JP6654531B2 - Policy management system, policy management method, and policy management device - Google Patents

Description

  The present invention relates to a policy management system, a policy management method, and a policy management device.

  Conventionally, policy control (priority control, filtering, monitoring and acquisition of statistical information such as communication data volume, bandwidth limitation, application detection, flow transfer, charging control, etc.) is performed for flows by 3GPP (3rd Generation Partnership Project) etc. An architecture for performing this is discussed (for example, see Non-Patent Document 1).

  A policy management apparatus having a PCRF (Policy and Charging Rules Function) function sends a user identification information (for example, line information, VLAN (VLAN) from a subscriber information management server having an SPR (Subscription Profile Repository) function. Virtual LAN (Local Area Network) information, terminal information, accommodation destination transfer device information) and contract service information are acquired. The policy management device holds service scenarios corresponding to each service. In the service scenario, a policy (control to be executed and flow conditions to be controlled) applied to the service contract user and an opportunity to apply the policy are registered. The policy management apparatus registers in advance a user identification information and service scenario information applied to the user based on the contract service in a database (hereinafter, DB) for each user.

  A packet transfer device and a DPI device having a PCEF (Policy and Charging Enforcement Function) or a TDF (Traffic Detection Function) function transmit a communication start notification to the policy management device when the user starts communication. The communication start notification has user information such as user identification information and user flow information (for example, IP address and communication protocol).

  Upon receiving the communication start notification, the policy management device refers to the DB and acquires service scenario information from the identification information of the user. Next, a policy applied to the user is determined with reference to the service scenario. Then, the policy and the user information to which the policy is applied are notified to the packet transfer device and the DPI device of the transmission source, and the setting of the policy is instructed. The packet transfer device and the DPI device set the instructed policy, and control the flow that matches the control target condition based on the policy.

  The policy management apparatus instructs to set or change the policy based on the service scenario applied to the user even at an occasion other than the reception of the communication start notification (for example, the reception of the communication data usage report).

  Further, the policy control service includes a service capable of determining a service target user based on user information included in a notification from a packet transfer device and a DPI device (hereinafter, a common service), and contract information of each user required for determination. There are services (hereinafter, individual services).

3GPP TS 23.203 v12.2.0 (2013-09), [online], 3GPP, [Search on August 24, 2016], Internet <URL: http://www.3gpp.org/ftp/Specs/archive/23_series /23.203/23203-c20.zip>

  However, the conventional technique has a problem that the amount of data stored in the DB is large and the access processing load of the DB increases. For example, in the prior art, regardless of the service, in order to determine the policy to be applied to the user by referring to the user identification information and the service scenario information registered in the DB, information of all users must be registered in the DB. In addition, the processing load such as the amount of information data to be registered in the DB and the access to the table of the DB is increasing.

  In order to solve the above-described problems and achieve the object, a policy management system of the present invention includes a user identification information of a specific user and a database that stores the service scenario applied to the specific user in association with each other, A common service information storage unit that stores a service scenario to be applied to a user other than the specific user, and if a predetermined notification including the user identification information is received from a communication device, whether the user identification information is stored in the database. Searching, if stored in the database, obtain a service scenario corresponding to the user identification information from the database; otherwise, obtain the service scenario from the common service information storage unit. An acquisition unit for acquiring a service scenario corresponding to the identification information; Service refers to the scenario, to determine the policy to be applied to the user, and having a an instructing unit for instructing the setting of the policy to the communication device.

  Further, the policy management method of the present invention is a policy management method executed in a policy management system, wherein when a predetermined notification including user identification information is received from a communication device, the user identification information is changed to a user of a specific user. Searches whether the identification information is stored in a database that stores the service scenario applied to the specific user in association with each other, and if the identification information is stored in the database, the database corresponds to the user identification information from the database. Obtain a service scenario, and if not stored in the database, obtain a service scenario corresponding to the user identification information from a common service information storage unit that stores a service scenario applied to a user other than the specific user. An acquisition step and a service scenario acquired by the acquisition step are referred to. And, determining the policy to be applied to the user, characterized in that contains an instruction step of instructing the setting of the policy to the communication device.

  Further, the policy management device of the present invention includes a database for storing user identification information of a specific user and a service scenario applied to the specific user in association with each other, and a service scenario applied to a user other than the specific user. When a predetermined notification including the user identification information is received from the communication device, a search is performed to determine whether the user identification information is stored in the database. Acquiring a service scenario corresponding to the user identification information from the database, and acquiring a service scenario corresponding to the user identification information from the common service information storage unit when the service scenario is not stored in the database. And referring to the service scenario acquired by the acquisition unit, Determining a policy to apply to, and having a an instructing unit for instructing the setting of the policy to the communication device.

  ADVANTAGE OF THE INVENTION According to this invention, there exists an effect that the amount of data memorize | stored in DB can be reduced and the access processing load of DB can be reduced.

FIG. 1 is a diagram illustrating an example of a configuration of a policy management system according to the first embodiment. FIG. 2 is a diagram illustrating an example of information registered in the DB. FIG. 3 is a block diagram illustrating the configuration of the policy management device according to the first embodiment. FIG. 4 is a diagram illustrating an example of a user information management table stored in the user information management storage unit. FIG. 5 is a diagram illustrating an example of a common service information table stored in the common service information storage unit. FIG. 6 is a flowchart illustrating a flow of a policy determination process in the policy management device according to the first embodiment. FIG. 7 is a diagram illustrating an example in which each process in the policy management device is specifically realized using a computer.

  Hereinafter, embodiments of a policy management system, a policy management method, and a policy management device according to the present application will be described in detail with reference to the drawings. The embodiment does not limit the policy management system, the policy management method, and the policy management device according to the present invention.

[First embodiment]
In the following embodiments, the configuration of the policy management system, the configuration of the policy management device, and the processing flow of the policy management device according to the first embodiment will be described in order, and finally, the effects of the first embodiment will be described. explain.

[Configuration of Policy Management System]
FIG. 1 is a diagram illustrating an example of a configuration of a policy management system according to the first embodiment. As shown in FIG. 1, the policy management system 1 according to the first embodiment includes a policy management device 10, a DB 20, a plurality of packet transfer devices 30, a DPI device 40, and a plurality of user terminals 50. The number of each device is not limited to the number shown in FIG.

  In the policy management system 1, based on the user information received from the packet transfer device 30 or the DPI device 40, regarding the user who can determine the service applied by the policy management device 10 and the policy to be applied, the user identification information and the user By not registering the applicable service scenario information in the DB 20 in advance, the amount of information data registered in the DB 20 of the policy management device 10 is reduced, and the access processing load of the DB 20 is reduced.

  In the policy management system 1, users communicate using various protocols, for example, according to communication types such as IPv4 (Internet Protocol version 4), IPv6 (Internet Protocol version 6), and PPP (Point to Point Protocol). The set address is set to the user terminal 50 or an HGW (home gateway) not shown.

  Further, in the policy management system 1, even if the service is provided commonly to all users, the conditions under which the service is applied differ depending on the service. For example, the application conditions include a communication type, a communication direction, a user address space, a connection destination server, an application, an OS of the user terminal 50, and the like. If it can be determined from the user information received from the packet transfer device 30 or the DPI device 40 whether the service is to be applied, it is not necessary to register the contract service information of each user in the DB 20 in advance.

  When receiving the communication start notification from the packet transfer device 30 or the DPI device 40, the policy management device 10 refers to the information stored in the DB 20 or its own device, and acquires the service scenario from the user identification information included in the communication start notification. Then, the policy management device 10 refers to the obtained service scenario and determines a policy to be applied to the user.

  The DB 20 stores user identification information of a specific user and a service scenario applied to the specific user in association with each other. That is, in the DB 20, the user identification information of the specific user using the individual service and the information of the service scenario applied to the user are registered in advance. Further, in the DB 20, user identification information of a user who uses only the common service and information of a service scenario applied to the user are not registered.

  FIG. 2 shows an example of information registered in the DB 20. FIG. 2 is a diagram illustrating an example of information registered in the DB. As illustrated in FIG. 2, the DB 20 stores “user identification information”, which is information for identifying a specific user, and “service scenario information”, which is information about a service scenario, in association with each other. The user identification information is “accommodation destination transfer device information” that is information for identifying a transfer device that is the accommodation destination of the user, “line information” that is information for identifying the line of the user, and information that identifies the VLAN. “VLAN information” and the like are included. Further, the service scenario information includes “application conditions” which are conditions for applying the service scenario, and “service scenarios” indicating the service scenario to be applied.

  In this embodiment, the user identification information and the service scenario information for each user are stored in the DB 20 of the policy management apparatus 10 in advance, and the DB 20 is accessed to search and acquire the information. Alternatively, the information may be obtained by accessing a subscriber information management server or the like storing the information.

  The packet transfer device 30 is a communication device that transfers packets transmitted and received by the user terminal 50 and the like. The DPI device 40 is a communication device that controls a flow. Hereinafter, a case where the policy management apparatus 10 communicates with the packet transfer apparatus 30 will be described as an example. The same applies to the DPI device 40 instead of the packet transfer device 30.

  The packet transfer device 30 transmits a communication start notification to the policy management device 10 when the user terminal 50 starts communication. Further, when detecting the end of the communication by the user, the packet transfer device 30 transmits a communication end notification to the policy management device 10.

  Further, when the same user performs communication of different communication types such as IPv4 and IPv6, the packet transfer device 30 transmits a communication start notification triggered by the start of each communication. The communication start notification has user information, and also includes user identification information. The user information includes, for example, line information, VLAN information, accommodation destination transfer device information, MAC address, communication type, IP address, and the like. In the case of the DPI device 40, since the payload of the packet can be analyzed, user information such as the model of the user terminal 50 and the OS can also be notified.

  Further, when instructed by the policy management apparatus 10 to set a policy, the packet transfer apparatus 30 sets the instructed policy and controls a flow that matches the control target condition based on the policy.

  Here, the service scenario will be described in detail. In the service scenario, a policy (control to be executed and a flow condition to be controlled) to be applied to a user who has subscribed to the service, and an opportunity to apply the policy are registered. Opportunities include, for example, reception of various notifications transmitted by the packet transfer apparatus 30, processing to be performed by the policy management apparatus 10 when a predetermined notification is received, and conditions for the processing results that trigger policy setting. . The various notifications have user identification information and information that can identify the type of the notification.

  The timing for applying the policy registered in the service scenario differs depending on the service. For example, in the case of a service that counts the amount of communication data usage for each user and limits the bandwidth of the user when the amount of communication data usage exceeds a predetermined value (hereinafter referred to as “excess bandwidth limitation service”), the packet transfer device is triggered by the start of communication. The policy set to 30 is a communication data usage count, a threshold excess monitoring, and a communication data usage notification to the policy management device 10 when the threshold is exceeded. Further, when receiving the communication data usage notification from the packet transfer device 30, the policy management device 10 calculates and holds the cumulative value of the communication data usage for each user. As a trigger, the packet transfer device 30 is instructed to set a policy for limiting the bandwidth of the user.

  On the other hand, in the case of a service in which the policy set at the start of communication is fixedly applied, such as a service that limits the bandwidth for each user for a flow of a predetermined communication type, the policy registered in the service scenario is used. The timing to apply is only the timing to start communication. If the trigger to apply the policy in all services is only the trigger to start communication, only the policy information in the service scenario is required, and no service scenario is required. In this case, a policy to be applied instead of the service scenario is registered in the DB 20 of the policy management apparatus 10 and a common service information table described later, and it may be referred to whether there is a policy that matches the application condition.

[Configuration of Policy Management Device]
Next, the configuration of the policy management device 10 shown in FIG. 1 will be described with reference to FIG. FIG. 3 is a block diagram illustrating the configuration of the policy management device according to the first embodiment. As shown in FIG. 3, the policy management device 10 includes a communication processing unit 11, a control unit 12, and a storage unit 13. The processing of each of these units will be described below.

  The communication processing unit 11 controls communication relating to various information exchanged with the packet transfer device 30. For example, the communication processing unit 11 receives a communication start notification from the packet transfer device 30. Further, for example, the communication processing unit 11 transmits a policy setting instruction notification to the packet transfer device 30 and the DPI device 40.

  The storage unit 13 stores data and programs necessary for various processes performed by the control unit 12, and particularly, as those closely related to the present invention, stores a user information management storage unit 13a and a common service information storage unit 13b. . For example, the storage unit 13 is a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk.

  The user information management storage unit 13a stores information for identifying a user and an applied service scenario. The information stored in the user information management storage unit 13a is information registered by a registration unit 12d described later. FIG. 4 is a diagram illustrating an example of a user information management table stored in the user information management storage unit 13a. For example, as illustrated in FIG. 4, the user information management storage unit 13a stores information “user information” related to user communication, “DB registration information” indicating whether the information is registered in the DB 20, and the applied service. A user information management table is stored in which a “service scenario” indicating a scenario, “applied policy information” indicating an applied policy, and “notification source device information” indicating a notification source device that has set the policy are associated with each other. .

  In the “DB registration information”, “1” is stored when the user information is registered in the DB 20, and “0” is stored when the user information is not registered. As illustrated in FIG. 4, the user information includes user identification information (for example, accommodation destination transfer device information, line information, VLAN information, and the like), a “communication type” indicating a type of communication, and a user IP address. "IP address" indicating the address is included.

  The common service information storage unit 13b stores a common service scenario applied to a user other than a specific user. FIG. 5 is a diagram illustrating an example of a common service information table stored in the common service information storage unit. For example, as illustrated in FIG. 5, the common service information storage unit 13b stores “common service”, which is information for identifying a common service applied to a user other than a specific user using an individual service, and a service scenario of each common service. Are stored in association with a "service condition" which is a condition for applying a "service scenario" and a "service scenario" indicating a service scenario to be applied.

  The control unit 12 has an internal memory for storing programs and required data defining various processing procedures and the like, and executes various processes by using these. Particularly, those closely related to the present invention include: It has a receiving unit 12a, an obtaining unit 12b, an instruction unit 12c, and a registration unit 12d.

  The receiving unit 12a receives a predetermined notification from the packet transfer device 30. For example, when receiving the communication start notification or the communication end notification, the receiving unit 12a outputs to the obtaining unit 12b that the communication start notification or the communication end notification has been received. In addition, the receiving unit 12a is transmitted from the packet transfer device 30 as a notification other than the communication start notification and the communication end notification based on a policy set after the user starts communication, for example, as in the case of an excess bandwidth limitation service. Also when various notifications are received, the fact that the notifications have been received is output to the acquisition unit 12b.

  When receiving the predetermined notification including the user identification information from the packet transfer device 30, the acquisition unit 12b searches whether the user identification information is stored in the DB 20, and when the user identification information is stored in the DB 20, The service scenario corresponding to the identification information is acquired, and when the service scenario is not stored in the DB 20, the service scenario corresponding to the user identification information is acquired from the common service information storage unit 13b.

  Before searching the DB 20, the acquiring unit 12b checks whether the user identification information is registered in the user information management storage unit 13a. For example, when the receiving unit 12a receives the communication start notification, the acquiring unit 12b first checks whether the user identification information of the user is registered in the user information management storage unit 13a. When the user identification information included in the predetermined notification is stored in the user information management storage unit 13a, the acquisition unit 12b reads the service scenario corresponding to the user identification information from the user information management storage unit 13a. To get.

  On the other hand, when the user identification information is not stored in the user information management storage unit 13a, the acquisition unit 12b searches whether the user identification information is stored in the DB 20. The acquisition unit 12b acquires the service scenario corresponding to the user identification information from the DB 20 when the service scenario is stored in the DB 20, and acquires the service scenario from the common service information storage unit 13b when the service scenario is not stored in the DB 20. Obtain a service scenario corresponding to the user identification information.

  Also, when receiving a notification other than the communication start notification, the obtaining unit 12b refers to the user information management storage unit 13a and obtains the service scenario of the user identification information included in the notification. For example, the acquisition unit 12b refers to the user information management storage unit 13a also when receiving various notifications from the packet transfer device 30 based on a policy set after the user's communication has started as a notification other than the communication start notification. And the service scenario of the user identification information included in the notification. When receiving the communication end notification from the packet transfer device 30, the acquisition unit 12b refers to the user information management storage unit 13a and deletes information corresponding to the notified user information.

  The instruction unit 12c refers to the service scenario acquired by the acquisition unit 12b, determines a policy to be applied to the user, and instructs the packet transfer device 30 to set the policy. When the user information received in the communication start notification does not match the applicable condition, the instruction unit 12c notifies the packet transfer device 30 of the notification transmission source that there is no policy set for the flow of the user. .

  In addition, the instruction unit 12c performs a process registered in the service scenario, triggered by the registration in the service scenario acquired by the acquisition unit 12b. For example, when the service scenario acquired by the acquiring unit 12b when various notifications are received, the instructing unit 12c receives the notification or, when the process of receiving and executing the notification is registered, registers the process. The process is executed, and if the condition is satisfied, the setting of the registered policy is instructed to the packet transfer device 30 of the notification transmission source. If the reception of the notification or the process of receiving and executing the notification is not registered in the trigger of the service scenario, the instructing unit 12c transmits only the response to the notification to the packet transfer device 30 of the notification transmission source. Send

  When the user identification information included in the predetermined notification is stored in the DB 20, the registration unit 12d acquires a service scenario corresponding to the user identification information from the DB 20, and stores the service scenario together with the user identification information in the user information. Register it in the management storage unit 13a. Further, the registration unit 12d further registers DB registration information indicating whether the user identification information included in the predetermined notification is stored in the DB 20, in the user information management storage unit 13a. When the user identification information included in the predetermined notification is not stored in the DB 20, the registration unit 12d acquires the service scenario from the common service information storage unit 13b, and as information of a user who uses only the common service, The user identification information and the service scenario are registered in the user information management storage unit 13a.

[Processing flow of policy management device]
First, a policy determination process when the policy management device 10 according to the first embodiment receives a communication start notification will be described with reference to FIG. FIG. 6 is a flowchart illustrating a flow of a policy determination process in the policy management device according to the first embodiment.

  As shown in FIG. 6, when receiving the communication start notification (Yes at Step S101), the policy management device 10 checks whether the user identification information of the user is registered in the user information management table (Step S102). As a result, when the user identification information is not registered in the user information management table (No at Step S102), the policy management device 10 checks whether the user identification information of the user is registered in the DB 20 (Step S103).

  As a result, when the policy management device 10 is registered in the DB 20 (Yes at Step S103), the policy management device 10 acquires the service scenario information of the user from the DB 20 (Step S104). Then, the policy management apparatus 10 checks whether there is a service scenario that matches the application condition with respect to the user information received in the communication start notification (step S105), and determines whether the user information received in the communication start notification has the application condition. If there is a matching service scenario (Yes at Step S105), the policy to be applied to the user is determined with reference to the service scenario (Step S106).

  Subsequently, the policy management apparatus 10 instructs the packet transfer apparatus 30 of the notification transmission source to set a policy for the flow of the user (step S107). Then, the policy management device 10 registers, in the user information management table, the user information received in the communication start notification, the service scenario and the policy information applied to the user, and the information of the notification transmission device that has set the policy. "1" is registered in the DB registration information of the table (step S108).

  Returning to the description of step S105, if there is no service scenario that matches the application condition with respect to the user information received in the communication start notification (No in step S105), the policy management apparatus 10 notifies the user information management table of the communication start. The user information received in step (1) is registered, and "1" is registered in the DB registration information (step S109). Then, the policy management apparatus 10 notifies the packet transfer apparatus 30 of the notification source that there is no policy to be set for the flow of the user (step S110).

  Returning to the description of step S103, when the user identification information of the user is not registered in the DB 20 (No in step S103), the policy management device 10 refers to the common service information table (step S111) and starts communication. It is confirmed whether there is a service scenario in which the user information received in the notification matches the condition (step S112).

  As a result, when there is a service scenario in which the user information received in the communication start notification matches the condition (Yes in step S112), the policy management apparatus 10 refers to the service scenario and determines a policy to be applied to the user. (Step S113). Subsequently, the policy management device 10 instructs the packet transfer device 30 of the notification transmission source to set a policy for the flow of the user (step S114). Then, the policy management device 10 registers, in the user information management table, the user information received in the communication start notification, the service scenario and the policy information applied to the user, and the information of the notification transmission device that has set the policy. “0” is registered in the DB registration information of the table (step S115).

  Returning to the description of step S112, when there is no service scenario in which the user information received in the communication start notification matches the condition (No in step S112), the policy management device 10 receives the communication start notification in the user information management table. The registered user information is registered, and "0" is registered in the DB registration information (step S116). Then, the policy management apparatus 10 notifies the packet transfer apparatus 30 of the notification transmission source that there is no policy to be set for the flow of the user (step S117).

  Returning to the description of step S102, when the user identification information is registered in the user information management table (Yes at step S102), the policy management apparatus 10 transmits the user information (other than the user identification information) of the communication start notification and the notification transmission. It is confirmed whether information matching the original device information is registered in the user information management table (step S118). For example, when the user starts IPv4 communication and the policy management apparatus 10 receives the communication start notification of IPv4 communication and registers it in the user information management table, and then starts the IPv6 communication, the communication start notification of IPv6 communication At the time of reception, the user identification information of the user and the information of the IPv4 communication that started the communication earlier are registered in the user information management table.

  As a result of the confirmation, if the information that matches the user information and the notification transmission source device information is not registered (No at Step S118), the policy management device 10 determines that the user identification information is already registered in the user information management table. It is determined whether or not the DB registration information that matches “1” is “1” (Step S119). If the DB registration information is “1” (Yes at Step S119), the process proceeds to the above-described Step S104 referring to the DB 20. I do. When the DB registration information is “0” (No at Step S119), the policy management apparatus 10 proceeds to the process at Step S111 referring to the common service information table.

  If information matching the user information and the notification transmission source device information is registered in step S118 (Yes in step S118), the policy management apparatus 10 registers the information in the user information management table for the flow of the user. The setting of the applied policy is instructed to the packet transfer device 30 of the notification transmission source (step S120).

[Effects of the First Embodiment]
As described above, in the policy management system 1 according to the first embodiment, when the policy management device 10 receives a predetermined notification including the user identification information from the communication device, the user identification information indicates the user of the specific user. A search is performed to determine whether the identification information is stored in the DB 20 that stores the service scenario applied to the specific user in association with each other. When the policy management device 10 is stored in the DB 20, the service scenario corresponding to the user identification information is acquired from the DB 20, and when the service scenario is not stored in the DB 20, a user other than the specific user is notified. The service scenario corresponding to the user identification information is acquired from the common service information storage unit 13b that stores the service scenario to be applied. Then, the policy management device 10 refers to the obtained service scenario, determines a policy to be applied to the user, and instructs the communication device to set the policy. Therefore, the amount of data stored in the DB 20 can be reduced, and the access processing load on the DB 20 can be reduced.

  That is, in the policy management system 1 according to the first embodiment, for example, the user identification information of a user who uses a service (individual service) that requires user contract information to determine whether the service is to be applied. By registering only the service scenario information and the service scenario information in the DB 20 in advance, the amount of information data to be registered in the DB 20 of the policy management device 10 and the processing load of the DB 20 such as table access can be reduced.

  In the policy management system 1 according to the first embodiment, for example, a service to be applied to a user and a service that can determine a policy based on user information received from the packet transfer device 30 and the DPI device 40 (a common service) For a user using only the service, a service and a policy to be applied to the user can be determined by referring to the common service information table without registering information of each user in the DB 20 in advance.

  Further, in the policy management system 1 according to the first embodiment, particularly, when only a common service is provided to all users in a carrier network with a large number of users, a user identification registered in advance in the DB 20 of the policy management device 10 The information and the service scenario information become unnecessary, and the amount of information data registered in the DB 20 of the policy management apparatus 10 and the processing load such as the table access of the DB 20 can be greatly reduced.

  As described above, only the information of the user who uses the service that requires the contract information of the user to determine whether the service is to be applied is registered in the DB 20 of the policy management apparatus 10 in advance, and the packet transfer apparatus 30 and the DPI apparatus By referring to the common service information table without registering in advance the service to be applied and the service for which the policy can be determined based on the user information from the user information 40 in the DB 20, the policy control service of the user unit can be obtained. In the provision, it is possible to reduce the amount of information data registered in the DB 20 of the policy management apparatus 10 and the processing load such as table access of the DB 20.

  Further, in the policy management system 1 according to the first embodiment, the policy management apparatus 10 registers information such as a service scenario acquired and applied from the DB 20 in the user information management table. Search can be made unnecessary.

  In the policy management system 1 according to the first embodiment, the user who has started communication is managed in the user information management table, and the policy and the service scenario are determined with reference to the DB 20 or the common service information table. Is registered as DB registration information, so that when the same user starts another communication (for example, the start of IPv6 communication in addition to IPv4 or the start of video distribution in addition to Web), the previous communication refers to DB20. Otherwise, the search of the DB 20 can be made unnecessary. This makes it possible to further reduce the access processing load on the DB 20.

[System configuration, etc.]
Each component of each device illustrated is a functional concept, and does not necessarily need to be physically configured as illustrated. That is, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed / arbitrarily divided into arbitrary units according to various loads and usage conditions. Can be integrated and configured. Further, all or any part of each processing function performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware by wired logic.

  Further, among the processes described in the present embodiment, all or a part of the processes described as being performed automatically can be manually performed, or the processes described as being performed manually can be performed. Can be automatically or entirely performed by a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified.

[program]
FIG. 7 is a diagram illustrating an example in which each process in the policy management device 10 is specifically realized using a computer. The computer 1000 has, for example, a memory 1010 and a CPU (Central Processing Unit) 1020. The computer 1000 has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. The video adapter 1060 is connected to, for example, the display 1061.

  The hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the policy management apparatus 10 is implemented as a program module 1093 in which codes executable by a computer are described. The program module 1093 is stored in, for example, the hard disk drive 1031. For example, a program module 1093 for executing the same processing as the functional configuration in the policy management apparatus 10 is stored in the hard disk drive 1031. The hard disk drive 1031 may be replaced by an SSD (Solid State Drive).

  The setting data used in the processing of the above-described embodiment is stored as the program data 1094 in, for example, the memory 1010 or the hard disk drive 1031. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1031 to the RAM 1012 as needed, and executes them.

  The program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1031. For example, the program module 1093 and the program data 1094 may be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1041 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), or the like). Then, the program module 1093 and the program data 1094 may be read from another computer by the CPU 1020 via the network interface 1070.

Reference Signs List 1 policy management system 10 policy management device 11 communication processing unit 12 control unit 12a reception unit 12b acquisition unit 12c instruction unit 12d registration unit 13 storage unit 13a user information management storage unit 13b common service information storage unit 20 DB
Reference Signs List 30 packet transfer device 40 DPI device 50 user terminal

Claims (6)

User identification information of each specific user who uses the individual service, and a database that stores the service scenario applied to the specific user in association with each other ,
A common service information storage unit that stores a service scenario commonly applied to a plurality of users other than the specific user,
When a predetermined notification including the user identification information is received from the communication device, a search is performed to determine whether the user identification information is stored in the database. If the user identification information is stored in the database, the user identification information is stored in the database. Acquiring a corresponding service scenario, and when not stored in the database, an acquiring unit for acquiring a service scenario corresponding to the user identification information from the common service information storage unit;
An instruction unit that refers to the service scenario acquired by the acquisition unit, determines a policy to be applied to the user, and instructs the communication device to set the policy;
A policy management system comprising: When the user identification information included in the predetermined notification is stored in the database, a service scenario corresponding to the user identification information is obtained from the database, and the service scenario is stored in the user information together with the user identification information. Further comprising a registration unit for registering in the management storage unit,
The receiving unit, upon receiving the predetermined notification, if the user identification information included in the predetermined notification is stored in the user information management storage unit, the user identification information from the user information management storage unit. The service scenario according to claim 1, wherein a service scenario corresponding to information is acquired, and if the service scenario is not stored in the user information management storage unit, a search is performed to determine whether the user identification information is stored in the database. Policy management system. The receiving unit, upon receiving the predetermined notification, if the user identification information included in the predetermined notification is stored in the user information management storage unit, the user identification information from the user information management storage unit. Get the service scenario corresponding to the information,
3. The policy management system according to claim 2, wherein the instruction unit performs a process registered in the service scenario when the service unit is registered in the service scenario acquired by the acquisition unit. 4.   The method according to claim 2, wherein the registration unit registers information indicating whether the user identification information included in the predetermined notification is stored in the database in the user information management storage unit. Policy management system. A policy management method executed by a policy management system,
When receiving from the communication device a predetermined notification including the user identification information, the user identification information, corresponding with a service scenario for applying the user identification information of each particular user using the individual services, the particular user Searching whether stored in the database to be stored, if it is stored in the database, obtains the service scenario corresponding to the user identification information from the database, if not stored in the database, An acquisition step of acquiring a service scenario corresponding to the user identification information from a common service information storage unit that stores a service scenario commonly applied to a plurality of users other than the specific user;
Referencing the service scenario acquired by the acquiring step, determining a policy to be applied to the user, and instructing the communication device to set the policy,
A policy management method comprising: User identification information of each specific user who uses the individual service, and a database that stores the service scenario applied to the specific user in association with each other ,
A common service information storage unit that stores a service scenario commonly applied to a plurality of users other than the specific user,
Upon receiving a predetermined notification including the user identification information from the communication device, search whether the user identification information is stored in the database, and if the user identification information is stored in the database, from the database to the user identification information Acquiring a corresponding service scenario, and when not stored in the database, an acquiring unit for acquiring a service scenario corresponding to the user identification information from the common service information storage unit;
An instruction unit that refers to the service scenario acquired by the acquisition unit, determines a policy to be applied to the user, and instructs the communication device to set the policy;
A policy management device comprising:

Images