JP4627291B2 - Management server, host gateway, host client, user gateway, user client, and network fusion and separation method - Google Patents

Description

  The present invention relates to a management server, a host gateway, a host client, a user gateway, a user client, and a network having a function of merging a plurality of networks to form a single network or separating a single network into a plurality of networks. It relates to fusion and separation methods.

  Conventionally, IETF RFC2131 defines “DHCP (Dynamic Host Configuration Protocol)”. This DHCP is a protocol that enables connection to a network by automatically assigning IP address information in response to a client request. In DHCP, it is possible to set a terminal that permits address assignment to a DHCP server that performs address assignment in units of MAC addresses.

  Although the basic performance of DHCP is IP address assignment, as other functions, setting information such as a subnet mask, a default gateway IP address, and a DNS server IP address can also be distributed.

By using this DHCP, the user does not need to make detailed settings every time the terminal moves, and the administrator does not need to provide support related to the setting of the terminal. In addition, since IP addresses are centrally managed and necessary numbers are lent to users in use each time, IP address resources allocated to the organization can be saved.
JP 2004-364271 A “Dynamic Host Configuration Protocol” IETF RFC2131.

  However, although DHCP solves address assignment to terminals in the network layer, it cannot assign addresses to the entire network. Also, in order to connect securely to the connection destination network, different secure information notification means are required.

  Further, for example, when a DHCP server is installed in a vehicle such as a taxi and an environment in which a network is provided to passengers in the vehicle is assumed, it is required to provide services only to passengers. However, it is impractical to register the MAC address of the client terminal owned by the passenger in advance in the DHCP server installed in the vehicle. Furthermore, it is impossible to distinguish between passengers and passers-by who only walk outside the vehicle. In addition, in such a public connection environment, client communication is transmitted wirelessly without being encrypted, causing a security problem, or a predetermined encryption key is continuously used. This causes a problem that once the encryption key is known, it can be used again.

  The present invention has been made in view of such circumstances, and a management server, a host gateway, a host client, and a user that can combine a plurality of networks and separate the combined networks under high security. An object is to provide a gateway, a user client, and a network fusion and separation method.

  (1) In order to achieve the above object, the present invention takes the following measures. That is, the management server of the present invention is a management server that forms a single network by fusing a host network that is an internal network formed by the host gateway and a user network that is an internal network configured by the user gateway. Host network information management for managing a unique ID for identifying a host gateway, an IP address of the host gateway, an IP address group assignable to the user gateway, and host network information including at least the wireless information of the host network Unit, a fusion state management unit that manages information on the fusion state or separation state of the host gateway, the host network, and the user network in a separated state, from the user gateway, Among the IP address groups managed by the fusion request processing unit that receives the network fusion request including the unique ID of the gateway and the number of clients in the user network and identifies the unique ID, and the host network information management unit, An address assignment calculation unit that calculates an IP address to be assigned to each client in the user network, and the fusion state management unit determines whether the host gateway is in a fusion state when the network fusion request is received. And the status of the host gateway is changed from the separated state to the merged state, and the merge request processing unit notifies the user gateway of each IP address group calculated by the address allocation calculation unit. Yes.

  As described above, since network information and the like are notified between a plurality of networks via the management server, the service provider can use the service only by the user who permits the connection. Thereby, it becomes possible for the service provider to prevent an unintended connection by a third party who should refuse the connection. In addition, by encrypting communication between terminals connected to the combined network using a one-time encryption key, it is possible to conceal communication contents from peripheral terminals and terminals that have been connected once and then separated. It becomes.

  (2) Further, the management server of the present invention is a management server that separates a single network into a host network that is an internal network configured by a host gateway and a user network that is an internal network configured by a user gateway. Host network information management for managing a unique ID for identifying a host gateway, an IP address of the host gateway, an IP address group assignable to the user gateway, and host network information including wireless information of the host network Unit, a fusion state management unit that manages information on the fusion state or separation state of the host gateway, the host network, and the user network are merged to form a single network. A separation request processing unit that accepts a network separation request from either a way or a user gateway, and when the network separation request is accepted, the fusion state management unit changes the status of the host gateway from the fusion state. In the separation state, the separation request processing unit makes the network separation request to either the host gateway or the user gateway.

  In this way, since the separation request for separating the fused networks is sent to either one of the gateways via the management server, it is possible to appropriately control the service end timing. As a result, for example, a user network as a mobile network can be separated from the fused network in a state where the user network is fused to the host network (which can be either mobile or fixed) with high security.

  (3) Further, the host gateway of the present invention has an HGW external interface connected to an external network and an HGW internal interface connected to an internal network, and the host network that is the internal network and an internal network configured by the user gateway And a user gateway that connects a single network to a management server that separates the single network into the host network and the user network, and forms a single network, A host network that stores IP address groups that can be assigned to user gateways and host network information that includes at least wireless information of the host network for each of network fusion and separation. When a network fusion request is received from the management server before the network information storage unit and the network are merged, or when a network separation request is made to the management server during the network fusion, and when the network is separated from the management server An HGW setting changing unit that changes a network setting that has been either one of the previous network fusion or separation based on the host network information to one of the other network settings when receiving a request; An encryption key creation unit that creates an encryption key included in the wireless information of the host network each time its own status is changed from the fusion state to the separation state or from the separation state to the fusion state. The host network information accumulating unit is created by the encryption key creating unit. The HGW external interface transmits the encryption key created by the encryption key creation unit before the network fusion to the management server, and after the network is separated, the HGW external interface stores the encryption key. An encryption key newly created by the encryption key creation unit is transmitted to the management server.

  In this way, the host gateway transmits the encryption key to the management server. Therefore, the management server manages the encryption key as wireless information, so that a third party can easily access the network at the time of network fusion. It is possible to configure a closed network that cannot. On the other hand, since the host gateway notifies the management server of an unused encryption key after separation, the user gateway that was previously integrated into the network can use the encryption key that was used at the time of integration. Disappear. As a result, it is possible to sufficiently enhance security at the time of network fusion and to appropriately control the start and end of service provision.

  (4) In the host gateway of the present invention, when the HGW internal interface receives a network fusion request from the management server before the fusion of the network, the host network information at the time of the network fusion is sent to the subordinate host client. On the other hand, when a network separation request is made to the management server during network fusion, or when a network separation request is received from the management server, host network information under the network separation is subordinate to the host client It is characterized by notifying.

  As described above, the host network information at the time of network fusion or separation is notified to the subordinate host client, so that the security at the time of network fusion and separation is sufficiently increased and the start and end of service provision are appropriately controlled. It becomes possible.

  (5) The host client of the present invention is a host client under the host gateway according to claim 4, and an HCL internal interface connected to a host network that is an internal network constituted by the host gateway, and network fusion When the host network information is previously notified from the host gateway at the time of network fusion, the previous network setting is changed to the network setting at the time of network fusion based on the host network information, while the network fusion is performed. When a network separation request is made to the host gateway by itself, or when a network separation request is received from the host gateway, the network settings up to that point are not changed. Is characterized by comprising the HCL setting changing unit that changes the over click setting, the.

  In this way, the network settings are changed when a host network information notification or network separation request is received from the host gateway at the time of network fusion, so that the security at the time of network fusion and separation is sufficiently increased, and the service It is possible to appropriately control the start and end of provision.

  (6) Further, the user gateway of the present invention has a UGW external interface connected to an external network and a UGW internal interface connected to an internal network, and the user network as the internal network and an internal network configured by the host gateway A user gateway that connects to a management server that separates the single network into the user network and the host network, and forms a single network by combining the host network and A user network for storing user network information including at least IP address groups assigned to subordinate user clients and wireless information of the user network at the time of network fusion or separation A network information accumulation unit, a UGW fusion request processing unit for making a network fusion request including a unique ID of the host gateway and the number of clients in the user network before the network fusion, and the network Based on the unused IP address group notified from the management server after the fusion request, the previous network setting is changed to the network setting at the time of network fusion, while the network separation request is sent to the management server. And a UGW setting changing unit that changes the network setting up to that before network integration when it is performed or when a network separation request is received from the management server.

  In this way, a network fusion request including the unique ID of the host gateway and the number of clients in the internal network is made to the management server, and based on an unused IP address group notified from the management server after the network fusion request. While changing the previous network settings to the network settings at the time of network integration, if you make a network separation request to the management server or receive a network separation request from the management server, the previous network settings Is changed to the network setting before the network fusion, it is possible to sufficiently enhance security at the time of network fusion and separation, and to appropriately control the start and end of service provision.

  (7) Further, in the user gateway of the present invention, the UGW internal interface is configured so that the unused user client is used based on an unused IP address group notified from the management server after the network fusion request. When the network separation request including the IP address information of the management server is made, or when the network separation request is made to the management server during the network fusion, or the network separation request is received from the management server, the user client is It is characterized by making a network separation request.

  As described above, since the network fusion request or the network separation request is made to the subordinate user client, it is possible to sufficiently enhance security at the time of network fusion and separation, and to appropriately control the start and end of service provision. Become.

  (8) Further, the user client of the present invention is a user client under the user gateway according to claim 7, and a UCL internal interface connected to a user network that is an internal network constituted by the user gateway, and network fusion When the network fusion request including unused IP address information is received from the user gateway before, based on the network fusion request, the previous network setting is changed to the network setting at the time of network fusion. When a network separation request is made to the user gateway by itself or when a network separation request is received from the user gateway, the network settings up to that point are Is characterized by comprising the UCL setting changing unit that changes the over click setting, the.

  In this way, when a network fusion request including unused IP address information is received from a user gateway before network fusion, the previous network setting is changed to the network setting at the time of network fusion based on the network fusion request. On the other hand, if a network separation request is made to the user gateway during network fusion or if a network separation request is received from the user gateway, the previous network setting is changed to the network setting at the time of network separation. Therefore, it is possible to sufficiently enhance security at the time of network fusion and separation, and to appropriately control the start and end of service provision.

  (9) The network fusion and separation method of the present invention includes an external interface connected to an external network, a host gateway including an internal interface connected to the internal network, and at least a unique ID for identifying the host gateway; A management server for managing host network information including an IP address associated with the unique ID, an IP address group assigned to a client under the host gateway, and wireless information of the internal network Network fusion and separation method, comprising: an external interface connected to an external network; and an internal interface connected to an internal network; A user gateway constituting the internal network accessing the management server and making a network fusion request including the unique ID of the host gateway and the number of clients in the internal network to the management server; Identifying the unique ID notified from the user gateway and notifying the host network information to the user gateway, and the user gateway to the subordinate clients based on the notified host network information, Assigning an IP address and at least a step of notifying at least wireless information and the IP address of the host gateway, an internal network constituted by the host gateway, and the user gateway An internal network formed by fusion is characterized by constituting a single network.

  As described above, since network information and the like are notified between a plurality of networks via the management server, the service provider can use the service only by the user who permits the connection. Thereby, it becomes possible for the service provider to prevent an unintended connection by a third party who should refuse the connection. In addition, by encrypting communication between terminals connected to the combined network using a one-time encryption key, it is possible to conceal communication contents from peripheral terminals and terminals that have been connected once and then separated. It becomes.

  (10) In the network fusion and separation method according to the present invention, the host gateway notifies the management server of an encryption key, and the management server uses the wireless information of the internal network formed by the host gateway as And a step of managing the notified encryption key.

  In this way, since the management server manages the encryption key notified from the host gateway as wireless information, it is possible to configure a closed network that cannot be easily accessed by a third party during network fusion. Become.

  (11) Further, in the network fusion and separation method of the present invention, in a state where the internal network configured by the host gateway and the internal network configured by the user gateway are merged to form a single network, Either the host gateway or the user gateway makes a network separation request to the management server, and the management server makes the network separation request to either the host gateway or the user gateway. A step in which a host gateway or a user gateway that has received a network separation request from the management server makes a network separation request to a subordinate client; and Comprises the steps of returning the network settings to the previous state, the single network, and an internal network to which the host gateway is configured, the user gateway is characterized in that the separation into the internal network configuration.

  In this way, since the separation request for separating the fused networks is notified to one of the gateways via the management server, the service end timing can be appropriately controlled. Thereby, for example, a user network as a mobile network can be fused to a host network (which can be either mobile or fixed) with high security, and the fused network can be separated.

  (12) In the network fusion and separation method according to the present invention, the host gateway notifies the management server of an unused encryption key after the separation, and the management server is configured by the host gateway. And managing the notified encryption key as wireless information of the internal network.

  In this way, the host gateway notifies the management server of an unused encryption key after the separation, so that the user gateway that has been integrated into the network until then uses the encryption key that was used at the time of the integration. Can not be. As a result, it is possible to sufficiently enhance security at the time of network fusion and to appropriately control the start and end of service provision.

  According to the present invention, network information and the like are notified through a management server between a plurality of networks, so that the service provider can use only the user who permits the connection. Thereby, it becomes possible for the service provider to prevent an unintended connection by a third party who should refuse the connection. In addition, by encrypting communication between terminals connected to the network after the integration with a one-time encryption key, it is possible to conceal communication contents from peripheral terminals.

  Next, embodiments of the present invention will be described with reference to the drawings. In this embodiment, a management server is installed on a network accessible from the user gateway and the host gateway. Then, the host gateway notifies the management server of host network information, and the management server notifies the user gateway of such information. In this way, by making it possible to notify each other of information such as a network via the management server, only a specific user gateway can acquire and connect to information on a specific host network.

  In the present embodiment, the host network includes, for example, a host gateway including a first communication unit such as a DHCP function and EV-DO, and a second communication unit such as IEEE 802.11b, and a subordinate of the host gateway. It is composed of two types of communication terminal devices of a host client connected by communication means such as IEEE802.11b. These communication means are merely examples, and the present invention is not limited to these.

  On the other hand, the user network includes, for example, a user gateway including a first communication unit such as a DHCP function and EV-DO and a second communication unit such as IEEE 802.11b, and IEEE 802.11b under the user gateway. It is composed of two types of communication terminal devices of user clients connected by communication means such as. These communication means are merely examples, and the present invention is not limited to these.

  FIG. 1 is a diagram showing a schematic configuration of a communication system according to the present embodiment. In this communication system, the user gateway 10 forms a user network 12 under the control of user clients 11a and 11b, and the host gateway 20 forms a host network 22 under the control of host clients 21a and 21b. The management server 30 manages the fusion or separation of the user network 12 and the host network 22. A network in which the user network 12 and the host network 22 are fused is referred to as a fused network.

  Here, in the present specification and drawings, the host network may be displayed as “HNW”, the host gateway as “HGW”, and the host client as “HCL”. The user network may be displayed as “UNW”, the user gateway as “UGW”, and the user client as “UCL”. Also, the default gateway may be displayed as “default GW”.

  FIG. 2 is a block diagram illustrating a schematic configuration of the management server 30. In the management server 30, a host network information management unit 301 (hereinafter referred to as “HNW information management unit 301”) can be assigned to a unique ID for identifying a host gateway, an IP address of the host gateway, and a user gateway. An IP address group and host network information including at least wireless information of the host network. FIG. 3 is a diagram illustrating a table stored in the HNW information management unit 301. As shown in FIG. 3, in this table, a unique ID of the host network, a default gateway and subnet, an IP address group that can be assigned to the user network, and radio information are managed. The radio information includes a channel, an SSID, and a WEP key.

  In FIG. 2, a host network information storage unit 302 (hereinafter referred to as “HNW information storage unit 302”) stores information related to the host network. The fusion request processing unit 303 receives a network fusion request from the user gateway (UGW) including the unique ID of the host gateway and the number of clients in the user network, and identifies the unique ID. The address assignment calculation unit 304 calculates an IP address assigned to each client in the user network.

  The fusion state management unit 305 manages information on the fusion state or separation state of the host gateway. FIG. 4 is a diagram illustrating a table stored in the fusion state management unit 305. As shown in FIG. 4, in this table, the unique ID of the host gateway and the status indicating the fusion state or separation state of the network are managed. The merged state management unit 305 confirms the status of the host gateway 20 (whether it is in use). In addition, the status is changed at the time of network fusion.

  In FIG. 2, the separation request processing unit 306 receives a network separation request from the user gateway or the host gateway, and changes the status at the time of network separation.

  FIG. 5 is a block diagram showing a schematic configuration of the host gateway. The host gateway 20 can be connected to an external network at the HGW external interface 201. Therefore, the host gateway 20 connects to the management server 30 in the HGW external interface 201. The HGW fusion request processing unit 202 receives the network fusion request notified from the management server 30.

  The host network information storage unit 203 (hereinafter referred to as “HNW information management unit 203”) is a host including at least its own IP address, an IP address group that can be assigned to the user gateway 10, and wireless information of the host network 22. Network information is stored for each of network fusion and separation. FIG. 6 is a diagram illustrating a table stored in the HNW information accumulation unit 203. As shown in FIG. 6, in this table, host network information is stored for each of the network fusion time and the separation time. For each of network fusion and separation, a default gateway and subnet, an IP address that can be assigned to the user network, and radio information are managed. The radio information includes a channel, an SSID, and a WEP key. In addition, in the current status, it is possible to identify the time of network fusion or separation by adding a mark.

  In FIG. 5, the HGW address assigning unit 204 assigns the address of a terminal in the host network for network fusion if necessary. The HGW internal interface 205 is connected to a subordinate host client.

  The HGW setting change unit 206 receives a network fusion request from the management server 30 before the fusion of the networks, or makes a network separation request to the management server 30 during the fusion of the network. When a separation request is received, based on the host network information, the network setting that was one of the previous network fusion or separation is changed to one of the other network settings.

  The HGW separation request processing unit 207 makes a network separation request to the management server 30 during network fusion. A network separation request is received from the management server 30. Also, the host network information at the time of separation is acquired from the HNW information storage unit 203.

  The encryption key creation unit 208 creates an encryption key included in the wireless information of the host network every time the status of the host gateway 20 is changed from the fusion state to the separation state or from the separation state to the fusion state. For example, an encryption key created in advance before network fusion is transmitted to the management server 30. Further, after the network separation, a new encryption key is created and transmitted to the management server 30.

  The server registration processing unit 209 transmits information that needs to be registered in the management server 30 to the management server 30 via the HGW external interface 201.

  FIG. 7 is a block diagram showing a schematic configuration of the user gateway. The user gateway 10 can be connected to an external network at the UGW external interface 101. Therefore, the user gateway 10 connects to the management server 30 in the UGW external interface 101. The UGW fusion request processing unit 102 makes a network fusion request including the unique ID of the host gateway 20 and the number of clients in the user network 12 to the management server 30 before the networks are fused.

  The UGW address assignment unit 103 assigns addresses to the user clients 11 a and 11 b using the block acquired from the management server 30. The UGW internal interface 104 is connected to subordinate user clients 11a and 11b. User network information storage unit 105 (hereinafter referred to as “UNW information storage unit 105”) includes at least its own IP address, an IP address group assigned to a subordinate user client, and wireless information of the user network. User network information is stored when networks are merged or separated.

  FIG. 8 is a diagram illustrating a table stored in the UNW information accumulation unit 105. As shown in FIG. 8, in this table, user network information is stored for network fusion or separation. Here, the default gateway and subnet, the IP address currently assigned to the user clients 11a and 11b, and the wireless information are managed. The radio information includes a channel, an SSID, and a WEP key. In the current status, it is possible to identify when the networks are merged or separated. When the networks are merged, the network information before the merge (when separated) is stored.

  In FIG. 7, the UGW setting changing unit 106 changes the network setting up to that point to the network setting at the time of network fusion based on the unused IP address group notified from the management server 30 after the network fusion request as described above. Change to On the other hand, when a network separation request is made to the management server 30 or when a network separation request is received from the management server 30, the previous network setting is changed to the network setting before the network integration.

  The UGW separation request processing unit 107 makes a network separation request to the management server 30 during network fusion. A network separation request is received from the management server 30. Also, user network information at the time of separation is acquired from the UNW information storage unit 105.

  FIG. 9 is a block diagram showing a schematic configuration of the user client. Since the host client also has the same configuration, redundant description is omitted here. The user client 11a can be connected to an external network through the UCL external interface 111. Therefore, the user client 11 a connects to the user gateway 10 at the UCL external interface 111. The UCL fusion request processing unit 112 issues a network fusion request to the user gateway 10 before network fusion. In addition, a network separation request may be made by itself to the user gateway.

  The user network information storage unit 113 (hereinafter referred to as “UNW information storage unit 113”) collects user network information including at least its own IP address and wireless information of the user network when the networks are merged or separated. accumulate.

  FIG. 10 is a diagram illustrating a table stored in the UNW information accumulation unit 113. As shown in FIG. 10, in this table, user network information is stored for network fusion or separation. Here, the default gateway and subnet, and the radio information are managed. The radio information includes a channel, an SSID, and a WEP key. In the current status, it is possible to identify when the networks are merged or separated. When the networks are merged, the network information before the merge (when separated) is stored.

  In FIG. 9, when the UCL setting changing unit 114 receives a network fusion request including unused IP address information from the user gateway 10 before the network fusion, the UCL setting changing unit 114 changes the network settings up to that point based on the network fusion request. Change to network settings for network integration. On the other hand, when a network separation request is made to the user gateway 10 during network fusion or when a network separation request is received from the user gateway 10, the previous network settings are changed to the network settings at the time of network separation. Change to

  The UCL separation request processing unit 115 makes a network separation request to the management server 30 during network fusion. A network separation request is received from the management server 30. Also, user network information at the time of separation is acquired from the UNW information storage unit 113.

  Next, the operation of the communication system of the present invention configured as described above will be described. FIG. 11 is a sequence chart showing a network fusion and separation procedure according to the present embodiment. FIG. 12 shows a state before network fusion, and FIG. 13 shows a transient state at the time of network fusion. FIG. 14 shows a state during network fusion, and FIG. 15 shows a state during network separation.

(Before network fusion)
11 and 12, the user network 12 and the host network 22 are configured independently in the initial state, that is, in the state before network fusion. As shown in FIG. 12, the user gateway 10 configures a user network 12 by assigning IP addresses to the user clients 11a and 11b by DHCP or the like. That is, communication between the user clients 11 a and 11 b and the external network is via the user gateway 10. At this point, encryption regarding communication between the user gateway 10 and the user clients 11a and 11b is arbitrary.

  On the other hand, the host gateway 20 similarly configures the host network 22 by assigning IP addresses to the host clients 21a and 21b by DHCP or the like. Encryption related to communication between the host gateway 20 and the host clients 21a and 21b is also optional at this point. Here, the encryption keys of the user network 12 and the host network 22 may be independent from each other.

  In FIG. 11, the host gateway 20 is allocating to the management server 30 to the IP address of the HGW internal interface 205 of the host gateway 20 (becomes a default gateway as seen from the host network) and terminal (host clients 21a and 21b). IP address group and wireless information (encryption key, wireless channel, etc.) of the host network 22 are notified (step S1, arrow in FIG. 12). The communication path used for notification can be encrypted by IPSec or the like. The management server 30 registers network information, wireless information, and the like notified from the host gateway 20.

(Network fusion transient state)
Next, in FIG. 11, it is assumed that the user wishes to merge the networks. The user generates a fusion trigger for the user gateway 10. As an example of this trigger, if the user gateway 10 is a PC, a USB key prepared by a service provider can be used, and the information stored in the USB key can be read as a trigger. If the user gateway 10 is a mobile phone with a camera, it can be triggered by reading a two-dimensional bar code prepared by the service provider. This trigger information includes the connection destination address of the management server 30 and the unique ID of the network to be provided (pre-assigned by the service provider).

  The user gateway 10 accesses the management server 30 using the trigger information, notifies the unique ID, and notifies the number of terminals of the user network 12 (number of user clients) (step S2, arrow A in FIG. 13).

  Here, prior to communication with the management server 30, it is desirable to encrypt the communication content between the user gateway 10 and the management server 30 by Diffie-Hellman key exchange or the like.

  Further, the unique ID of the host gateway 20 is encrypted by using the connection time or the like as a key so as not to be known to the user, thereby preventing a malicious connection from being attempted.

  The management server 30 identifies the unique ID based on the information notified from the user gateway 10. Thereafter, the network information of the host network 22, wireless channel and security information, and available IP addresses are notified to the user gateway (step S3, arrow B in FIG. 13).

  The user gateway 10 assigns an IP address to each user client, and notifies the network information, the wireless channel, and the security information of the merged network (step S4, arrow a in FIG. 13). Receiving this, each user client 11a, 11b executes resetting of the IP address, wireless channel, and security. As a result, the host network 22 can be connected. Further, the user gateway 10 itself performs the resetting in the same manner.

  On the other hand, the management server 30 makes a service start request to the host gateway 20 (step S5, arrow B ′ in FIG. 13). Further, the host gateway 20 assigns an IP address to each of the host clients 21a and 21b, and notifies the network information, the wireless channel, and the security information of the merged network (step S6, arrow b in FIG. 13). Receiving this, each host client 21a, 21b executes resetting of the IP address, radio channel, and security. In addition, the host gateway 20 itself performs the resetting similarly. Thereby, a fusion network is configured.

(State during network fusion)
As shown in FIG. 14, when the procedure from step S2 to step S6 is completed, the user gateway 10, the user clients 11a and 11b, the host gateway 20, and the host clients 21a and 21b all become the same wireless channel and security information. Communication is possible in the network 40. Here, the user clients 11a and 11b can use either the user gateway 10 or the host gateway 20 as a default gateway.

(Network separation transient state)
Next, network separation will be described. In order for the fusion network 40 to separate into the user network 12 and the host network 22 and return to the state before the network fusion again, some kind of trigger is required. It may be possible to explicitly indicate separation on any terminal, and when a polling packet is periodically transmitted from the gateway and this transmission / reception is interrupted, it is assumed that the distance between the terminals is sufficiently separated. May start.

  Here, it is assumed that a separation request is issued on the user gateway 10 (for example, when the user explicitly instructs separation), but conversely, when a separation request is issued on the host gateway 20, for example, When the host gateway 20 detects the absence of the user gateway 10 by periodic polling or the like, a separation request is notified to the user gateway 10 via the management server 30.

  The user gateway 10 notifies the management server 30 of a network separation request (step T1, arrow A in FIG. 15), and notifies the user clients 11a and 11b of the user client separation execution request (step S1). T2, arrow a) in FIG. The user clients 11a and 11b return their wireless settings to the state before the network integration. Here, when the user clients 11a and 11b have finished returning the settings to the state before the fusion, the user clients 11a and 11b may notify the user gateway 10 of this (step T3). Similarly, the user gateway 10 returns the setting to the state before the network fusion. Then, the user gateway 10 notifies the management server 30 of notification of completion of network separation (step T4, arrow B in FIG. 15).

  On the other hand, when receiving the notification of the network separation request from the user gateway 10, the management server 30 notifies the host gateway 20 to that effect (step T5, arrow C in FIG. 15). The host gateway 20 transmits a host client separation execution request to the host clients 21a and 21b (step T6, arrow b in FIG. 15).

  The host clients 21a and 21b return their own wireless settings to the state before network fusion. Here, when the host clients 21a and 21b have finished returning the settings to the state before merging, they may be notified to the host gateway 20 (step T7). Similarly, the host gateway 20 returns the setting to the state before the network fusion. Then, the host gateway 20 notifies the management server 30 of the completion of network separation (step T8, arrow D in FIG. 15).

  Next, the host gateway 20 creates a new encryption key to be used (step T9) and notifies the management server 30 (step T10, arrow E in FIG. 15).

  In the above description, an example in which a network fusion request and a network separation request are made from the user gateway 10 is shown, but the present invention is not limited to this. It is also possible to make a network fusion request or a network separation request from the host gateway. Further, when the number of terminals constituting the user network 12 and the host network 22 is one, the same procedure can be realized by omitting some procedures.

(Application example)
A user network as a mobile network can be configured by a mobile phone as a user gateway and a notebook PC as a user client. In addition, a host network as a mobile network can be configured by installing a PC having a wireless LAN function as a host gateway in a taxi vehicle.

  When a user using the user network gets into the taxi and wants to receive the wireless LAN service, the procedure shown in FIG. 1 is used to merge with the network configured by the PC installed in the taxi vehicle. be able to. For example, the user connects a USB key prepared in a taxi car to a notebook PC and accesses the management server based on data stored in the USB key. Then, a network fusion request is made to the management server.

  The management server identifies the unique ID of the host gateway and performs a network fusion procedure. Thereby, the user can receive the service provided in the taxi car.

  Next, when the user gets out of the taxi, information on service termination is transmitted from the notebook PC, and a network separation request is made to the management server. The management server notifies the PC as a host gateway of the network separation request, and the PC newly creates an encryption key and transmits it to the management server.

  When the user gets off the taxi and the network is separated, the service provided in the taxi car can no longer be received.

  As described above, according to the present embodiment, it is possible to sufficiently enhance security at the time of network fusion and to appropriately control the start and end of service provision.

It is a figure which shows schematic structure of the communication system which concerns on this Embodiment. It is a block diagram which shows schematic structure of a management server. It is a figure which shows the table which the HNW information management part stores. It is a figure which shows the table which the fusion state management part stores. It is a block diagram which shows schematic structure of a host gateway. It is a figure which shows the table which the HNW information storage part stores. It is a block diagram which shows schematic structure of a user gateway. It is a figure which shows the table which the UNW information storage part stores. It is a block diagram which shows schematic structure of a user client. It is a figure which shows the table which the UNW information storage part stores. It is a sequence chart which shows the fusion and isolation | separation procedure of the network which concerns on this Embodiment. It is a conceptual diagram which shows the state before network fusion. It is a conceptual diagram which shows the transient state at the time of network fusion. It is a conceptual diagram which shows the state during network fusion. It is a conceptual diagram which shows the state at the time of network isolation | separation.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 User gateway 11a, 11b User client 12 User network 20 Host gateway 21a, 21b Host client 22 Host network 30 Management server 40 Fusion network 102 UGW fusion request processing part 105 UNW information storage part 106 UGW setting change part 111 UCL internal interface 113 UNW Information storage unit 114 UCL setting change unit 203 HNW information storage unit 206 Setting change unit 208 Encryption key creation unit 301 HNW information management unit 302 HNW information storage unit 304 Address assignment calculation unit 305 Fusion state management unit 306 Separation request processing unit

Claims (9)

A host network that is an internal network formed by the host gateway and a user network that is an internal network formed by the user gateway are fused to form a single network, while the single network is configured as the host network and the user. A management server separated from the network ,
A host network information management unit for managing a unique ID for identifying a host gateway, an IP address of the host gateway, an IP address group that can be assigned to the user gateway, and host network information including at least wireless information of the host network When,
A fusion state management unit for managing information on the fusion state or separation state of the host gateway;
In the state where the host network and the user network are separated, a fusion request for receiving the network fusion request including the unique ID of the host gateway and the number of clients in the user network from the user gateway and identifying the unique ID A processing unit;
An address assignment calculation unit for calculating an IP address to be assigned to each client in the user network among the IP address group managed by the host network information management unit;
The host gateway or the user in a state where a single network is configured by fusing the fusion state management unit that manages the fusion state or separation state information of the host gateway, the host network, and the user network. A separation request processing unit that accepts a network separation request from any one of the gateways ,
The fusion state management unit, when said network fusion request has been accepted, the with a host gateway to determine whether the fusion state, while changing the status of the host gateway from the separation state to the fusion state, the network When the separation request is accepted, the status of the host gateway is changed from the fusion state to the separation state,
The fusion request processing unit notifies the user gateway of each IP address group calculated by the address allocation calculation unit ,
The separation request processing unit makes the network separation request to either the host gateway or the user gateway,
The management server is notified of security information from the host gateway before network integration, manages the notified security information, and notifies the user gateway of the notified security information immediately before network integration. . An HGW external interface connected to an external network and an HGW internal interface connected to an internal network, and a host network that is the internal network and a user network that is an internal network configured by a user gateway are fused to form a single A host gateway connecting to a management server that constitutes a network while separating a single network into the host network and the user network;
A host network information accumulating unit for accumulating host network information including at least one of its own IP address, an IP address group that can be assigned to a user gateway, and radio information of the host network for each of network fusion and separation;
When a network fusion request is received from the management server before network fusion, or when a network separation request is made to the management server during network fusion, and when a network separation request is received from the management server An HGW setting changing unit that changes the network setting that was one of network fusion or separation based on the host network information to one of the other network settings;
An encryption key creating unit that creates an encryption key included in the wireless information of the host network each time its own status is changed from the fusion state to the separation state or from the separation state to the fusion state;
The host network information storage unit stores the latest encryption key created by the encryption key creation unit,
The HGW external interface transmits the encryption key created by the encryption key creation unit before the network fusion to the management server, and is newly created by the encryption key creation unit after the network is separated. A host gateway, wherein an encryption key is transmitted to the management server. The HGW internal interface is
When a network fusion request is received from the management server before network fusion, the host network information at the time of network fusion is notified to the subordinate host client,
When a network separation request is made to the management server during network integration or when a network separation request is received from the management server, the host network information at the time of the network separation is notified to the subordinate host client. The host gateway according to claim 2. A host client under the host gateway according to claim 3,
An HCL internal interface connected to a host network which is an internal network constituted by the host gateway;
When receiving notification of host network information at the time of network fusion from the host gateway before network fusion, the host network information is changed to the network setting at the time of network fusion based on the host network information. An HCL setting changing unit that changes to a network setting in a separation state immediately before network fusion when a network separation request is made to the gateway by itself or when a network separation request is received from the host gateway. Host client. A UGW external interface that connects to an external network and a UGW internal interface that connects to an internal network. The user network that is the internal network and the host network that is the internal network that the host gateway configures are combined into a single A user gateway that configures a network and connects a single network to a management server that separates the user network and the host network;
A user network information accumulating unit that accumulates user network information including at least own IP address, an IP address group assigned to a subordinate user client, and wireless information of the user network at the time of network fusion or separation;
A UGW fusion request processing unit that performs a network fusion request including the unique ID of the host gateway and the number of clients in the user network before the network fusion;
Based on the unused IP address group notified from the management server after the network fusion request, while changing to the network setting at the time of network fusion, when making a network separation request to the management server, or A UGW setting changing unit for changing to a network setting in a separation state immediately before network fusion when receiving a network separation request from the management server,
Immediately before the integration of the networks, security information is notified from the management server, the notified security information is notified to the user client, and the security information is reset based on the security information. User gateway. The UGW internal interface
Based on the unused IP address group notified from the management server after the network fusion request, while making a network fusion request including the unused IP address information to the subordinate user client,
The network separation request is made to the user client when a network separation request is made to the management server during network fusion or when a network separation request is received from the management server. 5. The user gateway according to 5. A user client under the user gateway according to claim 6,
A UCL internal interface connected to a user network which is an internal network constituted by the user gateway;
When receiving the network fusion request including the unused IP address information from the user gateway before the network fusion, based on the network fusion request, the network setting at the time of network fusion is changed, while the network fusion, A UCL setting changing unit that changes to a network setting at the time of network separation when a network separation request is made to the user gateway or when a network separation request is received from the user gateway;
The user client is notified of security information from the user gateway immediately before the integration of the networks, and resets its own security information based on the security information. A host gateway having an external interface connected to the external network and an internal interface connected to the internal network;
A host including at least a unique ID for identifying the host gateway, an IP address associated with the unique ID, an IP address group assigned to a client under the host gateway, and wireless information of the internal network A network fusion and separation method for a communication system comprising a management server for managing network information,
An external interface connected to an external network and an internal interface connected to an internal network, and a user gateway configuring an internal network different from the internal network configured by the host gateway accesses the management server, and Making a network fusion request including a unique ID and the number of clients in the internal network to the management server;
The management server identifying the unique ID notified from the user gateway, and notifying the host network information to the user gateway;
The user gateway assigns an IP address to a subordinate client based on the notified host network information, and at least notifies the wireless information and the IP address of the host gateway;
Fusing the internal network configured by the host gateway and the internal network configured by the user gateway to form a single network,
In a state where the internal network configured by the host gateway and the internal network configured by the user gateway are merged to form a single network, either the host gateway or the user gateway requests a network separation request. Performing for the management server;
The management server making the network separation request to either the host gateway or the user gateway;
The host gateway or user gateway that has received a network separation request from the management server makes a network separation request to a subordinate client;
Each of the clients returns to the network setting of the separated state immediately before the network fusion, and
Separating the single network into an internal network configured by the host gateway and an internal network configured by the user gateway;
Before network integration, the management server is notified of security information from the host gateway, manages the notified security information, immediately before the network integration, notifies the user gateway of the notified security information, While the user gateway and the subordinate client reset their own security information based on the security information, immediately after the network separation, the internal network formed by the host gateway and the internal network formed by the user gateway are the network. A network fusion and separation method characterized by returning to security information in a separation state immediately before the fusion. The host gateway notifying the management server of an unused encryption key after the separation;
9. The network fusion and separation method according to claim 8, further comprising: the management server managing the notified encryption key as wireless information of an internal network configured by the host gateway.

Images