JP5311908B2 - Data network connection system and data network connection method - Google Patents

Description

  The present invention relates to a data network connection system and a data network connection method that mediate connection between a user terminal and a data network.

  In recent years, 3G-WLAN interworking systems that provide users with access to a wide communication area of 3G systems and broadband access of WLAN (Wireless Local Area Network) systems have attracted attention. Various systems have been studied. For example, Patent Document 1 discloses a method for shortening a network switching time when moving from a mobile communication network to a WLAN area.

  The above interworking method is standardized in 3GPP (3rd Generation Partnership Project), such as a method for receiving a packet service provided in a data network of a mobile communication network via a WLAN. Among these, TS (Technical Specification) 23.234 describes the architecture.

According to the above description, in the WLAN specification in 3GPP, when a user terminal is located in the WLAN, the user terminal communicates with a communication path (PDG: Packet Data Gateway) in which security is maintained. A request for opening an IPsec tunnel (IP security) is issued. The packet data control device opens the communication path after authenticating the terminal. A user terminal that has opened a communication path issues a connection request to a specific data network (PDN) by designating a W-APN (WLAN Access Point Name) to the packet data control apparatus. The packet data control apparatus performs connection authentication by confirming the contract information of the user terminal and then connects to the data network requested by the user terminal. This shows that the connection between the user terminal and the data network is established.
JP 2006-203641 A

  In the connection method between the user terminal and the data network, there is a problem that when the user terminal connects to a plurality of data networks, a plurality of communication paths must be opened. That is, when connecting to a plurality of data networks, it is necessary to specify a plurality of W-APNs. However, since it is not possible to make a connection request by specifying a plurality of W-APNs to the packet data control apparatus using a single communication path, a plurality of data networks are specified by specifying a plurality of W-APNs. When connecting to the network, it is necessary to open a plurality of communication paths. However, it is difficult to open a plurality of communication paths between the user terminal and the packet data control device at the same time because of the performance of the user terminal. Therefore, it has been difficult to simultaneously connect from a user terminal to a plurality of data networks.

  In addition, in the conventional connection method, when connecting to a data network different from the data network with which the user terminal has previously established the connection, the connection to the original data network is disconnected and the communication path used for the connection is disconnected at the same time. After that, it was necessary to open a communication path for establishing a connection with a different data network.

  The present invention has been made in view of the above, and provides a data network connection method and a data network connection system capable of efficiently establishing a communication path in accessing a data network from a user terminal via a WLAN. The purpose is to provide.

  In order to achieve the above object, a data network connection system according to the present invention is a data network connection system that is provided between a user terminal and a data network and mediates connection between the user terminal and the data network via a WLAN. Storage means for storing user terminal information for identifying a user terminal and information for identifying one or more data networks to which the user terminal can be connected, and when the user terminal is in the WLAN Receiving means for receiving a communication path opening request for transmitting a communication path between the data network connection system and the user terminal, the user terminal information transmitted from the user terminal and including the user terminal information relating to the own terminal; According to the received communication path opening request, the data network connection system and the user terminal The communication path opening means for opening the communication path and the user terminal information included in the communication path opening means received by the receiving means, with reference to the information stored in the storage means, Determination means for determining one or more data networks to which the user terminal can be connected; connection path establishment means for establishing a connection path between the one or more data networks determined by the determination means and the data network connection system; When the communication path is opened by the communication path opening means and the data is transmitted via the communication path from the user terminal that has established the connection path by the connection path establishing means, the data is transmitted one or more via the connection path. Transmission means for transmitting to the data network.

  The data network connection system according to the present invention receives a communication path establishment request including user terminal information specifying the user terminal transmitted from the user terminal, and then communicates with the user terminal based on the communication path establishment request. Open the road. On the other hand, the data network connection system acquires the user terminal information included in the communication path opening request, and the correspondence between the user terminal information stored in the storage means and the information specifying the data network to which the user terminal can be connected To establish a connection path with one or more data networks. Further, data transmitted from the user terminal whose communication path is opened is transmitted to an appropriate data network via the data network connection system of the present invention. Thus, according to the data network connection system according to the present invention, if only one communication path between the user terminal and the data network connection system is opened, the data network connection system and one or more data networks It is possible to establish a plurality of connection paths between the two. Therefore, since the user terminal itself can establish a connection with a plurality of data networks through the data network connection system without opening a plurality of communication paths with the data network connection system, A communication channel can be established efficiently in access.

  In the data network connection system according to the present invention, the storage means further associates information specifying the WLAN in which the user terminal is located with information specifying the data network to which the user terminal can connect. And receiving means receives a communication path opening request including user terminal information and information specifying the WLAN in which the user terminal is located, and the judging means receives the communication path opening received from the receiving means. Based on the user terminal information included in the request and the information specifying the WLAN in which the user terminal is located, the user terminal related to the user terminal information is connected with reference to the correspondence stored in the storage means Preferably, one or more data networks that can be determined are determined.

  According to the above data network connection system, the storage means includes user terminal information, information for specifying the WLAN in which the user terminal is located, and information for specifying the data network to which the user terminal can be connected. It is stored in association with each other. Then, from the communication path opening request transmitted from the user terminal, the user terminal information and the information specifying the WLAN in which the user terminal is located included in the user terminal information are extracted and stored in the storage unit. By reference, a connection path to one or more data networks can be established. For this reason, the data network to which the user terminal can be connected can be changed depending on the WLAN in which the user terminal is located. Therefore, a communication path to a suitable data network can be opened depending on the state of the WLAN in which the user terminal is located without specifying the user terminal in advance, and the establishment of a connection to an appropriate data network can be easily realized. be able to.

  The data network connection system according to the present invention can also be described as an invention of a data network connection method as shown below. This is substantially the same invention only in different categories, and has the same operations and effects.

  That is, the data network connection method according to the present invention mediates the connection between a user terminal and a data network, specifies user terminal information for specifying a user terminal, and information for specifying a data network to which the user terminal can connect. A data network connection method of a data network connection system comprising a storage means that stores the information in association with each other, including user terminal information related to the own terminal transmitted from the user terminal when the user terminal is in the WLAN, A reception step for receiving a communication path establishment request for requesting the establishment of a communication path between the data network connection system and the user terminal, and the data network connection system and the user terminal according to the communication path establishment request received in the reception step. A communication path opening step for opening a communication path between One or more data that can be connected to the user terminal related to the user terminal information by referring to the information stored in the storage unit based on the user terminal information included in the communication path opening request received in the network A determination step of determining a network, a connection path establishment step of establishing a connection path between the one or more data networks determined in the determination step and the data network connection system, and a communication path opening step, A transmission step of transmitting the data to one or more data networks via the connection path when data is transmitted via the communication path from the user terminal that has established the connection path in the connection path establishment step. It is characterized by.

  According to the present invention, a connection path to a plurality of data networks can be established even if there is a single communication path between the user terminal and the data network connection system. It is possible to establish a communication path efficiently in accessing the data network via the network.

  DESCRIPTION OF EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. In the description of the drawings, the same elements are denoted by the same reference numerals, and redundant description is omitted.

  FIG. 1 is a diagram showing a configuration of a data network connection system 1 according to a preferred embodiment of the present invention and a connection relationship therebetween. The data network connection system 1 according to the present embodiment includes a packet data control device 20 and an authentication server 30. The packet data control device 20 is provided between the user terminal 10 and the first data network 40 and the second data network 50, and is connected via the WLAN 60 between the user terminal 10 and the first data network 40 and the second data network. It is a device that mediates the connection. The packet data control device 20 corresponds to a PDG (Packet Data Gateway) defined by the WLAN specification in 3GPP. Further, when the user terminal connects to the data network via the data network connection system, the authentication server 30 authenticates the connection based on information of a person who is permitted to connect to the data network stored in advance. Server. The authentication server 30 corresponds to AAA (Authentication Authorization Accounting) defined by the WLAN specification in 3GPP. The data network connection system 20 and the authentication server 30 are devices included in a mobile communication network connected to the WLAN 60. The first data network 40 and the second data network 50 may also be included in the mobile communication network.

  The user terminal 10 and the packet data packet data control apparatus 20 are connected via the WLAN 60, and information is exchanged by wireless communication. The packet data packet data control device 20 and the authentication server 30 are connected to each other, and the packet data packet data control device 20 and the first data network 40 and the second data network 50 are connected to each other via a wired network. ing.

  Next, details of each device included in the data network connection system 1 will be described. First, the packet data control device 20 will be described. As shown in FIG. 2, the packet data control device 20 is configured as a computer including hardware such as a CPU 201, a RAM 202, a ROM 203, a communication module 204, an auxiliary storage device 205, and the like. When these components operate, the functions according to this embodiment described later are exhibited.

  As shown in FIG. 1, the packet data control apparatus 20 includes an IPsec processing unit 21, a control unit 22, an information reference unit 23, and a data transmission / reception unit 24.

  Next, the authentication server 30 will be described. As shown in FIG. 2, the authentication server 30 is configured as a computer including hardware such as a CPU 201, a RAM 202, a ROM 203, a communication module 204, and an auxiliary storage device 205. When these components operate, the functions according to this embodiment described later are exhibited.

  As illustrated in FIG. 1, the authentication server 30 includes an information reference unit 31, a control unit 32, and a subscriber information storage unit 33.

  Next, another device shown in FIG. 1 will be described. The user terminal 10 is a device that is used by a user and performs communication via a WLAN. Specifically, the user terminal 10 is realized as a device having a communication function such as a mobile phone, a PDA (Personal Digital Assistant), a notebook personal computer, and the like. The user terminal 10 can communicate with the packet data control apparatus 20 via an access point in the WLAN 60. This user terminal 10 corresponds to UE (User Equipment) defined by the WLAN specification in 3GPP.

  FIG. 3 shows a hardware configuration of the user terminal 10. The user terminal 10 includes a CPU 301, a RAM 302, a ROM 303, an operation unit 304, a wireless communication unit 305, a display 306, an antenna 307, and the like. When these components operate, the user terminal 10 exhibits the above functions.

  The first data network 40 and the second data network 50 are networks for providing a data communication service. As a specific example of such a data communication service provided from a data network, for example, a service (i-mode (registration) such as a home page and music data) is transmitted in response to an e-mail or a request from the user terminal 10 Trademark)) and the like. The first data network 40 and the second data network 50 correspond to a PDN (Packet Data Network) defined by the WLAN specifications in 3GPP.

  When there are a plurality of data networks as described above, the same service is provided, but the data network to be connected may be determined according to the type of the user terminal 10 and the connection status to the WLAN. In the conventional data network connection system, since the connection to the data network is not established unless the data network is designated from the user terminal 10 using W-APN, the user terminal 10 knows in advance the data network to be connected. There was a need.

  Here, details of functions of the packet data control device 20 and the authentication server 30 included in the data network connection system 1 according to the present embodiment will be described with reference to FIG.

  First, the function of each component of the packet data control device 20 will be described. The IPsec processing unit 21 of the packet data control device 20 functions as a receiving unit that receives a communication path establishment request that includes user terminal information that identifies the user terminal 10 and is transmitted from the user terminal 10 located in the WLAN 60. Here, the communication path opening request transmitted from the user terminal 10 is for requesting the opening of a communication path between the user terminal 10 and the packet data control device 20. The communication path opening request also requests establishment of a connection path between the packet data control device 20 and the data network, which is necessary for the user terminal 10 to access the data network via the WLAN.

  The IPsec processing unit 21 that receives the communication path opening request also functions as a communication path opening unit that opens a communication path with the user terminal 10 based on the communication path opening request transmitted from the user terminal 10. Further, the IPsec processing unit 21 acquires user terminal information included in the communication path establishment request transmitted from the user terminal 10 and information specifying the WLAN in which the user terminal 10 is located, and sends the information to the control unit 22. Here, the user terminal information sent from the IPsec processing unit 21 to the control unit 22 specifies the user terminal 10, for example, information specifying a user who handles the user terminal 10 and the type of user terminal (mobile terminal, PDA, etc.) It is information etc. which show. Specifically, the user terminal information is provided as an option in the header of a packet of a communication path establishment request (for example, an IKE communication path establishment request described later), and the IPsec processing unit 21 acquires user terminal information therefrom. In addition, the IPsec processing unit 21 acquires information that identifies the WLAN 60 in which the user terminal 10 is located. The packet data control device 20 holds information indicating the relationship between the IP address and the WLAN in advance, and the IPsec processing unit 21 determines which WLAN the user terminal 10 is located in. It can be specified from the address.

  In addition, the IPsec processing unit 21 receives data transmitted from the user terminal 10 after opening a communication path with the user terminal 10, and sends the data to the data transmission / reception unit 24. The data transmitted from the user terminal 10 at this time is data transmitted to either the first data network 40 or the second data network 50 in which a connection path has already been established as will be described later. Therefore, the IPsec processing unit 21 has a part of the function of the transmission unit.

  The control unit 22 of the packet data control apparatus 20 acquires user terminal information sent from the IPsec processing unit 21 and sends it to the information reference unit 23. The user terminal information sent to the information reference unit 23 is used to determine one or more data networks to which the user terminal can be connected, as will be described later. Therefore, the packet data control device 20 includes a part of a function as a determination unit that determines one or more data networks to which a user terminal can connect. In addition, the control unit 22 acquires data network information that can be connected to the user terminal 10 sent from the information reference unit 23 and instructs the data transmission / reception unit 24 to create a connection path. Data network information that can be held. Therefore, the control unit 22 includes a part of the function of a connection path establishment unit that establishes a connection path between the packet data control device 20 and the data network.

  Further, the information reference unit 23 receives user terminal information including information specifying the WLAN in which the user terminal 10 is located, sent from the control unit 22, and transmits the user terminal information to the authentication server 30. In addition, data network information that can be connected to the user terminal 10 transmitted from the authentication server 30 is received and sent to the control unit 22. As described above, the information reference unit 23 communicates with the authentication server 30.

  The data transmission / reception unit 24 functions as a connection path establishment unit that establishes a connection path between the first data network 40 and the second data network 50 and the data transmission / reception unit 24 in accordance with a connection path creation instruction sent from the control unit 22. To do. Also, it functions as a transmission means for acquiring data transmitted from the user terminal 10 sent from the IPsec processing unit 21, determining a data network to be transmitted with reference to the data, and transmitting the data to the data network. .

  Next, the function of each component of the authentication server 30 will be described. The information reference unit 31 receives user terminal information transmitted from the packet data control device 20 and sends it to the control unit 32. In addition, the control unit 32 receives data network information to which the user terminal 10 can be connected, and transmits the information to the packet data control device 20.

  The control unit 32 receives user terminal information sent from the information reference unit 32 and information specifying the WLAN 60 in which the user terminal 10 is located. Based on these pieces of information, the control unit 32 connects the user terminal information stored in advance in the subscriber information storage unit 33, information identifying the WLAN in which the user terminal is located, and the user terminal. The information specifying the data network that can be connected to the user terminal is acquired by referring to the correspondence with the information specifying the data network that can be connected, and sent to the information reference unit 301. That is, the control unit 32 functions as a determination unit.

  The subscriber information storage unit 33 functions as a storage unit that stores information that identifies a user terminal and a data network that can be connected to the user terminal, as described above.

  Here, an example of information stored in the subscriber information storage unit 33 will be described with reference to FIG. As shown in FIG. 4, the subscriber information storage unit 33 stores “mobile device type”, “WLAN” in the area, “presence / absence of service contract”, and “data network of connection destination” in association with each other. Has been. “Mobile device type” is information (user terminal information) indicating the type of user terminal, and is included in the communication path opening request transmitted from the user terminal 10. “WLAN” is information that identifies the WLAN in which the user terminal 10 is located, and can be determined from the IP address acquired by the user terminal 10. “Presence / absence of service contract” is whether the user who handles the user terminal 10 has a contract for receiving a service from the data network. Based on these pieces of information, the control unit 32 determines a data network to which the user terminal 10 can be connected. For example, if the mobile terminal type of the user terminal 10 is A and the user terminal 10 is located in WLAN # 1, if the user handling the user terminal 10 has made a service contract in advance (O), the user terminal 10 Are determined to be able to connect to the data network # 1 and the data network # 2, and the result (information specifying the data network) is sent from the control unit 32 to the information reference unit 31.

  The above-mentioned “type of mobile device”, “WLAN”, “presence / absence of service contract”, and “data network of connection destination” are stored in the subscriber information storage unit 33 in a state of being associated with each other in advance. In the example of the information stored in the subscriber information storage unit 33, the mobile device type is assigned for each type of terminal, but it is not necessarily required for each type of terminal. It is also possible to take a mode of distinguishing each. Moreover, the aspect of distinguishing according to the capability (function) of a terminal can also be taken.

  Subsequently, a data network connection method by the data network connection system 1 according to the present embodiment will be described in detail with reference to the sequence diagrams of FIGS. 5 and 7.

  First, using FIG. 5, a communication path is opened between the user terminal 10 and the packet data control device 20, and a connection path is connected between the packet data control device 20 and the first data network 40 and the second data network 50. The process of providing the will be described. A series of processes in FIG. 5 is performed when the user terminal 10 is in the WLAN 60.

  The user terminal 10 is located in the WLAN 60 (S01). When the user terminal 10 is in the WLAN 60, the user terminal 10 is assigned an IP address from an access point of the WLAN 60. Information indicating the WLAN 60 in which the user terminal 10 is located is specified based on the IP address assigned here. This process is automatically started by the user terminal 10 when the user terminal 10 is in the WLAN 60.

  Next, a communication path opening process is performed between the user terminal 10 and the packet data control device 20. Specifically, first, an IKE SA (Internet Key Exchange Security Association) for establishing a communication path is established between the user terminal 10 and the IPsec processing unit 21 of the packet data control device 20 (S02, reception step). ). In this step, the packet data control apparatus 20 receives “IKE SA INI Req” (IKE communication path establishment request) transmitted from the user terminal 10 as a communication path establishment request. The IKE packet packet data control device 20 that transmits the user terminal information to this “IKE SA INI Req” starts the communication path opening process by receiving this “IKE SA INI Req”. Next, “IKE SA INI Resp” is transmitted from the packet data control device 20 to the user terminal 10 to establish IKE SA. This IKE SA is a communication path used for exchanging information for opening a communication path (IPsec tunnel) in the present embodiment. In this step, “IKE AUTH Req” is further transmitted from the user terminal 10 to the packet data control apparatus 20. This is a request for performing detailed setting for a communication path opened between the user terminal 10 and the packet data control device 20. Data transmitted from the user terminal 10 in the above steps is transmitted as an IKE packet using a UDP (User Datagram Protocol) protocol. An example of the IKE packet at this time is shown in FIG. The IKE packet is configured in a format including a UDP header and encrypted data in a payload data portion according to the UDP protocol. In the UDP header portion, the IP address and transmission destination of the user terminal 10 that is the transmission source are described. Further, user terminal information (terminal type information, etc.) not described in the IP address is also described as an option in the UDP header portion. As described above, the step of receiving the communication path opening request may be performed by performing communication a plurality of times between the user terminal 10 and the packet data control device 20.

  Next, in order to perform mutual authentication between the user terminal 10 and the packet data control device 20, EAP (Extensible Authentication Protocol) authentication is performed between the packet data control device 20 and the authentication server 30 (S03, communication channel). Opening step). In this step, “EAP Req” is transmitted from the packet data control apparatus 20 to the authentication server 30, and then “EAP Resp” is transmitted from the authentication server 30 to the packet data control apparatus 20.

  Next, the user terminal 10 performs IKE authentication between the user terminal 10 and the IPsec processing unit 21 of the packet data control device 20 (S04, communication path opening step). This is a process for exchanging detailed settings and the like for a communication path opened between the user terminal 10 and the packet data control device 20. In this step, “IKE AUTH Resp” is transmitted from the packet data control apparatus 20 to the user terminal 10, and then “IKE AUTH Req” is transmitted from the user terminal 10 to the packet data control apparatus 20. Also in this step, the data is converted into an IKE packet by the UDP protocol and transmitted / received through the IKE SA which is a communication path provided in S02.

  Thereafter, EAP authentication is performed again between the packet data control device 20 and the authentication server 30 (S05, communication channel opening step). In this step, “EAP Req” is transmitted from the packet data control apparatus 20 to the authentication server 30, and then “EAP Resp” is transmitted from the authentication server 30 to the packet data control apparatus 20.

  On the other hand, the IPsec processing unit 21 of the packet data control device 20 acquires user terminal information included in the communication path opening request transmitted from the user terminal 10 in the reception step (S02) (S06, determination step). In the IPsec processing unit 21, the user is sent from the transmission source included in the IKE packet, that is, the IP address of the user terminal 10, which is transmitted as “IKE AUTH Req” from the user terminal 10 to the packet data control device 20 in the reception step (S 02). Terminal information and information specifying the WLAN 60 in which the user terminal 10 is located are acquired and sent to the control unit 22. For example, when the access point of the WLAN 60 has an IP address defined by “10.1.0.0/16”, the user terminal 10 residing in the WLAN 60 is informed of the WLAN 60, for example “10.1.2.2”. An IP address including information is assigned from the access point. Therefore, by acquiring the IP address of the user terminal 10 and referring to the IP address, information on the WLAN in which the user terminal 10 is located can also be acquired. The user terminal information acquired in this way and information specifying the WLAN 60 in which the user terminal 10 is located are transmitted from the information reference unit 23 to the authentication server 30 (S07, determination step). In the authentication server 30, the information reference unit 31 receives the user terminal information of the user terminal 10 and information specifying the WLAN 60 in which the user terminal 10 is located, and sends the information to the control unit 32. Based on these pieces of information, the control unit 32 stores information in which user terminal information stored in the subscriber information storage unit 33 is associated with information for specifying a data network to which the user terminal can connect. The data network to which the user terminal 10 can be connected is determined by referring to the determination (S08, determination step). The determination result (connection destination information) is transmitted from the control unit 32 to the information reference unit 31, and is transmitted from the information reference unit 31 to the packet data control apparatus 20 (S09). In the present embodiment, it is assumed that information specifying the first data network 40 and the second data network 50 is shown as connection destination information of the user terminal 10.

  In the information reference unit 23 of the packet data control device 20, connection destination information (first data network 40 and second data network) indicating information specifying a data network to which the user terminal 10 transmitted from the authentication server 30 can be connected. 50) is received and sent to the control unit 22. The control unit 22 holds the received connection destination information and instructs the data transmission / reception unit 24 to establish a connection path (S10, connection path establishment step). The data transmitting / receiving unit 24 establishes a connection path with the first data network 40 that is a connection destination instructed by the control unit 22 (S11, connection path establishment step). A connection path with the second data network 50 is also established (S12, connection path establishment step).

  After the connection path between the packet data control device 20 and the first data network 40 and the second data network 50 is established, IKE authentication is performed between the IPsec processing unit 21 of the packet data control device 20 and the user terminal 10. (S13, communication path opening step). In this step, “IKE AUTH Resp” is transmitted from the packet data control device 20 so far to the user terminal 10, and then “IKE AUTH Req” is transmitted from the user terminal 10 to the packet data control device 20. “IKE AUTH Resp” is transmitted again from the device 20 to the user terminal 10. Thus, the communication path (IPsec tunnel) opening process is completed.

  Next, referring to FIG. 7, in this embodiment, after a communication path is opened between the user terminal 10 and the packet data control apparatus 20, data is transmitted from the user terminal 10 to the packet data control apparatus 20 via the communication path. A process in the case where is transmitted will be described.

  The user terminal 10 transmits data to the packet data control device 20 through a communication path opened with the packet data control device 20 (S21). Here, it is assumed that the user terminal 10 transmits data necessary for receiving the provision of the service # 1 by the first data network 40 to the first data network 40. Data transmitted and received between the user terminal 10 and the packet data control device 20 via a communication path (IPsec tunnel) is encrypted by an ESP (Encapsulating Security Payload) protocol, and an IP header is added to the IP packet. It has become. An example of the IP packet at this time is shown in FIG. The IP packet is encrypted with the IP header, TCP (Transmission Control Protocol), and data, and the ESP header and ESP trailer / ESP authentication data are added before and after the IP packet. The configuration is such that an IP header is added. Among IP packets, the IP header describes the IP address of the user terminal 10 that is the transmission source.

  The IPsec processing unit 21 of the packet data control device 20 receives the data transmitted from the user terminal 10 through the communication path and sends it to the control unit 22. The control unit 22 refers to the data transmitted from the user terminal 10 and determines the data transfer destination (S22, transmission step). Here, the transfer destination is determined based on, for example, the TCP / UDP port number in the IP packet of FIG. As a result, when it is found that the transfer destination of the data is the first data network 40, the control unit 22 sends data to the data transmission / reception unit 24 and instructs transmission to the first data network 40. The data transmitter / receiver 24 transmits the data of the service # 1 to the first data network 40 according to the instruction from the controller 22 (S23, transmission step). As a result, the first data network 40 receives the data and provides the service # 1 to the user terminal 10 (S24).

  Further, when data necessary for the user terminal 10 to receive the provision of the service # 2 by the second data network 50 is transmitted to the second data network 50, the processing is performed by the same steps as described above. The user terminal 10 transmits data to the packet data control device 20 through a communication path opened with the packet data control device 20 (S31). The IPsec processing unit 21 of the packet data control device 20 receives the data transmitted from the user terminal 10 through the communication path and sends it to the control unit 22. The control unit 22 refers to the data transmitted from the user terminal 10 and determines the data transfer destination (S32, transmission step). When it is found that the data transfer destination is the second data network 50, the control unit 22 sends data to the data transmission / reception unit 24 and instructs transmission to the second data network 50. The data transmitter / receiver 24 transmits the data of the service # 2 to the second data network 50 according to the instruction from the controller 22 (S33, transmission step). Thereby, the second data network 50 receives the data and provides the service # 2 to the user terminal 10 (S34).

  As described above, according to the present embodiment, the first data network 40 and the first data network 40 are connected to the user terminal 10 and the packet data control device 20 via the packet data control device 20 without preparing a plurality of communication paths. It is possible to connect to a plurality of data networks such as two data networks 50. Therefore, since it is possible to easily connect to a plurality of data networks, it is possible to efficiently connect to the data network.

  In the present embodiment, the subscriber information storage unit 33 holds information for specifying a data network to which the user terminal 10 should be connected in advance. Therefore, in the conventional data network connection system, the user terminal 10 needs to specify a data network to be connected in advance. However, according to the data network connection system 1 of the present embodiment, a specific operation is performed on the user terminal 10. Instead, the data network to which the user terminal 10 can be connected can be switched according to the state of the WLAN in which the user terminal 10 is located. As a result, connection from the user terminal 10 to an appropriate data network is realized.

  The preferred embodiments of the present invention have been described above. However, the data network connection method and the data network connection system according to the present invention are not limited to the above embodiments, and can take various forms. It is.

  For example, in this embodiment, the data network connection system includes a packet data control device and an authentication server. However, the packet data control device and the authentication server may be arranged in the same device and connected via an internal bus.

  In the present embodiment, in the communication path opening request automatically transmitted from the user terminal when the user terminal is in the WLAN, a connection to a specific data network is requested via the data network connection system. No operation has been performed. However, it is also possible to make a communication path opening request by designating one or more data networks desired to be connected by the user terminal. Furthermore, in this embodiment, the data specifying the WLAN to which the user terminal is connected is determined using the information for specifying the WLAN in which the user terminal is located. However, the information for specifying the WLAN to which the user terminal is located is not essential. . That is, only the user terminal information may be used to determine the data network to which the user terminal is connected.

  Furthermore, in the above embodiment, IKE SA is used as a communication path used for exchanging information when a communication path (IPsec tunnel) is opened, but a communication path used for information exchange is created using another protocol. You can also Also, the communication path may use a format different from the IPsec tunnel used in this embodiment.

It is a figure which shows the structure of the data network connection system 1 which concerns on suitable embodiment of this invention, and those connection relations. It is a figure which shows the hardware constitutions of the packet data control apparatus 20, the authentication server 30, the 1st data network 40, and the 2nd data network 50 in embodiment of this invention. It is a figure which shows the hardware constitutions of the user terminal 10 in embodiment of this invention. In embodiment of this invention, it is a figure which shows a response | compatibility with the user terminal information previously stored in the subscriber information storage part 33, and the information which specifies the data network which the said user terminal can connect. In the embodiment of the present invention, a communication path is opened between the user terminal 10 and the packet data control device 20, and a connection path is established between the packet data control device 20 and the first data network 40 and the second data network 50. It is a sequence diagram which shows the process to provide. It is a figure which shows the structure of the packet used for transmission / reception of data in embodiment of this invention. In the embodiment of the present invention, after a communication path is opened between the user terminal 10 and the packet data control apparatus 20, a sequence showing processing when data is transmitted from the user terminal 10 to the control apparatus via the communication path. FIG.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Data network connection system, 10 ... User terminal, 20 ... Control apparatus, 21 ... IPsec processing part, 22 ... Control part, 23 ... Information reference part, 24 ... Data transmission / reception part, 30 ... Authentication server, 31 ... Information reference part , 32 ... control unit, 33 ... subscriber information storage unit, 40 ... first data network, 50 ... second data network, 60 ... WLAN.

Claims (3)

A data network connection system that is provided between a user terminal and a data network and mediates a connection between the user terminal and the data network via a WLAN,
Storage means for storing user terminal information for identifying a user terminal and information for identifying one or more data networks to which the user terminal can be connected;
When the user terminal is in a WLAN, it includes the user terminal information transmitted from the user terminal, and requests the opening of a communication path between the data network connection system and the user terminal. Receiving means for receiving a communication path opening request
Communication path opening means for opening a communication path between the data network connection system and the user terminal in accordance with the communication path opening request received by the receiving means;
Based on the user terminal information included in the communication path opening means received by the receiving means, the user terminal related to the user terminal information can be connected with reference to the information stored in the storage means A determination means for determining one or more data networks;
Connection path establishment means for establishing a connection path between each of the one or more data networks determined by the determination means and the data network connection system;
When data is transmitted via the communication path from the user terminal that has been opened by the communication path opening means and the connection path has been established by the connection path establishment means, the data is transferred to the one or more A transmission unit that determines which of the data networks to transmit , and based on the determination result, transmits the data to the one or more data networks via the connection path;
A data network connection system comprising: The storage means further stores the information specifying the WLAN in which the user terminal is located and the information specifying the data network to which the user terminal can be connected in association with each other;
The receiving means receives a communication path opening request including the user terminal information and information specifying the WLAN in which the user terminal is located;
The determination means stores in the storage means based on the user terminal information and information specifying the WLAN in which the user terminal is located, included in the communication path opening request received from the receiving means. 2. The data network connection system according to claim 1, wherein one or more data networks to which the user terminal related to the user terminal information can be connected are determined with reference to the handled correspondence. A data network comprising a storage means for storing user terminal information for specifying a user terminal and information for specifying a data network to which the user terminal can be connected in association with the connection between the user terminal and the data network A data network connection method of a connection system, comprising:
Requests opening of a communication path between the data network connection system and the user terminal, including the user terminal information related to the terminal transmitted from the user terminal when the user terminal is in a WLAN A receiving step for receiving a communication path opening request;
A communication path opening step for opening a communication path between the data network connection system and the user terminal according to the communication path opening request received in the receiving step;
Based on the user terminal information included in the communication path opening request received in the receiving step, the user terminal related to the user terminal information can be connected with reference to the information stored in the storage means A determining step of determining one or more data networks;
A connection path establishment step for establishing a connection path between each of the one or more data networks determined in the determination step and the data network connection system;
When data is transmitted through the communication path from the user terminal that has opened a communication path in the communication path opening step and has established a connection path in the connection path establishment step, the data is transferred to the one or more data. Determining to which network of the networks to transmit, based on the determination result, transmitting the data to the one or more data networks via the connection path;
A data network connection method characterized by comprising:

Images