JP5690239B2 - Method and system for remote access to a local network - Google Patents

Description

  The present invention relates to a method and system for remote access to a local network, and more particularly, to a method and system for remote access to a local network such as a home network or a corporate network from a destination or destination.

  In local networks such as homes and businesses, information terminals such as file servers and media servers are arranged, and technologies for accessing these information terminals from various places are attracting attention.

  In cellular communications, small base stations called femtocells have been introduced for the purpose of reinforcing coverage and offloading traffic. Until now, cellular communication via a small base station has been IP-terminated in the mobile core network of the operator and realized communication with external networks such as the Internet, so it was difficult to connect to a local network. In contrast, a local gateway having a function of terminating IP communication is arranged in a local network together with a small base station, and a local network of a home or a company is accessed via the small base station without going through a mobile core network. A method is being considered.

  As described above, when an IP termination device is arranged in a local network together with a small base station, an IP termination point for connecting to the local network can be provided even in cellular network communication at a destination or a moving destination. It is also expected to access the local network not only from a certain home or company, but also from the outside or destination.

  Further, as a technique related to these, a communication technique called “machine type communication” in which a communication module or the like automatically performs communication is known instead of communication used by a person as in the past. The communication module basically has a cellular communication function, and can communicate via a base station via cellular radio access. For example, the communication module can be expected as one communication means for remote access as described above. Note that a terminal that assumes machine type communication has a small amount of communication, and it is not necessary to support various communication patterns such as communication performed by a person, so that the configuration can be simplified.

  Non-Patent Document 1 discloses a technology for securely connecting a macro base station to a local network by constructing a security tunnel between an IP termination device in a small base station and a core network.

  In Patent Document 1, in communication between small base stations, even when the small base stations are in an environment under NAT, they are discovered by using SIP messages and communicated via a direct communication path that does not go through the core network. Techniques for performing are disclosed.

  In Non-Patent Publication 2, 3G and 3GPP specified by 3GPP are established by arranging a local gateway with a small base station, which is originally arranged in a core network and has a function equivalent to a gateway having an IP termination function in cellular communication. In cellular communication at 3.9G, a technique for directly connecting a communication from a small base station to a local network or the Internet without going through a core network is disclosed. Since the local gateway performs an operation in cooperation with the core network or a signaling operation for IP termination without affecting the user terminal, a security tunnel may be established with the core network. In addition, the local gateway can be arranged in the same node as the small base station, or can be arranged as another node.

JP 2010-87612 A

Chiba, Yokota, Miyanaga, "A Study on Security Remote Access from Wide-area Base Station to Femtocell", IEICE, 2010 IEICE Communication Society, B-7-41 3GPP TR 23.829 "Local IP Access and Selected IP Traffic Offload"

  In Patent Document 1, a security tunnel is constructed between a macro base station and an IP termination device for cellular communication arranged with a small base station and a core network, and remote access is realized using this tunnel.

  In this method, in order to realize remote access, a security tunnel constructed between the IP terminating device on the local network and the core network must always be maintained. Therefore, the processing load on the IP termination device and the core network always occurs regardless of whether there is remote access.

  On the other hand, when such a tunnel is not secured, it is usually difficult to construct a tunnel from the core network side to the IP termination device of the local network under NAT. In Patent Publication 1, in order to construct a communication path between small base stations under NAT, the path is constructed by using SIP signaling from the inside of NAT. This is difficult to implement when the terminal is not inside NAT.

  The object of the present invention is to solve the above-mentioned problems of the prior art, and when accessing a local network of a home or a company via a core network from a macro base station when going out, a path between the core network and the local network It is an object of the present invention to provide a remote access method and system for a local network capable of realizing remote access while minimizing the processing load for constructing and maintaining the network.

  In order to achieve the above object, the present invention is characterized in that, in a remote access method in which a wireless terminal connects from a macro base station to a local network via a core network, the following configuration is an invention specific matter. .

(1) Procedure for a wireless terminal to transmit a connection request in which the identifier of its own terminal and the local network name of the connection request destination are described from the macro base station to the core network

(2) server on the core network, in response to the connection request, a procedure of transmitting a paging request to the small base station of the local network, a server on the core network, the wireless terminal and A location management server that manages location information of the wireless module and an authentication server; a location management server that manages location information of the wireless terminal receives the connection request from the wireless terminal and forwards the connection request to the authentication server; In response to the connection request, the authentication server transmits the paging request including the GW information for accessing the wireless module and the request for establishing the security tunnel to the position management server that manages the position information of the wireless module. And a location management server that manages location information of the wireless module sends the paging request. To send to the serial small base station

(3) procedures in which the small base station, in response to the paging request, paging a wireless module connected to the local gateway connected to the local network

(4) Step the wireless module, in response to said paging, requesting security tunnel construction from the local gateway side to the local gateway

(5) Procedure wherein the local gateway, in response to the request of the security tunnel construction, building a security tunnel between the core network

(6) Step a wireless terminal, to establish the connection using the security tunnel to the local network

  According to the present invention, when a wireless terminal requests connection to a local network via a core network at a destination or the like, the wireless module connected to the local GW of the local network is paged in response to the connection request, In response to the request from the wireless module, the local GW establishes a security tunnel between the local GW side and the core network. Therefore, without always maintaining a security tunnel between the local network and the core network, the wireless terminal simply requests a connection from the outside location to the local network and uses the security tunnel that is constructed each time. To establish a connection with.

It is the block diagram which showed the structure (the 1) of the network to which the remote access method to the local network of this invention is applied. It is the functional block diagram which showed the structure of the principal part of local GW and a radio | wireless module. It is the block diagram which showed the structure (the 2) of the network to which the remote access method to the local network of this invention is applied. It is the sequence flow which showed the operation | movement of one Embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing a configuration of an embodiment of a network to which the present invention is applied. A local NW and a mobile core NW are connected via the Internet.

  The wireless terminal 1 includes a wireless interface for cellular communication and authentication information for connection authentication, establishes a communication session by executing connection signaling processing via the macro base station 5 and the small base station 2, and the Internet Communication with external networks. In the connection request, the connection destination network can be designated as the access point name. As the access point name, the Internet or a local network can be specified.

  The macro base stations 5 and 11 provide wireless connection to the wireless terminal 1 at the destination, and transfer communication data to the core NW. In addition, a paging function for delivering notification information to the subordinate wireless terminal 1 is provided. The access GW 10 operates as an entrance router when the wireless terminal 1 connects to the core NW via the macro base station 5. Also, a function for establishing a connection from the access GW 10 to the local GW 3 serving as an exit router is provided.

  The local GW 3 serves as an IP termination device in cellular communication and functions as a gateway serving as an exit from the core NW or the like. In addition to receiving data from the access GW 10 and transferring it to the local NW as a destination, it has a function of constructing a security tunnel for cooperation with the core NW and execution of signaling. After construction of the security tunnel, a function of registering address information of the local GW 3 in the authentication server 8 is provided.

  Here, in this embodiment, the wireless module 4 having a uniquely identifiable terminal identifier is mounted and connected to the local GW 3. The wireless module 4 can cause the local GW 3 to perform security tunnel construction from the local GW 3 side in response to a tunnel construction request included in the paging triggered by paging reception via the cellular network. . In addition, it has a function of registering a terminal identifier for paging and its position information in the authentication server 8 in the core NW.

  The small base station 2 of the local NW provides a wireless connection to the wireless terminal 1 and has a function of transferring communication data to the mobile core NW. In addition, a paging function for delivering notification information to the subordinate wireless terminal 1 is provided. Further, when there is a local GW 3 as an IP termination device, it has a function of directly transferring user data communication of the wireless terminal 1 to the local GW 3 without going through the core NW. The small base station 2 is configured as the same node as the local GW 3, and communicates with each other as an internal signal, or may be arranged as a separate node and communicate with each other using IP or the like.

  When the wireless module 4 and the wireless terminal 1 connect to the core NW via the small base station 2 and the macro base station 5 respectively, the mobility management nodes 7 and 9 execute signaling and manage the position information. To do. Further, when a paging request for the wireless module 4 is received, a base station that can be connected is identified based on the registered location information, and a paging request is transmitted to the base station.

  The authentication server 8 holds contractor information of the wireless terminal 1, setting information for connection, and the like, and returns each information in response to requests from the mobility management nodes 7 and 9. The setting information includes the access point name of the connection destination desired by the wireless terminal 1, the address information of the local GW 3 serving as the IP termination destination corresponding thereto, and the like. If there is no address information of the local GW 3, the terminal identifier and location information of the wireless module 4 connected to the local GW 3 are registered instead, and when there is a connection request to the local NW, the terminal identifier and Paging can be performed based on the position information.

  The security GW 6 has a function of constructing a security tunnel with the local GW 3 as a secure communication path when the small base station 2 or the local GW 3 performs a function in cooperation with the core NW, signaling, traffic transfer, or the like.

  FIG. 2 is a functional block diagram showing the configuration of the main parts of the local GW 3 and the wireless module 4, and illustrations of components unnecessary for the description of the present invention are omitted.

  In the wireless module 4, in the paging parameter storage unit 401, terminal identifier ID4 and position information P4 of the wireless module 4 are registered as information necessary for paging the wireless module 4 via the cellular network. The paging parameter notification unit 402 notifies the local GW 3 of the paging parameter using a connection with the local GW 3 or a request from the local GW 3 as a trigger.

  The cellular radio IF 404 controls communication with the cellular network. The paging detection unit 405 detects paging transmitted with its terminal identifier ID4 as the destination via the cellular network. The paging analysis unit 406 analyzes the message described in the paging addressed to itself. In the present embodiment, a security tunnel construction request is described as a message together with its connection destination (here, security GW 6). The processing request unit 404 transmits a request for establishing a security tunnel with the security GW 6 from the local GW 3 side to the local GW 3 via the IF 405.

  In the local GW 3, the paging parameter acquisition unit 302 acquires the paging parameters notified from the wireless module 4 via the IF 301. The local GW information registration unit 303 registers the notified paging parameter in advance as local GW information in the authentication server 8 of the mobile core NW.

  The process accepting unit 304 accepts a security tunnel construction request notified from the wireless module 4 via the IF 301. The security tunnel construction unit 305 constructs a security tunnel with the security GW 6 in response to the security tunnel construction request.

  FIG. 3 is a block diagram showing a configuration of another embodiment of a network to which the present invention is applied. The same reference numerals as those described above represent the same or equivalent parts, and thus description thereof is omitted. The present embodiment is characterized in that the local NW and the mobile core NW are directly connected without going through the Internet.

  Next, the remote access operation of the present invention will be described in detail with reference to the sequence flow of FIG.

[Pre-processing]
At time t1, local GW information necessary for the wireless terminal 1 to page the wireless module 4 connected to the local GW 3 of the local network from the outside (movement destination) of the NAT 12 is the local GW information registration unit 303 of the local GW 3. To the authentication server 8 via the security GW 6.

  In the present embodiment, a pair of the terminal identifier ID4 and the position information P4 of the wireless module 4 is registered as local GW information necessary for paging. In the present embodiment, the identifier of the small base station 2 to which the wireless module 4 can be connected is used as the position information P4 of the wireless module 4. Since the small base station 2 periodically notifies its own identifier, the wireless module 4 can acquire position information without establishing a wireless connection with the small base station 2. In cellular communication, the location information of communicable wireless devices is managed by the mobility management node (7, 9) of the core NW. In this case, only the terminal identifier ID4 of the wireless module 4 is registered. May be.

  Such a registration process of local GW information is performed by a wireless terminal establishing a connection with the local GW 3 via the small base station 2 and communicating with the local NW. It can be executed from the local GW 3 when disconnecting, and then the local GW 3 can disconnect the security tunnel with the core NW.

  At time t2, in the authentication server 8 that has received the GW information [ID4, P4] from the local GW 3, the local GW information [ID4, P4] responds to a remote access request from the wireless terminal 1 to the local NW. , It is registered as unique information for paging the wireless module 4.

  Note that when a security tunnel is established between the local GW 3 and the security GW 6 and there is an access path from the core NW, the address information of the local GW 3 can also be retained. In that case, when the security tunnel is disconnected, the address information is also deleted.

  In the present embodiment, these pre-processing eliminates the need to maintain a security tunnel by the security GW 6 when there is no connection to the local GW 3, thereby eliminating the management cost.

[Connection processing]
At time t3, when the destination wireless terminal 1 transmits a message requesting connection with the local NW in response to the connection request operation by the terminal user, the connection request is transmitted from the macro base station 5 that is wirelessly connected to the mobile core. It is transmitted to the mobility management node 9 of the NW. In this connection request message, connection authentication information including the identifier of the wireless terminal 1 and information designating the local NW as the access point name of the connection destination are described.

  At time t4, the mobility management node 9 that has received the connection request message inquires the authentication server 8 about information for establishing a connection. At that time, the connection authentication information including the terminal identifier received from the wireless terminal 1 and the access point name of the local NW are notified to the authentication server 8. At time t5, the authentication server 8 that has received the inquiry refers to the information for connecting to the local network based on the connection authentication information including the identifier of the wireless terminal 1 and the access point name of the local network.

  Here, since the address information of the local GW 3 is not registered in the authentication server 8, the terminal identifier ID 4 and the position information P 4 (the local GW information) of the wireless module 4 connected to the local GW 3 paging the wireless module 4. It is acquired as necessary information. Then, the wireless module 4 is transmitted as a paging request to the mobility management node 7 whose location is registered in advance. In this paging request, a message for requesting the local GW 3 to construct a security tunnel from the local GW 3 side is described together with the terminal identifier and position information of the wireless module 4 (the local GW information [ID4, P4]). .

  In this embodiment, since the location of the wireless module 4 is registered in the mobility management node 7 and the location of the wireless terminal 1 is registered in the mobility management node 9 at the destination, information related to the message request is stored in the plurality of mobility management nodes 7. , 9, but if the wireless module 4 and the wireless terminal 1 are registered in the same mobility management node, there is no need to transmit / receive information between the plurality of mobility management nodes.

  At time t6, in the mobility management node 7 that has received the paging request, the small base station 2 that transfers the paging request is specified based on the location information P4, and the paging request is transferred to the destination.

  At time t7, the small base station 2 that has received the paging request broadcasts the paging request in which the terminal identifier ID4 of the wireless module 4 and the message requesting the security tunnel construction from the local GW side are described. In the present embodiment, the small base station 2 is selected as the paging request transfer destination. However, if the paging request can be appropriately transferred to the wireless module 4, the macro base station 11 is selected as the paging request transfer destination. You may make it.

  At time t8, the paging detection unit 405 of the wireless module 4 that has received the paging request by the cellular radio IF 404 determines whether or not the message is addressed to itself based on the terminal identifier included in the paging request. Is done. If it is a paging request addressed to itself, the message analysis unit 406 analyzes the message and recognizes that it is a security tunnel construction request with the security GW 6 as a connection destination. The processing request unit 407 transmits a security tunnel construction request with the security GW 6 as a connection destination to the local GW 3 via the IF 403.

  In the local GW 3, the security tunnel construction request is accepted by the processing accepting unit 304, and the security tunnel construction unit 305 starts processing for constructing a security tunnel with the security GW 6.

  Note that the wireless module 4 receiving a paging request and performing a specific process is similar to a mail incoming process in cellular communication. That is, in the cellular communication, when the mail arrival is notified from the mail server, the core NW transmits a paging request together with information notifying the mail arrival to the destination terminal. The terminal that has received the paging request starts a mail application with this as a trigger, accesses the mail server, and acquires mail.

  At time t9, a security tunnel construction process is performed from the local GW 3 to the security GW 6. In many cases, the local NW is under the NAT, but here, since communication is performed from the local GW 3 in the local NW, access to the security GW 6 is possible.

  When a security tunnel is established between the local GW 3 and the security GW 6 in this way, at time t10, the security GW 6 accesses the authentication server 8 and registers the address information of the local GW.

  At time t11, the authentication server 8 returns the address information of the local GW 3 to the mobility management node 9. At time t12, the mobility management node 9 transmits a connection request to the access GW 10 serving as an entrance to the core NW of the wireless terminal 1 using the acquired address of the local GW 3 as a connection destination.

  At time t13, the access GW 10 transmits a connection request to the local GW 3. At this time, since a security tunnel is established between the local GW 3 and the security GW 6, this connection request can be delivered via the security tunnel.

  At time t14, in response to the connection request, the local GW 3 makes settings for communication with the wireless terminal 1 and returns a connection response to the access GW 10. The access GW 10 also makes a connection response to the mobility management node 9. The mobility management node 9 confirms the establishment of the connection and responds via the macro base station 5 to the wireless terminal 1 that the connection request to the local NW has been accepted.

  At time t15, a communication path that relays the macro base station 5, the access GW 10, the security GW 6, and the local GW 3 is established between the wireless terminal 1 and the local NW by the series of processes described above. Access to the local network from the destination is possible.

  DESCRIPTION OF SYMBOLS 1 ... Wireless terminal, 2 ... Small base station, 3 ... Local GW, 4 ... Wireless module, 5 ... Macro base station, 6 ... Security GW, 7, 9 ... Mobility management node, 8 ... Authentication server, 10 ... Access GW

Claims (5)

In a remote access method in which a wireless terminal connects to a local network from a macro base station via a core network,
A procedure in which the wireless terminal transmits a connection request in which the identifier of the own terminal and the local network name of the connection request destination are described from the macro base station to the core network;
And procedures server on the core network, in response to the connection request, transmits a paging request to the small base station of the local network,
The small base station, in response to the paging request, paging a wireless module connected to a local gateway connected to the local network ;
The procedure the wireless module, in response to said paging, requesting security tunnel construction from the local gateway side in said local gateway,
The local gateway responding to the security tunnel construction request to construct a security tunnel with the core network;
The wireless terminal, viewed contains a procedure for establishing a connection to the said local network by using security tunnel,
The server on the core network includes a location management server that manages location information of the wireless terminal and the wireless module, and an authentication server,
In the procedure on the server on the core network,
A location management server that manages location information of the wireless terminal receives the connection request from the wireless terminal and forwards it to an authentication server;
In response to the connection request, the authentication server sends the paging request including the GW information for accessing the wireless module and the security tunnel construction request to the location management server that manages the location information of the wireless module. Send
A remote access method to a local network , wherein a location management server that manages location information of the wireless module transmits the paging request to the small base station.   Including a procedure in which a local gateway of the local network pre-registers information for accessing a wireless module connected to the local network to a server on the core network as GW information for remotely accessing the local network. The method for remote access to a local network according to claim 1.   The local network and the core network are connected via the Internet, the Internet is connected to a security gateway of the core network, and the security tunnel is constructed between the local gateway and the security gateway. The remote access method to the local network of Claim 1 or 2.   The remote access to the local network according to claim 1 or 2, wherein the local network is connected to a security gateway of a core network, and the security tunnel is established between the local gateway and the security gateway. Method. In a remote access system in which a wireless terminal connects to a local network from a macro base station via a core network,
A wireless module connected to the local gateway of the local network;
A small base station in the local network,
It transmitted from the wireless terminal, in response to the described connection request identifier and the connection request destination local network name of the wireless terminal, and a server on a core network that transmits paging request to the small base station And
The small base station pages the wireless module in response to the paging request,
In response to the paging, the wireless module requests the local gateway to establish a security tunnel from the local gateway side,
The local gateway establishes a security tunnel with the core network in response to the security tunnel construction request,
The wireless terminal establishes a connection to the local network using the security tunnel ;
The server on the core network includes a location management server that manages location information of the wireless terminal and the wireless module, and an authentication server,
A location management server that manages location information of the wireless terminal receives the connection request from the wireless terminal and transfers the connection request to an authentication server.
In response to the connection request, the authentication server sends the paging request including the GW information for accessing the wireless module and the request for establishing the security tunnel to the location management server that manages the location information of the wireless module. Send
The location management server that manages location information of the wireless module transmits the paging request to the small base station.