WO2023175915A1

WO2023175915A1 - Session control device, session control system, session control method, and non-transitory computer-readable medium

Info

Publication number: WO2023175915A1
Application number: PCT/JP2022/012650
Authority: WO
Inventors: 浩史傅寳
Original assignee: 日本電気株式会社
Priority date: 2022-03-18
Filing date: 2022-03-18
Publication date: 2023-09-21

Abstract

The purpose of the present invention is to provide a session control device with which it is possible to suppress any increase in the load on a communication device constituting a network. A session control device (10) according to the present disclosure comprises: a communication unit (11) for receiving, from a communication terminal positioned in a communication area within which a first local network is formed, a request message requesting communication with a second data network capable of connecting to a second local network; an identification unit (12) for identifying a VPN service capable of connecting to the second data network and a communication device used in connection to the VPN service, the communication device being disposed within the first local network; and a control unit (13) for establishing a session between the communication terminal and the communication device.

Description

Session control device, session control system, session control method, and non-transitory computer-readable medium

The present disclosure relates to a session control device, a session control system, a session control method, and a non-transitory computer-readable medium.

The 3rd Generation Partnership Project (3GPP), which defines mobile communication standards, is considering using the 5th Generation (5G) system as a private network. The 5G system used as a private network is being standardized as SNPN (Standalone Non Public Network) in 3GPP. SNPN is constructed as a network independent from a public network.

Non-Patent Document 1 describes a connection configuration of multiple SNPNs. Further, Non-Patent Document 1 describes a plurality of scenarios regarding routes for establishing a PDU (Protocol Data Unit) session when a UE (User Equipment) moves from one SNPN to another SNPN. Specifically, it is described that when the UE moves from SNPN #1 to SNPN #2, the anchor point of the PDU session established by the UE is set to SNPN #1. A PDU session is established between the UE and a UPF (User Plane Function) entity (hereinafter referred to as UPF) that relays user plane data. That is, the PDU session is terminated at the UE and UPF. Here, when the UE moves from SNPN #1 to SNPN #2 and accesses SNPN #2, a PDU session is established between the UE and the UPF located in SNPN #1 via SNPN #2. Established. A PDU session established between the UE and the UPF located at SNPN #1 reaches the UPF located at SNPN #1 from the UE via SNPN #2.

When a UE that can use SNPN #1 accesses SNPN #2, the UPF of SNPN #1, which serves as an anchor point, needs to manage connections of UEs that do not exist in SNPN #1. In the future, when a large number of IoT (Internet of Things) terminals are used as UEs, no matter which SNPN the IoT terminal uses, the UPF of SNPN #1 will need to manage connections for a large number of IoT terminals as an anchor point. There is. As a result, there is a problem in that the load on the UPF of SNPN #1 increases, resulting in failure or congestion.

In view of the above-mentioned problems, one object of the present disclosure is to provide a session control device, a session control system, a session control method, and a non-transitory computer-readable medium that can suppress an increase in load on communication devices that constitute a network. Our goal is to provide the following.

A session control device according to a first aspect of the present disclosure is configured to perform communication from a communication terminal located in a communication area formed by a first local network to a second data network connectable via a second local network. a VPN service connectable to the second data network; and a communication device used for connection to the VPN service, the communication unit being disposed in the first local network. and a control unit that establishes a session between the communication terminal and the communication device.

A session control system according to a second aspect of the present disclosure includes a first session control system that controls a communication terminal located in a communication area formed by a first local network and a session established in the first local network. a second session control device that controls a session established in a second local network connectable to a second data network, the second session control device controlling a session established in a second local network connectable to a second data network; When the communication terminal receives a request message from the control device indicating that it requests communication to the second data network, it transmits a first response message to the first session control device, and sends a first response message to the first session control device. The response message includes VPN information indicating a VPN service connectable to the second data network, and the first session control device is a communication device used for connection to the VPN service, and the first session control device is a communication device used for connection to the VPN service, The communication device located in the local network of the communication terminal is identified, and a session is established between the communication terminal and the communication device.

A session control method according to a third aspect of the present disclosure includes communication from a communication terminal located in a communication area formed by a first local network to a second data network connectable via a second local network. a VPN service capable of receiving a request message requesting a second data network and connecting to the second data network; and a communication device used for connecting to the VPN service, the communication device being located in the first local network. A session is established between the communication terminal and the communication device.

A program according to a fourth aspect of the present disclosure requests communication from a communication terminal located in a communication area formed by a first local network to a second data network connectable via a second local network. a VPN service capable of receiving a request message to connect to the second data network; and a communication device used for connection to the VPN service, the communication device disposed in the first local network. the computer to identify the communication terminal and establish a session between the communication terminal and the communication device.

According to the present disclosure, it is possible to provide a session control device, a session control system, a session control method, and a non-transitory computer-readable medium that can suppress an increase in load on communication devices that constitute a network.

1 is a configuration diagram of a session control device according to a first embodiment; FIG. 7 is a flowchart of session control processing according to the first embodiment. FIG. 2 is a configuration diagram of a communication system according to a second embodiment. FIG. 7 is a diagram showing the flow of VPN setting processing according to the second embodiment. FIG. 7 is a diagram showing the flow of VPN setting processing according to the second embodiment. FIG. 7 is a diagram illustrating a communication path according to a second embodiment. FIG. 2 is a configuration diagram of a session control device according to a second embodiment.

(Embodiment 1)
Embodiments of the present invention will be described below with reference to the drawings. A configuration example of the session control device 10 according to the first embodiment will be described using FIG. 1. Session control device 10 may be a computer device that operates by a processor executing a program stored in memory. The session control device 10 may be a node device or a communication device that constitutes a mobile communication network.

The session control device 10 includes a communication section 11, a specification section 12, and a control section 13. The communication unit 11, the identification unit 12, and the control unit 13 may be software or modules whose processing is executed by a processor executing a program stored in a memory. Alternatively, the communication section 11, the identification section 12, and the control section 13 may be hardware such as a circuit or a chip.

The communication unit 11 receives a request message requesting communication to a data network connectable via the second local network from a communication terminal located in the communication area formed by the first local network.

A local network may also be referred to as a private network. The local network may not be a so-called public network, but may be a network that allows access only from specific users. The local network may be a network that constitutes a company network such as a so-called intranet. When constructing an internal network, a company having multiple locations may construct a local network for each location and interconnect the local networks. Specifically, a company may construct a local network at its headquarter (Head Quarters, HQ) and a local network at a branch office (Branch office), and interconnect the respective local networks. The first local network and the second local network may be networks at different locations.

The communication area formed by the local network is a communication area where communication terminals can access the local network. A communication terminal accesses a local network using a wireless communication line or a wired communication line. The communication area formed by the local network may be, for example, a communication area formed by wireless communication devices.

The data network may be, for example, a network that includes a server device in which data used by the user is stored, or a server device that the user wishes to access. A network having a server device may also be referred to as a network to which the server device is connected. The local network may be used as a network that relays communication between a communication terminal and a data network. The data network may also be included in the local network. In other words, the data network may be a part of the network that constitutes the local network.

The identification unit 12 identifies a VPN (Virtual Private Network) service that can be connected to the data network and a communication device used for connection to the VPN service. A communication device used to connect to the VPN service is located in the first local network.

A VPN service is, for example, a service that constructs a virtual private line on a public network such as the Internet. A VPN service is a service that constructs a virtual dedicated line for connecting a first local network and a second local network in a public network. In the virtual dedicated line, the confidentiality of data is maintained by encrypting the data.

The VPN service may be, for example, an L2VPN service or an L3VPN service. These techniques are commonly used to interconnect private networks. The L2VPN service interconnects LANs (Local Area Networks) built at different locations so that the entire network behaves as if it were one large LAN. As a result, even if a terminal moves from the head office to a branch office and accesses the LAN of the branch office, it is possible to use the same IP address because the IP subnet set on the LAN is the same. The L3VPN service interconnects IP subnets that are separate from each other, and the L3VPN service acts like a router. As a result, the head office and branch offices can have separate network designs and can be updated independently of each other. On the other hand, if a terminal moves from the head office to a branch office, it is necessary to use the IP address of the branch office. Although the IP address of the terminal is changed, IP reachability between the connected IP subnets is maintained, so terminals accessing the branch office LAN can use services connected to the head office LAN. . Both L2VPN services and L3VPN services can be isolated from other L2VPN services and L3VPN services. For example, even if duplicate private addresses are used in a VPN service for company X and a VPN service for company Y, they will be recognized as a private address for company X and a private address for company Y. The L2VPN service may be, for example, EVPN (Ethernet VPN). EVPN is implemented, for example, in an MPLS (Multi Protocol Label Switching) network or a Segment Routing network with Traffic Engineering.

A communication device is a device that allows access to a network that performs a VPN service. For example, the communication device may be a device located on a network that performs a VPN service, or may be a device that is connected to a data network used to access the network that performs a VPN service. One local network (for example, a branch office local network) may have a multi-stage configuration or distributed deployment, such as an Edge environment (for example, for each floor or building) and a Center environment (for example, a management room or server room). In this case, the communication device may be a device located on the Edge side and connected to a data network used to access the network running the VPN service. One local network (for example, a branch office local network) may have a multi-stage configuration or distributed deployment, such as an Edge environment (for example, for each floor or building) and a Center environment (for example, a management room or server room). In this case, the communication device may be a device located on the Center side and connected to a data network used to access the network that executes the VPN service.

The control unit 13 establishes a session between the communication terminal and the communication device identified by the identification unit 12. In other words, a session is established with the communication terminal and the communication device as end points. Establishing a session between the communication terminal and the communication device enables the communication terminal to communicate with the communication device, and further enables communication via the communication device. Also, since the communication device is located in the first local network, the session is established in the first local network. That is, the session is terminated at the first local network. A communication terminal may establish a different session for each application service to be used, or may use a plurality of application services using one session. A session between a communication terminal and a communication device may be referred to as a communication path between the communication terminal and the communication device.

By establishing a session between the communication terminal and the communication device, the communication terminal connects to the network that executes the VPN service via the communication device. Further, the communication terminal connects to the data network of the second local network via the communication device and the VPN service.

Next, a flowchart of session control processing executed in the session control device 10 will be described using FIG. 2.

First, the communication unit 11 receives a request message requesting communication to a data network connectable via the second local network from a communication terminal located in the communication area formed by the first local network (S11 ). Next, the specifying unit 12 specifies a VPN service connectable to the data network and a communication device used for connection to the VPN service (S12). The communication device is a device located in the first local network. Next, the control unit 13 establishes a session between the communication terminal and the communication device (S13).

As explained above, when a communication terminal located in the communication area formed by the first local network communicates with the data network, the session control device 10 establishes a session with the first local network. The data network is a network connectable via the second local network. In other words, the communication terminal can communicate with the data network via the session established in the first local network and the VPN service without establishing a session with the second local network. As a result, the second local network does not need to manage the connections of the communication terminals located in the first local network, so that the management load on the communication terminals can be reduced.

(Embodiment 2)
Next, a configuration example of the communication system according to the second embodiment will be described using FIG. 3. The communication system of FIG. 3 includes two local networks: an SNPN (Standalone Non Public Network) branch 20 and an SNPN head office 30. SNPN is a network that is being standardized in 3GPP. The SNPN branch 20 may have a PLMN (Public Land Mobile Network) ID (Identifier) different from that of the SNPN head office 30. The PLMN ID is generally an ID that identifies a network managed by a communication carrier. On the other hand, when a business operator or company manages multiple SNPNs, a PLMN ID may be assigned to each SNPN. Alternatively, one PLMN ID may be assigned to two or more SNPNs. When one PLMN ID is assigned to two or more SNPNs, each SNPN may be assigned an NID (Network ID). That is, the SNPN may be identified by the NID.

Here, the SNPN branch 20 and the SNPN head office 30 constitute one in-house network, with the SNPN head office 30 being the network at the head office and the SNPN branch 20 being the network at the branch office. A local network is not limited to a network constructed at a head office and a branch office, but may be constructed at a factory, for each floor of a building, or for each division within a company.

The SNPN branch 20 is recognized as the equivalent SNPN of the SNPN head office 30. The SNPN head office 30 is also recognized as the equivalent SNPN of the SNPN branch 20. For example, a UE 23 that has a Subscription and Credential for connecting to or being registered with the SNPN head office 30 will not be treated as roaming even if it moves from the communication area formed by the SNPN head office 30 to the communication area formed by the SNPN branch 20. When connecting to the SNPN branch 20, the UE 23 can use the Subscription and Credential for connecting to the SNPN head office 30. Subscription indicates subscriber data, and Credential indicates authentication data.

The SNPN branch 20 includes an AMF (Access and Mobility Function) entity 21, an SMF (Session Management Function) entity 22, a UE (User Equipment) 23, an (R)AN ((Radio) Access Network) 24, and a UPF (User Plane Function). It has an entity 25, a DN (Data Network) 26, an edge device 27, and an NSSMF (Network Slice Subnet Management Function) entity 28. The AMF (Access and Mobility Function) entity 21 is hereinafter referred to as AMF21. The SMF (Session Management Function) entity 22 will be referred to as SMF 22 below. The UPF (User Plane Function) entity 25 will be referred to as UPF 25 below. The NSSMF (Network Slice Subnet Management Function) entity 28 will be referred to as NSSMF 28 below.

UE (User Equipment) is used as a general term for communication terminals in 3GPP. The UE 23 may be, for example, a smartphone terminal, a tablet terminal, or an IoT (Internet of Things) terminal.

The AMF 21 performs mobility control and authentication processing regarding the UE 23. The SMF 22 performs session control regarding the UE 23. The SMF 22 corresponds to the session control device 10 in FIG. (R)AN 24 is an access network for connecting to the core network. The (R)AN 24 may be configured using, for example, a gNB (gNode B), or may be configured using a wireless device that supports a wireless communication standard different from the wireless communication standard defined in 3GPP. . For example, the (R)AN 24 may be a wireless device that performs wireless LAN (Local Area Network) communication. Alternatively, the (R)AN 24 may be a device that provides a wired communication line.

The UPF 25 transfers or relays User Plane data. User Plane data may be referred to as user data. Furthermore, the control data used to control the UPF 25 may be referred to as Control Plane data.

The DN 26 may be, for example, an IP network that performs communication using IP, which is used for the so-called Internet. The DN 26 may be, for example, a LAN to which the UPF 25 is connected. The DN26 may be a physically constructed network, or a virtual one using VLAN (Virtual LAN), VXLAN (Virtual eXtensible LAN), GRE (Generic Routing Encapsulation), etc. on the physically constructed network. It may also be a network built in In the following description, the name for identifying the DN 26 will be described as n6-site-branch. Note that the DN 26 is connected to the UPF 25 through an N6 interface in 3GPP.

The edge device 27 is a network device that terminates the n6-site-branch, and may be, for example, a router device or a Leaf/Spine switch. The edge device 27 may be, for example, a Provider Edge router (PE router). A PE router may be a router managed by another network provider. For example, a company owns the SNPN head office 30 and the SNPN branch 20, but may use a VPN service provided by another network provider to interconnect the two. Furthermore, the edge device 27 may have a virtual instance that provides a VPN service. The virtual instance terminates, for example, EVPN, which is a VPN service that connects the SNPN branch 20 and the SNPN headquarters 30, and the n6-site-branch. The virtual instance also forwards Ethernet frames. In the following description, the name for identifying the virtual instance that the edge device 27 has will be described as evpn-gw-branch. Edge device 27 may be called a gateway device.

The NSSMF 28 provides Provisioning Management Service regarding the network slice subnets that constitute the SNPN branch 20. A network slice is a logical network that virtually divides a single network infrastructure. For example, the operational policy or security policy may be different for each network slice. For example, network slices may be generated for each purpose, such as for each service provided. A network slice subnet is a logical network that is further virtually divided into a network slice.

The SNPN headquarters 30 includes an SMF entity 31, an edge device 32, a DN 33, an AF (Application Function) entity 34, an NSMF (Network Slice Management) entity 35, and an NSSMF entity 36. The SMF entity 31 will be referred to as SMF31 below. The AF entity 34 will be referred to as AF34 below. The NSMF entity 35 will be referred to as NSMF 35 below. The NSSMF entity 36 will be referred to as NSSMF 36 below.

The SMF 31 performs session control regarding the UE 23. Further, the SMF 31 may perform session control regarding UEs located in the communication area formed by the SNPN headquarters 30.

The AF 34 may be a server device that provides application services or stores data, and may be an in-house server located at the SNPN headquarters 30, for example.

The DN 33 may be, for example, an IP network that performs communication using IP, which is used for the so-called Internet. The DN 33 may be, for example, a LAN to which the AF 34 connects. DN33 may be a physically constructed network, or may be virtually constructed using Virtual LAN, VXLAN (Virtual eXtensible LAN), GRE (Generic Routing Encapsulation), etc. on a physically constructed network. It may also be a network. In the following explanation, the name for identifying DN33 will be explained as n6-site-hq.

The edge device 32 is a network device that terminates n6-site-hq, and may be, for example, a router device or a Leaf/Spine switch. The edge device 32 may be, for example, a Provider Edge router (PE router). Additionally, the edge device 32 may have a virtual instance that provides VPN services. The virtual instance terminates, for example, EVPN, which is a VPN service that connects the SNPN branch 20 and the SNPN headquarters 30, and n6-site-hq. The virtual instance also forwards Ethernet frames. In the following description, the name for identifying the virtual instance that the edge device 32 has will be described as evpn-gw-hq. Edge device 32 may be referred to as a gateway device.

The NSSMF 36 provides Provisioning Management Service regarding the network slice subnets that make up the SNPN headquarters 30. The NSMF 35 provides Provisioning Management Service regarding network slices including the network slice subnets that make up the SNPN branch 20 and the network subslice subnets that make up the SNPN head office 30.

Although FIG. 3 shows a configuration in which the SNPN branch 20 includes the NSSMF 28 and the SNPN head office 30 includes the NSMF 35 and the NSSMF 36, the present invention is not limited to this. For example, the NSMF 35 may be located at the SNPN branch 20 or at a different location from the SNPN branch 20 and the SNPN headquarters 30. NSSMF 28 and NSSMF 36 may also be located at different locations than SNPN branch 20 and SNPN headquarters 30. Further, the NSMF 35, the NSSMF 36, and the NSSMF 28 may be referred to as management devices.

Further, a service base architecture is applied to the AMF 21, SMF 22, NSSMF 28, SMF 31, NSMF 35, and NSSMF 36, and each is connected via a service base interface. In the service base interface, for example, HTTP (HyperText Transfer Protocol) may be used.

Next, the flow of the VPN setting process according to the second embodiment will be explained using FIGS. 4 and 5. Before the VPN setting process shown in FIGS. 4 and 5 is executed, evpn-gw-branch is set in the edge device 27, and evpn-gw-hq is set in the edge device 32. do. As a result, EVPN, which is an L2VPN service, is provided in the Transport Network between the edge device 27 and the edge device 32. Transport Network may be Transport Network Slice. Furthermore, assume that n6-site-hq is connected to evpn-gw-hq. Also, assume that n6-site-branch is not connected to evpn-gw-hq. n6-site-branch is not connected to evpn-gw-hq, that is, n6-site-branch is not connected to evpn-gw-hq. It has not been set, and the data communication route has not been set. Furthermore, assume that the UE 23 moves from the communication area formed by the SNPN head office 30 to the communication area formed by the SNPN branch 20. Specifically, it is assumed that the UE 23 has handed over from the communication area formed by the SNPN head office 30 to the communication area formed by the SNPN branch 20. Alternatively, assume that the UE 23 moves to the communication area formed by the SNPN branch 20 from a state where it is registered with the SNPN head office 30 but is not communicating. Alternatively, assume that the UE 23 holds subscriber data for connecting to the SNPN head office 30 and starts communication in the communication area formed by the SNPN branch 20.

First, when the AMF 21 receives a PDU Session connection request message from the UE 23, it calls the Nsmf_PDUSession_CreateSMContext service of the SMF 22 (S21). Specifically, the AMF 21 sends a request message to the SMF 22 in order to call the Nsmf_PDUSession_CreateSMContext service of the SMF 22. The AMF 21 specifies the resource sm-contexts and sends a request message in which the data {“SmContextCreateData”:{“dnn”: “n6-site-hq”}} is set to the SMF 22. SmContextCreateData is information regarding the PDU Session requested by the UE 23, and dnn (Data Network Name) is the name of the DN (Data Network) that the UE 23 desires to use. In other words, dnn indicates the DN to which the UE 23 is connected. Here, it is shown that the UE 23 specifies n6-site-hq as the dnn. In other words, the UE 23 requests connection to the DN 33 of the SNPN head office 30 via the SNPN branch 20.

It is also assumed that Ethernet is set as the service type in the PDU Session connection request message sent from the UE 23.

Next, when the Nsmf_PDUSession_CreateSMContext service is called, the SMF 22 calls the Nsmf_PDUSession_Create service of the SMF 31 (S22). The SMF 22 may request information regarding the PDU session in order to connect to the DN 33 of the SNPN head office 30 using the VPN service. Specifically, the SMF 22 sends a request message to the SMF 31 in order to call the Nsmf_PDUSession_Create service of the SMF 31. The SMF 22 sends a request message to the SMF 31 specifying the resource pdu-sessions and setting the data {“PduSessionCreateData”:{“dnn”: “n6-site-hq”, “requestedConnectivity”: “l2vpn-svc”}}. Send to. Note that the SMF 22 may specify the SMF 31 based on the DN specified by dnn.

PduSessionCreateData is information regarding the PDU Session requested by the UE 23, and dnn is the name of the DN (Data Network) that the UE 23 desires to use. requestedConnectivity is used to specify the service for connecting to n6-site-hq. In step S22, l2vpn-svc indicating an L2VPN service is specified as a service for connecting to n6-site-hq. Since the service type of the PDU Session specified by the UE 23 is Ethernet, the SMF 22 may specify l2vpn-svc. IETF RFC8466 defines a YANG data model that can be used to configure L2VPN services, and l2vpn-svc indicates the parameters used in the YANG data model. Note that if the service type of the PDU Session designated by the UE 23 is IP, the SMF 22 may designate the L3VPN service.

Next, the SMF 31 calls the Provisioning Management Service of the NSSMF 36 to update the DNFunction information (S23). Specifically, the SMF 31 sends a request message to the NSSMF 36 to call the Provisioning Management Service. The SMF 31 specifies a resource called DNFunction and sends a request message to the NSSMF 36 in which the data {“managedVpnService”: {network-access-id”: “n6-site-hq”}} is set as a filter condition.

It is assumed that the DNFunction information includes managedVpnService, vpn-id, network-access-id, site-id, and device-id. managedVpnService indicates the VPN service type. The VPN service type may indicate, for example, L2VPN or L3VPN. VPN-ID is identification information for identifying a VPN service. network-access-id indicates a data network accommodated in the VPN service type indicated in managedVpnService. site-id indicates where the data network is located. device-id indicates an edge device that is a physical device that terminates the VPN service indicated by vpn-id.

Step S23 in FIG. 4 indicates that the DNFunction information includes at least one managedVpnService information. managedVpnService information may be described according to the YANG data model defined in IETF RFC8466. The word "described" may also be interpreted as "shown" or "set". That is, managedVpnService information may include one l2vpn-svc.

The network-access-id is a parameter for extracting the DN33 accommodated in l2vpn-svc. Contained may also be referred to as connected. In step S23, network-access-id is used as a filter condition, and n6-site-hq is extracted as network-access-id.

Next, the NSSMF 36 transmits a response message for updating the DNFunction information to the SMF 31 (S24). The NSSMF 36 may use the managedVpnService information received in S23 as a filter condition and send matching DNFunction information to the SMF 31 as a response message. Specifically, the NSSMF36 has managedVpnService as l2vpn-svc, vpn-id as evpn, network-access-id as n6-site-hq, site-id as SNPN-hq, and device Assume that -id has DNFunction information that is pe-hq. evpn is a parameter that identifies an EVPN service. Note that the inclusion of evpn may indicate that an EVPN service is requested. SNPN-hq indicates the SNPN headquarters 30, and pe-hq indicates the edge device 32. Upon receiving the request message whose network-access-id is n6-site-hq, the NSSMF 36 transmits a response message including information indicating that the VPN-id is evpn to the SMF 31. That is, the NSSMF 36 notifies the SMF 31 that the identification information identifying the VPN service to which n6-site-hq connects is evpn. The NSSMF 36 transmits to the SMF 31 a response message in which the data {“DNFunction”: {“managedVpnService”: {“l2vpn-svc”: {“vpn-id”: “evpn”}}}} is set.

Next, the SMF 31 transmits a response message to the SMF 22 in response to step S22 (S25). The SMF 31 may send information regarding a PDU session for connecting to the DN 33 of the SNPN head office 30 using the VPN service to the SMF 22 as a response message to step S22. The SMF 31 transmits to the SMF 22 a response message in which the data {“PduSessionCreateData”:{“managedVpnService”: {“l2vpn-svc”: {“vpn-id”: “evpn”}}}} is set. PduSessionCreateData includes PDU Session information generated in the SMF 31. In step S25 of FIG. 3, it is shown that the VPN-ID is evpn, and the SMF 22 acquires evpn as identification information of the L2VPN service used between the SNPN branch 20 and the SNPN head office 30.

Next, the SMF 22 calls the Provisioning Management Service of the NSMF 35 and obtains the DNFunction information (S26). Since the SMF 22 uses the VPN service (here, evpn) acquired in S25, it may request the NSMF 35 for information on the edge device 27 at the SNPN branch that supports the VPN service. Specifically, the SMF 22 sends a request message to the NSMF 35 to call the Provisioning Management Service. The SMF22 specifies a resource called DNFunction and uses {“managedVpnService”: {“l2vpn-svc”: {“vpn-id”: “evpn”, “site-id”: “SNPN-Branch”}} as a filter condition. } A request message with a message set therein is sent to the NSMF 35.

Next, the NSMF 35 transmits a response message in response to step S26 to the SMF 22 (S27). The NSMF 35 may transmit information on the edge device 27 at the SNPN branch office that supports the VPN service to the SMF 22 as a response message to step S26. NSMF35 has managedVpnService as l2vpn-svc, vpn-id as evpn, network-access-id as n6-site-branch, site-id as SNPN-branch, and device-id as pe. Assume that it has DNFunction information that is -branch. pe-branch indicates the edge device 27. The NSMF 35 finds DNFunction information that matches the filter conditions in which the vpn-id is evpn and the site-id is SNPN-Branch. As a result, the NSMF35 uses branch”, “network-access-id”: n6-site-branch}}} is sent to the SMF 22.

Next, the SMF 22 selects a UPF (S28). The SMF 22 selects the UPF 25 as the UPF that can connect to the n6-site-branch included in the DNFunction acquired in step S27.

Next, the SMF 22 calls the Provisioning Management Service of the NSMF 35 and updates the UPFFunction information. (S29). In other words, the SMF 22 calls the Provisioning Management Service of the NSMF 35 and executes processing for connecting the n6-site-branch to the UPF 25. The SMF 22 may request the NSMF 35 to make settings for connecting the UPF 25 and the edge device 27. Specifically, the SMF 22 specifies a resource called UPFFunction and registers {“EP_N6”: {“localAddress”: “Bearer IP address of UPF”, “remoteAddress”: “Bearer IP address of pe-branch”}} A request message with data set is sent to the NSSMF 36. The Bearer IP address of UPF set as localAddress is the IP address of the physical network interface set in the UPF 25. The Bearer IP address of pe-branch set as remoteAddress is the IP address of the physical network interface set in the edge device 27. EP_N6 indicates Endpoint information of the N6 interface. The N6 interface is an interface defined in 3GPP as an interface between the UPF and the DN. Endpoint is Bearer IP address of UPF and Bearer IP address of pe-branch.

Next, the NSMF 35 calls the Provisioning Management Service of the NSSMF 28 and updates the UPFFunction information. (S30). Specifically, NSMF35 specifies a resource called UPFFunction and registers {“EP_N6”: {“localAddress”: “Bearer IP address of UPF”, “remoteAddress”: “Bearer IP address of pe-branch”}} A request message with data set is sent to the NSSMF 28.

Next, the NSSMF 28 updates the EP_N6 information in the UPF 25 (S31). The NSSMF 28 may request the UPF 25 to make settings for connecting the UPF 25 and the edge device 27. Specifically, the NSSMF 28 sends a request message in which the registration data {“EP_N6”: {“localAddress”: “Bearer IP address of UPF”, “remoteAddress”: “Bearer IP address of pe-branch”}} is set. Send to UPF25. For example, an IP address used by UPF, such as 192.168.0.10, is set as the Bearer IP address of UPF. Also, for example, an IP address used by pe-branch, such as 192.168.0.254, is set as Bearer IP address of pe-branch.

By executing the process in step S31, an IP address is set in the physical interface of the UPF 25, and furthermore, the IP address of the edge device 27, which is the endpoint of the N6 interface, is recognized. Thereby, the UPF 25 can set the IP address of the physical interface of the UPF 25 as the source address of the transmission data, and set the IP address of the edge device 27 as the destination address. As a result, it becomes possible for the UPF 25 and the edge device 27 to communicate.

Next, the NSSMF 28 executes processing to connect the UPF 25 and the edge device 27 via VXLAN. Specifically, the NSSMF 28 transmits a request message including the VXLAN configuration to the UPF 25 (S32). The UPF 25 acquires the VXLAN configuration and sets the VXLAN endpoint as the endpoint of the N6 interface. Next, the NSSMF 28 generates a VXLAN end point in the edge device 27, and connects the generated VXLAN end point to the evpn-gw-branch (S33). By executing the processes of steps S32 and S33, the UPF 25 can connect to the EVPN via VXLAN.

FIG. 6 shows a communication path regarding the UE 23. (R)AN 37 and UPF 38 constitute the SNPN headquarters 30. Further, it indicates that the UE 23 connected to the (R)AN 37 has moved to the SNPN branch 20. The processes shown in FIGS. 4 and 5 are executed, and the UE 23 receives a response message to the PDU Session connection request message, thereby establishing a PDU Session between the UE 23 and the UPF 25. Furthermore, VXLAN is set as the communication path between the UPF 25 and the DN 26. Furthermore, DN26 and DN33 are connected via EVPN. When communicating with the AF 34, the UE 23 communicates with the AF 34 according to the communication path shown in FIG.

As explained above, by connecting the UPF 25 to the evpn-gw-branch via the n6-site-branch, the UE 23 is connected to the L2VPN service set between the SNPN branch 20 and the SNPN headquarters 30. EVPN can be used. As a result, the UE 23 can communicate with the AF 34 connected to n6-site-hq in the SNPN headquarters 30. That is, when the UE 23 communicates with the AF 34, it does not establish a PDU Session with the UPF in the SNPN headquarters 30 as the anchor point. Thereby, it is possible to prevent the load on the UPF within the SNPN headquarters 30 from increasing.

(Modification 1 of Embodiment 2)
Here, a first modification of the second embodiment will be described. For example, when the SMF 22 receives a request message specifying n6-site-hq as the dnn in step S21 of FIG. You may judge. For example, the SMF 22 may manage the network name set in the dnn included in the request message in association with the VPN-id that accommodates the network. If the SMF 22 determines that it has previously received a request message specifying n6-site-hq, that is, if it manages n6-site-hq, the SMF 22 selects the VPN- associated with n6-site-hq. Identify the id. For example, the SMF 22 may use the vpn-id corresponding to n6-site-hq, which was previously received as a message corresponding to step S25 in FIG. Note that the message corresponding to step S25 in FIG. 4 may be a message for a UE different from the UE 23. Specifically, the SMF 22 identifies evpn as the VPN service that accommodates n6-site-hq. In this case, the SMF 22 can skip steps S22 to S25 in FIG. Further, it is assumed that the SMF 22 manages n6-site-hq, vpn-id, and even n6-site-branch in the SNPN branch 20 in association with each other. In this case, upon receiving a request message specifying n6-site-hq, the SMF 22 can specify n6-site-branch. In this case, the SMF 22 can skip steps S22 to S27 in FIG.

If the SMF 22 determines that it has not previously received a request message specifying n6-site-hq, the processes from step S22 onward in FIG. 4 are executed.

(Modification 2 of Embodiment 2)
Here, a second modification of the second embodiment will be described. For example, when the SMF 22 receives a request message specifying n6-site-hq as the dnn in step S21 of FIG. You may also inquire of the NSMF 35 whether or not it has been executed.

If the NSMF 35 determines that it has previously executed the process for connecting to the VPN service with n6-site-hq, it sends a response message containing the data set in step S27 in FIG. 4 to the SMF 22. Good too. This allows the SMF 22 to skip the processing from steps S22 to S26.

If the NSMF 35 determines that it has not previously performed the process for connecting to the VPN service with n6-site-hq, the processes from step S22 onward in FIG. 4 are executed.

FIG. 7 is a block diagram showing a configuration example of the session control device 10 described in the above embodiment. Referring to FIG. 7, the session control device 10 includes a network interface 1201, a processor 1202, and a memory 1203. Network interface 1201 may be used to communicate with network nodes. The network interface 1201 may include, for example, a network interface card (NIC) compliant with the IEEE 802.3 series. IEEE stands for Institute of Electrical and Electronics Engineers.

The processor 1202 reads software (computer program) from the memory 1203 and executes it, thereby performing the processing of the session control device 10 explained using the flowchart in the above embodiment. Processor 1202 may be, for example, a microprocessor, MPU, or CPU. Processor 1202 may include multiple processors.

The memory 1203 is configured by a combination of volatile memory and nonvolatile memory. Memory 1203 may include storage located remotely from processor 1202. In this case, processor 1202 may access memory 1203 via an I/O (Input/Output) interface, which is not shown.

In the example of FIG. 7, memory 1203 is used to store software modules. The processor 1202 can perform the processing of the session control device 10 described in the above embodiment by reading out and executing these software module groups from the memory 1203.

As explained using FIG. 7, each of the processors included in the session control device 10 in the above embodiment executes one or more programs including a group of instructions for causing a computer to execute the algorithm explained using the drawings. Execute.

In the examples above, the program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more of the functions described in the embodiments. The program may be stored on a non-transitory computer readable medium or a tangible storage medium. By way of example and not limitation, computer readable or tangible storage media may include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD - Including ROM, digital versatile disc (DVD), Blu-ray disc or other optical disc storage, magnetic cassette, magnetic tape, magnetic disc storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or a communication medium. By way of example and not limitation, transitory computer-readable or communication media includes electrical, optical, acoustic, or other forms of propagating signals.

Note that the technical idea shown in the present disclosure is not limited to the above embodiments, and can be modified as appropriate without departing from the spirit.

Part or all of the above embodiments may be described as in the following additional notes, but are not limited to the following.
(Additional note 1)
a communication unit that receives a request message requesting communication from a communication terminal located in a communication area formed by the first local network to a second data network connectable via the second local network;
a Virtual Private Network (VPN) service connectable to the second data network; and a communication device used for connection to the VPN service, the communication device located in the first local network. a specific part to specify;
A session control device comprising: a control unit that establishes a session between the communication terminal and the communication device.
(Additional note 2)
The communication department includes:
After receiving the request message, transmitting a first inquiry message inquiring about the VPN service to another session control device that controls a session established in the second local network;
The session control device according to supplementary note 1, which receives a first response message including VPN information indicating the VPN service from the other session control device.
(Additional note 3)
The communication department includes:
transmitting a second inquiry message to a management device inquiring about a first data network connectable to the VPN service;
receiving a second response message including network identification information indicating the first data network connectable to the VPN service;
The specific part is
after receiving the second response message, identifying the communication device connectable to the first data network;
The session control device according to appendix 1 or 2, wherein the first data network is a data network in the first local network.
(Additional note 4)
The session control device according to appendix 3, wherein the second inquiry message includes VPN information indicating the VPN service.
(Appendix 5)
The session control device according to appendix 3, wherein the identifying unit identifies the communication device connectable to the first data network based on the network identification information.
(Appendix 6)
further comprising a management unit that manages VPN information indicating the VPN service,
When the communication unit receives a request message requesting connection to the second data network from another communication terminal, the identification unit includes:
The session control device according to any one of Supplementary Notes 1 to 5, which specifies the communication device based on the managed VPN information.
(Appendix 7)
a communication terminal located in a communication area formed by the first local network;
a first session control device that controls a session established in the first local network;
a second session control device that controls a session established in a second local network connectable to the second data network;
The second session control device includes:
When the communication terminal receives a first request message indicating that it requests communication to the second data network from the first session control device, it sends a first response message to the first session control device. the first response message includes VPN information indicating a VPN service connectable to the second data network;
The first session control device includes:
session control for identifying the communication device used for connection to the VPN service and located in the first local network and establishing a session between the communication terminal and the communication device; system.
(Appendix 8)
The first session control device includes:
transmitting a first inquiry message inquiring about an access network connectable to the VPN service to a first management device; receiving a second response message; and specifying the communication device connectable to the access network. configured,
According to appendix 7, the second response message includes network identification information indicating a first data network connectable to the VPN service, and the first data network is a data network in the first local network. Session control system described.
(Appendix 9)
The second session control device includes:
Supplementary note: transmitting, to a second management device, a third inquiry message inquiring about a VPN service connectable to the second data network, and receiving a third response message including the VPN information indicating the VPN service; 9. The session control system according to 7 or 8.
(Appendix 10)
receiving a request message requesting communication to a second data network connectable via the second local network from a communication terminal located in a communication area formed by the first local network;
identifying a VPN service connectable to the second data network and a communication device used for connection to the VPN service and located in the first local network;
A session control method that establishes a session between the communication terminal and the communication device.
(Appendix 11)
After receiving the request message, transmitting a first inquiry message inquiring about the VPN service to another session control device that controls a session established in the second local network;
The session control method according to appendix 10, wherein a first response message including VPN information indicating the VPN service is received from the other session control device.
(Appendix 12)
transmitting a second inquiry message to a management device inquiring about a first data network connectable to the VPN service;
receiving a second response message including network identification information indicating the first data network connectable to the VPN service;
after receiving the second response message, identifying the communication device connectable to the first data network;
The session control method according to

appendix

10 or 11, wherein the first data network is a data network in the first local network.
(Appendix 13)
The session control method according to appendix 12, wherein the second inquiry message includes VPN information indicating the VPN service.
(Appendix 14)
The session control method according to appendix 12, wherein the communication device connectable to the first data network is specified based on the network identification information.
(Appendix 15)
When receiving a request message requesting connection to the second data network from another communication terminal,
The session control method according to any one of appendices 10 to 14, wherein the communication device is specified based on VPN information indicating the VPN service.
(Appendix 16)
receiving a request message requesting communication to a second data network connectable via the second local network from a communication terminal located in a communication area formed by the first local network;
identifying a VPN service connectable to the second data network and a communication device used for connection to the VPN service and located in the first local network;
A non-transitory computer-readable medium storing a program that causes a computer to establish a session between the communication terminal and the communication device.
(Appendix 17)
After receiving the request message, transmitting a first inquiry message inquiring about the VPN service to another session control device that controls a session established in the second local network;
17. A non-transitory computer-readable medium storing the program according to appendix 16, which causes a computer to receive a first response message including VPN information indicating the VPN service from the other session control device.
(Appendix 18)
transmitting a second inquiry message to a management device inquiring about a first data network connectable to the VPN service;
receiving a second response message including network identification information indicating the first data network connectable to the VPN service;
after receiving the second response message, identifying the communication device connectable to the first data network;
The first data network is a data network in the first local network. A non-transitory computer-readable medium storing the program according to attachment 16 or attachment 17, which causes a computer to execute the following.
(Appendix 19)
The non-transitory computer-readable medium storing the program according to attachment 18, wherein the second inquiry message includes VPN information indicating the VPN service.
(Additional note 20)
19. A non-transitory computer-readable medium storing the program according to appendix 18, which causes a computer to specify the communication device connectable to the first data network based on the network identification information.
(Additional note 21)
When receiving a request message requesting connection to the second data network from another communication terminal,
21. A non-transitory computer-readable medium storing the program according to any one of appendices 16 to 20, which causes a computer to specify the communication device based on VPN information indicating the VPN service.

10 Session control device 11 Communication unit 12 Specification unit 13 Control unit 20 SNPN branch 21 AMF
22 SMF
23 U.E.
24 (R)AN
25 UPF
26 DN
27 Edge device 28 NSSMF
30 SNPN Head Office 31 SMF
32 Edge device 33 DN
34 AF
35 NSMF
36 NSSMF

Claims

a communication unit that receives a request message requesting communication from a communication terminal located in a communication area formed by the first local network to a second data network connectable via the second local network;
a Virtual Private Network (VPN) service connectable to the second data network; and a communication device used for connection to the VPN service, the communication device located in the first local network. a specific part to specify;
A session control device comprising: a control unit that establishes a session between the communication terminal and the communication device.
The communication department includes:
After receiving the request message, transmitting a first inquiry message inquiring about the VPN service to another session control device that controls a session established in the second local network;
The session control device according to claim 1, wherein the first response message including VPN information indicating the VPN service is received from the other session control device.
The communication department includes:
transmitting a second inquiry message to a management device inquiring about a first data network connectable to the VPN service;
receiving a second response message including network identification information indicating the first data network connectable to the VPN service;
The specific part is
after receiving the second response message, identifying the communication device connectable to the first data network;
The session control device according to claim 1 or 2, wherein the first data network is a data network in the first local network.
The session control device according to claim 3, wherein the second inquiry message includes VPN information indicating the VPN service.
The session control device according to claim 3, wherein the identifying unit identifies the communication device connectable to the first data network based on the network identification information.
further comprising a management unit that manages VPN information indicating the VPN service,
When the communication unit receives a request message requesting connection to the second data network from another communication terminal, the identification unit includes:
The session control device according to claim 1 , wherein the communication device is specified based on the managed VPN information.
a communication terminal located in a communication area formed by the first local network;
a first session control device that controls a session established in the first local network;
a second session control device that controls a session established in a second local network connectable to the second data network;
The second session control device includes:
When the communication terminal receives a first request message indicating that it requests communication to the second data network from the first session control device, it sends a first response message to the first session control device. the first response message includes VPN information indicating a VPN service connectable to the second data network;
The first session control device includes:
session control for identifying the communication device used for connection to the VPN service and located in the first local network and establishing a session between the communication terminal and the communication device; system.
The first session control device includes:
transmitting a first inquiry message inquiring about an access network connectable to the VPN service to a first management device; receiving a second response message; and specifying the communication device connectable to the access network. configured,
7. The second response message includes network identification information indicating a first data network connectable to the VPN service, the first data network being a data network in the first local network. The session control system described in .
The second session control device includes:
Sending a third inquiry message to a second management device inquiring about a VPN service connectable to the second data network, and receiving a third response message including the VPN information indicating the VPN service; The session control system according to item 7 or 8.
receiving a request message requesting communication to a second data network connectable via the second local network from a communication terminal located in a communication area formed by the first local network;
identifying a VPN service connectable to the second data network and a communication device used for connection to the VPN service and located in the first local network;
A session control method that establishes a session between the communication terminal and the communication device.
After receiving the request message, transmitting a first inquiry message inquiring about the VPN service to another session control device that controls a session established in the second local network;
The session control method according to claim 10, wherein a first response message including VPN information indicating the VPN service is received from the other session control device.
transmitting a second inquiry message to a management device inquiring about a first data network connectable to the VPN service;
receiving a second response message including network identification information indicating the first data network connectable to the VPN service;
after receiving the second response message, identifying the communication device connectable to the first data network;
The session control method according to claim 10 or 11, wherein the first data network is a data network in the first local network.
The session control method according to claim 12, wherein the second inquiry message includes VPN information indicating the VPN service.
The session control method according to claim 12, wherein the communication device connectable to the first data network is identified based on the network identification information.
When receiving a request message requesting connection to the second data network from another communication terminal,
The session control method according to any one of claims 10 to 14, wherein the communication device is specified based on VPN information indicating the VPN service.
receiving a request message requesting communication to a second data network connectable via the second local network from a communication terminal located in a communication area formed by the first local network;
identifying a VPN service connectable to the second data network and a communication device used for connection to the VPN service and located in the first local network;
A non-transitory computer-readable medium storing a program that causes a computer to establish a session between the communication terminal and the communication device.
After receiving the request message, transmitting a first inquiry message inquiring about the VPN service to another session control device that controls a session established in the second local network;
17. A non-transitory computer-readable medium storing a program according to claim 16, which causes a computer to receive a first response message including VPN information indicating the VPN service from the other session control device. .
transmitting a second inquiry message to a management device inquiring about a first data network connectable to the VPN service;
receiving a second response message including network identification information indicating the first data network connectable to the VPN service;
after receiving the second response message, identifying the communication device connectable to the first data network;
18. The non-transitory computer-readable medium storing the program according to claim 16 or 17, which causes a computer to execute the following: the first data network is a data network in the first local network.
The non-transitory computer-readable medium storing the program according to claim 18, wherein the second inquiry message includes VPN information indicating the VPN service.
19. A non-transitory computer-readable medium storing the program according to claim 18, which causes a computer to specify the communication device connectable to the first data network based on the network identification information. .
When receiving a request message requesting connection to the second data network from another communication terminal,
21. A non-transitory computer-readable medium storing the program according to claim 16, which causes a computer to specify the communication device based on VPN information indicating the VPN service.