JP2011182033A - Call control system for network - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To attain secure communication at all times, even for messages or data which are transmitted from a user terminal for which no means for secure communication are taken. <P>SOLUTION: A security determining section 51 determines whether a means for attaining secure communication of application data is taken on a user terminal side UA#1, on the basis of a call connection request received from the user terminal UA#1. A speed comparing section 52 compares the search speed of an opposite terminal designated in the call connection request for an overlay network NWa and a core network NWc. A message route select section 53 selects the core network as the route of a call control message, if the means for secure communication is not taken, and will select any one having a searching speed from the overlay network and the core network, if the means is taken. The call-control message and the application data are transferred via the selected network. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a network call control system, and in particular, in a network configuration including an insecure access network and a secure core network, secure and high-speed communication can be performed even when secure communication is not conscious on the user terminal side. The present invention relates to a call control system that makes possible.

  In mobile networks using small base stations such as femtocells, multiple call control systems such as IMS (IP Multimedia Subsystem) in a secure core network and access networks in which multiple femtocells form a non-secure overlay network Exists.

  In the standard connection form of the femtocell, SIP (Session Initiation Protocol) based IMS is used for searching for a partner terminal in data communication (for example, VoIP) between user terminals. In IMS, all call control messages placed in the core network must pass through the core network, and there is a concern that the load on the core network will increase. To solve this, an overlay is constructed between femtocells using P2P-based SIP (P2P-SIP), and when it is estimated that the search for the partner terminal will be completed within a certain time, the overlay is used. Non-Patent Document 1 discloses a technology that uses IMS when the number exceeds the limit.

Sugano et al., "Core-overlay-linked session control method to realize minimum core", IEICE General Conference 2009, B-6-101, 2009.

  However, in the above-described conventional technology, even if a message or data is transmitted from a user terminal that does not have any means for realizing secure communication, the route is optimized without being aware of secure communication. Therefore, there has been a technical problem that communication of unencrypted data is performed through a non-secure route.

  The object of the present invention is to solve the above-mentioned problems of the prior art, and a call control system capable of always realizing secure communication even with a message or data transmitted from a user terminal that does not have any means for realizing secure communication. Is to provide.

  In order to achieve the above object, the present invention is configured such that a non-secure access network in which a plurality of femtocells construct an overlay network and a secure core network are connected by a secure tunnel for communication and are accommodated in each femtocell. The network call control system for establishing a communication path between user terminals via an overlay network or a core network is characterized in that the following measures are taken.

  (1) Each femtocell, based on a call connection request received from a user terminal, secure determination means for determining whether a means for realizing secure communication of application data is taken on the user terminal side, and call connection Selects the core network if no means for secure communication is provided as the path for the call control message and the speed comparison means for comparing the search speed of the partner terminal specified in the request for the overlay network and the core network. If there is no means for secure communication as a message path selection means for selecting the network having the fast search speed among the overlay network and the core network if it is taken and a path for the application data, the core Select the network and be taken A data path selection means for selecting an overlay network, equipped with a means for transferring the call control messages and application data via the selected network.

  (2) The secure determination means determines that the means for realizing the secure communication is taken on the user terminal side if an encryption key is described in the call connection request received from the user terminal. .

  (3) It further comprises registration means for registering the user terminal in both the overlay network and the core network based on the registration request received from the user terminal.

According to the present invention, the following effects are achieved.
(1) If secure communication is implemented on the user terminal side, a faster route is preferentially selected, and if not, secure route is selected. Route optimization is possible.
(2) Since it is determined based on the call control message transmitted from the user terminal side whether or not a means for realizing secure communication is taken on the user terminal side, a special function addition or modification to the user terminal is performed. Etc. become unnecessary.
(3) Since the location registration of the user terminal is performed for both the secure core network and the non-secure overlay network, communication is possible regardless of which route is selected through which network.

It is the block diagram which showed the structure of the network to which this invention is applied. It is the flowchart which showed operation | movement of one Embodiment of this invention. 3 is a sequence flowchart (part 1) illustrating an operation of the embodiment of case 1. 6 is a sequence flowchart (part 2) illustrating an operation of the embodiment of case 1. 7 is a sequence flowchart illustrating an operation of an embodiment of case 2. 6 is a sequence flowchart illustrating an operation of an embodiment of case 3. It is the figure which expressed typically the selection method of a network. It is the functional block diagram which showed the structure of the femtocell.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a network to which the present invention is applied.

  The access network NWa is composed of a plurality of femtocells, and the femtocells and overlay emulators construct an overlay network based on Chord-based P2P-SIP. Hereinafter, the access network NWa may be expressed as an overlay network NWa.

  The core network NWc accommodates an authentication server 21, a security gateway (GW) 22 and an IMS 23, and each femtocell # 1, # 2,... Of the overlay network NWa is based on IKEv2 between the security network GW22 of the core network NWc. A secure IPSec tunnel 31 is established to communicate with the IMS 23.

  The authentication server 21 performs user authentication using the RADIUS protocol with the security GW 22 as a RADIUS client. The IMS 23 is a group of SIP servers that are arranged in the core network NWc and manage users. P-CSCF (Proxy Call Session Control Function), S-CSCF (Serving Call Session Control Function), and I-CSCF (S-CSCF) function as SIP servers. Interrogating Call Session Control Function) and user information database HSS (Home Subscribe Server). The security GW 22 establishes an IPSec tunnel 31 based on the IKEv2 procedure with each femtocell # 1, # 2,..., Performs user authentication processing, and assigns an IP address assigned to each user terminal UA (User Agent) to each femtocell. Notify

  Each femtocell accommodates the user terminal UA and performs authentication processing of the user terminal UA in cooperation with the security GW 22 and the authentication server 21. Also, in PPP, a DNS address and an IP address are assigned to each user terminal UA. Here, an authentication procedure based on IKEv2 is used between the femtocell and the security GW 22. The RADIUS protocol is used between the security GW 22 and the authentication server 21.

  Each femtocell also operates as a SIP proxy and appropriately forwards various SIP messages received from the user terminal UA. The SIP REGISTER received from each user terminal UA is transferred to the IMS 23 in the overlay network NWa and the core network NWc to request location registration. Each femtocell, when transferring SIP REGISTER / SIP INVITE (and a transaction associated therewith) to the overlay network NWa, adds a Via header as its own local IP address and transfers it. When transferring to the IMS 23 of the core network NWc, the inside IP address of IPSec is added to the Via header and transferred.

  For SIP INVITE received from the user terminal UA, as will be described in detail later, a network with a high search speed is identified by comparing the case of searching for the partner terminal with the overlay network NMa and the case of searching with the IMS 23 of the core network NMc. At the same time, it is determined whether or not means for realizing secure communication of application data is taken on the user terminal UA side, and a transfer path is determined based on the comparison result and the determination result. In this embodiment, if the encryption key information is described in the SIP INVITE, it is determined that the means for realizing the secure communication is taken on the user terminal UA side.

  The user terminal UA is an IMS client that sends and receives VoIP (Voice over IP) voice data and video data based on SIP, performs authentication processing in the PPP procedure, and also performs IP address and DNS. Get the address. Further, in order to directly transmit and receive application data between femtocells, the SIP INVITE and the 200 OK SDP field are converted into a format communicable within the access network NWa. Furthermore, the user terminal UA performs SRTP encryption between the user terminals UA in order to ensure the safety of the application data. However, if encryption is not performed, key information is not included in the INVITE so that the femtocell always selects IMS.

  Next, the operation of the present embodiment will be described in detail with reference to the flowchart of FIG. 2 and the sequence flows of FIGS. The flowchart of FIG. 2 mainly shows the operation of the femtocell # 1 that accommodates the user terminal UA # 1 on the transmission side.

  First, referring to the flowchart of FIG. 2 and the sequence flows of FIGS. 3 and 4, when user terminal UA # 1 is activated at time t1, in step S1, user terminal UA # 1 and femtocell # 1 at time t2. A wireless link is established between In step S2, LCP / CHAP processing is executed at time t3 to authenticate user terminal UA # 1. In step S3, an IPSec tunnel 31 based on IKEv2 is established between the femtocell # 1 and the security GW22.

  In the present embodiment, IKE_SA parameter negotiation is performed between the femtocell # 1 and the security GW 22 at time t4. At time t5, an IKE_AUTH request (MOBIKE) is transmitted from the femtocell # 1 to the security GW 22. At time t6, the security GW 22 returns an IKE_AUTH response (authentication challenge). At time t7, an IKE_AUTH request (authentication information) is transmitted from the femtocell # 1 to the security GW 22.

  In response to this IKE_AUTH request, the security GW 22 performs RADIUS authentication with the authentication server 21 at time t8, and returns an IKE_AUTH response (authentication response) to the femtocell # 1 at time t9. At time t10, an IKE_AUTH request (mutual authentication) is transmitted from the femtocell # 1 to the security GW 22. At time t11, when an IKE_AUTH response (mutual authentication, IP # A) is returned from the security GW 22, an IPSec tunnel 31 is established between the femtocell # 1 and the security GW 22.

  In step S4, IPCP processing is executed between user terminal UA # 1 and femtocell # 1 at time t12, and a global IP address (IP # A) is assigned to user terminal UA # 1. In step S5, appropriate processing such as STUN processing is executed to notify the user terminal UA # 1 of the local IP address and port number (IP # 1 and Port # 1) of the femtocell # 1.

  In step S6, user terminal UA # 1 transmits SIP REGISTER (location registration) in which its own SIP URI and contact address (global IP address: IP # A) are described to femtocell # 1 at time t14, which The data is transferred to the IMS 23 via the IPSec tunnel 31 and the security GW 22. The 200 OK returned from the IMS 23 is also returned to the femtocell # 1 via the security GW 22 and the IPSec tunnel 31. In step S7, the SIP REGISTER is transmitted from the femtocell # 1 to the overlay network NWa at time t15, and 200 OK returned from the overlay network NWa is returned from the femtocell # 1 to the user terminal UA # 1. Thus, in this embodiment, the location registration of the user terminal UA # 1 by the femtocell # 1 is performed for both the core network MWc (IMS23) and the overlay network NWa.

  Thereafter, when another user terminal UA # 2 is activated at time t16, in step S8, a radio link is established between the user terminal UA # 2 and the femtocell # 2 in the same procedure as described above at time t17. Then, the authentication process of the user terminal UA # 2 is executed, the IPSec tunnel 31 is established between the femtocell # 2 and the security GW 22, and the location registration of the user terminal UA # 2 is performed in the core network MWc (IMS23) and the overlay. It is performed for both network NWa.

  Referring to FIG. 4, when user terminal UA # 2 is transmitted from user terminal UA # 1 at time t18, SIP INVITE is transmitted from user terminal UA # 1 to femtocell # 1 at time t19. In this SIP INVITE, the user terminal UA # 2 is described as the destination, the local IP address IP # 1 and port number Port # 1 of the femtocell # 1 and the encryption key are described in the SDP field, and the user is further specified as the contact address. Global IP address IP # A of terminal UA # 1 is described. In Femtocell # 1, when this SIP INVITE is received in step S9, the process proceeds to step S10. At time t20, application data transmitted / received in a session established with the SIP INVITE as an opportunity is transmitted to the overlay network. It is determined whether to transfer to the user terminal UA # 2 via the NWa or the core network NWc.

  In the present embodiment, the following two parameters are referred to as parameters for determining the transfer path. First, it is determined whether or not means for realizing secure communication of application data is taken on the user terminal UA # 1 side. In the present embodiment, if an encryption key is described in the SIP INVITE received from the user terminal UA # 1, it is determined that a means for realizing secure communication is taken. Secondly, the speed (delay time) and the number of sessions between the case of requesting detection of the counterpart terminal (here, user terminal UA # 2) to the overlay network NWa and the case of requesting to the core network (IMS23) are estimated. .

  Then, as shown in FIG. 7, if the means for realizing secure communication of application data is taken on the user terminal UA # 1, the detection speed of the partner terminal is further compared, and the detection on the core network NWc is performed. If the speed is superior, the core network NWc having a high detection speed is selected as a transfer path for various call control messages including SIP INVITE, and the overlay network NWa is selected for application data (case 1).

  If the detection speed in the overlay network NWa is superior, the overlay network NWa having the fast detection speed is selected as the call control message transfer path, and the overlay network NWa is also selected for the application data (case 2).

  On the other hand, if the means for realizing secure communication of application data is not taken at the user terminal UA # 1, the core network NWc is selected as the transfer path for the call control message, and the core network is similarly applied to the application data. NWc is selected (Case 3).

[Case 1]
If the case 1 is determined, the process proceeds to step S11, and at time t21 in FIG. 4, the SIP INVITE is transferred to the IMS 23 of the overlay network NWa via the IPSec tunnel 31 and the security GW 22, and further from the IMS 23 to the security GW 22 And forwarded to the user terminal UA # 2 via the IPSec tunnel and the femtocell # 2. At time t22, 180 Ringing transmitted from the user terminal UA # 2 in response to the SIP INVITE is transferred to the IMS 23 via the femtocell # 2, the IPSec tunnel 31, and the security GW 22, and further from the IMS 23 to the security GW 22 Then, the packet is transferred to the user terminal UA # 1 via the IPSec tunnel 31 and the femtocell # 1.

  At time t23, 200 OK transmitted from the user terminal UA # 2 is transferred to the IMS 23 via the femtocell # 2, the IPSec tunnel 31 and the security GW 22, and further from the IMS 23 to the security GW 22, the IPSec tunnel 31 and the femto cell. Transferred to user terminal UA # 1 via # 1. In this 200 OK, the local IP address (IP # 2) and port number (Port # 2) of femtocell # 2 and the encryption key are described in the SDP field, and the global IP address of user terminal UA # 2 is further used as the contact address. (IP # B) is described.

  At time t24, the ACK transmitted from the user terminal UA # 1 in response to the 200 OK is transferred to the IMS 23 via the femtocell # 1, the IPSec tunnel 31, and the security GW 22, and further from the IMS 23 to the security GW 22, The data is transferred to the user terminal UA # 2 via the IPSec tunnel 31 and the femtocell # 2.

  When the route via the overlay network NWa is established between the user terminals UA # 1 and UA # 2 as described above, application data such as audio data and image data is encrypted with the encryption key at time t25 in step S12. And is securely transmitted and received through the route of user terminal UA # 1, femtocell # 1, overlay network NWa, femtocell # 2 and user terminal UA # 2.

[Case 2]
On the other hand, if it is determined as case 2 in step S10 (t20), the process proceeds to step S13, and as shown in FIG. 5, the SIP INVITE is transferred from the femtocell # 1 to the overlay network NWa at time t31. Further, the data is transferred from the overlay network NWa to the user terminal UA # 2 via the femtocell # 2. At time t32, 180 Ringing transmitted from the user terminal UA # 2 in response to the SIP INVITE is transferred to the overlay network NWa via the femtocell # 2, and further from the overlay network NWa to the femtocell # 1. To user terminal UA # 1.

  At time t33, 200 OK transmitted from the user terminal UA # 2 is transferred to the overlay network NWa via the femtocell # 2, and further from the overlay network NWa to the user terminal UA # 1 via the femtocell # 1. Transferred. In this 200 OK, the local IP address and port number of femtocell # 2 and the encryption key are described in the SDP field, and the global IP address (IP # B) of user terminal UA # 2 is described as the contact address. Yes.

  At time t34, the ACK transmitted from the user terminal UA # 1 in response to the 200 OK is transferred to the overlay network NWa through the femtocell # 1, and further from the overlay network NWa through the femtocell # 2. To user terminal UA # 2.

  When the route via the overlay network is established between the user terminals UA # 1 and UA # 2 as described above, in step S14, application data such as audio data and image data is encrypted with the encryption key at time t35. Thus, transmission / reception is securely performed via the route of the user terminal UA # 1, the femtocell # 1, the overlay network NWa, the femtocell # 2, and the user terminal UA # 2.

[Case 3]
Further, if the case 3 is determined in step S10, the process proceeds to step S15. As shown in FIG. 6, the SIP INVITE is overlaid from the femtocell # 1 via the IPSec tunnel 31 and the security GW 22 at time t51. The data is transferred to the IMS 23 of the network NWa, and further transferred from the IMS 23 to the user terminal UA # 2 via the security GW 22, the IPSec tunnel 31, and the femtocell # 2. At time t52, 180 Ringing transmitted from the user terminal UA # 2 in response to the SIP INVITE is transferred to the IMS 23 via the femtocell # 2, the IPSec tunnel 31, and the security GW 22, and further from the IMS 23 to the security GW 22 Then, the packet is transferred to the user terminal UA # 1 via the IPSec tunnel 31 and the femtocell # 1.

  At time t53, 200 OK transmitted from the user terminal UA # 2 is transferred to the IMS 23 via the femtocell # 2, the IPSec tunnel 31 and the security GW 22, and further from the IMS 23 to the security GW 22, the IPSec tunnel 31 and the femto cell. Transferred to user terminal UA # 1 via # 1.

  At time t54, the ACK transmitted from the user terminal UA # 1 in response to the 200 OK is transferred to the IMS 23 via the femtocell # 1, the IPSec tunnel 31, and the security GW 22, and further from the IMS 23 to the security GW 22, The data is transferred to the user terminal UA # 2 via the IPSec tunnel 31 and the femtocell # 2.

  When a secure path via the core network NWC is established between the user terminals UA # 1 and UA # 2 as described above, in step S16, application data such as voice data and image data is transferred to the user terminal UA at time t55. # 1, femtocell # 1, IPSec tunnel 31 and security GW22, core network NWc, security GW22, IPSec tunnel 31, femtocell # 2 and user terminal UA # 2 are securely transmitted and received.

  FIG. 8 is a functional block diagram showing the configuration of the main part of each femtocell. Here, the configuration unnecessary for the description of the present invention is omitted.

  Based on the call connection request received from the user terminal UA # 1, the secure determination unit 51 determines whether a means for realizing secure communication of application data is taken on the user terminal side. The speed comparison unit 52 compares the search speed of the counterpart terminal specified in the call connection request with respect to the overlay network NWa and the core network NWc. The message route selection unit 53 selects a core network as a route of the call control message if the means for the secure communication is not taken, and if it is taken, the message route selection unit 53 selects the search speed of the overlay network and the core network. Choose a faster network.

  The data path selection unit 54 selects a core network as a path of application data if the means for secure communication is not taken, and selects an overlay network if it is taken.

  The first message transmission unit 55 transmits the call control message selected by the core network to the partner terminal via the secure tunnel and the core network. The second message transmission unit 56 transmits the call control message with the overlay network selected to the counterpart terminal via the overlay network. The first data transmission unit 57 transmits the application data selected by the core network to the partner terminal via the secure tunnel and the core network. The second data transmission unit 58 transmits the application data for which the overlay network is selected to the counterpart terminal via the overlay network.

  21 ... Authentication server, 22 ... Security gateway (GW), 23 ... IMS, 31 ... IPSec tunnel

Claims (3)

A non-secure access network in which multiple femtocells construct an overlay network and a secure core network are connected by a secure tunnel for communication, and between the user terminals accommodated in each femtocell via an overlay network or via a core network In a network call control system for establishing a communication path,
Each femtocell
Secure determination means for determining whether means for realizing secure communication of application data is taken on the user terminal side based on a call connection request received from the user terminal;
Speed comparison means for comparing the search speed of the counterpart terminal specified in the call connection request for the overlay network and the core network;
As a path of the call control message, a message path for selecting a core network if the means for the secure communication is not taken, and for selecting a network having a high search speed among the overlay network and the core network if taken. A selection means;
As a route of application data, if the means for secure communication is not taken, a core network is selected, and if taken, a data route selection means for selecting an overlay network;
A network call control system comprising: means for transferring the call control message and application data via the selected network.   The secure determination means determines that the means for realizing the secure communication is taken on the user terminal side if an encryption key is described in the call connection request received from the user terminal. Item 4. The network call control system according to Item 1.   The network call control according to claim 1 or 2, further comprising registration means for registering the user terminal in both the overlay network and the core network based on a registration request received from the user terminal. system.

Images