JP5713833B2 - Communication system and operation support method - Google Patents

Description

Embodiments described herein relate generally to a communication system including a plurality of base stations and an operation support method for the communication system.

  Existing circuit switched networks are being replaced by Internet Protocol (IP) networks. Against this backdrop, telecommunications carriers are promoting the use of IP / optical communication, and the number of IP telephone subscribers is increasing year by year. Further, attention is also focused on next-generation IP (Internet Protocol) network technology called NGN (Next Generation Network). Therefore, as typified by cloud technology, there is an increasing demand to freely distribute network devices on an IP network. This type of device has an IP interface.

  By the way, in order to smoothly operate a communication network, it is necessary to monitor a device (network device) connected to the network and manage the state of each device. Correspondence between a device (monitoring device or control device) responsible for monitoring control and a device (monitored device) to be monitored and controlled is the main procedure.

  Traditionally, this procedure has been carried out manually by a network operator, so it has been proposed that it can be automated, and a patent application has been filed (for example, Japanese Patent Application No. 2011-057243). According to the invention of this application, there are advantages that the burden on the operator is reduced and the expansion of the distributed communication system becomes easy.

JP 2005-94600 A

In actual system operation, an initial setting procedure including not only associating a monitoring apparatus with a monitored apparatus but also assigning an IP address to a device connected to the network is necessary. When an unspecified number of devices are connected to the network without strictly performing the initial setting procedure, there is a problem particularly from the viewpoint of ensuring security. However, at the present time, there is no known technique for automating the initial setting procedure, further reducing the load on the operator and promoting the improvement of security.
An object of the present invention is to provide a communication system and an operation support method capable of reducing the labor involved in system operation, further improving the degree of freedom of arrangement of monitored devices while ensuring security.

According to the embodiment, the communication system includes a gateway interconnecting the first first second network having different security levels and the network of networks Toko guaranteed security. The first network includes a base station, a radio unit, an authentication processing unit, and a notification unit. The base station forms a radio zone. The wireless unit receives an authentication request message from the first device connected to the second network via the base station. The authentication processing unit performs authentication processing for the first device in response to the authentication request message. If the authentication process is successful, the notification unit notifies the first device via the base station of a response message including the gateway address information. The gateway includes a connection processing unit. The connection processing unit forms a communication link between the second device connected to the first network and the first device in response to a connection request from the first device using the notified address information.

1 is a system diagram showing an example of a communication system according to an embodiment. 1 is a system diagram showing an example of a first embodiment of a communication system. The functional block diagram which shows the function with which the system shown by FIG. 2 is equipped. FIG. 4 is a sequence diagram showing a processing procedure performed in the system shown in FIGS. 2 and 3. The figure which shows an example of the information exchanged between entities in the sequence shown by FIG. The conceptual diagram which shows the transmission path | route of the information in the communication system concerning embodiment. The system diagram which shows an example of 2nd Embodiment of a communication system. The functional block diagram which shows the function with which the system shown by FIG. 7 is equipped. FIG. 9 is a sequence diagram illustrating a processing procedure performed in the system illustrated in FIGS. 7 and 8. The system diagram which shows an example of 3rd Embodiment of a communication system. The functional block diagram which shows the function with which the system shown by FIG. 10 is equipped. FIG. 12 is a sequence diagram illustrating a processing procedure performed in the system illustrated in FIGS. 10 and 11.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. This embodiment will be described assuming a PHS (Personal Handy phone System). In addition, the embodiment can also be applied to a cellular phone system known as a so-called mobile phone system or an XGP (eXtended Global Platform) called a next generation PHS.

  FIG. 1 is a system diagram showing a communication system according to the embodiment. This system is formed with the communication network 100 and the control devices G11 and G12 connected to the communication network 100 as the core. The communication network 100 includes, for example, an IP (Internet Protocol) network, a packet communication network using an IP-VPN (IP-Virtual Private Network), or an ISDN (Integrated Service Digital Network).

  In this embodiment, TCP / IP (Transmission Control Protocol / Internet Protocol) is assumed as a protocol of the communication network 100. In the embodiment, it is assumed that the communication network 100 includes two IP networks having different security levels.

  The communication network 100 is provided with a management system 400 for remotely controlling the control devices G11 and G12 remotely and providing various communication services. The management system 400 is realized, for example, by installing dedicated application software on a general-purpose server device.

  The management system 400 includes a database 44 and also functions as a host device for managing monitored devices existing in the system. That is, the management system 400 is positioned in the upper hierarchy of the control devices G11 and G12, and manages or monitors and controls the communication system based on notifications from the control devices G11 and G12. One of the functions is, for example, a failure management function for managing a failure occurrence state in each device in the communication system. Protocols for network management include CMIP (Common Management Information Protocol) or SNMP (Simple Network Management Protocol), but protocols applicable to the embodiments are not limited to these.

  The control device G11 is connected to the base station CS11 via an individual line. The control device G12 is connected to the base stations CS21 and CS22 via another individual line. That is, the base station CS11 is under the control device G11, and the base stations CS21 and CS22 are under the control device G12. Each of the control devices G11 and G12 has a function as a connection device that connects the connected base station to the communication network 100. The number of base stations connected to the control devices G11 and G12 (the codes are unified with CS) is not limited to that shown in FIG.

  Base stations CS11, CS21 and CS22 each form a radio zone (hereinafter referred to as a cell), and communicate with mobile terminals PS (PS11 and PS12) located in the cell via a radio channel. As the mobile terminals PS11 and PS12 move, they hand over each cell and switch the connection destination base station CS. The control devices G11 and G12 can also form a communication link between each other via the communication network 100, and the mobile terminals PS11 and PS12 can communicate with each other via this link.

  In order to realize end-to-end communication between communication terminals, the control devices G11 and G12 perform protocol conversion, exchange processing, etc. between opposing devices (gateway in communication network 100, control device of communication partner, etc.) Responsible for various controls. The control devices G11 and G12 specify signals (digital signals such as audio data, video and image data, data for performing various services, etc.) communicated via the base station CS via the communication network 100. Process according to the communication type.

  Incidentally, the system shown in FIG. 1 includes network devices 501, 502, and 503 connected to the communication network 100 via wired or wireless communication. The network devices 501 to 503 are distributed in the communication network 100, and are positioned as a lower layer in system management and function as monitored devices.

  The network devices 501 to 503 are provided in the user home 600, for example. In short, the network device is a device that can be directly or indirectly connected to the communication network 100. The network devices 501 to 503 have a function of connecting to the base station CS via a wireless channel, and can communicate with the communication network 100 and the management system 400 via the connection destination base station.

  1 includes a relay unit 700 for connecting a personal computer (PC) or a fixed telephone (TEL) to the control devices G11 and G12. The relay unit 700 is also a network device. This type of device is sometimes referred to as a terminal adapter (TA). If voice call software is installed on a PC, it can be used as a telephone. Furthermore, an access point (not shown) compliant with a wireless LAN (Local Area Network) standard may be connected to the control devices G11 and G12. Next, a plurality of embodiments will be described.

[First Embodiment]
FIG. 2 is a system diagram showing an example of the first embodiment of the communication system. The system shown in FIG. 2 is based on the system shown in FIG. The internal IP network 101, the external IP network 102, and the gateway 200 interconnecting these networks shown in FIG. 2 correspond to the communication network 100 in FIG. That is, the communication network includes the internal IP network 101, the external IP network 102, and the gateway 200.

In the embodiment, the management system 400 provides an authentication service. The security of the internal IP network 101 is guaranteed by this authentication service. That is, the internal IP network 101 is positioned as a secure network.
The security level of the internal IP network 101 and the security level of the external IP network 102 are different from each other. That is, the security of the internal IP network 101 is guaranteed, but the external IP network 102 is not limited thereto. An example of the internal IP network 101 is a private network using a communication carrier. An example of the external IP network 102 is a so-called Internet.

  The control devices G11 and G12 and the management system 400 in FIG. 1 belong to the internal IP network 101. Therefore, the base stations CS11 and CS22 also belong to the internal IP network 101. Network devices 501 and 502 are connected to the external IP network 102. The network device 503 is connected to the internal IP network 101. Therefore, in order for the network devices 501 and 502 to communicate with the network device 503, it is necessary to go through the gateway 200. For this purpose, various initial settings are required. In the first embodiment, the processing procedure will be described.

FIG. 3 is a functional block diagram showing functions provided in the system shown in FIG. In FIG. 3, the base station CS11 includes a radio unit CSa, and the network device 502 includes a radio unit 502a. The base station CS11 and the network device 502 can perform wireless communication with each other by the functions of the wireless unit CSa and the wireless unit 502a.
The control device G11 includes a registration processing unit Ga. The registration processing unit Ga determines which control device the individual network device falls under. Note that the management system 400 may include a registration processing unit Ga.

  The gateway 200 includes a connection processing unit 200a. The connection processing unit 200a provides a processing function for forming a communication link between a calling source network device and a calling destination network device. In a system that employs a general Session Initiation Protocol (SIP) as a call connection processing procedure, the gateway 200 serves as a SIP server by including the connection processing unit 200a.

  The internal IP network 101 and the management system 400, the control device G11, and the gateway 200 are connected by wire. The control device G11 and the base station CS11 are also connected by wire. A wireless connection is established between the base station CS11 and the network device 502. The network device 502 and the external IP network 102 can be connected by wire or wireless. The same applies to the network device 502 and the internal IP network 101.

  Incidentally, the management system 400 includes an authentication processing unit 400a as a processing function according to the embodiment. The base station CS11 includes an authentication processing unit CSb and a radio notification unit CSc. The gateway 200 includes an authentication processing unit 200b.

When the authentication processing unit 400a, CSb, 200b receives a message requesting authentication sent from the network device 502 connected to the external IP network 102 via the base station CS11, the authentication processing unit 400a, CSb, 200b responds to the network device 502 that is the transmission source of this message. Perform the authentication processing procedure. Then, by returning a response message to the network device 502, the authentication processing units 400a, CSb, and 200b respond with the result of the authentication processing procedure.
The radio notification unit CSc notifies the network device 502 of the response message indicating the result of the authentication processing procedure via the base station CS11. Next, the operation of the above configuration will be described.

FIG. 4 is a sequence diagram showing a processing procedure executed in the system shown in FIGS. In the embodiment, the following three stages are considered as the authentication processing procedure.
(1) A first processing procedure for authenticating whether or not a transmission source network device can access the management system 400.

  (2) A second processing procedure for authenticating whether or not the transmission source network device can access the gateway 200.

(3) A third processing procedure for authenticating whether or not the transmission source network device can access the internal IP network 101.
The processes (1) to (3) are an example of an initial setting procedure required when starting operation of a network device. Other initial setting procedures include assignment of IP addresses to network devices.

  As shown in FIGS. 2 and 3, the network device 502 is connected to the external IP network 102, and the network device 503 is connected to the internal IP network 101. In FIG. 4, the network device 502 is the connection source, and the network device 503 is the connection destination.

  In FIG. 4, when connected to the external IP network 102, the network device 502 sends a communication request to the base station CS11 (step S1). In response, the base station CS11 performs security authentication and determines whether or not the network device 502 can access the base station CS11 (step S2). If this authentication is successful, the base station CS11 returns a communication establishment response to the network device 502 (step S3). Thereby, the procedure (1) is completed, and the network device 502 is permitted to access the management system 400. The procedure so far is mainly a wireless communication function provided in the network device 502 and the base station CS11.

  Next, the network device 502 that has received the communication establishment response transmits an operation start request to the management system 400 via the control device G11 (step S4). This operation start request includes terminal identification information (registration information such as a subscriber number and a telephone number) of the network device 502 and a media access control (MAC) address. The management system 400 refers to the database 44 and determines whether or not authentication is possible by verifying the correspondence between the received identification information and the MAC address (step S5). If the authentication is unsuccessful, it becomes NG.

  If the authentication is successful (Yes in step S5), an operation start response is returned to the network device 502 (step S6). This operation start response includes initial setting information required for the network device 502 to access the gateway 200, such as the IP address of the gateway 200. Thereby, the procedure (2) is completed, and the network device 502 is permitted to access the gateway 200.

  Next, the network device 502 transmits an authentication request message to the gateway 200 using the IP address of the gateway 200 (step S7). This authentication request includes a user name and a password associated with the network device 502. The gateway 200 performs an authentication process for the network device 502 based on these pieces of information (step S8). If the authentication is unsuccessful, it becomes NG.

  If the authentication is successful (Yes in step S8), an authentication response is returned to the network device 502 (step S9). This authentication response includes information necessary for the network device 502 to access the internal IP network 101, such as an IP address assigned to the network device 502. Thereby, the procedure (3) is completed, and the network device 502 is permitted to access the internal IP network 101.

  The procedure so far is mainly the initial setting procedure. This procedure is a procedure related to the initial setting of the network device including the IP address assignment. The initial setting procedure is a procedure for obtaining information (user name, password, etc.) necessary for security authentication and connection destination device information (IP address, etc.) via a base station when a network device connects to a different IP network with VPN. Is included. In the embodiment, by automating such a procedure, the operator is freed from the conventional manual setting process.

  When the procedure up to step S9 is completed, the network device 502 can connect from the external IP network 102 to the network device 503 belonging to the internal IP network 101. The network device 502 transmits a call request with the network device 503 as a connection destination to the gateway 200 (step S10). The gateway 200 returns a call connection response including the IP address of the network device 503 to the network device 502 (step S11). Then, after the call connection processing procedure is performed (step S12), a communication link is formed between the network devices 502 and 503 by, for example, virtual private network (VPN) connection, and both devices are in a communication state (step S13). ).

FIG. 5 is a diagram showing an example of information exchanged between entities in the sequence shown in FIG. The brackets correspond to each step in the authentication process procedure.
FIG. 6 is a conceptual diagram showing an information transmission path in the communication system according to the embodiment. In the embodiment, the network device 502 transmits information required for initial setting via the radio channel of the base station CS11 to the management system 400. Get from. Then, the gateway 200 is accessed using its own IP address included in the acquired information and the IP address of the gateway 200, and a call can be made from the external IP network 102 to the internal IP network 101. At this time, the authentication processing procedure is executed, and if any procedure is NG, the initial setting information including the IP address is not notified to the network device 502.

  In the existing communication system, when a large number of network devices are distributed on the IP network, it is necessary to initialize each network device manually by an operator. For example, prior to communication on the IP network, it is necessary to manually set IP address assignment and VPN. Even if IP address assignment is automated using Dynamic Host Configuration Protocol (DHCP), since broadcast is used, it is necessary to install a DHCP server or a DHCP relay agent in each network. On the other hand, in an environment connected by VPN, it is necessary to manually input a connection destination IP address, authentication information, and the like to the network device.

  Furthermore, when connecting a network device to an external IP network, access from a device that is not originally permitted to be connected is assumed, so it is necessary to consider security authentication for preventing unauthorized access. That is, if a large number of network devices are connected to the network without initial setting, there is a security problem.

  For the reasons described above, in order to further increase the degree of freedom of arrangement of network devices on the IP network, a system architecture that can automatically start communication without being manually set without being affected by the network environment is required. It is done.

  Therefore, in the first embodiment, the internal IP network 101, which is a secure network, is provided with an authentication processing unit and a wireless notification unit. The authentication processing unit authenticates the network device connected to the external IP network 102 in three stages in the initial setting procedure. Information necessary for authentication and a necessary IP address are exchanged between the internal IP network 101 and the network device by the wireless notification unit via the wireless channel of the wireless zone formed by the base station. This authentication processing procedure includes assignment of an IP address. If this procedure is successful, the network device communicates with the network device of the internal IP network 101 via a gateway connecting the internal IP network 101 and the external IP network 102. It becomes possible to form a communication link.

  Since it did in this way, the network device can acquire the information required for initial setting via a radio | wireless, and the initial setting for a network device to function by an IP network is automated. In other words, if the network device is installed in the IP network (specifically, within the wireless zone), it is connected to the base station by wireless communication, and the initial setting sequence is automatically performed. Therefore, it is possible to connect to the IP network without manual setting work. Can do.

  The security of the internal IP network 101 is ensured, and the reliability of the secure network can be used by performing authentication in the internal IP network 101. In other words, the initial setting target is limited to network devices registered in the radio access network on the internal IP network 101 side. Therefore, even if the network device is connected to the external IP network 102, unauthorized access from an unauthorized terminal can be prevented.

Accordingly, it is possible to provide a communication system and an operation support method capable of reducing the labor involved in system operation, further improving the degree of freedom of arrangement of monitored devices while ensuring security. .

[Second Embodiment]
FIG. 7 is a system diagram showing an example of the second embodiment of the communication system. In FIG. 7, parts that are the same as those in FIG. 2 are given the same reference numerals, and only different parts will be described here. The system shown in FIG. 7 does not include the external IP network 102 and therefore does not have the gateway 200. It is assumed that communication between network devices is performed in a form closed to the internal IP network 101. In the second embodiment, it is assumed that the networks 501 and 502 are connected to the internal IP network 101.

  FIG. 8 is a functional block diagram showing functions provided in the system shown in FIG. In the second embodiment, the management system takes over the function of the gateway 200 (FIG. 3) and includes a connection processing unit 400b. The connection processing unit 400b provides the SIP server function, and the network device can communicate within the internal IP network 101 without using a gateway.

  FIG. 9 is a sequence diagram showing a processing procedure executed in the system shown in FIGS. The sequence shown in FIG. 9 is characterized in that the management system 400 receives an operation start request and an authentication request of the network device 502 (step S40), and returns an operation start response and an authentication response (step S60). In step S40, the network device 502 notifies the management system 400 of information such as a user name and password in addition to the MAC address. If the authentication of the network device 502 is successful, the management system 400 provides an IP address to the network device 502 in step S60. After the procedure so far is completed, a communication link with the network device 501 is formed in response to a call request from the network device 502, and communication by VPN connection becomes possible.

  As described above, even when the management system 400 substitutes for the function of the SIP server, it is possible to reduce the labor involved in the operation of the system and further improve the degree of freedom of arrangement of the monitored devices.

[Third Embodiment]
FIG. 10 is a system diagram showing an example of the third embodiment of the communication system. 10, parts that are the same as those in FIG. 2 are given the same reference numerals, and only different parts will be described here. The system shown in FIG. 10 corresponds to a system in which the control devices G11 and G12 are further omitted from FIG. That is, the base station CS11 is directly connected to the internal IP network 101.

FIG. 11 is a functional block diagram showing functions provided in the system shown in FIG. The base station CS11 is connected to the internal IP network 101 by a wired line, for example.
FIG. 12 is a sequence diagram illustrating a processing procedure performed in the system illustrated in FIGS. 10 and 11. Compared with the sequence of FIG. 9, since it does not go through a control apparatus, transmission / reception of a message becomes still simpler. The necessary initial setup procedure is implemented in a sufficient manner by the base station CS11 and the management system 400. With the above-described configuration, it is possible to reduce the labor involved in the operation of the system, and it is possible to further improve the degree of freedom of arrangement of monitored devices.

  The present invention is not limited to the above embodiment. For example, the control devices G11 and G12 may include an authentication processing unit. In this case, for example, the procedure of step S5 in FIG. 3 will be performed by the control device G11. Alternatively, the gateway 200 may execute the procedure of step S5 in FIG. 3, or the management system 400 may execute the procedure of step S8.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the spirit of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

  DESCRIPTION OF SYMBOLS 100 ... Communication network, G11, G12 ... Control apparatus, 400 ... Management system, 44 ... Database, CS11, CS21, CS22 (CS) ... Base station, PS11, PS12 ... Mobile terminal, 501, 502, 503 ... Network device, 600 User home, 700 ... Relay unit, 101 ... Internal IP network, 102 ... External IP network, 200 ... Gateway, CSa, 502a, 501a ... Wireless unit, Ga ... Registration processing unit, 200a, 400b ... Connection processing unit, CSc ... Wireless notification unit, 400a, CSb, 200b ... authentication processing unit

Claims (13)

In a communication system comprising a gateway that interconnects a secure network with guaranteed security and an IP (Internet Protocol) network having a different security level from the secure network,
The secure network is
A base station forming a radio zone;
A wireless unit that receives, from the first device connected to the IP network, an authentication request message accompanying the initial setting procedure when starting operation of the first device via the base station;
An authentication processing unit that performs an authentication process on the first device in response to the authentication request message;
A notification unit for notifying the first device via the base station of a response message including an IP address of the gateway in the IP network when the authentication process is successful;
The gateway is
Connection processing for forming a communication link between the second device connected to the secure network and the first device in response to a connection request from the first device using the notified IP address A communication system. And a server for guaranteeing the security of the secure network,
The authentication process includes
A first processing procedure for authenticating whether or not the first device can access the server;
A second processing procedure for authenticating whether the first device can access the gateway;
The communication system according to claim 1, further comprising: a third processing procedure implemented by the gateway for authenticating whether the first device can access the secure network.   3. The communication system according to claim 1, wherein the secure network is a network different from the IP network, which is separated from the IP network by the gateway. 4.   The communication system according to claim 3, wherein the authentication processing unit assigns an IP address in the IP network to the first device that has been successfully authenticated.   The communication system according to claim 1, wherein the gateway includes the authentication processing unit.   The communication system according to claim 2, wherein the server includes the authentication processing unit. And a connection device for connecting the base station to the secure network,
The communication system according to claim 1, wherein the connection device includes the authentication processing unit.   The communication system according to claim 1, wherein the base station includes the notification unit.   The communication system according to claim 1, wherein the base station includes the authentication processing unit. In a method for supporting the operation of a communication system comprising a gateway that interconnects a secure network with guaranteed security and an IP (Internet Protocol) network having a different security level from the secure network,
The wireless unit included in the secure network forms a wireless zone with an authentication request message accompanying an initial setting procedure when starting operation of the first device from the first device connected to the IP network. Received via the base station,
An authentication processing unit provided in the secure network performs an authentication process on the first device in response to the authentication request message;
When the authentication process is successful, the notification unit provided in the secure network notifies the first device via the base station of a response message including the IP address of the gateway in the IP network,
In response to a connection request from the first device using the notified IP address, the gateway establishes a communication link between the second device connected to the secure network and the first device. An operation support method to be formed. The authentication process includes
A first processing procedure for authenticating whether the first device can access a server that guarantees security of the secure network;
A second processing procedure for authenticating whether the first device can access the gateway;
The operation support method according to claim 10, further comprising: a third processing procedure implemented by the gateway and authenticating whether or not the first device can access the secure network.   The operation support method according to any one of claims 10 and 11, wherein the secure network is a network different from the IP network, which is isolated from the IP network by the gateway.   The operation support method according to claim 12, wherein the authentication processing unit assigns an IP address in the IP network to the first device that has been successfully authenticated.

Images