50a is designated to operate in the normal mode instead of the learning mode, and receives a packet sent from the wireless terminal 10 in the communication area under its control, and The indicated process is started. In the following description of the operation, steps for performing the same processes as those in the sequence chart shown in FIG. 6 are simplified.
[0061]
First, upon receiving a packet transmitted from the wireless terminal 10 (step S401), the AR 50a specifies the wireless terminal 10 that is the transmission source of the packet. Next, the AR 50a searches the authentication information registration DB 505a (Step S402), and checks whether the authentication information of the specified wireless terminal 10 is registered in the authentication information registration DB 505a.
[0062]
As a result, if the authentication information corresponding to the authentication information registration DB 505a has been registered (step S403: No), the AR 50a has subscribed to the mobile packet communication service and has already been authenticated. If the terminal is a terminal, the authentication information registration DB 505a updates the retention period of the searched authentication information (step S417), and performs the transfer processing of the packet received in step S401 (step S418). 8 and 9 are finished.
[0063]
On the other hand, if the authentication information corresponding to the authentication information registration DB 505a is not registered as a result of the search in step S402 (step S403: Yes), the AR 50a includes information for specifying the authentication information to be inquired, and An Authentication-State Request message encrypted using the key [ALL] is transmitted using the multicast address [Neighbor / AR50a] as a destination address (step S404).
[0064]
Since the Authentication-State Request message uses the multicast address [Neighbor / AR50a] as the transmission destination address, it is transmitted only to each AR 50 participating in the multicast group of the multicast address [Neighbor / AR50a]. . Note that the sequence chart shown in FIG. 8 exemplifies a case where AR50b and AR50c participate in the multicast group for the multicast address [Neighbor / AR50a]. That is, the Authentication-State Request message transmitted from AR 50a in step S404 is transmitted to AR 50b and AR 50c. In step S404, an inquiry is made using the multicast address [Neighbor / AR50a]. However, an Authentication-State Request message is transmitted by unicast to each AR 50 to be inquired. Is also good.
[0065]
When each of the ARs 50b and 50c receives the Authentication-State Request message, it authenticates the message using the common key [ALL] (step S405), and searches the authentication information registration DB 505a (step S406). It is checked whether the authentication information inquired by the user is registered in the authentication information registration DB 505a.
[0066]
In this way, each of the ARs 50b and 50c confirms whether or not the authentication information inquired from the AR 50a is held in the own device 50b or 50c, and then indicates whether the AR 50b or 50c has the authentication information. And returns an Authentication-State Response message encrypted using the common key [ALL] to the AR 50a by unicast (step S407). Of course, of the ARs 50b and 50c that have received the inquiry, only the AR 50 having the authentication information may return an Authentication-State Response message to the AR 50a.
[0067]
Upon receiving the Authentication-State Response message from each of the ARs 50b and 50c, the AR 50a authenticates each of the received messages using the common key [ALL] (Step S408), analyzes the contents of each message, and analyzes the contents of the AR 50b or AR 50b. It is determined whether or not the AR 50c has returned a message indicating that the AR 50c has the requested authentication information (step S409). As a result, when the AR 50a is returned from one or more of the ARs 50 as having the inquired authentication information (step S409: No), that is, the wireless terminal 10 has already been authenticated by another AR 50. If the terminal is a terminal that has been authenticated, the authentication information of the wireless terminal 10 and its retention period are registered in the authentication information registration DB 505a (step S417), and after the packet received in step S401 is transferred (step S418). 8 and 9 are finished.
[0068]
On the other hand, if the AR 50a returns a response indicating that the AR 50a does not have the requested authentication information from both ARs 50b and 50c (step S409: Yes), the AR 50a then uses the multicast group [ALL] to transmit the carrier communication network. A process is performed to inquire of all ARs 50a to 50d in 40 whether or not authentication information exists.
[0069]
Here, the processing of steps S410 to S418 is substantially the same as the processing of steps S204 to S213 in the sequence chart shown in FIG. 6, and therefore the description of the operation is omitted. Note that the process shown in FIGS. 8 and 9 is different from the process shown in FIG. 6 in that the process shown in FIG. 6 performs a process for updating count table 505b (step S211). 8) and FIG. 9 are the only points that do not perform such processing.
[0070]
In step S410, all ARs 50a to 50c in the carrier communication network 40 are inquired about the presence or absence of the authentication information. In this manner, all ARs 50a to 50c are inquired. Instead, the inquiry may be made only to the remaining ARs 50, excluding the AR 50 for which the inquiry was made using the multicast address [Neighbor / AR 50a]. Of course, only the inquiry using the multicast address [Neighbor / AR50a] may be performed.
[0071]
As described above, according to the present embodiment, among the plurality of ARs 50 provided in the carrier communication network 40, the wireless terminal 10 that moves to the communication area controlled by the own device 50 is located in the AR 50. The AR 50 that controls another communication area that is likely to have been identified is specified, and the AR 50 is used as the inquiry destination. When receiving the packet transmitted from the wireless terminal 10 within the communication area controlled by the own device 50, the AR 50 specifies the wireless terminal 10 that is the transmission source of the packet, and the authentication information of the wireless terminal 10 becomes If the authentication information is not stored in the device 50, the AR 50 of the inquiry destination specified in advance is inquired about the presence or absence of the authentication information of the wireless terminal 10, and it is notified from the inquired AR 50 that the authentication information is held. In this case, the packet transmitted from the wireless terminal 10 is transferred to the destination of the packet.
[0072]
Therefore, even when the wireless terminal 10 performs communication via a different AR 50 as the mobile terminal 10 moves, the AR 50 does not temporarily interrupt the communication performed by the wireless terminal 10 to perform the authentication process. Therefore, it is possible to provide a suitable communication environment for the wireless terminal 10 without impairing the usability of the wireless terminal 10.
[0073]
Also, when compared with the technology described in Patent Document 1, inquiries do not concentrate on one AR 50 in the carrier communication network 40, and each AR 50 is transmitted to another AR 50. There is no need to analyze the contents of the message asking for the presence or absence of authentication information. Therefore, communication efficiency in the carrier communication network 40 can be improved.
[0074]
Note that, in the present embodiment, the AR 50 (computer) executes the processing shown in FIGS. 5 to 9 according to a program stored in the ROM 502 or the HD 505. The program may be provided to the AR 50 by communication. Alternatively, such a program may be recorded on a recording medium and provided to the AR 50.
[0075]
[B. Modification]
As described above, the embodiments of the present invention have been described, but the present invention can be embodied in various other forms without departing from the main features. The embodiment described above is merely an example of one aspect of the present invention, and for example, the following modified examples can be considered.
[0076]
<Modification 1>
In the packet relay processing in the normal mode (see FIG. 8 and FIG. 9), the frequency at which the one or more ARs 50 specified in the learning mode are returned in response to the inquiry that the authentication information is held in response to the inquiry is determined. The AR 50 measured for each AR 50 and having a reduced frequency may be excluded from the inquiry destination of the authentication information. However, in this case, it is necessary to perform processing for changing the multicast address [Neighbor / AR50X] in the AR 50 of the inquiry source and the AR 50 excluded from the inquiry destination.
[0077]
Further, in the packet relay processing in the normal mode, for example, the number of times that one or more ARs 50 specified in the learning mode are returned that the authentication information is held within a certain period of time is five or more times. The AR50 of group 1 is divided into group 2, the AR50 of 2 times or more and less than 5 times is classified into group 2, and the AR50 of 1 time or less is classified into group 3, and 3 days for group 1, 2 days for group 2, and 1 for group 3. A period is set for each group, such as days, for the AR 50. If the AR 50 does not notify that the authentication information is held even after the set period, the AR 50 is sent from the inquiry about the authentication information. It may be excluded. In this case, for example, for the AR 50 belonging to the group 1 and for which a period of three days is set, if there is a notification that the authentication information is held within the period, the AR 50 for three days from that point is received. The period is set again.
[0078]
<Modification 2>
For example, the AR management server 50 notifies the AR 50a of information on the ARs 50 whose adjacent communication areas are adjacent to each other, and the AR 50a determines the AR 50 that inquires of the presence or absence of authentication information according to the information notified from the AR management server 50. Is also good.
[0079]
<Modification 3>
When the AR 50 is notified that it has the authentication information from another AR 50, the AR 50 transmits the authentication information of the wireless terminal 10 to the AR 50 that has notified that the AR 50 has the authentication information, in the authentication information registration DB 505a. , A message instructing deletion of the authentication information may be transmitted, and the authentication information may be deleted from the authentication information registration DB 505a. By doing so, it is possible to eliminate the situation where a plurality of ARs 50 hold the authentication information of the same wireless terminal 10, and thus it is possible to effectively use the memory resources in each AR 50.
[0080]
<Modification 4>
When the AR 50 or the AR management server 60 transmits / receives a message, it is not always necessary to perform processing related to encryption or decryption using the common key [ALL], the common key [AR50], or the like. When the AR 50 or the AR management server 60 transmits / receives a message, a hash function such as MD5 may be used. Furthermore, for distribution of the common key [ALL] and the multicast address [ALL] to each AR 50, a public key system or a key exchange protocol may be used. Alternatively, each AR 50 may be authenticated using an electronic signature by CA (Certificate Authority) and registered in the AR management server 60.
[0081]
The AR management server 60 can update the common key [ALL] and the multicast address [ALL] in order to enhance security in the carrier communication network 40. For example, when the AR management server 60 updates the common key [ALL], the updated common key [ALL] is transmitted from the AR management server 60 to each AR 50. Further, each AR 50 stores both the common key [ALL] before the update and the common key [ALL] after the update in the HD 505, so that even before and after the common key [ALL] is updated. Communication with other ARs 50 can be performed without any trouble.
[0082]
<Modification 5>
The AR 50 may be provided in the wireless access communication network 30 instead of the carrier communication network 40. Further, a communication protocol for transmitting and receiving data to and from the wireless terminal 10 may be, for example, mobile IPv4 or mobile IPv6 defined in RFC2002 of the IETF (Internet Engineering Task Force). Of course, the wireless terminal 10 (mobile station) may be a PC 12 on which a wireless LAN card is mounted, a PDA having a wireless communication function, or the like.
[0083]
【The invention's effect】
As described above, according to the present invention, even when a mobile station communicates via a different relay device (router) as it moves, the usability of the mobile station is not impaired and the mobile communication network Data transmitted from the mobile station can be efficiently relayed.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a configuration of a communication system according to an embodiment of the present invention.
FIG. 2 is a block diagram illustrating a hardware configuration of the AR according to the embodiment;
FIG. 3 is a diagram illustrating a data configuration of an authentication information registration DB according to the embodiment;
FIG. 4 is a diagram illustrating a data configuration of a counting table according to the embodiment;
FIG. 5 is a sequence chart illustrating an operation of the AR and the AR management server in a registration mode according to the embodiment.
FIG. 6 is a sequence chart illustrating an operation of a packet relay process in a learning mode according to the embodiment;
FIG. 7 is a sequence chart exemplifying an operation of processing involved in determining an AR to be inquired according to the embodiment;
FIG. 8 is a sequence chart (part 1) illustrating an operation of a packet relay process in a normal mode according to the embodiment;
FIG. 9 is a sequence chart (part 2) illustrating an operation of a packet relay process in a normal mode according to the embodiment;
FIG. 10 is a block diagram illustrating the configuration of a mobile communication network.
[Explanation of symbols]
10 wireless terminal, 11 mobile phone, 12 PC, 20a to 20f base station, 30a, 30b wireless access communication network, 40 carrier communication network, 50a to 50d AR 60: AR management server, 501: CPU, 505: HD, 505a: Authentication information registration DB, 505b: Count table.

Claims (11)

Relay of any one of the plurality of relay devices constituting a mobile communication network for transferring data transmitted from a mobile station in a communication area controlled by the relay device to a communication partner via the relay device A first device that specifies a relay device that controls another communication area in which a mobile station moving to a communication area controlled by the own device is likely to be located among the plurality of relay devices; Process and
A second process in which the one relay device receives data transmitted from a mobile station in a communication area controlled by the relay device;
The one relay device specifies a mobile station that is a source of data received in the second process, and stores information indicating that the mobile station has been authenticated in the mobile communication network in its own device. A third step of determining whether or not it is held;
A fourth step of inquiring the relay apparatus identified in the first step about the presence or absence of the information, when the one relay apparatus determines that the information is not held in the third step; When,
When the one relay device is notified that the information is held by the relay device that has made the inquiry in the fourth process, the data received in the second process is And a fifth step of transferring to a destination. A step performed between the fourth step and the fifth step or after the fifth step,
When the one relay device is notified that the information is held by the relay device that has made the inquiry in the fourth process, while holding the information in its own device, A sixth process of instructing the relay device that has notified that the information is held to delete the information,
7. The communication according to claim 1, further comprising: a seventh step in which the relay apparatus instructed to delete the information from the one relay apparatus deletes the information held in the relay apparatus. Control method. Relay of any one of the plurality of relay devices constituting a mobile communication network for transferring data transmitted from a mobile station in a communication area controlled by the relay device to a communication partner via the relay device In the device,
A plurality of relay devices constituting the mobile communication network are controlled by a relay device which controls another communication area in which a mobile station moving to a communication area controlled by the one relay device is likely to have been located. Specifying means for specifying from among the relay devices;
Receiving means for receiving data transmitted from a mobile station in a communication area controlled by the one relay device;
Identify the mobile station that is the source of the data received by the receiving means, and determine whether the one relay device holds information indicating that the mobile station has been authenticated in the mobile communication network. Determining means for determining;
When it is determined that the information is not held by the determining unit, a transmitting unit that transmits a message inquiring about the presence or absence of the information to the relay device specified by the specifying unit,
And a transfer unit for transferring the data received by the receiving unit to a destination of the data when notified that the information is held from the relay device that has made an inquiry using the message. Characteristic relay device. The identification unit is configured to identify a relay device that controls a communication area adjacent to a communication area controlled by the one relay device from among a plurality of relay devices configuring the mobile communication network. 4. The relay device according to claim 3, wherein: The specifying means includes:
When it is determined that the information is not stored by the determination unit, each relay device configuring the mobile communication network is inquired about the presence / absence of the information, and a notification that the information is stored is provided for each inquiry. Counting means for counting the number of times that the relay apparatus has been notified and that the relay apparatus has been notified that the information is held for each of the relay apparatuses,
4. The relay device according to claim 3, further comprising: a determination unit that determines, among the relay devices, a relay device having a large number of times counted by the counting unit, as a relay device that inquires about the presence / absence of the information. The said determination means determines the relay device of which the number of times counted by the counting device exceeds a predetermined threshold among the relay devices, as the relay device for inquiring about the presence or absence of the information. Item 6. The relay device according to Item 5. The transmitting means transmits a message inquiring about the presence or absence of the information to the relay device specified by the specifying means when the determining means determines that the information is not held, and inquires using the message. 4. The method according to claim 3, wherein the message is transmitted to each of the relay devices constituting the mobile communication network, when the relay device that has performed the notification does not notify that the information is held. Relay device. Identify the relay device that has notified that the information is held for each inquiry using the message, and among the relay devices specified by the specifying unit, hold the information for a predetermined period. 4. The relay device according to claim 3, further comprising: a unit that excludes a relay device that has not been notified that the information has been sent from the relay device that inquires about the presence or absence of the information. 4. The relay device according to claim 3, wherein the information indicates that a user using the mobile station has been authenticated in the mobile communication network. Any one of a plurality of computers constituting a mobile communication network for transferring data transmitted from a mobile station in a communication area controlled by the computer to a communication partner via the computer,
The computer that controls the other communication area where the mobile station moving to the communication area controlled by the one computer is likely to be located is a computer of the plurality of computers configuring the mobile communication network. A first process of identifying from within,
A second step of receiving data transmitted from a mobile station in a communication area controlled by the one computer;
Specifying a mobile station that is a transmission source of the data received in the second step, and determining whether the one computer holds information indicating that the mobile station has been authenticated in the mobile communication network; A third step of determining whether
A fourth step of transmitting, to the computer specified in the first step, a message inquiring about the presence or absence of the information when it is determined that the information is not held in the third step;
A fifth step of transferring the data received in the second step to a destination of the data when it is notified that the information is held from the computer that has made the inquiry using the message; The program to execute. A computer-readable recording medium on which the program according to claim 10 is recorded.

Images