KR20140030839A - Method for transmitting data using bandwidth of subscriber and apparatus for the same - Google Patents

Abstract

The present invention relates to a data transmission method and, more specifically, to a data transmission method using a designated line for subscribers and a service apparatus for supporting the same capable of reinforcing security by allowing access to a destination server using the designated line for the subscribers within allowed areas by transmitting address information of a predetermined bandwidth to the destination server using a user terminal when the user terminal is located in a specific area. The service apparatus for supporting the data transmission using the designated line for the subscribers according to an embodiment of the present invention comprises a storage unit for storing address information of a predetermined bandwidth and base station information in a list of base stations for providing a data call service of the user terminal which belongs to a security area corresponding to the subscriber information of the user terminal; and a call process control unit for allocating the address information of the predetermined bandwidth to the user terminal when the current location belongs to the security area according to the location of the base station indicated by the cell identifier by obtaining the cell identifier of a serving base station in which the user terminal is belonged when the a data call access request is received from one user terminal to the destination server. [Reference numerals] (AA) START; (BB) END; (S201) Receive a data call access request; (S203) Obtain a cell identifier of a serving base station; (S205) Is it a security area?; (S207) Assign address information of a predetermined band

Description

Method for transmitting data through a dedicated subscriber line, and a service apparatus supporting the same {Method for transmitting data using bandwidth of subscriber and apparatus for the same}

The present invention relates to a data transmission method, and more particularly, when a user terminal is located in a specific area, by assigning address information of a predetermined band to the user terminal and transferring the address information to a destination server, a subscriber-only line is provided only in an authorized area. The present invention relates to a data transmission method through a dedicated subscriber line that can enhance security by allowing access to a destination server through a network, and a service device supporting the same.

The rapid development of information and communication technology has brought a lot of changes to the work environment of the enterprise. One of them is called smart work.

Smart work refers to a type of work that can efficiently perform work anytime, anywhere without restriction of time and place through user terminals such as smart phones, tablet PCs, and personal digital assistants (PDAs). .

For example, video conferencing between users in the home and users in the company, as well as the process of handling work outside the company and immediately reporting it to the company. It is a type of work that can increase the efficiency of work by processing without restriction in time and place and transmitting the result to the server.

However, the most worrisome concern for companies in promoting such smart work is the possibility of leaking important information.

In general, external corporate users are assigned a private IP from a service provider that provides their own communication service, and then access the data call to a destination server where corporate resources are stored through a public network using the private IP as a source IP. Request, the destination server also permits access after only performing simple authentication on the private IP of the user terminal.

At this time, since a malicious user can easily steal the private IP accessible to the destination server, there is a problem that corporate personnel are always concerned about the possibility of leaking important resources.

Registered Korean Patent No. 10-0714368, April 26, 2007 (Name: IP address management system interworking with authentication server)

The present invention has been proposed to solve the above-mentioned conventional problems, and in particular, a method for transmitting data through a dedicated subscriber line that can enhance security by allowing access of a destination server of a user terminal only within an authorized area, and a service supporting the same. The purpose is to provide a device.

To this end, when the data call connection request is received from the user terminal to the destination server, the present invention allocates address information of a predetermined band to the user terminal only when the current location of the user terminal is permitted. An object of the present invention is to provide a data transmission method through a subscriber dedicated line for controlling access to a destination server through a subscriber dedicated line corresponding to address information of a predetermined band, and a service device supporting the same.

A service apparatus for supporting data transmission through a subscriber dedicated line of the present invention for achieving the above object is a base station for providing a data call service to a user terminal belonging to a security area in response to subscriber information of the user terminal. A storage unit which stores list of base station information and address information of a predetermined band; And receiving a data call connection request from a user terminal to a destination server, acquiring a cell identifier of a serving base station to which the user terminal belongs, depending on whether the base station indicated by the cell identifier belongs to the base station information. If the current position belongs to the security area, the call processing control unit for allocating address information of a predetermined band to the user terminal; may be configured.

The service device may further include an authentication processing unit for obtaining subscriber information by querying subscriber authentication of the user terminal through a subscriber authentication device, and then transferring the subscriber information to the call processing control unit. The base station indicated by the cell identifier of the serving base station to which the user terminal belongs may determine whether the current location is the security area based on whether the base station indicated by the cell identifier belongs to previously stored base station information corresponding to the subscriber information of the user terminal.

The call processing control unit may allocate address information of a predetermined band corresponding to the subscriber information and then transmit a data call connection request of the user terminal to the destination server through a subscriber dedicated line corresponding to the address information. .

The call processing controller may be further configured to convert the address information system of the user terminal and the address information system supported by the destination server to the destination server after converting the address information system supported by the destination server. A data call connection request of the user terminal can be delivered.

According to an aspect of the present invention, there is provided a data transmission method through a subscriber dedicated line, comprising: receiving a data call connection request from any one user terminal; Obtaining a cell identifier of a serving base station to which the user terminal belongs; According to whether the base station indicated by the cell identifier of the user terminal belongs to base station information which is a list of base stations for providing a data call service to a user terminal belonging to a previously stored security area, the current location belongs to the security area. Determining whether or not; And if the current location of the user terminal belongs to the security area, allocating address information of a predetermined band to the user terminal.

At this time, before the step of receiving the data call connection request, the base station information which is a list of base stations for providing the data call service to the user terminal belonging to the security area in response to the subscriber information of the user terminal and the address of the predetermined band The method may further include storing information.

The method may further include performing subscriber authentication of the user terminal to obtain subscriber information after receiving the data call connection request.

The step of allocating address information of a predetermined band to the user terminal may include determining whether a base station indicated by a cell identifier of a serving base station to which the user terminal belongs belongs to previously stored base station information corresponding to subscriber information of the user terminal. step; Determining that the current location of the user terminal is a preset security area corresponding to the subscriber information of the user terminal when the information belongs to base station information previously stored corresponding to the subscriber information of the user terminal; And allocating address information of a predetermined band to the user terminal in correspondence with the subscriber information of the user terminal.

The method may further include, after the step of allocating address information of a predetermined band to the user terminal, transmitting a data call connection request of the user terminal to the destination server through a subscriber dedicated line corresponding to the address information. can do.

In this case, the step of transmitting the data call connection request of the user terminal to the destination server, if the assigned address information system and the address information system supported by the destination server is different from each other, the destination server supports After converting to an address information system, a data call connection request of the user terminal may be transmitted to the destination server.

According to a data transmission method through a subscriber-only line of the present invention, and a service apparatus supporting the same, address information of a band previously designated to the user terminal when the current position of the user terminal is a security area when a user terminal requests a data call connection After allocating a service provider, the security service can be provided to a corporate customer through a dual security scheme such as allowing access to a destination server of a user terminal through a dedicated line corresponding to the address information. .

In addition, the access to the destination server in the area other than the security area specified by the enterprise customer can be blocked at the source, thereby preventing unauthorized users from accessing and preventing information leakage to the outside.

1 is a block diagram showing the main configuration of a data transmission system through a subscriber dedicated line according to an embodiment of the present invention.
2 is a block diagram showing a main configuration of a service apparatus according to an embodiment of the present invention.
FIG. 3 is a block diagram showing the main configuration of the call processing control unit shown in FIG. 2.
4 is a schematic flowchart of a data transmission method through a subscriber line according to an embodiment of the present invention.
5 is a more detailed flowchart illustrating a data transmission method through a subscriber dedicated line according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the detailed description of known functions and configurations incorporated herein will be omitted when it may unnecessarily obscure the subject matter of the present invention. This is to omit the unnecessary description so as to convey the key of the present invention more clearly without fading. Also, the terms first, second, etc. are used for describing various components and are used only for the purpose of distinguishing one component from another component, and are not used to define the components.

The same reference numerals are used for portions having similar functions and functions throughout the drawings.

Hereinafter, a data transmission system via a subscriber dedicated line according to an embodiment of the present invention will be described.

1 is a block diagram showing the main configuration of a data transmission system through a subscriber dedicated line according to an embodiment of the present invention.

Referring to FIG. 1, a data transmission system 1000 using a subscriber dedicated line according to an exemplary embodiment of the present invention may include a user terminal 100, a service network 200, and a private network 300. The service network 200 and the private network 300 are connected to each other through a subscriber dedicated line, and the service network 200 controls only the authorized user terminal 100 to access the private network 300 through the subscriber dedicated line. It will play a role.

Referring to each component of the data transmission system 1000 using a subscriber dedicated line, first, the user terminal 100 may perform a voice call or data service according to a user's request (UE, User Equipment). In particular, the user terminal 100 according to an embodiment of the present invention is a subscriber terminal pre-subscribed to a service dedicated to an enterprise provided by a service network 200 operator, and the private network 300 through the service network 200. Is connected to the terminal to access the data provided by the destination server (320).

Such, the user terminal 100 of the present invention may be implemented in various forms. For example, the user terminal 100 described in the present specification may be a mobile terminal such as a smart phone, a tablet PC, a personal digital assistant (PDA), a portable multimedia player (PMP), or an MP3 player. Of course, a fixed terminal such as a smart TV, a desktop computer, or the like may be used.

The service network 200 is operated by a specific service provider, and is a network that controls data transmission and reception between the user terminal 100 and the private network 300. In particular, the service network 200 according to an embodiment of the present invention is a user terminal. It serves to support data access through the enterprise-only service to the private network 300 of (100).

To this end, the service network 200 may be composed of an access network 210 and a core network 220. When the user terminal 100 transmits a data call connection request to a destination server through the access network 210, The service device 230 in the network 220 checks the cell identifier of the base station in the access network 210 to which the user terminal 100 is connected, so that the area where the user terminal 100 is currently located, that is, the access network ( It is checked whether the area covered by the base station connected to the user terminal 100 in 210 is a security area assigned to a subscriber corresponding to the private network 300, for example, an enterprise customer.

Subsequently, if it is determined that the user terminal 100 belongs to the secure area, the service device 230 in the core network 220 may determine the source IP address included in the data call connection request of the user terminal 100 in a predetermined band. The data information is changed to address information, and the data call connection to the private network 300 is transmitted through the subscriber dedicated line corresponding to the address information of the predetermined band.

In more detail with respect to the above-described process, first, the user terminal 100 connects to a neighboring access network 210 and requests a data call connection from the enterprise server 310 in the private network 300 to a destination IP address. . Here, the data call connection request may be in the form of a service request including a packet data network (PDN), for example, an access point name (APN) having an IP address of an enterprise server in the private network 300 as a destination IP address, for example, lte. It can be delivered in the form of sktelecom.com.

In this case, the access network 210 including the plurality of base stations 211, 212, ... to support the access of the user terminal 100 receives the data call connection request received from the user terminal 100 core network 220 In this case, the base stations 211 and 212 may be implemented as a base station transmission system (BTS) in a synchronous (CDMA) network, and a base station controller (BSC) which controls a base station. Controller may be included in the access network 210. In addition, in the asynchronous (WCDMA) network, the BTS may be replaced with a NodeB, and the BSC may be replaced with a Radio Network Controller (RNC). In addition, in a Long Term Evolution (LTE) network, an eNodeB is an evolved base station. And a mobility management entity (MME), wherein the MME is an RNC in which an RNC is integrated with a mobile service control node (MSC) that performs RNC and additional service processing in a WCDMA network, receiving and originating call processing of a subscriber, and the like. And the role of the MSC can be performed almost identically.

The access network 210 may perform various functions such as baseband signal processing, wired / wireless conversion, and transmission / reception of wireless signals in addition to transmitting data call access requests of the user terminal 100 to the core network 220. have.

When the core network 220 receives the data call connection request of the user terminal 100 through the access network 210 as described above, the service device 230 of the core network 220 is the current position of the user terminal 100 It is determined whether is in the security domain.

This can be confirmed through a cell identifier of a base station, that is, a serving base station, to which the user terminal 100 is connected. The service device 230 obtains a cell identifier of the serving base station of the user terminal 100, and indicates that the cell identifier is indicated. It is possible to check whether the base station belongs to the base station information which is a list of base stations for providing the data call service to the user terminal 100 belonging to the security area in response to the previously stored subscriber information.

Subsequently, if it is determined that the user terminal 100 belongs to the security area, the service device 230 allocates address information of a predetermined band to the user terminal 100, and uses only the subscriber corresponding to the address information of the predetermined band. The data call connection of the user terminal 100 is transmitted to the private network 300 through the line.

As such, the first step of confirming whether the user terminal 100 is in the designated security area, and through the subscriber dedicated line corresponding to the address information of the predetermined band only when the user terminal 100 is in the designated security area; The private network 300 is controlled by controlling the access of the user terminal 100 to the private network 300 through a double-secure network of the second step of transferring the data call connection of the user terminal 100 to the private network 300. There is an effect that can further enhance the security of.

As described above, it is described that the user terminal 100 is located in a designated security area by comparing the cell identifier of the serving base station to which the user terminal 100 belongs to the previously stored base station information.

At this time, the service device 230 in the core network 220 is based on the subscriber information of the user terminal 100, the cell identifier of the serving base station to which the user terminal 100 belongs is included in the base station information corresponding to the subscriber information It is desirable to judge whether

In other words, the service network 200 including the service device 230 provides data call services of a plurality of private networks 300, and allocates a separate dedicated security zone for each enterprise customer of the private network 300. In this case, the base station list includes a base station list that covers a dedicated security area allocated to an enterprise customer of the private network 300, rather than performing a search in base station information which is a list of all base stations managed by the service network 200. It would be desirable to perform the search only on the base station information.

To this end, the service device 230 first performs subscriber authentication through the subscriber authentication device 240 and obtains subscriber information. In other words, the identification information of the user terminal 100 requesting the data call connection is checked, and the identification information of the user terminal 100 is transmitted to the subscriber authentication device 240 to query the subscriber authentication.

The identification information of the user terminal 100 may be mobile communication service information (telephone number), a mobile identification number (MIN), an electronic serial number (ESN), or the like, to which the user terminal 100 is subscribed. 230 may query the subscriber authentication by transmitting the identified identification information of the user terminal 100 to the subscriber authentication device 240, and may receive the success or failure result information from the subscriber authentication device 240.

In addition, the subscriber authentication apparatus 240 may further store subscriber information in response to the identification information of the user terminal 100. At this time, the subscriber information may include corporate dedicated service subscription information of the user terminal 100 and It can be your company information.

Subsequently, when the subscriber information of the user terminal 100 is confirmed, the service device 230 based on the base station information which is a list of base stations for providing a data call service to the user terminal 100 belonging to the security area in response to the subscriber information. As a result, it is determined whether the user terminal 100 is located in the security area.

As a result of the determination, when the user terminal 100 belongs to the security area, the service device 230 allocates address information of a band designated in advance to the user terminal 100, and a dedicated line corresponding to the address information of the predetermined band. Through this, the data call connection request of the user terminal 100 is transmitted to the enterprise server 310 which is a destination server in the private network 300.

The service device 230 performing such a role may include a switch (not shown) that performs basic and additional service processing, reception and outgoing call processing of a subscriber, location registration and handoff procedures, and interworking with other networks; It may be configured to include a plurality of gateways (not shown) to perform the session control function of the user terminal 100, and provide a packet data service.

The plurality of gateways may be configured to include a serving gateway (SGW), a packet data network gateway (PGW), and the like. For example, in the LTE network, the SGW may serve as a mobility anchor in an eNodeB handover of the user terminal 100, 3GPP. PGW assigns an IP address of the user terminal 100 and performs packet data related functions in the core network 220, for example, for each user terminal 100. It performs different QoS policies and controls traffic. In particular, in the embodiment of the present invention, the PGW may play a role of allocating address information of a predetermined band corresponding to subscriber information of the user terminal 100.

In addition, the switch can be implemented in the form of MME in the LTE network, MME performs the user authentication of the user terminal 100 using an authentication protocol such as EPS-AKA, the user terminal 100 is a PDN A communication channel for accessing (a destination server in a private network), for example, manages a state of a communication channel leading to a user terminal-eNodeB-SGW-PGW-PDN, etc., and manages a core network of the user terminal 100. It is to manage whether or not the connection of (220).

In addition, the subscriber authentication device 240 performs subscriber authentication based on the location information of the user terminal 100 where the location registration is made and the identification information of the user terminal 100. The subscriber authentication device 240 includes a Home Location Register (HLR) / Home Subscriber Server (HSS) and the like, and performs subscriber authentication at the request of the MME of the service device 230, more specifically, the service device 230. And, the authentication result is delivered to the MME.

In addition, the core network 230 further includes various devices such as a router (not shown) and a switching device (not shown) for performing packet flow control for data services such as call processing, mobility control, and switching. However, since the configuration is a known configuration, a detailed description thereof will be omitted.

Through this process, the service device 230 allocates address information of a predetermined band to the user terminal 100 only when the user terminal 100 is subscribed to an enterprise-only service and located within a predetermined security area. Then, by transmitting the data call connection request to the private network 300 through the corresponding subscriber dedicated line, it is possible to fundamentally block the data call connection request of the user terminal 100 in other areas than the secure area. .

In addition, even if the user terminal 100 located in the secure area, after assigning address information of a predetermined band corresponding to the subscriber information of the user terminal 100, the user terminal 100 through a dedicated line corresponding to the address information By transmitting the data call connection request of), unauthorized access of the user terminal 100 may be blocked at source.

In other words, the private network 300, which is a private data communication network having a pre-arranged relationship with the service network 200 operator, may request a data call connection request of the user terminal 100 through a dedicated line previously contracted with the service network 200. When the dedicated line is received, since the dedicated line is in agreement with the service network 200, the received data call connection request is determined as a secure data call connection request, and the enterprise server 310 of the user terminal 100 is connected. Can be allowed.

In addition, the firewall of the private network 300 checks the address information of the user terminal 100, checks whether the address information is included in address information of a predetermined band, and once again, the user terminal 100 again. By checking the access of), the access of the unauthorized user terminal 100 is blocked.

In addition, the user terminal 100 may use an external resource by accessing an external network 400, for example, an internet network, through the corporate server 310.

Such a service network 200 providing a service may be implemented in various forms of communication networks. In addition, the service network 200 may include a cloud computing network coupled with a cache device to store computing resources such as hardware and software, and provide computing resources required by a client to a corresponding terminal. Here, cloud computing refers to a computer environment in which information is permanently stored on a server on the Internet and temporarily stored in a client terminal such as a desktop, a tablet computer, a notebook, a netbook, or a smart phone. Cloud computing, Refers to a computer environment access network that stores information on a server on the Internet and makes the information available anytime and anywhere through various IT devices. The service network 200 may be a closed network such as a local area network (LAN), a wide area network (WAN), an open network such as the Internet, a code division multiple access (CDMA), or a wideband code (WCDMA). This concept includes both Division Multiple Access (GSM), Global System for Mobile Communications (GSM), Long Term Evolution (LTE), and Evolved Packet Core (EPC), as well as next-generation and cloud computing networks. .

Hereinafter, the service device 230 according to an embodiment of the present invention will be described in more detail.

2 is a block diagram showing a main configuration of a service apparatus according to an embodiment of the present invention.

1 and 2, the service device 230 of the present invention may include an authentication processing unit 231, a call processing control unit 232, and a storage unit 233.

When the identification information of the user terminal 100 is transmitted from the call processing control unit 232 to be described later, the authentication processing unit 231 confirms the subscriber information by performing subscriber authentication based on the identification information of the user terminal 100.

At this time, when the identification information of the user terminal 100 is transmitted from the call processing control unit 232, the authentication processing unit 231 transmits the identification information of the user terminal 100 to the subscriber authentication device 240 to the user terminal 100. The subscriber authentication of the query is queried and subscriber information is received from the subscriber authentication device 240 according to the result.

Thereafter, the authentication processing unit 231 transfers the subscriber information received from the subscriber authentication device 240 to the call processing control unit 232. Here, the subscriber information preferably includes corporate dedicated service subscription information and affiliated company information of the user terminal 100.

The call processing control unit 232 is to support a data call service to the destination server of the user terminal 100, in particular, the call processing control unit 232 according to an embodiment of the present invention is a user terminal 100 located in a secure area Only the data call service to the destination server is supported.

More specifically, when a data call connection request including an APN whose IP address of the corporate server in the private network 300 to which the user terminal 100 is to be connected is a destination IP address is received, the call processing control unit 232 is The identification information of the user terminal 100 is transferred to the authentication processing unit 231 to obtain subscriber information, and the cell identifier of the serving base station to which the user terminal 100 is connected is obtained.

Here, the cell identifier is a cell identifier of a base station to which the user terminal 100 is connected, that is, a serving base station. For example, in the LET network, the eNodeB ID and the cell number may be used as cell identification information. In the LTE network, an E-utran Cell ID (ECI) is composed of 28 bits, and "ECI (28) = eNodeB ID (20) + headquarters division (3) + base station number (15) + cell number (6) + network (2). ) ". Accordingly, the call processing control unit 232 may acquire 28 hooks to obtain a hook and analyze the preceding 28 digits to determine an eNodeB ID and a cell number where the current user terminal 100 is located. In the case of WCDMA, a cell ID having a structure as shown in Table 1 may be used as a cell identifier.

Subsequently, the call processing control unit 232 includes the serving base station in the base station information based on the cell identifier of the serving base station to which the user terminal 100 accesses in the base station information corresponding to the subscriber information of the user terminal 100. You will be checked.

As a result of the check, if the serving base station is included in the base station information, the area covered by the serving base station to which the user terminal 100 is currently connected is a security area designated by the service device 230, and thus, the call processing control unit 232 may control the user terminal. In step 100, address information of a predetermined band is allocated.

Here, the address information of the predetermined band is different from the address information allocated to the user terminal 100 at the time when the user terminal 100 registers the location, and the subscriber information, for example, belonging to the user of the user terminal 100. It means address information of a predetermined band corresponding to company information.

To this end, the storage unit 233 of the service device 230 preferably includes address information of a predetermined band corresponding to the corporate information, and if the company information of the user terminal 100 is SKP, call processing The controller 232 allocates APN = lte.sktelecom.com to address information corresponding to company information, that is, APN = SKP.sktelecom.com. This process can be done in PGW.

Thereafter, the call processing control unit 232 transfers the allocated address information back to the user terminal 100, and the data call connection request of the user terminal passes through the access network 210 to the service device 230 in the core network 220. In this case, since the source IP included in the address information of the user terminal 100 points to SKP, the call processing control unit 232 of the service device 230 routes to the private line corresponding to the SKP to the private network. 300).

In addition, the call processing control unit 232 is the user terminal 100, if the location that the user terminal 100 is currently connected is not a security area pre-allocated in the enterprise customer, "the current area is not an area that can be connected to the server. . " You can also send a message.

In addition, the call processing controller 232 is different from the system of address information allocated to the user terminal 100 and the system of address information supported by the private network 300 in which the enterprise server 310 serving as the destination server exists. In this case, the data call connection request may be transferred after converting into an address information system supported by the private network 300.

To this end, the service network 200 may further include a network address translation (NAT) that performs address translation.

In order to perform the above-described operation, the call processing controller 232 may include an information processing module 232a and an information providing module 232b as shown in FIG. 3.

Here, the information processing module 232a may check whether the access position of the current user terminal 100 is a security area and a corporate dedicated service subscriber, based on the subscriber information obtained by querying subscriber authentication to the authentication processing unit 231. do. After that, if it is determined that the user is a suitable user, the user terminal 100 plays a role of allocating predetermined address information.

On the other hand, the information providing module 232b plays a role of transmitting and receiving information with the authentication processing unit 231 and the storage unit 233 and routing a data call connection request of the user terminal 100. The processing module 232a and the information providing module 232b may include various devices according to a communication environment. As described above, the processing module 232a and the information providing module 232b may include a plurality of gateways of SGW and PGW.

In order to support the above-described process, the storage unit 233 preferably stores base station information, that is, a list of base stations allocated by enterprise customer information, and address information of a predetermined band.

The main configuration of the service device 230 according to an embodiment of the present invention has been described above.

Hereinafter, a data transmission method through a subscriber dedicated line according to an embodiment of the present invention will be described schematically.

4 is a schematic flowchart of a data transmission method through a subscriber line according to an embodiment of the present invention.

1 and 4, first, when the service device 230 in the core network 220 receives a data call connection request from the user terminal 100 through the access network 210 (S201), the current user terminal ( The cell identifier of the serving base station, for example, the first base station 211, to which 100 is connected, is acquired (S203).

Subsequently, the service device 230 checks whether the obtained cell identifier is included in base station information which is a list of base stations for providing a data call service to the user terminal 100 belonging to the secure area, It is determined whether the current location is a security area (S205).

Here, preferably, first, after obtaining the subscriber information of the user terminal 100, the user terminal 100 is a user subscribed to the service provided by the communication service provider of the service network 200, the company of the user After confirming the information, it is preferable to perform the search only in the base station information corresponding to the company information.

Subsequently, the service device 230 corresponds to the subscriber information of the user terminal 100 when it is determined that the user terminal 100 is a user subscribed to an enterprise-only service and the current location of the user terminal 100 is a security area. After allocating address information of a predetermined band (S207), the data call connection request of the user terminal 100 is transmitted to the enterprise server 310 in the private network 300 through the corresponding subscriber-only line. .

The above-described process will be described in more detail with reference to FIG. 5.

5 is a more detailed flowchart illustrating a data transmission method through a subscriber dedicated line according to an embodiment of the present invention.

1 and 5, when the user terminal 100 makes a data call connection request using the destination server, that is, the IP address of the corporate server as the destination IP address in the private network 300 (S301), The base station in the access network 210 of the to transmit the data call connection request of the user terminal 100 to the service device 230 in the core network 220 (S303).

The service device 230 receiving the request first transmits the identification information of the user terminal 100 to the subscriber authentication device 240 to query the subscriber authentication whether the user is a suitable user (S305). The subscriber authentication device 240 performs authentication based on the identification information of the user terminal 100, and when authentication fails, transmits an authentication failure message to the service device 230 (S309), or when authentication is successful. In operation S311, the subscriber information is transmitted to the service device 230.

Here, the subscriber information may be corporate dedicated service subscription information and affiliated company information of the user terminal 100.

Thereafter, the service device 230 obtains a cell identifier of the base station of the access network 210 to which the current user terminal 100 is connected (S313), and determines whether the current access area of the user terminal 100 is a security area based on this. Determine (S315).

Here, if it is determined that the security area is not, an access denied message, for example, "the currently connected area is not an access allowed area" may be transmitted to the user terminal 100 via the access network 210 (S317 ˜). S319)

If it is determined in step S315 that the security area, the service device 230 checks the predetermined address information corresponding to the subscriber information obtained in step S311 (S321), and assigns the address information to the user terminal (100) (S323). ). Although not shown in the figure, in order to allocate the address information to the user terminal 100, the address information is allocated to the user terminal 100 via the access network 210, but the above steps are omitted for convenience of description.

In addition, when a data call connection request is received from the user terminal 100, the subscriber authentication is performed and the cell identifier accessed by the user terminal 100 has been described. However, the present invention is not limited thereto. Although it can be performed first, the service device 230 queries the subscriber authentication with the subscriber authentication device 240 and then receives the subscriber information from the subscriber authentication device 240 as an example, but the location of the user terminal 100 When the registration is made, the subscriber authentication device 240 transmits related information including the subscriber information of the user terminal 100 to the service device 230, and the service device 230 performs subscriber authentication of the user terminal 100. You can also do it yourself.

In this way, the service apparatus receives a data call connection request via the access network 210, using the new IP address allocated by the user terminal 100 as the source IP address, and the destination IP address as the destination IP address of the destination server of the private network 300. When forwarding to 230, the service device 230 confirms the source IP address included in the data call connection request, and transmits the data call connection request through the subscriber dedicated line corresponding to the source IP address.

Upon receiving this, the private network 300 may once again check the source IP address of the user terminal 100 to perform user authentication based on this, and may finally allow access to the destination server.

In addition, when the address information system between the service network 200 and the private network 300 is different from each other in step S325, converts the address information of the user terminal 100 into a form supported by the private network 300 through NAT. After this, it may be transferred to the private network 300.

As such, when the external user terminal 100 requests a data call connection to the corporate private network 300, when the user terminal 100 is a user subscribed to an enterprise-only service and the current location is a security area, the user After allocating address information of a predetermined band to the terminal and allowing access to a destination server of the user terminal through a dedicated line corresponding to the address information, a security service for enhanced corporate communication services is provided to corporate customers through a dual security scheme. There is an effect that can be provided.

In addition, the access to the destination server in the area other than the security area specified by the enterprise customer can be blocked at the source, thereby preventing unauthorized users from accessing and preventing information leakage to the outside.

In the above, the data transmission method through the subscriber dedicated line according to an embodiment of the present invention has been described.

Such a data transmission method in a data transmission system through a subscriber line according to an embodiment of the present invention can be implemented as computer readable codes on a computer readable recording medium. The computer readable recording medium may include program instructions, data files, data structures, and the like, alone or in combination, and includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include an optical recording medium such as a magnetic medium such as a hard disk, a floppy disk and a magnetic tape, a compact disk read only memory (CD-ROM), and a digital video disk (ROM), random access memory (RAM), flash memory, and the like, such as a magneto-optical medium such as a magneto-optical medium and a floppy disk, And hardware devices that are specifically configured to perform the functions described herein.

In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner. In addition, functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers of the technical field to which the present invention belongs.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be appreciated by those skilled in the art that numerous changes and modifications can be made to the invention. And all such modifications and changes as fall within the scope of the present invention are therefore to be regarded as being within the scope of the present invention.

The present invention relates to a data transmission method, and more particularly, when a user terminal is located in a specific area, by assigning address information of a predetermined band to the user terminal and transferring the address information to a destination server, a subscriber-only line is provided only in an authorized area. The present invention relates to a data transmission method through a dedicated subscriber line that can enhance security by allowing access to a destination server through a network, and a service device supporting the same.

According to the present invention, when the current position of the user terminal is a security area when the user terminal requests a data call connection, after assigning address information of a predetermined band to the user terminal, a dedicated line corresponding to the address information is established. Through the dual security system such as allowing access to the destination server of the user terminal through the effect that can provide a security-enhanced communication service to corporate customers, it can contribute to the development of the security service industry.

In addition, since the present invention is not only possible to be marketed or operated, but also can be practically and practically carried out, it is industrially applicable.

100: user terminal 200: service network 210: access network
211: first base station 212: second base station 220: core network
230: service device 240: subscriber authentication device 300: private network
310: enterprise server 400: external network
1000: data transmission system.

Claims (10)

A storage unit for storing base station information and address information of a predetermined band, the base station information being a list of base stations for providing a data call service to a user terminal belonging to a security area corresponding to subscriber information of the user terminal; And
When a data call connection request is received from a user terminal to a destination server, a cell identifier of the serving base station to which the user terminal belongs is obtained, and according to whether the base station indicated by the cell identifier belongs to the base station information. A call processing control unit for allocating address information of a predetermined band to the user terminal if the location belongs to the security area;
Service apparatus for supporting data transmission through the subscriber dedicated line comprising a. The method according to claim 1,
An authentication processor for querying subscriber authentication of the user terminal through a subscriber authentication device to obtain subscriber information, and then transferring the subscriber information to the call processing controller;
Further comprising:
The call processing control unit
And a base station indicated by the cell identifier of the serving base station to which the user terminal belongs determines whether the current location is the security area according to whether the base station indicated by the cell identifier belongs to previously stored base station information corresponding to the subscriber information of the user terminal. A service device that supports data transfer through the network. The method according to claim 1,
The call processing control unit
And assigning address information of a predetermined band corresponding to the subscriber information, and transmitting a data call connection request of the user terminal to the destination server through a subscriber dedicated line corresponding to the address information. A service device that supports data transmission via data. The method of claim 3,
The call processing control unit
If the allocated address information system of the user terminal and the address information system supported by the destination server are different from each other, the data server is requested to connect to the destination server after converting to the address information system supported by the destination server. A service device for supporting data transmission through a subscriber line, characterized in that for transmitting. Receiving a data call connection request from any one user terminal;
Obtaining a cell identifier of a serving base station to which the user terminal belongs;
According to whether the base station indicated by the cell identifier of the user terminal belongs to base station information which is a list of base stations for providing a data call service to a user terminal belonging to a previously stored security area, the current location belongs to the security area. Determining whether or not; And
Allocating address information of a predetermined band to the user terminal when the current location of the user terminal belongs to the security area as a result of the determination;
Method of transmitting data through a subscriber dedicated line comprising a. 6. The method of claim 5,
Prior to receiving the data call connection request,
Storing base station information and address information of a predetermined band, the base station information which is a list of base stations for providing a data call service to a user terminal belonging to a security area corresponding to the subscriber information of the user terminal;
The data transmission method via a subscriber dedicated line further comprising. 6. The method of claim 5,
After receiving the data call connection request
Obtaining subscriber information by performing subscriber authentication of the user terminal;
The data transmission method via a subscriber dedicated line further comprising. The method of claim 7, wherein
Allocating address information of a predetermined band to the user terminal
Determining whether a base station indicated by a cell identifier of a serving base station to which the user terminal belongs belongs to previously stored base station information corresponding to subscriber information of the user terminal;
Determining that the current location of the user terminal is a preset security area corresponding to the subscriber information of the user terminal when the information belongs to base station information previously stored corresponding to the subscriber information of the user terminal; And
Allocating address information of a predetermined band to the user terminal in correspondence with the subscriber information of the user terminal;
Method of transmitting data through a subscriber dedicated line comprising a. 6. The method of claim 5,
After allocating address information of a predetermined band to the user terminal,
Transmitting a data call connection request of the user terminal to the destination server through a subscriber dedicated line corresponding to the address information;
The data transmission method via a subscriber dedicated line further comprising. 10. The method of claim 9,
The step of transmitting a data call connection request of the user terminal to a destination server,
If the allocated address information system of the user terminal and the address information system supported by the destination server are different from each other, after converting the address information system supported by the destination server to the data call connection request of the user terminal, the destination server Method for transmitting data through a subscriber line, characterized in that for transmitting to.

Images