JP7732598B2 - Communication control system, communication control method, and communication control program - Google Patents

Description

The present invention relates to a communication control system, a communication control method, and a communication control program.

In some cases, mobile service providers provide cloud services to individual organizations or companies. For example, mobile service providers build virtual private clouds for each company within their own cloud computing infrastructure and provide a means of accessing the virtual private cloud using communication devices for accessing the mobile services provided by the mobile service provider. One known method of accessing the aforementioned virtual private cloud is to set up overlay tunnels between a virtual private cloud access gateway and the virtual private cloud, and between a virtual private cloud access gateway and a terminal device. The former method uses tunneling protocols such as GRE (Generic Routing Encapsulation) and MPLS (Multi-Protocol Label Switching).

On the other hand, the latter is a method that combines PDU (Protocol Data Unit)/PDN (Packet Data Network) sessions in mobile networks with the aforementioned tunneling protocol (see, for example, Non-Patent Document 1). Based on the aforementioned technology, the gateway process analyzes the arriving packet data, and if the included destination belongs to the target virtual private cloud, it forwards the packet to an overlay tunnel set up toward the target virtual private cloud.

The process that executes gateway processing may run on a general-purpose server if the gateway process is implemented as software. In this case, if the general-purpose server is stopped or the aforementioned gateway process is stopped, data cannot be transferred to the corresponding virtual private cloud. Therefore, the general-purpose server must continue to run the gateway process as long as there are virtual private cloud service users (hereinafter referred to as "users"), which can result in increased power consumption. Therefore, prior art has adopted a method of consolidating virtual machines on specific servers, improving the server's CPU utilization rate and reducing the number of operating servers, thereby reducing the power required when virtual machines are running (see, for example, Non-Patent Document 2).

With the above-mentioned method, if there are few or no users accessing the VPN via the VPN gateway, resource usage by the gateway process decreases, and as a result, it becomes possible to run virtual machines or containers implementing the gateway on fewer servers. Therefore, as mentioned above, reducing the number of platform servers enables power savings.

Cisco Systems, Configuring VPNs Using IPSec Tunnels and GRE, Internet <URL: https://www.cisco.com/cisco/web/support/JP/docs/RT/BranchRT/800RT/CG/003/5332_01_7.html?bid=0900e4b1825ae859> R. A. Arockia and S. Arun, Virtual Machine Consolidation Framework for Energy and Performance Efficient Cloud Data Centers, 2019 IEEE International Conference on System, Computation, Automation and Networking (ICSCAN), 2019, pp. 1-7

However, with conventional technology, it was sometimes not possible to count the number of users in a network who were able to communicate and dynamically start and stop gateway processes based on the presence or absence of users.

Specifically, current mobile network specifications do not provide a method for counting the number of users within a mobile network for each service, making it impossible to count the number of users, and therefore making it impossible to dynamically start and stop gateway processes based on the presence or absence of users. Therefore, even when there are no virtual private cloud users within the mobile network, it is necessary to keep the general-purpose server running on which the gateway process runs, which can be problematic.

In order to solve the above problems and achieve the objectives, the communication control system of the present invention is a communication control system having a connected terminal number management device that builds and deletes overlay tunnel routes for data transfer that terminal devices belonging to a connection network use to connect to a dedicated network for each contract organization. The connected terminal number management device is characterized by having: a counting unit that counts the number of connected terminals, which is the number of terminal devices accessing the dedicated network for each contract organization, using contract information, which is information that identifies the dedicated network for each contract organization, and anchor GW identification information, which is information that identifies an overlay tunnel route forwarding device that belongs to the area to which the terminal device connects; a setting unit that, when the number of connected terminals changes from 0 to 1 or more, starts a VPN gateway and configures the VPN gateway and the overlay tunnel route forwarding device to connect to the dedicated network for each contract organization, and builds the overlay tunnel route for data transfer; and a deletion unit that, when the number of connected terminals changes from 1 or more to 0, deletes the settings of the VPN gateway and the overlay tunnel route forwarding device, stops the VPN gateway, and deletes the overlay tunnel route for data transfer.

The present invention has the effect of counting the number of users within a network who are available for communication and dynamically starting and stopping gateway processes based on the presence or absence of users.

FIG. 1 is a diagram illustrating an example of an outline of a communication control method for a communication control system according to a first embodiment. FIG. 2 is a diagram illustrating an example of the operation of the gateway according to the first embodiment. FIG. 3 is a diagram illustrating an example of the device configuration of the terminal device according to the first embodiment. FIG. 4 is a diagram illustrating an example of the device configuration of the VPN gateway according to the first embodiment. FIG. 5 is a table illustrating an example of information stored in the forwarding destination storage unit of the VPN gateway according to the first embodiment. FIG. 6 is a diagram illustrating an example of the device configuration of the overlay tunnel route forwarding device according to the first embodiment. FIG. 7 is a table diagram illustrating an example of a first table format stored in the forwarding destination storage unit of the overlay tunnel route forwarding device according to the first embodiment. FIG. 8 is a table diagram illustrating an example of a second table format stored in the forwarding destination storage unit of the overlay tunnel route forwarding device according to the first embodiment. FIG. 9 is a diagram illustrating an example of the device configuration of the terminal location information management device according to the first embodiment. FIG. 10 is a table illustrating an example of information stored in the terminal device connection destination VPN storage unit of the terminal location information management device according to the first embodiment. FIG. 11 is a table illustrating an example of information stored in the anchor GW storage unit of the terminal location information managing device according to the first embodiment. FIG. 12 is a diagram illustrating an example of the device configuration of the contract information management device according to the first embodiment. FIG. 13 is a table illustrating an example of information stored in the contract information storage unit of the contract information management apparatus according to the first embodiment. FIG. 14 is a diagram illustrating an example of the device configuration of the connected terminal count management device according to the first embodiment. FIG. 15 is a table illustrating an example of information stored in the number-of-connected-terminals storage unit of the device for managing the number of connected terminals according to the first embodiment. FIG. 16 is a diagram illustrating an example of the device configuration of the transfer information management device according to the first embodiment. FIG. 17 is a table diagram illustrating an example of a connected terminal number management device reply table stored in the address storage unit of the transfer information management device according to the first embodiment. FIG. 18 is a table diagram illustrating an example of a terminal device reply table stored in the address storage unit of the transfer information management device according to the first embodiment. FIG. 19 is a diagram illustrating an example of a flowchart of a communication control method according to the first embodiment. FIG. 20 is a diagram illustrating an example of an outline of a communication control method of a communication control system according to embodiment 1'. FIG. 21 is a diagram illustrating an example of the device configuration of a connected terminal number management device according to embodiment 1'. FIG. 22 is a diagram showing an example of a flowchart of a communication control method according to embodiment 1'. FIG. 23 is a diagram illustrating an example of an outline of a communication control method for a communication control system according to embodiment 1″. FIG. 24 is a diagram showing an example of a flowchart of a communication control method according to embodiment 1″. FIG. 25 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to the second embodiment. FIG. 26 is a diagram illustrating an example of an outline of the operation of the communication control system according to the second embodiment. FIG. 27 is a diagram illustrating an example of an overview of establishing an encrypted path according to the second embodiment. FIG. 28 is a diagram illustrating an example of a device configuration of a mobile gateway according to the second embodiment. FIG. 29 is a table diagram illustrating an example of information stored in a VPN search table storage unit of the mobile gateway according to the second embodiment. FIG. 30 is a diagram illustrating an example of a flowchart of a communication control method (pattern 1) according to the second embodiment. FIG. 31 is a diagram illustrating an example of a flowchart of a communication control method (pattern 2) according to the second embodiment. FIG. 32 is a diagram illustrating an example of an outline of a communication control method of a communication control system according to embodiment 2-1. FIG. 33 is a diagram showing an example of a block diagram of various devices constituting a communication control system according to embodiment 2-1. FIG. 34 is a diagram illustrating an example of an outline of the operation of the communication control system according to embodiment 2-1. FIG. 35 is a diagram illustrating an example of the device configuration of an overlay tunnel route forwarding device for an IP network according to embodiment 2-1. FIG. 36 is a diagram showing an example of a flowchart of a communication control method according to embodiment 2-1. FIG. 37 is a diagram illustrating an example of a computer in which various devices of the communication control system according to each embodiment are realized.

Hereinafter, with reference to the drawings, we will explain the form for implementing the present invention (hereinafter referred to as "embodiment"). Note that each embodiment is not limited to the content described below.

[1. Overview of the communication control system]
In each embodiment, the communication control system 1 constructs and deletes overlay tunnel routes for data transfer that are used by terminal devices 100 belonging to a connection network to connect to a dedicated network for each contracting organization (e.g., a virtual private cloud, hereafter simply referred to as a "dedicated network").

The following items provide an overview of the communication control system 1 in this embodiment. First, the counting unit 631 of the connected terminal number management device 600 possessed by the communication control system 1 counts the number of connected terminals, which is the number of terminal devices 100 accessing the dedicated network, using contract information (hereinafter referred to as the "destination VPN ID"), which is information that identifies the dedicated network, and anchor GW identification information (hereinafter referred to as the "responsible anchor GW ID"), which is information that identifies the overlay tunnel route forwarding device 300 that belongs to the area to which the terminal device 100 is connected.

Next, the determination unit 632 of the connected terminal count management device 600 determines that the number of connected terminals has been updated from 0 to 1 or more. In this case, the setting unit 634 of the connected terminal count management device 600 starts the VPN (Virtual Private Network) gateway 200, sets a VPN connection address (hereinafter referred to as "VPN connection address") for connecting the VPN gateway 200 and the overlay tunnel route forwarding device 300 to the dedicated network, and constructs an overlay tunnel route for data transfer.

Then, the determination unit 632 of the connected terminal count management device 600 determines that the number of connected terminals has been updated from 1 or more to 0. In this case, the deletion unit 635 of the connected terminal count management device 600 deletes the settings of the VPN connection addresses of the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, and deletes the overlay tunnel route for data transfer.

2. First Embodiment: Starting and Stopping VPN Gateway According to the Number of Connected Terminals
Hereinafter, as the first embodiment, the "activation and deactivation of VPN gateways according to the number of connected terminals" realized by the communication control system 1 will be described. First, an overview will be given using FIG.

Figure 1 is a schematic diagram showing a situation in which a terminal device 100 connected to a certain area connects to a dedicated network. First, the terminal device 100 transmits to the terminal location information management device 400 terminal device information (hereinafter referred to as "terminal ID"), which is information identifying the terminal device 100, the destination VPN ID, and a registration request to register the above information in the terminal location information management device 400 (see (1) in Figure 1).

Here, if the terminal device 100 holds a destination VPN ID, the registration unit 433 of the terminal location information management device 400 registers the terminal ID and destination VPN ID received from the terminal device 100. On the other hand, if the terminal device 100 does not hold a destination VPN ID, the registration unit 433 of the terminal location information management device 400 acquires and registers the destination VPN ID identified by the terminal ID from the contract information management device 500 (see (2) in Figure 1). Then, the terminal location information management device 400 establishes a D-plane session based on the connection request, which is a D-plane session establishment request sent by the terminal device 100 (see (3) in Figure 1).

Next, the transmitting unit 434 of the terminal location information management device 400 transmits the responsible anchor GW ID and the destination VPN ID to the connected terminal number management device 600 (see (4) in Figure 1). Then, the counting unit 631 of the connected terminal number management device 600 counts and updates the number of connected terminals, which is the number of connections to the overlay tunnel route forwarding device 300 belonging to the area to which the terminal device 100 is connected, based on the accepted responsible anchor GW ID and destination VPN ID.

Next, based on the determination by the determination unit 632 of the connected terminal count management device 600 that the number of connected terminals has been updated from 0 to 1 or more, the acquisition unit 633 of the connected terminal count management device 600 sends the destination VPN ID to the transfer information management device 700 and acquires a VPN connection address corresponding to the dedicated network (see (5) in Figure 1). Then, the setting unit 634 of the connected terminal count management device 600 starts the VPN gateway 200 and sets the acquired VPN connection address to the VPN gateway 200 and the overlay tunnel route forwarding device 300, thereby constructing an overlay tunnel route for data transfer (see (6) in Figure 1). Next, the terminal device 100 connects to the dedicated network using the overlay tunnel route for data transfer constructed by the communication control system 1 (see (7) in Figure 1).

Then, based on the determination by the determination unit 632 of the connected terminal count management device 600 that the number of connected terminals has been updated from 1 or more to 0, the deletion unit 635 of the connected terminal count management device 600 deletes the settings of the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, and deletes the overlay tunnel route for data transfer (see (8) in Figure 1).

The following provides additional information about the configuration of the VPN according to embodiment 1. The VPN according to embodiment 1 is composed of an MEC (Multi Access Edge Cloud) and an overlay tunnel route for data transfer. The MEC contains a front-end server (e.g., "front-end server 10" in FIG. 1) that accepts data requests from users and returns system results to the users. Each server has its own unique connection address (the aforementioned VPN connection address). The terminal device 100 is assigned a VPN terminal address by the transfer information management device 700.

Next, using Figure 2, we will explain how the VPN gateway 200 and the overlay tunnel route forwarding device 300 distribute packets to the destination overlay tunnel route for data transfer based on the VPN connection address. First, Figure 2 shows terminal device 100, which is "Destination: 10A," terminal device 101, which is "Destination: 10C," and terminal device 102, which is "Destination: 10B."

Here, VPN gateway 200 and overlay tunnel route forwarding device 300 analyze the packet headers sent by each terminal device and distribute the packets to the data transfer overlay tunnel route according to the destination. Specifically, VPN gateway 200 and overlay tunnel route forwarding device 300 distribute communications between terminal device 100 and terminal device 102 to data transfer overlay tunnel route X, and distribute communications between terminal device 101 to data transfer overlay tunnel route Y.

2-1. Configuration of the communication control system
The configuration of the communication control system 1 in the first embodiment will now be described with reference to Figures 3 to 18. The communication control system 1 in the first embodiment is configured to include a terminal device 100, a VPN gateway 200, an overlay tunnel route forwarding device 300, a terminal location information management device 400, a contract information management device 500, a number of connected terminals management device 600, and a transfer information management device 700. The functional units of each device will be described in detail in the following sections. Note that in the following description, descriptions of functional units (communication unit, storage unit, control unit, etc.) having similar functions in each device will be omitted as appropriate.

(Terminal device 100)
First, the configuration of the terminal device 100 will be described with reference to FIG. 3. As shown in FIG. 3, the terminal device 100 has a communication unit 110, a storage unit 120, and a control unit 130. Although not shown, the terminal device 100 may also have an input unit (e.g., a keyboard, a mouse, etc.) that accepts various operations and a display unit (e.g., a display, etc.) that displays various information. The terminal device 100 may also be a desktop personal computer, a notebook PC, a smartphone, a tablet, a PDA (Personal Digital Assistant), etc. Next, the detailed functions of each unit will be described below.

(Communication unit 110)
The communication unit 110 is realized by a network interface card (NIC) or the like, and controls communication via a telecommunication line such as a local area network (LAN), the internet, etc. The communication unit 110 is connected to a network via a wired or wireless connection as necessary, and can transmit and receive information bidirectionally.

(Storage unit 120)
The storage unit 120 stores data and programs necessary for various processes performed by the control unit 130. The storage unit 120 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk.

(Control unit 130)
The control unit 130 has an address management unit 131 and a communication session management unit 132. The control unit 130 has an internal memory for temporarily storing programs that define various processing procedures and the like and processing data, and is realized by electronic circuits such as a CPU (Central Processing Unit) and an MPU (Micro Processing Unit), and integrated circuits such as an ASIC (Application Specific Integrated Circuit) and an FPGA (Field Programmable Gate Array).

(Address management unit 131)
The address management unit 131 receives a VPN terminal address for the terminal device 100 assigned to the terminal device 100 and stores it in the storage unit 120 .

(Communication Session Management Unit 132)
When terminal device 100 makes a network connection, communication session management unit 132 requests terminal location information management device 400 to establish a C-plane and D-plane session. Furthermore, when making the session establishment request, communication session management unit 132 transmits the terminal ID and, if held by terminal device 100, the destination VPN ID to terminal location information management device 400.

(VPN gateway 200)
Next, the configuration of the VPN gateway 200 will be described with reference to Fig. 4. As shown in Fig. 4, the VPN gateway 200 has a communication unit 210, a storage unit 220, and a control unit 230. Note that the functions of the communication unit 210 are the same as those described for the communication unit 110 of the terminal device 100, and therefore will not be described here. In addition, the VPN gateway 200 controlled by the communication control system 1 may be a virtual gateway (vGW) implemented in software.

(Storage unit 220)
The storage unit 220 stores data and programs required for various processes performed by the control unit 230. The storage unit 220 includes a transfer destination storage unit 221.

(Transfer destination storage unit 221)
The forwarding destination storage unit 221 stores information about forwarding destinations as a forwarding table. Specifically, the forwarding destination storage unit 221 stores the items "Address" and "Destination Tunnel" as shown in FIG. 5. Note that the items stored in the forwarding destination storage unit 221 are not limited to the above-mentioned items, and other items may be stored. Also, the input information for each item shown in FIG. 5 is merely an example and is not limited to the information described.

(Control unit 230)
The control unit 230 includes a packet header analysis unit 231 and a transfer processing unit 232 .

(Packet header analysis unit 231)
The packet header analysis unit 231 analyzes the packet header transmitted when the terminal device 100 performs communication, and extracts destination information (for example, an IP address).

(Transfer Processing Unit 232)
The transfer processing unit 232 distributes the data to the target overlay tunnel route for data transfer based on the destination information.

(Overlay tunnel route forwarding device 300)
Next, the configuration of the overlay tunnel route forwarding device 300 will be described with reference to Fig. 6. As shown in Fig. 6, the overlay tunnel route forwarding device 300 has a communication unit 310, a storage unit 320, and a control unit 330. Note that the function of the communication unit 310 is the same as the function described for the communication unit 110 of the terminal device 100, and therefore will not be described here.

(Storage unit 320)
The storage unit 320 stores data and programs required for various processes performed by the control unit 330. The storage unit 320 includes a transfer destination storage unit 321.

(Transfer destination storage unit 321)
The forwarding destination storage unit 321 stores information related to forwarding destinations as a forwarding table. Specifically, the forwarding destination storage unit 321 analyzes a packet header transmitted from the terminal device 100 and stores items called "Address" and "Forwarding Destination Tunnel" as shown in FIG. 7 as table type 1 relating to mapping between included destination information (e.g., IP address, etc.) and the overlay tunnel route for data forwarding of the VPN gateway 200. Furthermore, the forwarding destination storage unit 321 stores items called "Mobile NW Tunnel" and "Forwarding Destination Tunnel to VPN Gateway" as shown in FIG. 8 as table type 2 relating to mapping between tunnels in the mobile network and the overlay tunnel route for data forwarding to the VPN gateway 200.

Note that the items in Table Form 1 and Table Form 2 are not limited to the aforementioned items and may store other items in the transfer destination storage unit 321. Furthermore, the input information for each item shown in Figures 7 and 8 is merely an example and is not limited to the information described.

(Control unit 330)
6, the description will be continued. The control unit 330 includes a packet header analysis unit 331 and a transfer processing unit 332.

(Packet header analysis unit 331)
The packet header analysis unit 331 analyzes the packet header transmitted when the terminal device 100 performs communication, and extracts destination information (for example, an IP address).

(Transfer processing unit 332)
The transfer processing unit 332 distributes the data to the target overlay tunnel route for data transfer based on the destination information.

(Terminal location information management device 400)
Next, the configuration of terminal location information managing device 400 will be described with reference to Fig. 9. As shown in Fig. 9, terminal location information managing device 400 has a communication unit 410, a storage unit 420, and a control unit 430. Note that the function of communication unit 410 is the same as the function described for communication unit 110 of terminal device 100, and therefore will not be described here. In addition, terminal location information managing device 400 may utilize an MME (Mobility Management Entity) and an AMF (Access and Mobility management Function).

(Storage unit 420)
The storage unit 420 stores data and programs required for various processes performed by the control unit 430. The storage unit 420 includes a terminal device connection destination VPN storage unit 421 and an anchor GW storage unit 422.

(Terminal Device Connection Destination VPN Storage Unit 421)
The terminal device connection destination VPN storage unit 421 stores a terminal device-connection destination VPN management table as information regarding the data transfer overlay tunnel route connecting to the dedicated network. Specifically, the terminal device connection destination VPN storage unit 421 stores the items "Terminal ID" and "Connection destination VPN ID" as shown in FIG. 10 as the terminal device-connection destination VPN management table. Note that the information stored in the terminal device connection destination VPN storage unit 421 is not limited to the above-mentioned items and may store other items. Also, the input information for each item shown in FIG. 10 is merely an example and is not limited to the information described.

(Anchor GW storage unit 422)
The anchor GW storage unit 422 stores a location management table as information for identifying the overlay tunnel route forwarding device 300 that belongs to the area to which the terminal device 100 is connected. Specifically, the anchor GW storage unit 422 stores items such as "Terminal ID" and "Responsible Anchor GW ID" as shown in FIG. 11 as the location management table. Note that the information stored in the anchor GW storage unit 422 is not limited to the above-mentioned items and may store other items. Also, the input information for each item shown in FIG. 11 is merely an example and is not limited to the information described.

(Control unit 430)
9, the control unit 430 includes a receiving unit 431, a notifying unit 432, a registering unit 433, and a transmitting unit 434.

(Reception unit 431)
The reception unit 431 determines that the terminal device 100 holds a destination VPN ID. In that case, the reception unit 431 receives, from the terminal device 100, terminal device information (terminal ID) that identifies the terminal device 100 and contract information (destination VPN ID). On the other hand, the reception unit 431 determines that the terminal device 100 does not hold a destination VPN ID. In that case, the reception unit 431 receives, from the terminal device 100, the terminal device information (terminal ID) that identifies the terminal device 100 and a registration request that requests to register the terminal device information (terminal ID) and contract information (destination VPN ID) in the terminal location information management device 400.

Furthermore, the reception unit 431 receives a connection request from the terminal device 100, which is a request for connection from the mobile network to the data network. Note that the reception unit 431 is not limited to the information described above, and may receive other information as necessary.

(Notification section 432)
If the terminal device 100 does not hold the destination VPN ID, the notification unit 432 notifies the terminal ID to the contract information management device 500. Note that the notification unit 432 is not limited to the information described above, and may notify other information as necessary.

(Registration unit 433)
When the terminal device 100 holds a destination VPN ID, the registration unit 433 registers the terminal device information (terminal ID) and contract information (destination VPN ID) received from the terminal device 100. On the other hand, when the terminal device 100 does not hold contract information, the registration unit 433 registers the terminal ID received from the terminal device 100 and the contract information (destination VPN ID) acquired from the contract information management device 500 using the terminal device information (terminal ID) based on a registration request.

In other words, the registration unit 433 registers the terminal ID transmitted by the terminal device 100 and the destination VPN ID transmitted by the transmission unit 532 of the contract information management device 500 (described below). Note that the registration unit 433 is not limited to the information described above and may accept other information as necessary.

(Transmitter 434)
Based on the connection request, the transmission unit 434 transmits the contract information (connection destination VPN ID) and anchor GW identification information (responsible anchor GW ID) to the connected terminal number management device 600. Note that the information transmitted by the transmission unit 434 is not limited to the above-mentioned information, and may transmit other information as necessary.

(Contract information management device 500)
Next, the configuration of the contract information management device 500 will be described with reference to Fig. 12. As shown in Fig. 12, the contract information management device 500 has a communication unit 510, a storage unit 520, and a control unit 530. Note that the functions of the communication unit 510 are the same as those described for the communication unit 110 of the terminal device 100, and therefore will not be described here. In addition, the contract information management device 500 may be linked to a home subscriber server (HSS) and a unified data management (UDM).

(Storage unit 520)
The storage unit 520 stores data and programs required for various processes performed by the control unit 530. The storage unit 520 includes a contract information storage unit 521.

(Contract information storage unit 521)
The contract information storage unit 521 stores a contract management table including a destination VPN ID as contract information. Specifically, the contract information storage unit 521 stores items such as "Terminal ID" and "Destination VPN ID" as shown in FIG. 13 as the contract management table. Note that the information stored in the contract information storage unit 521 is not limited to the above-mentioned items and may store other items. Also, the input information for each item shown in FIG. 13 is merely an example and is not limited to the information described.

(Control unit 530)
12, the description will be continued. The control unit 530 includes a receiving unit 531 and a transmitting unit 532.

(Reception unit 531)
The receiving unit 531 receives the terminal ID notified by the notifying unit 432 of the terminal location information managing device 400. Note that the information received by the receiving unit 531 is not limited to the information described above, and may receive other information as necessary.

(Transmitter 532)
The transmitting unit 532 transmits the destination VPN ID corresponding to the terminal ID received by the receiving unit 531 to the terminal location information managing device 400. Note that the transmitting unit 532 is not limited to transmitting the information described above, and may transmit other information as necessary.

(Connected terminal number management device 600)
Next, the configuration of the connected terminal count management device 600 will be described using Figure 14. The connected terminal count management device 600 builds and deletes overlay tunnel routes for data transfer that are used by terminal devices 100 belonging to a connection network to connect to a dedicated network for each contracted organization. As shown in Figure 14, the connected terminal count management device 600 has a communication unit 610, a storage unit 620, and a control unit 630. Note that the function of the communication unit 610 is the same as the function described for the communication unit 110 of the terminal device 100, and therefore will not be described here.

(Storage unit 620)
The storage unit 620 stores data and programs required for various processes performed by the control unit 630. The storage unit 620 also includes a connected terminal number storage unit 621.

(Number of connected terminals storage unit 621)
The number of connected terminals storage unit 621 stores a number of connected terminals management table as information used to count the number of connected terminals. Specifically, the number of connected terminals storage unit 621 stores the following items as the number of connected terminals management table, as shown in FIG. 15 : "Responsible anchor GW ID,""Destination VPN ID," and "Number of connected terminals." Note that the information stored in the number of connected terminals storage unit 621 is not limited to the items described above, and other items may also be stored. Also, the input information for each item shown in FIG. 15 is merely an example, and is not limited to the information described.

(Control unit 630)
14, the control unit 630 includes a counting unit 631, a determining unit 632, an acquiring unit 633, a setting unit 634, and a deleting unit 635.

(Counting unit 631)
The counting unit 631 counts the number of connected terminals, which is the number of terminal devices 100 accessing the dedicated network for each contracting organization, using contract information (destination VPN ID), which is information for identifying the dedicated network for each contracting organization, and anchor GW identification information (responsible anchor GW ID), which is information for identifying the overlay tunnel route forwarding device 300 belonging to the area to which the terminal device 100 is connected, and updates the number of connected terminals. Note that the counting unit 631 is not limited to the information described above, and may perform counting using other information as necessary.

(Determination unit 632)
The determination unit 632 determines whether a predetermined condition is met based on the connected terminal number information counted and updated by the counting unit 631. For example, the determination unit 632 determines that the setting unit 634 will perform processing when the number of connected terminals is updated from 0 to 1 or more, and determines that the deletion unit 635 will perform processing when the number of connected terminals has been 0 for a predetermined period of time or longer, i.e., when the number of connected terminals is updated from 1 or more to 0. Note that the determination unit 632 may also determine that the deletion unit 635 will perform processing when the number of connected terminals is updated from 1 or more to 0 and remains 0 for a certain period of time or longer. Furthermore, the determination unit 632 is not limited to the above-mentioned determination conditions and may make a determination based on other determination conditions as necessary.

(Acquisition unit 633)
The acquisition unit 633 uses the contract information (destination VPN ID) to acquire information (VPN connection address) for connecting to the dedicated network for each contract organization to which the terminal device 100 is to be connected, from the transfer information management device 700. Note that the acquisition unit 633 is not limited to the information described above, and may acquire other information as necessary.

(Setting unit 634)
If the determination result of the determination unit 632 satisfies a predetermined condition, i.e., if the number of connected terminals changes from 0 to 1 or more, the setting unit 634 starts up the VPN gateway 200, configures the VPN gateway 200 and the overlay tunnel route forwarding device 300 to connect to a dedicated network for each contracted organization, and constructs an overlay tunnel route for data transfer. Specifically, if the determination unit 632 determines that the number of connected terminals has been updated from 0 to 1 or more, the setting unit 634 starts up the VPN gateway 200, configures VPN connection addresses for the VPN gateway 200 and the overlay tunnel route forwarding device 300, and constructs an overlay tunnel route for data transfer. Note that the setting unit 634 is not limited to the information described above, and may use other information as necessary to perform configuration for any device.

(Deletion unit 635)
When the determination result of the determination unit 632 satisfies a predetermined condition, i.e., when the number of connected terminals changes from 1 or more to 0, the deletion unit 635 deletes the settings of the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, and deletes the data forwarding overlay tunnel route. Specifically, when the determination unit 632 determines that the number of connected terminals has been updated from 1 or more to 0, the deletion unit 635 deletes the VPN connection addresses set for the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, and releases the data forwarding overlay tunnel route. Note that the deletion unit 635 is not limited to the information described above, and may delete the settings of any device using other information as necessary.

(Transfer information management device 700)
Next, the configuration of the transfer information management device 700 will be described with reference to Fig. 16. As shown in Fig. 16, the transfer information management device 700 has a communication unit 710, a storage unit 720, and a control unit 730. Note that the function of the communication unit 710 is the same as the function described for the communication unit 110 of the terminal device 100, and therefore will not be described here.

(Storage unit 720)
The storage unit 720 stores data and programs required for various processes performed by the control unit 730. The storage unit 720 includes an address storage unit 721.

(Address storage unit 721)
The address storage unit 721 stores a connected terminal number management device reply table and a terminal device reply table as information related to VPN connection addresses for connecting to the dedicated network. Specifically, the address storage unit 721 stores the items "Connection Destination VPN ID" and "VPN Connection Address" as the connected terminal number management device reply table, as shown in FIG.

On the other hand, the address storage unit 721 stores the following items as a terminal device reply table: "Service connection URI (Uniform Resource Identifier)/URL (Uniform Resource Locator)" and "VPN terminal address" as shown in Figure 18. Note that the information stored in the address storage unit 721 is not limited to the items described above, and other items may be stored. Also, the input information for each item shown in Figures 17 and 18 is merely an example, and is not limited to the information described. Furthermore, the address storage unit 721 of the transfer information management device 700 may utilize DNS (Domain Name System) as a function of the terminal reply table.

(Control unit 730)
16, the description will be continued. The control unit 730 includes a receiving unit 731 and a transmitting unit 732.

(Reception unit 731)
The receiving unit 731 receives the connected VPN ID transmitted by the acquisition unit 633 of the connected terminal number management device 600. Note that the information received by the receiving unit 731 is not limited to the information described above, and may receive other information as necessary.

(Transmitter 732)
Based on the connection VPN ID received by the reception unit 731, the transmission unit 732 transmits the corresponding VPN connection address to the connected terminal number management device 600 and the corresponding VPN terminal address to the terminal device 100. Note that the transmission unit 732 is not limited to the information described above, and may transmit other information as necessary.

[2-2. Communication control method procedure]
19, a communication control method performed by the communication control system 1 in the first embodiment will be described. First, the reception unit 431 of the terminal location information management device 400 receives a terminal ID and a registration request to the C-plane of the mobile network from the terminal device 100 (step S11).

Next, the reception unit 431 of the terminal location information management device 400 determines that the terminal device 100 holds a destination VPN ID (Yes in step S12). In this case, the reception unit 431 of the terminal location information management device 400 receives the destination VPN ID from the terminal device 100 (step S13). Next, the registration unit 433 of the terminal location information management device 400 registers the terminal ID and the destination VPN ID corresponding to the terminal ID (step S16).

On the other hand, the reception unit 431 of the terminal location information management device 400 determines that the terminal device 100 does not hold a destination VPN ID (No in step S12). In this case, the notification unit 432 of the terminal location information management device 400 notifies the contract information management device 500 of the terminal ID (step S14). Then, the transmission unit 532 of the contract information management device 500 transmits the destination VPN ID corresponding to the terminal ID to the terminal location information management device 400 (step S15). Next, the registration unit 433 of the terminal location information management device 400 registers the terminal ID transmitted by the terminal device 100 and the destination VPN ID transmitted by the contract information management device 500 (step S16).

Next, the terminal location information management device 400 establishes a C-plane session with the terminal device 100 (step S17). Subsequently, the reception unit 431 of the terminal location information management device 400 receives a connection request for establishing a D-plane session from the terminal device 100 (step S18). Subsequently, the terminal location information management device 400 determines the destination overlay tunnel route forwarding device 300 and establishes a D-plane session within the mobile network (step S19).

Then, the transmitting unit 434 of the terminal location information management device 400 transmits the destination VPN ID and the responsible anchor GW ID to the connected terminal count management device 600 (step S20). Next, the counting unit 631 of the connected terminal count management device 600 counts and updates the number of connected terminals based on the received destination VPN ID and responsible anchor GW ID (step S21).

Then, the determination unit 632 of the connected terminal count management device 600 determines that the number of connected terminals has been updated from 0 to 1 or more (step S22). In this case, the acquisition unit 633 of the connected terminal count management device 600 sends the destination VPN ID to the transfer information management device 700 and acquires a VPN connection address (step S23). Next, the setting unit 634 of the connected terminal count management device 600 starts the VPN gateway 200 and sets the acquired VPN connection address to the VPN gateway 200 and the overlay tunnel route forwarding device 300, thereby constructing an overlay tunnel route for data transfer (step S24).

Next, the transfer information management device 700 transmits the VPN terminal address to the terminal device 100 (step S25). The terminal device 100 then connects to the dedicated network via the data transfer overlay tunnel route using the VPN terminal address transmitted by the transfer information management device 700 (step S26). Thereafter, the terminal device 100 continues its connection to the dedicated network (step S27).

Then, the terminal location information management device 400 measures the non-communication time of the terminal device 100 (step S28). If the non-communication time exceeds a predetermined threshold, the terminal location information management device 400 disconnects the D-plane session (step S29). Next, the counting unit 631 of the connected terminal number management device 600 subtracts the number of connected terminals corresponding to the VPN of the terminal device 100's communication destination and the overlay tunnel route forwarding device 300 via which the terminal device 100 communicates (step S30). If the above-mentioned subtraction changes the number of connected terminals from 1 or more to 0, the determination unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has been updated from 1 or more to 0 (Yes in step S31). In this case, the deletion unit 635 of the connected terminal count management device 600 deletes the VPN connection address set in the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, releases the overlay tunnel route for data transfer, and the process ends (step S32).

On the other hand, if the number of connected terminals does not become 0, the determination unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has not been updated from 1 or more to 0 (No in step S31). In this case, the process returns to normal and the communication control system 1 continues processing.

[2-3. Effects]
The communication control system 1 according to the first embodiment has a connected terminal number management device 600 that establishes and deletes a data transfer overlay tunnel route used by a terminal device 100 belonging to a connection network to connect to a dedicated network for each contract organization. The connected terminal number management device 600 stores contract information (connection destination VPN ID) that is information for identifying the dedicated network for each contract organization, and anchor GW identification information (responsible anchor GW) that is information for identifying an overlay tunnel route forwarding device 300 that belongs to the area to which the terminal device 100 is connected. The present embodiment is characterized in that it uses a network ID (network ID) to count the number of connected terminals, which is the number of terminal devices 100 accessing the dedicated network for each contracting organization, and when the number of connected terminals changes from 0 to 1 or more, it starts up the VPN gateway 200, configures the VPN gateway 200 and the overlay tunnel route forwarding device 300 to connect to the dedicated network for each contracting organization, and constructs an overlay tunnel route for data transfer, and when the number of connected terminals changes from 1 or more to 0, it deletes the settings of the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, and deletes the overlay tunnel route for data transfer. Therefore, this embodiment has the following effects.

With conventional methods, it was necessary to prepare a vGW in every area and pre-configure area-specific instance information. In addition, it was necessary to activate the vGW in every area and assign a dedicated operational server to each dedicated network. Furthermore, the general-purpose server running the gateway process (hereafter referred to as the "operational server") keeps the gateway process on standby even when no packet data arrives, which occupies memory and continues to consume power. Therefore, when multiple gateway processes exist, each providing gateway functionality to a different dedicated network, the memory available to the operational server for the active gateway process is reduced, potentially resulting in reduced packet forwarding performance.

However, the communication control system 1 of embodiment 1 dynamically configures the gateway process in response to an increase or decrease in the number of connected terminals, in other words, dynamically controls the VPN gateway 200 and overlay tunnel route forwarding device 300 that construct overlay tunnel routes for data transfer, thereby providing the effect of reducing power consumption and avoiding unnecessary resource occupation.

3. Embodiment 1': Selection of a VPN gateway operating server in consideration of the load on the VPN gateway operating server
Next, embodiment 1' will be described as another embodiment. In embodiment 1', the communication control system 1 selects an operating server to operate, taking into consideration the load on the operating server of the VPN gateway 200. Specifically, the communication control system 1 in embodiment 1' periodically acquires information on the operating status of the VPN gateway 200, such as the CPU usage rate of the operating server and the number of VPN gateways 200 in operation, and determines an operating server that satisfies predetermined conditions (for example, low CPU usage rate, high power efficiency, low load, etc.).

A specific example of the above content will be explained using Figure 20. Figure 20 shows a situation in which the VPN gateway 200 has two operating servers: operating server 20A with a CPU utilization rate of 20% and operating server 20B with a CPU utilization rate of 80%. First, the monitoring unit 636 of the connected terminal count management device 600 monitors the CPU utilization rates of operating server 20A and operating server 20B, and acquires information regarding the CPU utilization rates at predetermined time intervals (see (1) in Figure 20).

The monitoring unit 636 of the connected terminal count management device 600 then selects an operating server to run the VPN gateway 200 based on the acquired information on CPU usage. In the example shown in Figure 20, the CPU usage of operating server 20A is lower than that of operating server 20B, so the monitoring unit 636 of the connected terminal count management device 600 determines to use operating server 20A as the operating server.

Note that although the example in Figure 20 mentions CPU usage, the monitoring unit 636 of the connected terminal number management device 600 may also use other information such as the number of VPN gateways in operation, memory usage, and the number of connected terminals to determine the operating server to operate.

[3-1. Configuration of the communication control system]
The configuration of the communication control system 1 in embodiment 1' will now be described with reference to FIG. 21. The communication control system 1 in embodiment 1' has a device configuration including a terminal device 100, a VPN gateway 200, an overlay tunnel route forwarding device 300, a terminal location information management device 400, a contract information management device 500, a number-of-connected-terminals management device 600, and a transfer information management device 700. The functional units of each device will be described in detail in the following sections. Note that the system configuration in embodiment 1' is the same as in embodiment 1, and in this section only the monitoring unit 636 of the number-of-connected-terminals management device 600, which is a different functional unit, will be described, and detailed description of the other units will be omitted.

(Monitoring unit 636)
The monitoring unit 636 acquires information about the operating status of the operating server from the operating server that operates the VPN gateway 200, and determines which operating server to operate based on the information about the operating status. For example, the monitoring unit 636 monitors the operating server of the VPN gateway 200 and acquires information about the operating status of the operating server (e.g., CPU usage rate, memory usage rate, memory usage amount, number of VPN gateways in operation, etc.). Note that the monitoring unit 636 is not limited to the information described above, and may monitor and acquire other information as necessary.

[3-2. Communication control method procedure]
Next, a communication control method performed by the communication control system 1 in embodiment 1' will be described with reference to Figure 22. First, the monitoring unit 636 of the device for managing the number of connected terminals 600 monitors the operating status of the operating server of the VPN gateway 200 (step S31). Then, the monitoring unit 636 of the device for managing the number of connected terminals 600 acquires information regarding the operating status of the operating server (step S32). Furthermore, the monitoring unit 636 of the device for managing the number of connected terminals 600 determines the operating server to use based on the information regarding the operating status (step S33).

[3-3. Effects]
In the embodiment 1', the communication control system 1 has the following effects.

In conventional technology, static configuration is used, in which all gateway process and overlay settings are performed when a dedicated network begins to be used. With this static configuration method, the operating server for the gateway process corresponding to each dedicated network is also determined at the time of configuration. As a result, conventional technology did not have a method for load balancing of gateway processes between operating servers based on the operating status of the operating servers and gateway processes. As a result, when there are many terminals connected to a dedicated network handled by a gateway process running on a certain operating server, traffic can become concentrated on a specific operating server, resulting in degraded packet forwarding performance.

However, the communication control system 1 in embodiment 1' dynamically selects the operating server that operates the VPN gateway 200 depending on the operating status of the operating server, thereby providing the effect of balancing the load on the operating servers and suppressing deterioration of packet forwarding performance.

4. Embodiment 1″: Operation when changing overlay tunnel route forwarding device due to area movement
Next, a further different embodiment, embodiment 1″, will be described. Embodiment 1″ is an embodiment in which the terminal device 100 moves between areas, and the overlay tunnel route forwarding device 300 in charge is changed.

Below, an overview of embodiment 1'' will be explained using Figure 23. Figure 23 shows that the terminal device 100 moves between logically different areas, "Area A" and "Area B." Furthermore, it is assumed that the terminal location information management device 400 belonging to each area holds the anchor GW ID responsible for the overlay tunnel route forwarding device 300 belonging to that area. Therefore, when the terminal device 100 registers with the mobile network, the responsible terminal location information management device 400 and overlay tunnel route forwarding device 300 are determined depending on the base station to which it connects.

Specifically, area A is the terminal location information management device 400A and overlay tunnel route forwarding device 300A, and area B is the terminal location information management device 400B and overlay tunnel route forwarding device 300B. In other words, when the terminal device 100 moves across areas, the terminal location information management device 400 with which it is registered changes, and as a result, the overlay tunnel route forwarding device 300 to which it is connected changes.

From here, a specific example of embodiment 1'' will be explained again using Figure 23. First, the terminal device 100 moves across areas from area A to area B (see (1) in Figure 23). Next, the terminal location information management device 400B in area B, the destination of the movement, registers the terminal ID and the destination VPN ID of the terminal device 100 (see (2) in Figure 23).

Next, similar to the procedure in embodiment 1, terminal location information management device 400B establishes a D-plane session within the mobile network (see (3) in Figure 23). Then, although not shown in Figure 23, counting unit 631 of connected terminal number management device 600 performs a process of adding the number of connected terminals in area B. Next, when a D-plane session is established in area B, terminal location information management device 400A terminates the D-plane session in area A (see (4) in Figure 23). Then, although not shown in Figure 23, counting unit 631 of connected terminal number management device 600 performs a process of subtracting the number of connected terminals in area A.

[4-1. Configuration of the communication control system]
From here, the configuration of the communication control system 1 in embodiment 1" will be described. The communication control system 1 in embodiment 1" is a device configuration including a terminal device 100, a VPN gateway 200, an overlay tunnel route forwarding device 300, a terminal location information management device 400, a contract information management device 500, a number of connected terminals management device 600, and a transfer information management device 700. Note that the system configuration in embodiment 1" is the same as in embodiment 1, so detailed description will be omitted.

[4-2. Communication control method procedure]
Next, a communication control method performed by the communication control system 1 in embodiment 1'' will be described with reference to FIG. 24. First, the terminal device 100 moves from an arbitrary area A to a different area B (step S41). Next, the terminal location information manager 500B in the destination area B registers the terminal ID and destination VPN ID of the terminal device 100 that has moved between areas in the terminal location information manager 400B (step S42). Then, the terminal location information manager 400B determines the destination overlay tunnel route forwarding device 300B, as in the procedure of embodiment 1, and establishes a D-plane session within the mobile network (step S43).

Next, the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals in area B, adds up, and updates (step S44). Next, after the D-plane session is established in area B, the terminal location information management device 500A terminates the D-plane session in area A (step S45). Then, the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals in area A, subtracts, and updates (step S46).

[4-3. Effects]
In embodiment 1'', the communication control system 1 has the following effects.

In the communication control system 1 according to embodiment 1'', even when a terminal device 100 moves between areas and the overlay tunnel route forwarding device 300 in charge changes, the terminal location information management device 400 in the new area acquires the information necessary to count the number of connected terminals from the terminal device 100, and the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals. The setting unit 634 and deletion unit 635 of the connected terminal number management device 600 dynamically control the VPN gateway 200 and overlay tunnel route forwarding device 300, thereby saving resources on the operating server and improving the load balancing efficiency of the gateway process.

5. Embodiment 2: When a terminal device connects to a VPN via Wi-Fi
From here, a further different embodiment will be described, which is embodiment 2. In embodiment 2, an embodiment will be described in which the terminal device 100 connects to a VPN via WiFi via a mobile network.

First, an overview of embodiment 2 will be described using Figure 25. First, a terminal device 100 making a Wi-Fi connection connects to Wi-Fi router R (see (1) in Figure 25). Next, Wi-Fi router R forwards packet data to mobile gateway 800 (see (2) in Figure 25). Then, based on information related to the destination address (VPN connection address) and information related to the corresponding VPN (destination VPN ID) that it stores in advance, mobile gateway 800 determines the VPN connection address and destination VPN ID based on the destination information (e.g., IP address, etc.) sent by terminal device 100, and establishes a D-plane session on behalf of terminal device 100. Then, mobile gateway 800 forwards data to the D-plane session corresponding to the destination VPN (see (3) in Figure 25). Note that the subsequent counting of the number of connected terminals is omitted, as it is the same as in embodiment 1.

From here, we will further explain the detailed operation flow of the mobile gateway 800. First, there are two methods by which the mobile gateway 800 obtains the destination VPN ID: "Case 1: The terminal device obtains the destination VPN ID when performing VPN authentication" and "Case 2: The terminal device sends an announcement message for a certain period of time when connected to Wi-Fi." First, we will explain Case 1 using Figure 26.

In FIG. 26, the terminal device 100 sends a VPN authentication request (including a password and user ID) to the mobile gateway 800 when starting a VPN connection (see (1) in FIG. 26). The mobile gateway 800 then sends the authentication request received from the terminal device 100 to the VPN authentication server 900 (see (2) in FIG. 26). The VPN authentication server 900 then sends an authentication response (destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (see (3) in FIG. 26). Note that if the VPN authentication server 900 sends a VPN terminal address, the mobile gateway 800 obtains the corresponding destination VPN ID from the contract information management device 500 based on the VPN terminal address (see (4) in FIG. 26).

Next, the mobile gateway 800 transmits the destination VPN ID acquired from the VPN authentication server 900 or the contract information management device 500 to the terminal location information management device 400 (see (5) in Figure 26). The terminal location information management device 400 further transmits the destination VPN ID to the forwarding information management device 700 and acquires the corresponding VPN connection address (see (6) in Figure 26). Next, the terminal location information management device 400 transmits the acquired VPN connection address to the mobile gateway 800 (see (7) in Figure 26). The mobile gateway 800 then maps the acquired VPN connection address to the destination VPN ID it holds and sets it.

Now, case 2 will be explained using Figure 27. First, when the terminal device 100 detects a Wi-Fi connection, it establishes encrypted path C with the mobile gateway 800 (see (1) in Figure 27). Note that if the terminal device 100 is unable to establish encrypted path C within a predetermined time, it stops the procedure for establishing encrypted path C. The mobile gateway 800 then performs VPN authentication in the same manner as in Case 1 described above, obtains a VPN connection address and destination VPN ID, and sets them to itself after mapping. Next, the mobile gateway 800 sends a registration completion message to the terminal device 100 via encrypted path C (see (2) in Figure 27).

5-1. Configuration of the communication control system
Next, the configuration of the communication control system 1 in embodiment 2 will be described with reference to FIG. 28 . The communication control system 1 in embodiment 2 is configured to include a terminal device 100, a VPN gateway 200, an overlay tunnel route forwarding device 300, a terminal location information management device 400, a contract information management device 500, a number of connected terminals management device 600, a transfer information management device 700, and a mobile gateway 800. The functional units of each device will be described in detail in the following sections. Note that the device configuration in embodiment 2 other than the mobile gateway 800 is the same as in embodiment 1, and this section will only describe the mobile gateway 800, which is different, and will omit detailed description of the rest.

(Mobile gateway 800)
28, the mobile gateway 800 includes a communication unit 810, a storage unit 820, and a control unit 830. The functions of the communication unit 810 are the same as those described for the communication unit 110 of the terminal device 100, and therefore will not be described here.

(Storage unit 820)
The storage unit 820 stores data and programs required for various processes performed by the control unit 830. The storage unit 820 also includes a VPN search table 821 storage unit.

(VPN search table storage unit 821)
The VPN search table storage unit 821 stores a VPN search table that maps and sets the acquired VPN connection address and the destination VPN ID. Specifically, the VPN search table storage unit 821 stores the items "VPN connection address" and "destination VPN ID" as shown in FIG. 29 as the VPN search table. Note that the information stored in the VPN search table storage unit 821 is not limited to the above-mentioned items and may store other items. Also, the input information for each item shown in FIG. 29 is merely an example and is not limited to the information described.

(Control unit 830)
28, the description will be continued. The control unit 830 includes a distribution unit 831, a transmission unit 832, a setting unit 833, and a session establishment unit 834.

(Distribution section 831)
The distribution unit 831 determines the VPN connection address and the destination VPN ID based on information related to the destination address (VPN connection address) and information related to the corresponding VPN (destination VPN ID) stored in advance, and the destination information (IP address) sent by the terminal device 100, and distributes the communication to the D-plane session corresponding to the destination VPN.

(Transmitter 832)
The transmission unit 832 transmits an authentication request (including a user ID, a password, etc.) received from the terminal device 100 to the VPN authentication server 900. Furthermore, the transmission unit 832 transmits the destination VPN ID acquired from the VPN authentication server 900 to the terminal location information management device 400. The transmission unit 832 also transmits a registration completion message to the terminal device 100.

(Setting unit 833)
The setting unit 833 maps and sets the VPN connection address acquired from the transfer information management device 700 and the destination VPN ID held by the mobile gateway 800 .

(Session establishment unit 834)
The session establishment unit 834 establishes an overlay tunnel route for data transfer with the terminal location information management device 400 on behalf of the terminal device 100, based on the contract information (destination VPN ID), information for connecting to the dedicated network for each contract organization to which the terminal device 100 is to connect (VPN connection address), and destination information included in the packet data sent by the terminal device 100.

Specifically, to establish a D-plane session based on a D-plane session establishment request from the terminal device 100, the session establishment unit 834 determines the destination VPN connection address and destination VPN ID from the destination information (IP address) included in the packet data sent by the terminal device 100, based on the mapped VPN connection address and destination VPN ID. The session establishment unit 834 then establishes a D-plane session corresponding to the destination VPN and transfers the packet data.

[5-2. Communication control method procedure]
Next, a communication control method performed by the communication control system 1 in embodiment 2 will be described. As described above, in embodiment 2, there are two methods for the mobile gateway 800 to acquire the destination VPN ID, and therefore the procedures for each case will be described separately. First, the procedure for the case corresponding to the above-mentioned case 1 will be described using FIG. 30.

First, the terminal device 100 connects to the Wi-Fi router R (step S51). Next, the terminal device 100 transmits a VPN authentication request (including a password and user ID) to the mobile gateway 800 when starting the VPN connection (step S52). Next, the transmitting unit 832 of the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (step S53). Then, the VPN authentication server 900 transmits an authentication response (destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (step S54).

Next, the transmitting unit 832 of the mobile gateway 800 transmits the destination VPN ID acquired from the VPN authentication server 900 to the terminal location information management device 400 (step S55). Then, the acquiring unit 435 of the terminal location information management device 400 acquires a VPN connection address from the transfer information management device 700 (step S56). Next, the transmitting unit 434 of the terminal location information management device 400 transmits the acquired VPN connection address to the mobile gateway 800 (step S57). The setting unit 833 of the mobile gateway 800 maps the acquired VPN connection address to the stored destination VPN ID and sets it (step S58).

Next, the WiFi router R transfers the packet data to the mobile gateway 800 (step S59). Subsequently, the session establishment unit 834 of the mobile gateway 800 determines the destination VPN connection address and destination VPN ID from the destination information included in the packet data sent by the terminal device 100, based on the mapped VPN connection address and destination VPN ID (step S60). The session establishment unit 834 of the mobile gateway 800 then establishes a D-plane session corresponding to the destination VPN and transfers the packet data (step S61).

Next, the procedure for the case corresponding to the aforementioned Case 2 will be explained using Figure 31. The terminal device 100 connects to the WiFi router R (step S71). At this time, the terminal device 100 establishes an encrypted path C with the mobile gateway 800 (step S72). Next, the terminal device 100 transmits a VPN authentication request (including a password and user ID) to the mobile gateway 800 when starting the VPN connection (step S73). Next, the transmitter 832 of the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (step S74). Then, the VPN authentication server 900 transmits an authentication response (destination VPN ID or VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (step S75).

Next, the transmitting unit 832 of the mobile gateway 800 transmits the destination VPN ID acquired from the VPN authentication server 900 to the terminal location information management device 400 (step S76). Then, the acquiring unit 435 of the terminal location information management device 400 acquires a VPN connection address from the transfer information management device 700 (step S77). Next, the transmitting unit 434 of the terminal location information management device 400 transmits the acquired VPN connection address to the mobile gateway 800 (step S78). The setting unit 833 of the mobile gateway 800 maps the acquired VPN connection address to the retained destination VPN ID and sets it (step S79). Then, the transmitting unit 832 of the mobile gateway 800 transmits a registration completion message to the terminal device 100 (step S80).

Next, the WiFi router R transfers the packet data to the mobile gateway 800 (step S81). Subsequently, the session establishment unit 834 of the mobile gateway 800 determines the destination VPN connection address and destination VPN ID from the destination information included in the packet data sent by the terminal device 100, based on the mapped VPN connection address and destination VPN ID (step S82). The session establishment unit 834 of the mobile gateway 800 then establishes a D-plane session corresponding to the destination VPN and transfers the packet data (step S83).

[5-3. Effects]
In the second embodiment, the communication control system 1 has the following advantages.

In conventional technology, when performing Wi-Fi communication, the terminal device 100 only held the destination IP address of the data packet to be forwarded to the VPN as information to identify the VPN to be accessed, and the mobile gateway 800 had to attach information identifying the VPN to the signaling message for session establishment.

Furthermore, in conventional technology, a device equivalent to the mobile gateway 800 was unable to derive information identifying the VPN to be accessed from the destination IP address of the arriving packet, and therefore was unable to establish an overlay tunnel route for data transfer to the VPN via mobile network signaling immediately upon packet arrival.

However, the communication control system 1 in embodiment 2 provides the effect of searching for a mapped VPN connection address from the destination information (IP address) of packet data arriving at the mobile gateway 800, establishing an overlay tunnel route for data transfer, and enabling the counting of the number of connected terminals.

6. Embodiment 2-1: When a terminal device connects to a VPN via an IP network
From here, an embodiment 2-1 will be described as a similar embodiment to embodiment 2. In Fig. 32, an embodiment in which the terminal device 100 connects to a VPN via WiFi via an IP network will be described.

First, Figure 32 illustrates the cases where the terminal device 100 connects to the fixed network access router SR via a Wi-Fi router R and the case where it connects directly to the fixed network access router SR. In Figure 32, when the terminal device 100 accesses via an IP network, the communication control system 1 cannot count the number of connected terminals based on the establishment and release of D-plane sessions. Therefore, the communication control system 1 in embodiment 2-1 counts the number of connected terminals using terminal operation confirmation triggered by a "heartbeat," "ping," etc., after the VPN authentication and establishment of the data transfer overlay tunnel route described in embodiment 2.

Furthermore, as a premise of embodiment 2-1, an overlay tunnel route forwarding device 300 for the IP network (hereinafter referred to as the "overlay tunnel route forwarding device 300") is installed between the IP network and the data network. As shown in FIG. 33, the communication control system 1 is configured to include multiple VPN authentication servers 900 for the IP networks (hereinafter referred to as the "VPN authentication servers 900") and multiple access points AP (for example, residential Wi-Fi routers, etc.) in order to identify the overlay tunnel route forwarding device 300.

From here, an overview of the operation of the communication control system 1 in embodiment 2-1 will be explained using Figure 34. First, the terminal device 100 transmits VPN connection information (user ID, password, etc.) to the VPN authentication server 900 via the WiFi router R and the fixed network access router SR, or via only the fixed network access router SR (see (1) in Figure 34).

Next, the VPN authentication server 900 notifies the connected terminal count management device 600 of the destination VPN ID and the responsible anchor GW ID (see (2) in Figure 34). The connected terminal count management device 600 then counts and adds up the number of connected terminals connected to the target VPN that connects to the dedicated network from the corresponding overlay tunnel route forwarding device 300. Note that the procedure for constructing the overlay tunnel route for data transfer after the addition is the same as the method described in embodiment 1.

Next, the terminal survival confirmation unit 333 of the overlay tunnel route forwarding device 300 confirms the survival of the terminal using "heartbeat" or "ping" (see (3) in Figure 34). If the terminal survival confirmation result indicates that the terminal device 100 has stopped responding, the terminal survival confirmation unit 333 of the overlay tunnel route forwarding device 300 notifies the connected terminal count management device 600 of the destination VPN ID and the responsible anchor GW ID (see (4) in Figure 34). Based on the notification, the connected terminal count management device 600 then counts and subtracts the number of connected terminals connected to the target VPN to be connected to the dedicated network. Note that the procedure for deleting the data transfer overlay tunnel route after subtraction is the same as the method described in embodiment 1.

6-1. Configuration of the communication control system
Next, the configuration of the communication control system 1 in embodiment 2-1 will be described. The communication control system 1 in embodiment 2-1 is configured to include a terminal device 100, a VPN gateway 200, an overlay tunnel route forwarding device 300 for an IP network, a terminal location information management device 400, a contract information management device 500, a connected terminal number management device 600, and a forwarding information management device 700.

Note that the system configuration other than the overlay tunnel route forwarding device 300 in embodiment 2-1 is the same as in embodiment 1, and this section will only explain the overlay tunnel route forwarding device 300, which is different, and will omit detailed explanations of other parts. Furthermore, since the overlay tunnel route forwarding device 300 in embodiment 2-1 has the same functions as the overlay tunnel route forwarding device 300 in embodiment 1, only the terminal survival confirmation unit 333, which is a different functional unit, will be explained, and explanations of other parts will be omitted.

(Control unit 330)
From here, the description will be made with reference to Fig. 35. The control unit 330 has a packet header analysis unit 331, a transfer processing unit 332, and a terminal existence confirmation unit 333.

(Terminal existence confirmation unit 333)
The terminal existence confirmation unit 333 transmits an identification signal to the terminal device 100 connected to the dedicated network via the IP network, and confirms whether the terminal device 100 is connected to the dedicated network.

Specifically, the terminal survival confirmation unit 333 confirms the terminal survival using "heartbeat" or "ping" and determines whether or not there is a response from the terminal device 100. Based on the determination result of the terminal survival confirmation, the terminal survival confirmation unit 333 notifies the connected terminal count management device 600 of the destination VPN ID and the responsible anchor GW ID. If the terminal survival confirmation shows that there is no response from the terminal device 100, the terminal survival confirmation unit 333 notifies the connected terminal count management device 600 of the destination VPN ID and the responsible anchor GW ID.

[6-2. Communication control method procedure]
Next, the procedure of the communication control method performed by the communication control system 1 according to embodiment 2-1 will be described with reference to Fig. 36. First, the terminal device 100 transmits VPN connection information (user ID, password, etc.) to the VPN authentication server 900 via the WiFi router R and the fixed network access router SR or via only the fixed network access router SR (step S91). Furthermore, the VPN authentication server 900 notifies the connected terminal count management device 600 of the destination VPN ID and the responsible anchor GW ID (step S92).

Then, the connected terminal count management device 600 counts the number of connected terminals connected to the target VPN via the corresponding overlay tunnel route forwarding device 300 based on the destination VPN ID and responsible anchor GW ID notified by the VPN authentication server 900, adds up the number, and updates the count (step S93). Next, the terminal survival confirmation unit 333 of the overlay tunnel route forwarding device 300 confirms the survival of the terminal using "heartbeat", "ping", etc. (step S94).

Then, the terminal survival confirmation unit 333 of the overlay tunnel route forwarding device 300 determines that there is no longer a response from the terminal device 100 (Yes in step S95). In this case, the terminal survival confirmation unit 333 of the overlay tunnel route forwarding device 300 notifies the connected terminal count management device 600 of the destination VPN ID and the responsible anchor GW ID (step S96). Then, the counting unit 631 of the connected terminal count management device 600 counts the number of connected terminals connected to the target VPN based on the destination VPN ID and the responsible anchor GW ID notified by the terminal survival confirmation unit 333 of the overlay tunnel route forwarding device 300, and updates the count by subtracting the number (step S97).

On the other hand, the terminal survival confirmation unit 333 of the overlay tunnel route forwarding device 300 determines that there is a response from the terminal device 100, and the process continues (No in step S95).

[6-3. Effects]
In embodiment 2-1, the communication control system 1 has the following effects.

In the communication control system 1, the terminal existence confirmation unit 333 of the overlay tunnel route forwarding device 300 confirms the existence of the terminal device 100 and subtracts the number of connected terminals based on the response result from the terminal device 100. As a result, the communication control system 1 is able to count the number of connected terminals even in the case of connections via IP networks, where the number of connected terminals cannot be counted using the method described in embodiment 1, thereby providing the effect of enabling dynamic control of the data forwarding overlay tunnel route and the overlay tunnel route forwarding device 300.

7. Hardware Configuration
The components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of the devices can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can also be performed manually using known methods. In addition, the information shown in the drawings, including the processing procedures, control procedures, specific names, various data, and parameters, can be changed as desired unless otherwise specified.

[program]
In one embodiment, the various devices constituting the communication control system 1 can be implemented by installing a display program that performs the above-described learning as package software or online software on a desired computer. For example, by executing the display program on an information processing device, the various devices constituting the communication control system 1 can function. The information processing device referred to here includes desktop and notebook personal computers. Other examples of information processing devices also include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants).

Figure 37 is a diagram showing an example of a computer in which the various devices that make up the communication control system 1 are realized. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. Each of these components is connected by a bus 1080.

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. In other words, the programs that define the processes of the various devices that make up the communication control system 1 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, on the hard disk drive 1090. For example, program modules 1093 for executing processes similar to the functional configurations of the various devices that make up the communication control system 1 are stored on the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

In addition, the setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed, and executes the processing of the above-described embodiment.

The program module 1093 and program data 1094 may not necessarily be stored on the hard disk drive 1090, but may also be stored on a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100, etc. Alternatively, the program module 1093 and program data 1094 may be stored on another computer connected via a network (such as a LAN or a WAN (Wide Area Network)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[8. Other]
Although the present embodiment has been described above, the present embodiment is not limited by the descriptions and drawings that form part of the disclosure. In other words, other embodiments, examples, operational techniques, etc. that are made by those skilled in the art based on the present embodiment are all included in the scope of the present embodiment.

1 Communication control system 10 Front-end server 10A Front-end server 10B Front-end server 10C Front-end server 20A Working server 20B Working server 100 Terminal device 101 Terminal device 102 Terminal device 110 Communication unit 120 Memory unit 130 Control unit 131 Address management unit 132 Communication session management unit 200 VPN gateway 210 Communication unit 220 Memory unit 221 Transfer destination memory unit 230 Control unit 231 Packet header analysis unit 232 Transfer processing unit 300 Overlay tunnel route transfer device 300A Overlay tunnel route transfer device 300B Overlay tunnel route transfer device 310 Communication unit 320 Memory unit 321 Transfer destination memory unit 330 Control unit 331 Packet header analysis unit 332 Transfer processing unit 333 Terminal existence confirmation unit 400 Terminal location information management device 400A Terminal location information management device 400B Terminal location information management device 410 Communication unit 420 Storage unit 421 Terminal device connection destination VPN storage unit 422 Anchor GW storage unit 430 Control unit 431 Reception unit 432 Notification unit 433 Registration unit 434 Transmission unit 435 Acquisition unit 500 Contract information management device 510 Communication unit 520 Storage unit 521 Contract information storage unit 530 Control unit 531 Reception unit 532 Transmission unit 600 Connected terminal number management device 610 Communication unit 620 Storage unit 621 Connected terminal number storage unit 630 Control unit 631 Counting unit 632 Determination unit 633 Acquisition unit 634 Setting unit 635 Deletion unit 636 Monitoring unit 700 Transfer information management device 710 Communication unit 720 Storage unit 721 Address storage unit 730 Control unit 731 Reception unit 732 Transmission unit 800 Mobile gateway 810 Communication unit 820 Storage unit 821 VPN search table storage unit 830 Control unit 831 Distribution unit 832 Transmission unit 833 Setting unit 834 Session establishment unit 900 VPN authentication server R WiFi router SR Fixed network access router AP Access point DN Data network MN Mobile network 1000 Computer 1010 Memory 1011 ROM
1012 RAM
1020 CPU
1030 Hard disk drive interface 1040 Disk drive interface 1050 Serial port interface 1060 Video adapter 1070 Network interface 1080 Bus 1090 Hard disk drive 1091 OS
1092 Application program 1093 Program module 1094 Program data 1100 Disk drive 1110 Mouse 1120 Keyboard

Claims (8)

A communication control system having a connected terminal number management device that establishes and deletes a data transfer overlay tunnel route used by a terminal device belonging to a connection network to connect to a dedicated network for each contract organization,
the connected terminal number management device is a counting unit that counts the number of connected terminals, which is the number of terminal devices accessing the dedicated network for each contract organization, using contract information that is information that identifies the dedicated network for each contract organization and anchor GW identification information that is information that identifies an overlay tunnel route forwarding device that belongs to an area to which the terminal device is connected;
a setting unit that starts a VPN gateway when the number of connected terminals changes from 0 to 1 or more, and configures the VPN gateway and the overlay tunnel route forwarding device to connect to a dedicated network for each contracted organization, thereby constructing the overlay tunnel route for data transfer;
a deletion unit that deletes the settings of the VPN gateway and the overlay tunnel route forwarding device, stops the VPN gateway, and deletes the data transfer overlay tunnel route when the number of connected terminals becomes zero from one or more,
A communication control system comprising: the communication control system further includes a terminal location information management device;
The terminal location information management device includes a reception unit that receives, from the terminal device, terminal device information that is information for identifying the terminal device, the contract information, and a connection request that is a request for connection from a mobile network to a data network;
a registration unit that registers the terminal device information and the contract information;
a transmission unit that transmits the contract information and the anchor GW identification information to the connected terminal number management device based on the connection request;
2. The communication control system according to claim 1. the communication control system further includes a terminal location information management device and a contract information management device;
The terminal location information management device includes a reception unit that receives, from the terminal device, terminal device information that is information for identifying the terminal device, a registration request that is a request to register the terminal device information and the contract information in the terminal location information management device, and a connection request that is a request to connect from a mobile network to a data network;
a registration unit that registers the terminal device information and the contract information acquired from the contract information management device using the terminal device information based on the registration request;
a transmission unit that transmits the contract information and the anchor GW identification information to the connected terminal number management device based on the connection request;
2. The communication control system according to claim 1. an acquisition unit that acquires, from a transfer information management device, information for connecting to a dedicated network for each contract organization to which the terminal device is to be connected, using the contract information;
a monitoring unit that acquires information about the operation status of the operation server that operates the VPN gateway from the operation server, and determines the operation server to be operated based on the information about the operation status;
2. The communication control system according to claim 1. the communication control system further comprises a mobile gateway;
The mobile gateway further includes a session establishment unit that establishes an overlay tunnel route for data transfer with the terminal location information management device on behalf of the terminal device based on the contract information, information for connecting to a dedicated network for each contract organization to which the terminal device is to connect, and destination information included in packet data transmitted by the terminal device.
2. The communication control system according to claim 1. The overlay tunnel route forwarding device further includes a terminal existence confirmation unit that transmits an identification signal to the terminal device connected to the dedicated network via an IP network and confirms whether the terminal device is connected to the dedicated network.
2. The communication control system according to claim 1. A communication control system having a connected terminal number management device that establishes and deletes a data transfer overlay tunnel route used by a terminal device belonging to a connection network to connect to a dedicated network for each contract organization,
the connected terminal number management device counts the number of connected terminals, which is the number of the terminal devices accessing the dedicated network for each contract organization, using contract information, which is information for identifying the dedicated network for each contract organization, and anchor GW identification information, which is information for identifying an overlay tunnel route forwarding device belonging to an area to which the terminal device is connected;
a step of starting up a VPN gateway when the number of connected terminals changes from 0 to 1 or more, configuring the VPN gateway and the overlay tunnel route forwarding device to connect to a dedicated network for each contracted organization, and constructing the overlay tunnel route for data transfer;
and when the number of connected terminals becomes zero from one or more, deleting the settings of the VPN gateway and the overlay tunnel route forwarding device, stopping the VPN gateway, and deleting the data transfer overlay tunnel route.
A communication control method comprising: A communication control system having a connected terminal number management device that establishes and deletes a data transfer overlay tunnel route used by a terminal device belonging to a connection network to connect to a dedicated network for each contract organization,
the connected terminal number management device counts the number of connected terminals, which is the number of the terminal devices accessing the dedicated network for each contract organization, using contract information, which is information for identifying the dedicated network for each contract organization, and anchor GW identification information, which is information for identifying an overlay tunnel route forwarding device belonging to an area to which the terminal device is connected;
When the number of connected terminals changes from 0 to 1 or more, starting up a VPN gateway, configuring the VPN gateway and the overlay tunnel route forwarding device to connect to a dedicated network for each contracted organization, and constructing the overlay tunnel route for data transfer;
and when the number of connected terminals becomes zero from one or more, deleting the settings of the VPN gateway and the overlay tunnel route forwarding device, stopping the VPN gateway, and deleting the data transfer overlay tunnel route.
A communication control program comprising: