WO2024038606A1 - Système de commande de communication, procédé de commande de communication et programme de commande de communication - Google Patents

Système de commande de communication, procédé de commande de communication et programme de commande de communication Download PDF

Info

Publication number
WO2024038606A1
WO2024038606A1 PCT/JP2022/031449 JP2022031449W WO2024038606A1 WO 2024038606 A1 WO2024038606 A1 WO 2024038606A1 JP 2022031449 W JP2022031449 W JP 2022031449W WO 2024038606 A1 WO2024038606 A1 WO 2024038606A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
information
vpn
management device
unit
Prior art date
Application number
PCT/JP2022/031449
Other languages
English (en)
Japanese (ja)
Inventor
幸司 杉園
伸也 河野
克真 宮本
浩輝 加納
Original Assignee
日本電信電話株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 日本電信電話株式会社 filed Critical 日本電信電話株式会社
Priority to PCT/JP2022/031449 priority Critical patent/WO2024038606A1/fr
Publication of WO2024038606A1 publication Critical patent/WO2024038606A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/64—Routing or path finding of packets in data switching networks using an overlay routing layer

Definitions

  • the present invention relates to a communication control system, a communication control method, and a communication control program.
  • a mobile service provider builds a virtual private cloud for each company within its own cloud computing, and then creates a virtual private cloud using communication equipment to access mobile services provided by the mobile service provider. Provides a means of access.
  • a method is known in which an overlay tunnel is set up between a virtual private cloud access gateway and a virtual private cloud, and between a virtual private cloud access gateway and a terminal device.
  • the former is a method that uses tunneling protocols such as GRE (Generic Routing Encapsulation) and MPLS (Multi-Protocol Label Switching).
  • the latter is a method that combines a PDU (Protocol Data Unit)/PDN (Packet Data Network) session in a mobile network and the above-mentioned tunneling protocol (see, for example, Non-Patent Document 1).
  • the gateway process analyzes the arriving packet data and, if the included destination belongs to the target virtual private cloud, forwards the packet to the overlay tunnel that is set up towards the target virtual private cloud. Forward.
  • the process that executes the gateway process may be run on a general-purpose server when the gateway process is implemented as software.
  • you stop the general-purpose server or stop the operation of the aforementioned gateway process you will not be able to transfer data to the corresponding virtual private cloud.
  • the general-purpose server had to keep the gateway process running while there was a virtual private cloud service user (hereinafter referred to as "user"), which could result in increased power consumption.
  • user virtual private cloud service user
  • a method has been adopted in which virtual machines are collectively operated on a specific server, and the power required for operating the virtual machine is reduced by improving the server's CPU utilization rate and reducing the number of operating servers (for example, (See Patent Document 2).
  • the amount of resources used by the gateway process decreases, and as a result, the number of virtual machines and containers implementing the gateway is reduced. It becomes possible to operate with Therefore, as described above, by reducing the number of servers serving as a platform, it is possible to reduce power consumption.
  • the communication control system of the present invention constructs an overlay tunnel path for data transfer used for connecting a terminal device belonging to a connection network to a dedicated network for each contract organization.
  • a communication control system having a connected terminal number management device that performs deletion, wherein the connected terminal number management device includes contract information that is information that identifies a dedicated network for each of the contracted organizations, and an area to which the terminal device connects.
  • a counting unit that counts the number of connected terminals, which is the number of the terminal devices accessing the dedicated network for each of the contracted organizations, using anchor GW identification information that is information that identifies the overlay tunnel route transfer device to which it belongs; and the connected terminals.
  • start the VPN gateway configure the VPN gateway and the overlay tunnel route transfer device to connect to the dedicated network for each contracted organization, and configure the a setting unit that constructs an overlay tunnel route, and when the number of connected terminals becomes 0 from 1 or more, deletes the settings of the VPN gateway and the overlay tunnel route transfer device, stops the VPN gateway, and deletes the settings of the VPN gateway and the overlay tunnel route transfer device; A deletion unit that deletes a transfer overlay tunnel route.
  • the present invention has the advantage of being able to count the number of communicable users existing in the network and dynamically start and stop gateway processes based on the presence or absence of users.
  • FIG. 1 is a diagram illustrating an example of an overview of a communication control method of a communication control system according to a first embodiment.
  • FIG. 2 is a diagram illustrating an example of the operation of the gateway according to the first embodiment.
  • FIG. 3 is a diagram illustrating an example of the device configuration of the terminal device according to the first embodiment.
  • FIG. 4 is a diagram showing an example of the device configuration of the VPN gateway according to the first embodiment.
  • FIG. 5 is a table diagram showing an example of information stored in the transfer destination storage unit of the VPN gateway according to the first embodiment.
  • FIG. 6 is a diagram illustrating an example of the device configuration of the overlay tunnel route transfer device according to the first embodiment.
  • FIG. 1 is a diagram illustrating an example of an overview of a communication control method of a communication control system according to a first embodiment.
  • FIG. 2 is a diagram illustrating an example of the operation of the gateway according to the first embodiment.
  • FIG. 3 is a diagram illustrating an example of the device configuration of the terminal device
  • FIG. 7 is a table diagram showing an example of table form 1 stored in the transfer destination storage unit of the overlay tunnel route transfer device according to the first embodiment.
  • FIG. 8 is a table diagram illustrating an example of table format 2 stored in the transfer destination storage unit of the overlay tunnel route transfer device according to the first embodiment.
  • FIG. 9 is a diagram illustrating an example of the device configuration of the terminal location information management device according to the first embodiment.
  • FIG. 10 is a table diagram showing an example of information stored in the terminal device connection destination VPN storage unit of the terminal location information management device according to the first embodiment.
  • FIG. 11 is a table diagram showing an example of information stored in the anchor GW storage unit of the terminal location information management device according to the first embodiment.
  • FIG. 12 is a diagram showing an example of the device configuration of the contract information management device according to the first embodiment.
  • FIG. 13 is a table diagram showing an example of information stored in the contract information storage unit of the contract information management device according to the first embodiment.
  • FIG. 14 is a diagram illustrating an example of the device configuration of the connected terminal number management device according to the first embodiment.
  • FIG. 15 is a table diagram showing an example of information stored in the connected terminal number storage unit of the connected terminal number management device according to the first embodiment.
  • FIG. 16 is a diagram illustrating an example of the device configuration of the transfer information management device according to the first embodiment.
  • FIG. 17 is a table diagram showing an example of a connected terminal number management device reply table stored in the address storage unit of the transfer information management device according to the first embodiment.
  • FIG. 18 is a table diagram showing an example of a terminal device reply table stored in the address storage unit of the transfer information management device according to the first embodiment.
  • FIG. 19 is a diagram illustrating an example of a flowchart of the communication control method according to the first embodiment.
  • FIG. 20 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to Embodiment 1'.
  • FIG. 21 is a diagram illustrating an example of the device configuration of the connected terminal number management device according to Embodiment 1'.
  • FIG. 22 is a diagram illustrating an example of a flowchart of the communication control method according to Embodiment 1'.
  • FIG. 23 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to the first embodiment.
  • FIG. 20 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to Embodiment 1'.
  • FIG. 21 is a diagram illustrating an example of the device configuration
  • FIG. 24 is a diagram illustrating an example of a flowchart of the communication control method according to the first embodiment.
  • FIG. 25 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to the second embodiment.
  • FIG. 26 is a diagram illustrating an example of an overview of the operation of the communication control system according to the second embodiment.
  • FIG. 27 is a diagram illustrating an example of an overview of establishing an encrypted path according to the second embodiment.
  • FIG. 28 is a diagram illustrating an example of the device configuration of a mobile gateway according to the second embodiment.
  • FIG. 29 is a table diagram showing an example of information stored in the VPN search table storage unit of the mobile gateway according to the second embodiment.
  • FIG. 30 is a diagram illustrating an example of a flowchart of the communication control method (pattern 1) according to the second embodiment.
  • FIG. 31 is a diagram illustrating an example of a flowchart of the communication control method (pattern 2) according to the second embodiment.
  • FIG. 32 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to Embodiment 2-1.
  • FIG. 33 is a diagram showing an example of a block diagram of various devices forming the communication control system according to Embodiment 2-1.
  • FIG. 34 is a diagram illustrating an example of an overview of the operation of the communication control system according to Embodiment 2-1.
  • FIG. 35 is a diagram illustrating an example of a device configuration of an overlay tunnel route transfer device for an IP network according to Embodiment 2-1.
  • FIG. 36 is a diagram illustrating an example of a flowchart of the communication control method according to Embodiment 2-1.
  • FIG. 37 is a diagram illustrating an example of a computer on which various devices of the communication control system according to each embodiment are implemented.
  • the communication control system 1 in each embodiment is configured so that a terminal device 100 belonging to a connection network connects to a dedicated network (for example, a virtual private cloud, etc., hereinafter simply referred to as "dedicated network") for each contract organization. Constructs and deletes overlay tunnel paths for data transfer used for data transfer.
  • a dedicated network for example, a virtual private cloud, etc., hereinafter simply referred to as "dedicated network”
  • the counting unit 631 of the connected terminal number management device 600 included in the communication control system 1 collects contract information (hereinafter referred to as "connection destination VPN ID”), which is information that identifies the dedicated network, and the terminal device 100 connected to.
  • Connection destination VPN ID which is information that identifies the dedicated network
  • Number of connected terminals which is the number of terminal devices 100 that access the dedicated network
  • anchor GW ID in charge anchor GW identification information
  • the determination unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has been updated from 0 to 1 or more. In that case, the setting unit 634 of the connected terminal number management device 600 starts the VPN (Virtual Private Network) gateway 200 and provides a VPN connection for the VPN gateway 200 and the overlay tunnel route transfer device 300 to connect to the dedicated network.
  • An address hereinafter referred to as "VPN connection address" is set, and an overlay tunnel path for data transfer is constructed.
  • the determination unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has been updated from 1 or more to 0. In that case, the deletion unit 635 of the connected terminal number management device 600 deletes the settings of the VPN connection address of the VPN gateway 200 and the overlay tunnel route transfer device 300, stops the VPN gateway 200, and deletes the overlay tunnel route for data transfer. Delete.
  • Embodiment 1 Starting and stopping the VPN gateway according to the number of connected terminals
  • FIG. 1 is a schematic diagram showing a situation in which a terminal device 100 connected to a certain arbitrary area is connected to a dedicated network.
  • the terminal device 100 sends to the terminal location information management device 400 terminal device information (hereinafter referred to as "terminal ID") that is information that identifies the terminal device 100, the connection destination VPN ID, and the above-mentioned information. and a registration request for registering the terminal location information management device 400 in the terminal location information management device 400 (see (1) in FIG. 1).
  • terminal ID terminal device information
  • the registration unit 433 of the terminal location information management device 400 registers the terminal ID and connection destination VPN ID received from the terminal device 100.
  • the registration unit 433 of the terminal location information management device 400 acquires the connection destination VPN ID identified by the terminal ID from the contract information management device 500. and register it (see (2) in Figure 1). Then, the terminal location information management device 400 establishes a D-plane session based on the connection request, which is a D-plane session establishment request, transmitted by the terminal device 100 (see (3) in FIG. 1).
  • the transmitter 434 of the terminal location information management device 400 transmits the assigned anchor GW ID and the connection destination VPN ID to the connected terminal number management device 600 (see (4) in FIG. 1).
  • the counting unit 631 of the connected terminal number management device 600 calculates the number of connections to the overlay tunnel route transfer device 300 that belongs to the area to which the terminal device 100 connects, based on the accepted anchor GW ID and connection destination VPN ID. Count and update the number of connected terminals.
  • the acquisition unit 633 of the connected terminal number management device 600 updates the transfer information management device 700.
  • the connection destination VPN ID is sent to the private network, and the VPN connection address corresponding to the dedicated network is obtained (see (5) in FIG. 1).
  • the setting unit 634 of the connected terminal number management device 600 starts the VPN gateway 200, sets the acquired VPN connection address to the VPN gateway 200 and the overlay tunnel route transfer device 300, and sets the acquired VPN connection address to the overlay tunnel route transfer device 300. Build a tunnel route (see (6) in Figure 1).
  • the terminal device 100 connects to the dedicated network using the data transfer overlay tunnel path constructed by the communication control system 1 (see (7) in FIG. 1).
  • the deletion unit 635 of the connected terminal number management device 600 deletes the VPN gateway 200 and the overlay tunnel route.
  • the settings of the transfer device 300 are deleted, the VPN gateway 200 is stopped, and the overlay tunnel route for data transfer is deleted (see (8) in FIG. 1).
  • the VPN according to the first embodiment is configured with an MEC (Multi Access Edge Cloud) and an overlay tunnel path for data transfer.
  • MEC Multi Access Edge Cloud
  • a front-end server for example, "front-end server 10" in Figure 1
  • the terminal device 100 is given a VPN terminal address by the transfer information management device 700.
  • FIG. 2 shows a terminal device 100 having a "destination: 10A", a terminal device 101 having a “destination: 10C”, and a terminal device 102 having a "destination: 10B", respectively.
  • the VPN gateway 200 and the overlay tunnel route transfer device 300 analyze the packet headers transmitted by each terminal device and distribute the packets to the overlay tunnel route for data transfer according to the destination. Specifically, the VPN gateway 200 and the overlay tunnel route transfer device 300 distribute the communication of the terminal device 100 and the communication of the terminal device 102 to the overlay tunnel route X for data transfer, and the communication of the terminal device 101 is distributed to the data transfer Allocate to transfer overlay tunnel route Y.
  • the communication control system 1 in the first embodiment includes a terminal device 100, a VPN gateway 200, an overlay tunnel route transfer device 300, a terminal location information management device 400, a contract information management device 500, and a connected terminal number management device 600. , and a transfer information management device 700.
  • the following items provide detailed explanations of the functional units of each device. Note that in the following description, descriptions of functional units (communication unit, storage unit, control unit, etc.) having similar functions in each device will be omitted as appropriate.
  • the terminal device 100 includes a communication section 110, a storage section 120, and a control section 130.
  • the terminal device 100 may include an input unit (for example, a keyboard, a mouse, etc.) that accepts various operations, and a display unit (for example, a display) for displaying various information.
  • the terminal device 100 may be a desktop personal computer, a notebook PC, a smartphone, a tablet, a PDA (Personal Digital Assistant), or the like. Next, detailed functions of each part will be described below.
  • the communication unit 110 is realized by a NIC (Network Interface Card) or the like, and controls communication via a telecommunication line such as a LAN (Local Area Network) or the Internet.
  • the communication unit 110 is connected to a network by wire or wirelessly as necessary, and can transmit and receive information in both directions.
  • the storage unit 120 stores data and programs necessary for various processing by the control unit 130.
  • the storage unit 120 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.
  • a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory
  • a storage device such as a hard disk or an optical disk.
  • the control unit 130 includes an address management unit 131 and a communication session management unit 132.
  • the control unit 130 has an internal memory for temporarily storing programs and processing data that define various processing procedures, and includes electronic circuits such as a CPU (Central Processing Unit) and an MPU (Micro Processing Unit). It is realized by integrated circuits such as ASIC (Application Specific Integrated Circuit) and FPGA (Field Programmable Gate Array).
  • ASIC Application Specific Integrated Circuit
  • FPGA Field Programmable Gate Array
  • the address management unit 131 receives a VPN terminal address for the terminal device given to the terminal device 100 and stores it in the storage unit 120.
  • the communication session management unit 132 requests the terminal location information management device 400 to establish C-plane and D-plane sessions when the terminal device 100 establishes a network connection. Furthermore, when making the above-mentioned session establishment request, the communication session management unit 132 transmits the terminal ID and the connection destination VPN ID if held by the terminal device 100 to the terminal location information management device 400. .
  • the VPN gateway 200 includes a communication section 210, a storage section 220, and a control section 230.
  • the functions of the communication unit 210 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted.
  • the VPN gateway 200 controlled by the communication control system 1 may be a virtual gateway (vGW) implemented using software.
  • the storage unit 220 stores data and programs necessary for various processing by the control unit 230.
  • the storage unit 220 includes a transfer destination storage unit 221 .
  • the forwarding destination storage unit 221 stores information regarding the forwarding destination as a forwarding table. Specifically, the transfer destination storage unit 221 stores the items "address" and "transfer destination tunnel" as shown in FIG. Note that the transfer destination storage unit 221 is not limited to the above-mentioned items as items to be stored, and may store other items. Furthermore, the input information for each item shown in FIG. 5 is just an example and is not limited to the information described.
  • the control unit 230 includes a packet header analysis unit 231 and a transfer processing unit 232.
  • the packet header analysis unit 231 analyzes a packet header transmitted when the terminal device 100 performs communication, and extracts destination information (eg, IP address, etc.).
  • destination information eg, IP address, etc.
  • Transfer processing unit 232 performs distribution to the target overlay tunnel route for data transfer based on the above-mentioned destination information.
  • overlay tunnel route transfer device 300 includes a communication section 310, a storage section 320, and a control section 330. Note that the functions of the communication unit 310 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted.
  • the storage unit 320 stores data and programs necessary for various processing by the control unit 330.
  • the storage unit 320 includes a transfer destination storage unit 321.
  • the forwarding destination storage unit 321 stores information regarding the forwarding destination as a forwarding table. Specifically, the transfer destination storage unit 321 analyzes the packet header transmitted from the terminal device 100 and maps the included destination information (for example, IP address, etc.) to the overlay tunnel route for data transfer of the VPN gateway 200. As a table form 1 related to , as shown in FIG. 7, the items "address” and “transfer destination tunnel” are stored. Further, the transfer destination storage unit 321 stores “Mobile NW tunnel” and “Mobile NW tunnel” as shown in FIG. Store the item "Transfer destination tunnel to VPN gateway".
  • the transfer destination storage unit 321 stores “Mobile NW tunnel” and “Mobile NW tunnel” as shown in FIG. Store the item "Transfer destination tunnel to VPN gateway".
  • the transfer destination storage unit 321 is not limited to the above-mentioned items, and may store other items. Furthermore, the input information for each item shown in FIGS. 7 and 8 is merely an example, and is not limited to the information described.
  • the control unit 330 includes a packet header analysis unit 331 and a transfer processing unit 332.
  • the packet header analysis unit 331 analyzes a packet header transmitted when the terminal device 100 performs communication, and extracts destination information (eg, IP address, etc.).
  • Transfer processing unit 332 The transfer processing unit 332 performs distribution to the target overlay tunnel route for data transfer based on the destination information described above.
  • the terminal location information management device 400 includes a communication section 410, a storage section 420, and a control section 430. Note that the functions of the communication unit 410 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted. In addition, the terminal location information management device 400 may utilize MME (Mobility Management Entity) and AMF (Access and Mobility management Function).
  • MME Mobility Management Entity
  • AMF Access and Mobility management Function
  • the storage unit 420 stores data and programs necessary for various processing by the control unit 430.
  • the storage unit 420 includes a terminal device connection destination VPN storage unit 421 and an anchor GW storage unit 422.
  • the terminal device connection destination VPN storage unit 421 stores a terminal device-connection destination VPN management table as information regarding the overlay tunnel route for data transfer connecting to the dedicated network. Specifically, the terminal device connection destination VPN storage unit 421 stores the items “terminal ID” and “connection destination VPN ID” as a terminal device-connection destination VPN management table as shown in FIG. Note that the terminal device connection destination VPN storage unit 421 is not limited to the above-mentioned items as information to be stored, and may store other items. Furthermore, the input information for each item shown in FIG. 10 is just an example, and the information is not limited to the information described.
  • Anchor GW storage unit 422 stores a location management table as information for identifying overlay tunnel route transfer device 300 belonging to the area to which terminal device 100 connects. Specifically, the anchor GW storage unit 422 stores the items "terminal ID" and "in-charge anchor GW ID" as a location management table, as shown in FIG. Note that the anchor GW storage unit 422 is not limited to the above-mentioned items as information to be stored, and may store other items. Furthermore, the input information for each item shown in FIG. 11 is just an example and is not limited to the information described.
  • the control unit 430 includes a reception unit 431, a notification unit 432, a registration unit 433, and a transmission unit 434.
  • the reception unit 431 determines that the terminal device 100 holds the connection destination VPN ID. In that case, the receiving unit 431 receives terminal device information (terminal ID), which is information for identifying the terminal device 100, and contract information (connection destination VPN ID) from the terminal device 100. On the other hand, the reception unit 431 determines that the terminal device 100 does not hold the connection destination VPN ID. In that case, the reception unit 431 sends terminal device information (terminal ID) that is information that identifies the terminal device 100, terminal device information (terminal ID), and contract information (connection destination VPN ID) to the terminal location information management device. 400 is received from the terminal device 100.
  • terminal ID terminal device information
  • terminal ID terminal ID
  • contract information connection destination VPN ID
  • the reception unit 431 receives a connection request from the terminal device 100, which is a request for connection from the mobile network to the data network.
  • the reception unit 431 is not limited to the above-mentioned information, and may accept other information as necessary.
  • the notification unit 432 notifies the contract information management device 500 of the terminal ID when the terminal device 100 does not hold the connection destination VPN ID. Note that the notification unit 432 is not limited to the above-mentioned information, and may notify other information as necessary.
  • the registration unit 433 registers the terminal device information (terminal ID) and contract information (connection destination VPN ID) received from the terminal device 100. On the other hand, if the terminal device 100 does not hold contract information, the registration unit 433 registers the contract information management device 500 using the terminal device information (terminal ID) based on the terminal ID received from the terminal device 100 and the registration request. Register the contract information (connection destination VPN ID) obtained from .
  • the registration unit 433 registers the terminal ID transmitted by the terminal device 100 and the connection destination VPN ID transmitted by the transmission unit 532 of the contract information management device 500, which will be described later.
  • the registration unit 433 is not limited to the above-mentioned information, and may accept other information as necessary.
  • the transmitter 434 transmits contract information (connection destination VPN ID) and anchor GW identification information (anchor GW ID in charge) to the connected terminal number management device 600 based on the connection request. Note that the transmitter 434 is not limited to the above-mentioned information, and may transmit other information as necessary.
  • the contract information management device 500 includes a communication section 510, a storage section 520, and a control section 530. Note that the functions of the communication unit 510 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted. In addition, the contract information management device 500 may work in conjunction with an HSS (Home Subscriber Server) and a UDM (Unified Data Management).
  • HSS Home Subscriber Server
  • UDM Unified Data Management
  • the storage unit 520 stores data and programs necessary for various processing by the control unit 530.
  • the storage unit 520 includes a contract information storage unit 521.
  • the contract information storage unit 521 stores a contract management table including connection destination VPN IDs as contract information. Specifically, the contract information storage unit 521 stores items such as "terminal ID" and "connection destination VPN ID” as shown in FIG. 13 as a contract management table. Note that the information stored in the contract information storage section 521 is not limited to the above-mentioned items, and may store other items. Furthermore, the input information for each item shown in FIG. 13 is just an example, and the information is not limited to the information described.
  • the control unit 530 includes a reception unit 531 and a transmission unit 532.
  • the reception unit 531 receives the terminal ID notified by the notification unit 432 of the terminal location information management device 400. Note that the reception unit 531 is not limited to the above-mentioned information, and may accept other information as necessary.
  • the transmitter 532 transmits the connection destination VPN ID corresponding to the terminal ID accepted by the receiver 531 to the terminal location information management device 400. Note that the transmitter 532 is not limited to the above-mentioned information, and may transmit other information as necessary.
  • the connected terminal number management device 600 constructs and deletes an overlay tunnel path for data transfer used by the terminal device 100 belonging to the connection network to connect to a dedicated network for each contract organization.
  • the connected terminal number management device 600 includes a communication section 610, a storage section 620, and a control section 630. Note that the functions of the communication unit 610 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted.
  • the storage unit 620 stores data and programs necessary for various processing by the control unit 630.
  • the storage unit 620 includes a connected terminal number storage unit 621.
  • the number of connected terminals storage unit 621 stores a number of connected terminals management table as information used to count the number of connected terminals. Specifically, the number of connected terminals storage unit 621 stores items such as "anchor GW ID in charge”, "connection destination VPN ID”, and "number of connected terminals" as shown in FIG. 15 as a number of connected terminals management table.
  • the information stored by the number of connected terminals storage unit 621 is not limited to the above-mentioned items, and may store other items.
  • the input information for each item shown in FIG. 15 is just an example, and the information is not limited to the information described.
  • the control section 630 includes a counting section 631, a determining section 632, an obtaining section 633, a setting section 634, and a deleting section 635.
  • the counting unit 631 includes contract information (connection destination VPN ID), which is information that identifies a dedicated network for each contract organization, and anchor GW, which is information that identifies the overlay tunnel route transfer device 300 that belongs to the area to which the terminal device 100 connects. Using the identification information (anchor GW ID in charge), the number of connected terminals, which is the number of terminal devices 100 accessing the dedicated network for each contracted organization, is counted, and the number of connected terminals is updated. Note that the counting unit 631 is not limited to the above-mentioned information, and may perform counting using other information as necessary.
  • the determining unit 632 determines whether a predetermined condition is satisfied based on the connected terminal number information counted and updated by the counting unit 631. For example, the determining unit 632 determines that the setting unit 634 performs the process when the number of connected terminals is updated from 0 to 1 or more, and when the number of connected terminals is 0 for a predetermined time or more, that is, the number of connected terminals is If the value is updated from 1 or more to 0, it is determined that the deletion unit 635 performs the process.
  • the determining unit 632 may also determine that the deletion unit 635 performs the process when the number of connected terminals is updated from 1 or more to 0 and the number of connected terminals remains 0 for a certain period of time or more. Further, the determination unit 632 is not limited to the aforementioned determination conditions, and may make determinations based on other determination conditions as necessary.
  • the acquisition unit 633 uses the contract information (connection destination VPN ID) to obtain information (VPN connection address) for connecting to a dedicated network for each contracted organization to which the terminal device 100 connects from the transfer information management device 700. get.
  • the acquisition unit 633 is not limited to the above-mentioned information, and may acquire other information as necessary.
  • the setting unit 634 activates the VPN gateway 200 and transfers the VPN gateway 200 and the overlay tunnel route transfer device 300.
  • the setting unit 634 activates the VPN gateway 200 and sends the request to the VPN gateway 200 and the overlay tunnel route transfer device 300. Then, set the VPN connection address and construct an overlay tunnel route for data transfer.
  • the setting unit 634 is not limited to the above-mentioned information, and may use other information as necessary to perform settings for any device.
  • the deletion unit 635 deletes the settings of the VPN gateway 200 and the overlay tunnel route transfer device 300, and deletes the settings of the VPN gateway 200 and the overlay tunnel route transfer device 300 when the determination result of the determination unit 632 satisfies a predetermined condition, that is, when the number of connected terminals changes from 1 or more to 0.
  • the gateway 200 is stopped and the overlay tunnel route for data transfer is deleted.
  • the deletion unit 635 deletes the VPN connection set for the VPN gateway 200 and the overlay tunnel route transfer device 300. address, stop the VPN gateway 200, and release the overlay tunnel route for data transfer.
  • the deletion unit 635 is not limited to the above-mentioned information, and may delete settings of any device using other information as necessary.
  • the transfer information management device 700 includes a communication section 710, a storage section 720, and a control section 730. Note that the functions of the communication unit 710 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted.
  • the storage unit 720 stores data and programs necessary for various processing by the control unit 730.
  • the storage unit 720 includes an address storage unit 721.
  • the address storage unit 721 stores a connected terminal number management device reply table and a terminal device reply table as information regarding the VPN connection address for connecting to the dedicated network. Specifically, the address storage unit 721 stores the items "connection destination VPN ID" and "VPN connection address” as a table for replying to the number of connected terminals management device, as shown in FIG.
  • the address storage unit 721 stores items such as "Service connection URI (Uniform Resource Identifier)/URL (Uniform Resource Locator)" and "VPN terminal address” as shown in FIG. 18 as a terminal device reply table. do.
  • the information stored in the address storage section 721 is not limited to the above-mentioned items, and may store other items.
  • the input information for each item shown in FIGS. 17 and 18 is just an example, and the information is not limited to the information described.
  • the address storage unit 721 of the transfer information management device 700 may utilize DNS (Domain Name System) as a function of the terminal reply table.
  • DNS Domain Name System
  • the control section 730 includes a reception section 731 and a transmission section 732.
  • the reception unit 731 receives the connection VPN ID transmitted by the acquisition unit 633 of the connected terminal number management device 600. Note that the reception unit 731 is not limited to the above-mentioned information, and may accept other information as necessary.
  • the transmission unit 732 Based on the connection VPN ID received by the reception unit 731, the transmission unit 732 transmits the corresponding VPN connection address to the connected terminal number management device 600 and the corresponding VPN terminal address to the terminal device 100. Note that the transmitter 732 is not limited to the above-mentioned information, and may transmit other information as necessary.
  • the reception unit 431 of the terminal location information management device 400 receives a terminal ID and a registration request to the C-plane of the mobile network from the terminal device 100 (step S11).
  • the reception unit 431 of the terminal location information management device 400 determines that the terminal device 100 holds the connection destination VPN ID (Yes in step S12). In that case, the receiving unit 431 of the terminal location information management device 400 receives the connection destination VPN ID from the terminal device 100 (step S13). Subsequently, the registration unit 433 of the terminal location information management device 400 registers the terminal ID and the connection destination VPN ID corresponding to the terminal ID (step S16).
  • the reception unit 431 of the terminal location information management device 400 determines that the terminal device 100 does not hold the connection destination VPN ID (No in step S12). In that case, the notification unit 432 of the terminal location information management device 400 notifies the contract information management device 500 of the terminal ID (step S14). Then, the transmitting unit 532 of the contract information management device 500 transmits the connection destination VPN ID corresponding to the terminal ID to the terminal location information management device 400 (step S15). Subsequently, the registration unit 433 of the terminal location information management device 400 registers the terminal ID transmitted by the terminal device 100 and the connection destination VPN ID transmitted by the contract information management device 500 (step S16).
  • the terminal location information management device 400 establishes a C-plane session with the terminal device 100 (step S17). Subsequently, the receiving unit 431 of the terminal location information management device 400 receives a connection request for establishing a D-plane session from the terminal device 100 (step S18). Subsequently, the terminal location information management device 400 determines the overlay tunnel route transfer device 300 to be connected, and establishes a D-plane session within the mobile network (step S19).
  • the transmitting unit 434 of the terminal location information management device 400 transmits the connection destination VPN ID and the anchor GW ID in charge to the connected terminal number management device 600 (step S20). Subsequently, the counting unit 631 of the connected terminal number management device 600 counts and updates the number of connected terminals based on the received connection destination VPN ID and assigned anchor GW ID (step S21).
  • the determination unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has been updated from 0 to 1 or more (step S22). In that case, the acquisition unit 633 of the connected terminal number management device 600 transmits the connection destination VPN ID to the transfer information management device 700 and acquires the VPN connection address (step S23). Subsequently, the setting unit 634 of the connected terminal number management device 600 starts the VPN gateway 200, sets the acquired VPN connection address for the VPN gateway 200 and the overlay tunnel route transfer device 300, and sets the acquired VPN connection address to the overlay tunnel route transfer device 300 for data transfer. A tunnel route is constructed (step S24).
  • the transfer information management device 700 transmits the VPN terminal address to the terminal device 100 (step S25). Then, the terminal device 100 uses the VPN terminal address transmitted by the transfer information management device 700 to connect to the dedicated network via the data transfer overlay tunnel path (step S26). Thereafter, the terminal device 100 continues to connect to the dedicated network (step S27).
  • the terminal location information management device 400 measures the non-communication time of the terminal device 100 (step S28). Then, if the non-communication time exceeds a predetermined threshold, the terminal location information management device 400 disconnects the D-plane session (step S29). Subsequently, the counting unit 631 of the connected terminal number management device 600 subtracts the number of connected terminals corresponding to the overlay tunnel route transfer device 300 via which the terminal device 100 communicates with the VPN (step S30). When the number of connected terminals is changed from 1 or more to 0 by the above-described subtraction, the determining unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has been updated from 1 or more to 0. (Yes in step S31).
  • the deletion unit 635 of the connected terminal number management device 600 deletes the VPN connection addresses set in the VPN gateway 200 and the overlay tunnel route transfer device 300, stops the VPN gateway 200, and deletes the overlay tunnel route for data transfer. It is released, and the process ends (step S32).
  • the determining unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has not been updated from 1 or more to 0 (No in step S31). In that case, the process returns and the communication control system 1 continues the process.
  • the communication control system 1 includes a connected terminal number management device 600 that constructs and deletes an overlay tunnel path for data transfer used for connecting a terminal device 100 belonging to a connection network to a dedicated network for each contract organization.
  • anchor GW identification information anchor GW ID in charge
  • the number of connected terminals which is the number of terminal devices 100 that access the dedicated network for each contract organization, is counted, and the connected terminals are If the number is from 0 to 1 or more, start the VPN gateway 200, configure the VPN gateway 200 and overlay tunnel route transfer device 300 to connect to the dedicated network for each contract organization, and connect the overlay for data transfer.
  • the settings of the VPN gateway 200 and overlay tunnel route transfer device 300 are deleted, the VPN gateway 200 is stopped, and the overlay tunnel route for data transfer is changed. It is characterized by deleting. Therefore, according to this embodiment, the following effects are achieved.
  • the general-purpose server that executes the gateway process keeps the gateway process on standby even when packet data does not arrive, and the memory is occupied by the gateway process, resulting in a low power consumption. continue to consume. Therefore, if there are multiple gateway processes, each providing gateway functions to different dedicated networks, the memory of the operating server that can be used by the active gateway processes may decrease, and packet forwarding performance may deteriorate. Ta.
  • the communication control system 1 of the first embodiment dynamically sets the gateway process according to an increase or decrease in the number of connected terminals. This provides the effect of reducing power and avoiding unnecessary occupation of resources.
  • Embodiment 1' Selection of a server for operating a VPN gateway in consideration of the load on the server for operating a VPN gateway]
  • the communication control system 1 selects the operating server to be operated in consideration of the load on the operating server of the VPN gateway 200.
  • the communication control system 1 in Embodiment 1' periodically acquires the CPU usage rate of the operating server and the number of VPN gateways 200 in operation as information regarding the operating status of the VPN gateways 200, A server for operation that satisfies predetermined conditions (for example, low CPU usage rate, high power efficiency, low load, etc.) is determined.
  • predetermined conditions for example, low CPU usage rate, high power efficiency, low load, etc.
  • FIG. 20 shows a situation where, as operating servers of the VPN gateway 200, there are an operating server 20A with a CPU usage rate of 20% and an operating server 20B with a CPU usage rate of 80%.
  • the monitoring unit 636 of the connected terminal number management device 600 monitors the CPU usage rates of the operating server 20A and the operating server 20B, and acquires information regarding the CPU usage rate at predetermined time-series intervals (( (see 1)).
  • the monitoring unit 636 of the connected terminal number management device 600 selects an operating server on which to operate the VPN gateway 200 based on the obtained information regarding the CPU usage rate.
  • the monitoring unit 636 of the connected terminal number management device 600 uses the operating server 20A as the operating server. Determine.
  • the monitoring unit 636 of the connected terminal number management device 600 also monitors the number of VPN gateways in operation, memory usage rate, number of connected terminals, etc.
  • the operating server to be operated may be determined using this information.
  • the communication control system 1 in Embodiment 1' includes a terminal device 100, a VPN gateway 200, an overlay tunnel route transfer device 300, a terminal location information management device 400, a contract information management device 500, and a connected terminal number management device 600.
  • the device configuration includes a transfer information management device 700 and a transfer information management device 700. The following items provide detailed explanations of the functional units of each device.
  • Embodiment 1' is the same as in Embodiment 1, and in this article, only the monitoring unit 636 of the connected terminal number management device 600, which is a different functional unit, will be explained, and other detailed explanations will be omitted. Omitted.
  • the monitoring unit 636 acquires information regarding the operating status of the operating server that operates the VPN gateway 200, and determines the operating server to be operated based on the information regarding the operating status. For example, the monitoring unit 636 monitors the operating server of the VPN gateway 200, and provides information regarding the operating status of the operating server (for example, CPU usage rate, memory usage rate, memory usage amount, and the operating status of the VPN gateway 200). number of etc.). Note that the monitoring unit 636 is not limited to the above-mentioned information, and may monitor and acquire other information as necessary.
  • the monitoring unit 636 of the connected terminal number management device 600 monitors the operating status of the operating server of the VPN gateway 200 (step S31). Then, the monitoring unit 636 of the connected terminal number management device 600 acquires information regarding the operating status of the operating server (step S32). Further, the monitoring unit 636 of the connected terminal number management device 600 determines the operating server to be used based on the information regarding the operating status (step S33).
  • the communication control system 1 in Embodiment 1' dynamically selects the operating server that operates the VPN gateway 200 according to the operating status of the operating server, so the load distribution of the operating server and the packet transfer performance are improved. Provides the effect of suppressing deterioration.
  • Embodiment 1'' Operation when changing overlay tunnel route transfer device due to area movement
  • Embodiment 1'' will be described as a further different embodiment.
  • Embodiment 1'' is an embodiment in which the terminal device 100 moves between areas and the overlay tunnel route transfer device 300 in charge is changed.
  • FIG. 23 shows that the terminal device 100 moves between “area A” and “area B” which are logically different areas. Further, as a premise, the terminal location information management device 400 belonging to each area holds the assigned anchor GW ID of the overlay tunnel route transfer device 300 belonging to the corresponding area. Therefore, the terminal location information management device 400 and overlay tunnel route transfer device 300 in charge determine the base station to which the terminal device 100 connects when registering with the mobile network.
  • area A is the terminal location information management device 400A and overlay tunnel route transfer device 300A
  • area B is the terminal location information management device 400B and overlay tunnel route transfer device 300B.
  • Embodiment 1'' will be explained with continued reference to FIG. 23.
  • the terminal device 100 moves across areas from area A to area B (see (1) in FIG. 23).
  • the terminal location information management device 400B in the destination area B registers the terminal ID and connection destination VPN ID of the terminal device 100 (see (2) in FIG. 23).
  • the terminal location information management device 400B establishes a D-plane session within the mobile network (see (3) in FIG. 23).
  • the counting unit 631 of the connected terminal number management device 600 performs a process of adding up the number of connected terminals in area B.
  • the terminal location information management device 400A terminates the D-plane session in area A (see (4) in FIG. 23).
  • the counting unit 631 of the connected terminal number management device 600 performs a process of subtracting the number of connected terminals in area A.
  • a communication control system 1 in embodiment 1'' includes a terminal device 100, a VPN gateway 200, an overlay tunnel route transfer device 300, a terminal location information management device 400, a contract information management device 500, and a connected terminal number management device. 600 and a transfer information management device 700. Note that the system configuration in Embodiment 1'' is the same as that in Embodiment 1, so detailed explanation will be omitted.
  • the terminal device 100 moves from an arbitrary area A to a different area B (step S41).
  • the terminal location information management device 500B of the destination area B registers the terminal ID and connection destination VPN ID of the terminal device 100 that has moved between areas in the terminal location information management device 400B (step S42).
  • the terminal location information management device 400B determines the overlay tunnel route transfer device 300B to be connected to, and establishes a D-plane session within the mobile network, similarly to the procedure of the first embodiment (step S43).
  • the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals in area B, adds it, and updates it (step S44).
  • the terminal location information management device 500A terminates the D-plane session in area A (step S45).
  • the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals in area A, subtracts it, and updates it (step S46).
  • the terminal location information management device 400 of the area movement destination is the terminal device.
  • Information necessary for counting the number of connected terminals is acquired from the device 100, and the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals.
  • the setting unit 634 and deletion unit 635 of the connected terminal number management device 600 dynamically control the VPN gateway 200 and the overlay tunnel route transfer device 300, thereby saving resources of the operating server and distributing the load of the gateway process. Provides the effect of increasing efficiency.
  • Embodiment 2 When the terminal device connects to the VPN via WiFi] Embodiment 2 will now be described as a further different embodiment. In the second embodiment, an embodiment will be described in which the terminal device 100 connects to a VPN from WiFi via a mobile network.
  • the terminal device 100 that performs a WiFi connection connects to the WiFi router R (see (1) in FIG. 25).
  • the WiFi router R transfers the packet data to the mobile gateway 800 (see (2) in FIG. 25).
  • the mobile gateway 800 uses the destination information (for example, IP address etc.), determines the VPN connection address and connection destination VPN ID, and establishes a D-plane session on behalf of the terminal device 100.
  • the mobile gateway 800 then transfers the data to the D-plane session corresponding to the destination VPN (see (3) in FIG. 25). Note that the subsequent counting of the number of connected terminals is the same as in the first embodiment, and will therefore be omitted.
  • the terminal device 100 transmits a VPN authentication request (including a password and user ID) to the mobile gateway 800 when starting a VPN connection (see (1) in FIG. 26). Subsequently, the mobile gateway 800 further transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (see (2) in FIG. 26). Then, the VPN authentication server 900 transmits an authentication response (connection destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (see (3) in FIG. 26). ). Note that when the VPN authentication server 900 transmits the VPN terminal address, the mobile gateway 800 acquires the corresponding connection destination VPN ID from the contract information management device 500 based on the VPN terminal address (( (See 4).
  • the mobile gateway 800 transmits the connection destination VPN ID acquired from the VPN authentication server 900 or the contract information management device 500 to the terminal location information management device 400 (see (5) in FIG. 26).
  • the terminal location information management device 400 further transmits the connection destination VPN ID to the transfer information management device 700 and acquires the corresponding VPN connection address (see (6) in FIG. 26).
  • the terminal location information management device 400 transmits the acquired VPN connection address to the mobile gateway 800 (see (7) in FIG. 26).
  • the mobile gateway 800 maps and sets the acquired VPN connection address and the held connection destination VPN ID.
  • Case 2 will be explained using FIG. 27.
  • the terminal device 100 detects a WiFi connection, it establishes an encrypted path C with the mobile gateway 800 (see (1) in FIG. 27).
  • the terminal device 100 stops the procedure for establishing the encrypted route C.
  • the mobile gateway 800 performs VPN authentication in the same manner as in case 1 described above, obtains the VPN connection address and the connection destination VPN ID, and sets them to itself after mapping.
  • the mobile gateway 800 transmits a registration completion message to the terminal device 100 via the encrypted path C (see (2) in FIG. 27).
  • the communication control system 1 in the second embodiment includes a terminal device 100, a VPN gateway 200, an overlay tunnel route transfer device 300, a terminal location information management device 400, a contract information management device 500, and a connected terminal number management device 600. , a transfer information management device 700, and a mobile gateway 800.
  • the following items provide detailed explanations of the functional units of each device. Note that the device configuration of the second embodiment other than the mobile gateway 800 is the same as that of the first embodiment, and in this section, only the different mobile gateway 800 will be explained, and detailed explanation of the other components will be omitted.
  • mobile gateway 800 As shown in FIG. 28, mobile gateway 800 includes a communication section 810, a storage section 820, and a control section 830. Note that the functions of the communication unit 810 are the same as those described for the communication unit 110 of the terminal device 100, so a description thereof will be omitted.
  • the storage unit 820 stores data and programs necessary for various processing by the control unit 830.
  • the storage unit 820 has a VPN search table 821 storage unit.
  • the VPN search table storage unit 821 stores a VPN search table that maps and sets the acquired VPN connection address and connection destination VPN ID. Specifically, the VPN search table storage unit 821 stores the items "VPN connection address" and "connection destination VPN ID" as a VPN search table, as shown in FIG. Note that the information stored in the VPN search table storage section 821 is not limited to the above-mentioned items, and may store other items. Furthermore, the input information for each item shown in FIG. 29 is just an example, and the information is not limited to the information described.
  • the control unit 830 includes a distribution unit 831, a transmission unit 832, a setting unit 833, and a session establishment unit 834.
  • the distribution unit 831 assigns a VPN based on pre-held information regarding the destination address (VPN connection address), information regarding the corresponding VPN (connection destination VPN ID), and destination information (IP address) transmitted by the terminal device 100.
  • the connection address and connection destination VPN ID are determined, and communication is distributed to the D-plane session corresponding to the destination VPN.
  • the transmitter 832 transmits the authentication request (including the user ID, password, etc.) received from the terminal device 100 to the VPN authentication server 900. Further, the transmitter 832 transmits the connection destination VPN ID acquired from the VPN authentication server 900 to the terminal location information management device 400. Furthermore, the transmitter 832 transmits a registration completion message to the terminal device 100.
  • the setting unit 833 maps and sets the VPN connection address acquired from the transfer information management device 700 and the connection destination VPN ID held by the mobile gateway 800.
  • the session establishment unit 834 includes contract information (connection destination VPN ID), information for connecting to a dedicated network for each contracted organization to which the terminal device 100 connects (VPN connection address), and packets transmitted by the terminal device 100. Based on the destination information included in the data, an overlay tunnel path for data transfer is established with the terminal location information management device 400 instead of the terminal device 100.
  • the session establishment unit 834 performs the following steps based on the mapped VPN connection address and connection destination VPN ID.
  • the destination VPN connection address and connection destination VPN ID are determined from the destination information (IP address) included in the packet data transmitted by the terminal device 100.
  • the session establishment unit 834 establishes a D-plane session corresponding to the corresponding destination VPN and transfers the packet data.
  • the terminal device 100 connects to the WiFi router R (step S51). Subsequently, the terminal device 100 transmits a VPN authentication request (including a password and user ID) to the mobile gateway 800 at the time of starting the VPN connection (step S52). Next, the transmitter 832 of the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (step S53). Then, the VPN authentication server 900 transmits an authentication response (connection destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (step S54).
  • a VPN authentication request including a password and user ID
  • the transmitter 832 of the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (step S53).
  • the VPN authentication server 900 transmits an authentication response (connection destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (step S54).
  • the transmitter 832 of the mobile gateway 800 transmits the connection destination VPN ID acquired from the VPN authentication server 900 to the terminal location information management device 400 (step S55).
  • the acquisition unit 435 of the terminal location information management device 400 then acquires the VPN connection address from the transfer information management device 700 (step S56).
  • the transmitter 434 of the terminal location information management device 400 transmits the acquired VPN connection address to the mobile gateway 800 (step S57).
  • the setting unit 833 of the mobile gateway 800 maps and sets the acquired VPN connection address and the held connection destination VPN ID (step S58).
  • the WiFi router R transfers the packet data to the mobile gateway 800 (step S59).
  • the session establishment unit 834 of the mobile gateway 800 determines the destination VPN connection address from the destination information included in the packet data transmitted by the terminal device 100, based on the mapped VPN connection address and connection destination VPN ID. and the connection destination VPN ID is determined (step S60). Then, the session establishment unit 834 of the mobile gateway 800 establishes a D-plane session corresponding to the corresponding destination VPN and transfers the packet data (step S61).
  • the terminal device 100 connects to the WiFi router R (step S71). At this time, the terminal device 100 establishes an encrypted path C with the mobile gateway 800 (step S72). Subsequently, the terminal device 100 transmits a VPN authentication request (including a password and user ID) to the mobile gateway 800 at the time of starting the VPN connection (step S73). Next, the transmitter 832 of the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (step S74). Then, the VPN authentication server 900 transmits an authentication response (connection destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (step S75).
  • a VPN authentication request including a password and user ID
  • the transmitter 832 of the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (step S74).
  • the VPN authentication server 900 transmits an authentication response (connection destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (step S
  • the transmitter 832 of the mobile gateway 800 transmits the connection destination VPN ID acquired from the VPN authentication server 900 to the terminal location information management device 400 (step S76).
  • the acquisition unit 435 of the terminal location information management device 400 acquires the VPN connection address from the transfer information management device 700 (step S77).
  • the transmitter 434 of the terminal location information management device 400 transmits the acquired VPN connection address to the mobile gateway 800 (step S78).
  • the setting unit 833 of the mobile gateway 800 maps and sets the acquired VPN connection address and the held connection destination VPN ID (step S79).
  • the transmitter 832 of the mobile gateway 800 transmits a registration completion message to the terminal device 100 (step S80).
  • the WiFi router R transfers the packet data to the mobile gateway 800 (step S81).
  • the session establishment unit 834 of the mobile gateway 800 determines the destination VPN connection address from the destination information included in the packet data transmitted by the terminal device 100, based on the mapped VPN connection address and connection destination VPN ID. and the connection destination VPN ID is determined (step S82). Then, the session establishment unit 834 of the mobile gateway 800 establishes a D-plane session corresponding to the corresponding destination VPN and transfers the packet data (step S83).
  • the communication control system 1 has the following effects.
  • the terminal device 100 when performing WiFi communication, the terminal device 100 only has the destination IP address of the data packet to be transferred to the VPN as information for identifying the VPN to be accessed, and the mobile gateway 800 has only the destination IP address of the data packet transferred to the VPN. It was necessary to attach identifying information to the session establishment signaling message.
  • the device corresponding to the mobile gateway 800 cannot derive information identifying the VPN to be accessed from the destination IP address of the arriving packet, it is possible to connect the device to the VPN through signaling of the mobile network as soon as the packet arrives. An overlay tunnel route for data transfer could not be established.
  • the communication control system 1 in the second embodiment searches for a mapped VPN connection address from the destination information (IP address) of packet data arriving at the mobile gateway 800, establishes an overlay tunnel path for data transfer, and connects the Provides the effect of making it possible to count the number of terminals.
  • IP address destination information
  • Embodiment 2-1 When a terminal device connects to a VPN via an IP network] Embodiment 2-1 will now be described as a similar form to Embodiment 2. In FIG. 32, an embodiment will be described in which the terminal device 100 connects to a VPN from WiFi via an IP network.
  • FIG. 32 shows a case where the terminal device 100 connects to the fixed network access router SR via the WiFi router R, and a case where the terminal device 100 connects directly to the fixed network access router SR.
  • the communication control system 1 when the terminal device 100 accesses via the IP network, the communication control system 1 cannot count the number of connected terminals based on D-plane session establishment and release. Therefore, the communication control system 1 in Embodiment 2-1 uses a terminal operation check performed using "heartbeat", "ping”, etc. as a trigger after establishing the VPN authentication and data transfer overlay tunnel path described in Embodiment 2. and count the number of connected terminals.
  • an overlay tunnel route transfer device 300 for the IP network (hereinafter referred to as “overlay tunnel route transfer device 300") is installed between the IP network and the data network.
  • the communication control system 1 communicates with a VPN authentication server 900 (hereinafter referred to as "VPN authentication server 900") for multiple IP networks in order to identify the overlay tunnel route transfer device 300.
  • VPN authentication server 900 a configuration including a plurality of access point APs (for example, a residential WiFi router, etc.).
  • the terminal device 100 transmits VPN connection information (user ID, password, etc.) to the VPN authentication server 900 via the WiFi router R and the fixed network access router SR, or only the fixed network access router SR (see FIG. 34). (see (1)).
  • VPN connection information user ID, password, etc.
  • the VPN authentication server 900 notifies the connected terminal number management device 600 of the connection destination VPN ID and the anchor GW ID in charge (see (2) in FIG. 34). Then, the connected terminal number management device 600 counts and adds up the number of connected terminals connected to the target VPN to be connected to the dedicated network from the corresponding overlay tunnel route transfer device 300. Note that the procedure for constructing an overlay tunnel path for data transfer after addition is the same as the method described in the first embodiment.
  • the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 performs terminal survival confirmation using "heartbeat", "ping”, etc. (see (3) in FIG. 34). Then, if there is no response from the terminal device 100 as a result of the terminal survival confirmation, the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 sends the connection destination VPN ID and the anchor GW ID in charge to the connected terminal number management device 600. (See (4) in FIG. 34). Then, based on the above-mentioned notification, the connected terminal number management device 600 counts and subtracts the number of connected terminals connected to the VPN to be connected to the dedicated network. Note that the procedure for deleting the overlay tunnel path for data transfer after subtraction is the same as the method described in the first embodiment.
  • the communication control system 1 in Embodiment 2-1 connects a terminal device 100, a VPN gateway 200, an overlay tunnel route transfer device 300 for an IP network, a terminal location information management device 400, and a contract information management device 500.
  • This device configuration includes a terminal number management device 600 and a transfer information management device 700.
  • Embodiment 2-1 other than the overlay tunnel route transfer device 300 is the same as in Embodiment 1, and in this item, only the different overlay tunnel route transfer device 300 will be explained, and other detailed explanations will be provided. Omitted. Furthermore, since the overlay tunnel route transfer device 300 in Embodiment 2-1 has the same functions as the overlay tunnel route transfer device 300 in Embodiment 1, only the terminal survival confirmation unit 333, which is a different functional unit, will be explained. will be carried out, and other explanations will be omitted.
  • the control unit 330 includes a packet header analysis unit 331, a transfer processing unit 332, and a terminal survival confirmation unit 333.
  • Terminal survival confirmation unit 333 transmits an identification signal to the terminal device 100 connected to the dedicated network via the IP network, and confirms whether the terminal device 100 is currently connected to the dedicated network.
  • the terminal survival confirmation unit 333 uses "heartbeat", “ping”, etc. to confirm the terminal survival, and determines whether there is a response from the terminal device 100. Then, the terminal survival confirmation unit 333 notifies the connection destination VPN ID and the assigned anchor GW ID to the connected terminal number management device 600 based on the determination result of the terminal survival confirmation described above. Then, as a result of the terminal survival confirmation, if there is no response from the terminal device 100, the terminal survival confirmation unit 333 notifies the connected terminal number management device 600 of the connection destination VPN ID and the anchor GW ID in charge.
  • the terminal device 100 transmits VPN connection information (user ID, password, etc.) to the VPN authentication server 900 via the WiFi router R and the fixed network access router SR or only the fixed network access router SR (step S91). . Further, the VPN authentication server 900 notifies the connected terminal number management device 600 of the connection destination VPN ID and the anchor GW ID in charge (step S92).
  • VPN connection information user ID, password, etc.
  • the number of connected terminals management device 600 determines the number of connected terminals that connect to the target VPN via the corresponding overlay tunnel route transfer device 300 based on the connection destination VPN ID and the anchor GW ID in charge notified by the VPN authentication server 900. are counted, added, and updated (step S93). Subsequently, the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 uses "heartbeat", "ping", etc. to confirm the terminal survival (step S94).
  • the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 determines that there is no longer a response from the terminal device 100 (Yes in step S95). In that case, the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 notifies the connected terminal number management device 600 of the connection destination VPN ID and the assigned anchor GW ID (step S96). Then, the counting unit 631 of the number of connected terminals management device 600 calculates the number of connected terminals connected to the target VPN based on the connection destination VPN ID and the anchor GW ID in charge notified by the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300. is counted, subtracted, and updated (step S97).
  • the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 determines that there is a response from the terminal device 100, and the process continues (No in step S95).
  • the communication control system 1 has the following effects.
  • the terminal survival confirmation unit 333 of the overlay tunnel route transfer device 300 performs terminal survival confirmation on the terminal device 100, and subtracts the number of connected terminals based on the response result from the terminal device 100. Thereby, the communication control system 1 can count the number of connected terminals even in the case of a connection via an IP network where the number of connected terminals cannot be counted using the method described in Embodiment 1. This provides the effect of enabling dynamic control of the tunnel route transfer device 300.
  • each component of each device shown in the drawings is functionally conceptual, and does not necessarily need to be physically configured as shown in the drawings.
  • the specific form of distributing and integrating each device is not limited to what is shown in the diagram, and all or part of the devices can be functionally or physically distributed or integrated in arbitrary units depending on various loads and usage conditions. Can be integrated and configured.
  • all or any part of each processing function performed by each device can be realized by a CPU and a program that is analyzed and executed by the CPU, or can be realized as hardware using wired logic.
  • various devices constituting the communication control system 1 can be implemented by installing a display program that executes the above-described learning into a desired computer as package software or online software. For example, by causing an information processing device to execute the above display program, it can be made to function as various devices constituting the communication control system 1.
  • the information processing device referred to here includes a desktop or notebook personal computer.
  • information processing devices include mobile communication terminals such as smartphones, mobile phones, and PHSs (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants).
  • FIG. 37 is a diagram showing an example of a computer on which various devices constituting the communication control system 1 are implemented.
  • Computer 1000 includes, for example, a memory 1010 and a CPU 1020.
  • the computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These parts are connected by a bus 1080.
  • the memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012.
  • the ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System).
  • Hard disk drive interface 1030 is connected to hard disk drive 1090.
  • Disk drive interface 1040 is connected to disk drive 1100.
  • Serial port interface 1050 is connected to, for example, mouse 1110 and keyboard 1120.
  • Video adapter 1060 is connected to display 1130, for example.
  • the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the various devices constituting the communication control system 1 is implemented as a program module 1093 in which code executable by a computer is written. Program module 1093 is stored in hard disk drive 1090, for example. For example, a program module 1093 for executing processing similar to the functional configuration of various devices making up the communication control system 1 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).
  • SSD Solid State Drive
  • the setting data used in the processing of the embodiment described above is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 and program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as necessary, and executes the processing of the embodiment described above.
  • program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like.
  • program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN, WAN (Wide Area Network), etc.).
  • Program module 1093 and program data 1094 may then be read by CPU 1020 from another computer via network interface 1070.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Ce système de commande de communication (1) comprend un dispositif de gestion du nombre de terminaux de connexion (600) qui crée et supprime un chemin de tunnel de réseau applicatif qui est destiné à la transmission de données et qui est utilisé par des dispositifs terminaux (100) qui appartiennent à un réseau de connexion, afin d'être connectés à un réseau dédié pour chaque organisation de contrat. De plus, le dispositif de gestion du nombre de terminaux de connexion (600) : utilise des informations de contrat, qui sont des informations pour identifier le réseau dédié pour chaque organisation de contrat, et des informations d'identification de passerelle de rattachement qui sont des informations pour identifier un dispositif de transmission de chemin de tunnel de réseau applicatif (300) qui appartient à une zone à laquelle les dispositifs terminaux (100) sont connectés, pour compter le nombre de terminaux de connexion, qui correspond au nombre de dispositifs terminaux (100) qui accèdent au réseau dédié pour chaque organisation de contrat ; et effectue, sur la base de conditions prescrites, le démarrage et l'arrêt d'une passerelle VPN (200), le réglage pour connecter la passerelle VPN (200) et le dispositif de transmission de chemin de tunnel de réseau applicatif (300) au réseau dédié pour chaque organisation de contrat, et la suppression du réglage.
PCT/JP2022/031449 2022-08-19 2022-08-19 Système de commande de communication, procédé de commande de communication et programme de commande de communication WO2024038606A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/JP2022/031449 WO2024038606A1 (fr) 2022-08-19 2022-08-19 Système de commande de communication, procédé de commande de communication et programme de commande de communication

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2022/031449 WO2024038606A1 (fr) 2022-08-19 2022-08-19 Système de commande de communication, procédé de commande de communication et programme de commande de communication

Publications (1)

Publication Number Publication Date
WO2024038606A1 true WO2024038606A1 (fr) 2024-02-22

Family

ID=89941605

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2022/031449 WO2024038606A1 (fr) 2022-08-19 2022-08-19 Système de commande de communication, procédé de commande de communication et programme de commande de communication

Country Status (1)

Country Link
WO (1) WO2024038606A1 (fr)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2018037974A (ja) * 2016-09-02 2018-03-08 日本電信電話株式会社 ゲートウェイルータ、通信システム、トラヒックフロー制御方法及びプログラム
US20210185752A1 (en) * 2019-12-17 2021-06-17 Cisco Technology, Inc. Techniques for providing a third generation partnership project (3gpp) fabric anchor for an enterprise fabric

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2018037974A (ja) * 2016-09-02 2018-03-08 日本電信電話株式会社 ゲートウェイルータ、通信システム、トラヒックフロー制御方法及びプログラム
US20210185752A1 (en) * 2019-12-17 2021-06-17 Cisco Technology, Inc. Techniques for providing a third generation partnership project (3gpp) fabric anchor for an enterprise fabric

Similar Documents

Publication Publication Date Title
US11758416B2 (en) System and method of network policy optimization
CN113225782B (zh) 用于会话管理的方法、设备和计算机可读存储介质
CN101217497B (zh) 一种无线网状网络的路径选择方法
CN113596191B (zh) 一种数据处理方法、网元设备以及可读存储介质
CN105340244A (zh) 基于来自暂态准则的上下文的动态内容分发网络选择
Ganz et al. A resource mobility scheme for service-continuity in the Internet of Things
CN114902634A (zh) 移动通信系统中提供应用服务器的信息的设备和方法
US11233694B2 (en) Method and device for processing communication path
US20220021754A1 (en) Network multi-path proxy selection to route data packets
WO2022033345A1 (fr) Procédé d'établissement de session pdu, dispositif de terminal et système de puce
JP2008546272A (ja) Ｓｃｔｐ基盤のハンドオーバ機能を具備した端末装置及びハンドオーバ方法
WO2023000940A1 (fr) Procédé et appareil de traitement de données et dispositif d'élément de réseau, support de stockage et produit-programme
CN108141772B (zh) 控制装置和存储介质
JP2021524204A (ja) サービス品質監視方法、及びシステム、並びに装置
WO2021169291A1 (fr) Procédé de recommandation de route, éléments de réseau, système et dispositif
JP2017503407A (ja) パケット処理方法および装置
WO2015070763A1 (fr) Procédé et appareil d'auto-établissement d'interface x2
WO2023035925A1 (fr) Procédé, appareil et système de traitement de service
WO2024038606A1 (fr) Système de commande de communication, procédé de commande de communication et programme de commande de communication
US7768946B2 (en) Resource determination in IP-based networks
CN114980243A (zh) 一种数据转发方法、装置及存储介质
WO2011026355A1 (fr) Procédé permettant à un nœud d'accéder à un agent mère, système en grappe d'agents mères et routeur de service
WO2013189130A1 (fr) Système de communication et procédé de communication dans un système de communication basé sur un réseau ad hoc
US11570080B1 (en) Multiple state control interfaces between a control plane and a user plane in a disaggregated broadband network gateway architecture
CN112055083B (zh) 请求处理方法、装置、电子设备和介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22955778

Country of ref document: EP

Kind code of ref document: A1