VPN system, gateway, program, and VPN connection method

Abstract

To connect by VPN between IP telephone systems constructed at each base and realize extension telephone services between the bases without separately installing a management server.SOLUTION: A master GW 1 generates a domain name on the basis of identification information of a base A to which it belongs and registers the address information of the base A to the Internet 5. A slave GW 2-1 generates a domain name on the basis of identification information of a base B to which it belongs and registers the address information of the base B to the Internet 5. The master GW 1 acquires an address corresponding to the domain name generated on the basis of identification information of the base B from the Internet 5, transmits VPN connection information notification to the slave GW 2-1 identified by this address for VPN connection to the slave GW 2-1. Then, number information of the base B is generated, and connection number notification including the number information of each base is transmitted to a main device 30-1 and the slave GW 2-1. The slave GW 2-1 transfers the connection number information received from the master GW 1 to a main device 30-2.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a VPN (Virtual Private Network) connection technology between IP (Internet Protocol) telephone systems. [Background technology]

[0002] Patent Document 1 discloses a technique for easily constructing a VPN without setting complex configuration information. In Patent Document 1, when a VPN management server receives a router addition request signal from a VPN router, if the set of the VPN name and management password included in this router addition request signal is registered as a managed VPN, the server registers the address information of the VPN router that is the sender of this router addition request signal as a VPN router belonging to the managed VPN, and transmits router setting information including the address information and VPN setting information of each VPN router belonging to the managed VPN to each VPN router belonging to the managed VPN. The VPN router that receives the router setting information from the VPN management server establishes a VPN connection with each VPN router belonging to the same managed VPN based on the address information and VPN setting information included in this router setting information. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2006-54704 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the technology described in Patent Document 1 requires a VPN management server for managing and configuring each VPN router in addition to the VPN router that implements the VPN connection. Also, in order to realize an extension telephone service between bases by connecting IP telephone systems established at each base via VPN, it is necessary to share number information between the IP telephone systems established at each base. However, the technology described in Patent Document 1 does not take this into consideration.

[0005] The present invention has been made in consideration of the above circumstances, and its purpose is to provide a technology that enables an internal telephone service between bases by establishing a VPN connection between IP telephone systems constructed at each base, without the need to set up a separate management server. [Means for solving the problem]

[0006] In order to solve the above problem, the present invention comprises a master gateway that connects an IP telephone system established at an arbitrary location to the Internet, and a slave gateway that connects an IP telephone system established at a location other than the arbitrary location to the Internet.

[0007] When the master gateway receives identification information from the IP telephone system installed at the base, it generates a domain name for the base based on this identification information. When the master gateway receives setting information including the base's Internet connection information, VPN connection information, number information, and identification information for the VPN connection destination base from its own maintenance terminal, the master gateway connects to the Internet using the Internet connection information included in this setting information and acquires the base's global IP address. Then, it registers the base's address information, including the acquired global IP address and the generated domain name, on the Internet.

[0008] Next, the master gateway generates a domain name of the VPN destination base based on the identification information of the VPN destination base included in the setting information received from the first maintenance terminal, and acquires from the Internet a global IP address linked to the domain name of the VPN destination base.The master gateway then transmits a first VPN connection information notification including the address information of the base and VPN connection information to the slave gateway of the VPN destination base identified by the global IP address acquired from the Internet, and establishes a VPN connection with the slave gateway of the VPN destination base using the VPN connection information included in this first VPN connection information notification.

[0009] Next, when the master gateway receives a connection number request from a VPN-connected slave gateway, it generates number information of the VPN destination base to which this slave gateway belongs, and transmits a first connection number notification including the number information of the base to which the master gateway belongs and the VPN destination base to the IP telephone system built in the base to which the master gateway belongs and to the slave gateway that is the sender of the connection number request.

[0010] On the other hand, when the slave gateway receives identification information from the IP telephone system installed at the base, it generates a domain name for the base based on this identification information. This domain name matches the domain name of the VPN connection destination base generated by the master gateway. Also, when the slave gateway receives setting information including the Internet connection information of the base from its own maintenance terminal, the second maintenance terminal, it connects to the Internet using the Internet connection information included in this setting information and acquires the global IP address of the base from the Internet. Then, it registers the address information of the base, including the acquired global IP address and the generated domain name, on the Internet.

[0011] Next, the slave gateway waits for a first VPN connection information notification to be sent from the master gateway. Then, when the slave gateway receives the first VPN connection information notification from the master gateway, it establishes a VPN connection with the master gateway using the VPN connection information included in the first VPN connection information notification.

[0012] The slave gateway then sends a connection number request to the master gateway connected via VPN. When the slave gateway receives a first connection number notification from the master gateway, it transfers this first connection number notification to the main unit of the IP telephone system established at the base to which the slave gateway belongs.

[0013] For example, the present invention provides A VPN system that connects IP (Internet Protocol) telephone systems built at each site via a VPN (Virtual Private Network), a master gateway that connects the IP telephone system installed at any one of the locations to the Internet; a slave gateway that connects the IP telephone system constructed at a site other than the arbitrary site to the Internet, The master gateway includes: a first domain generating means for generating a domain name of a base based on identification information of the base received from the IP telephone system constructed in the base, and for generating a domain name of a VPN destination base based on identification information of the VPN destination base included in first setting information received from a first maintenance terminal which is the maintenance terminal of the first domain generating means; a first address acquisition means for connecting to the Internet based on Internet connection information included in the first setting information received from the first maintenance terminal and acquiring a global IP address of a base; a first address information registration means for registering address information of the base, including the domain name of the base generated by the first domain generation means and the global IP address of the base acquired by the first address acquisition means, on the Internet; a first address resolution means for acquiring from the Internet a global IP address of the VPN connection destination point that is associated with the domain name of the VPN connection destination point generated by the first domain generation means; a first VPN connection means for transmitting a first VPN connection information notification to the slave gateway identified by the global IP address of the VPN connection destination base acquired by the first address resolution means, the first VPN connection information notification including address information of the base and VPN connection information included in the first setting information received from the first maintenance terminal, and for establishing a VPN connection with the slave gateway using the VPN connection information included in the first VPN connection information notification; a number information generating means for generating number information of a VPN connection destination point in accordance with a connection number request received from the slave gateway of the VPN connection destination point connected to the first VPN connection means by the first VPN connection means; a connection number notification means for transmitting a first connection number notification including the number information of the base included in the first setting information received from the first maintenance terminal and the number information of the VPN destination base generated by the number information generation means to the slave gateway specified by the global IP address of the VPN destination base and to the IP telephone system constructed in the base, The slave gateway, a second domain generating means for generating a domain name of the base based on identification information of the base received from the IP telephone system constructed in the base; a second address acquisition means for connecting to the Internet based on Internet connection information of the base of origin included in second setting information received from a second maintenance terminal which is the maintenance terminal of the terminal itself, and acquiring a global IP address of the base of origin; a second address information registration means for registering address information of the base, including the domain name of the base generated by the second domain generation means and the global IP address of the base acquired by the second address acquisition means, on the Internet; a second VPN connection means for establishing a VPN connection with the master gateway using VPN connection information included in the first VPN connection information notification received from the master gateway; and a connection number request means for transmitting the connection number request to the master gateway connected via VPN by the second VPN connection means, receiving the first connection number notification from the master gateway, and transmitting the first connection number notification to the IP telephone system established at the base station. Effect of the Invention

[0014] According to the present invention, by transmitting setting information including the Internet connection information, VPN connection information, number information, and VPN destination point identification information of these bases from the first maintenance terminal to the master gateway, and transmitting setting information including the Internet connection information of these bases from the second maintenance terminal to the slave gateway, a VPN connection is established between the IP telephone systems constructed at the bases of the master gateway and the slave gateway, and number information is shared between these IP telephone systems. This makes it possible to realize an extension telephone service between bases without providing a separate management server. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a schematic diagram of a VPN system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a sequence diagram for explaining an example of an operation for realizing an internal telephone service between the locations A and B in the VPN system shown in FIG. [Diagram 3] FIG. 3 is a sequence diagram for explaining an example of an operation for realizing an internal telephone service between the sites A and B in the VPN system shown in FIG. 1, and is a continuation of FIG. [Figure 4] FIG. 4 is a sequence diagram for explaining an example of operation when the slave gateway 2-1 of the site B is replaced while an extension telephone service is being provided between the sites A and B in the VPN system shown in FIG. [Diagram 5] FIG. 5 is a sequence diagram for explaining an example of operation when the slave gateway 2-1 of site B is replaced while an internal telephone service is being provided between sites A and B in the VPN system shown in FIG. 1, and is a continuation of FIG. 4. [Figure 6] FIG. 6 is a sequence diagram for explaining an example of an operation when the number information of site B is changed in the VPN system shown in FIG. [Figure 7] FIG. 7 is a sequence diagram for explaining an example of operation when VPN connection information is changed in the VPN system shown in FIG. 1 and contains an error. [Figure 8] FIG. 8 is a sequence diagram for explaining an example of an operation for adding the site C to the extension telephone service in the VPN system shown in FIG. [Figure 9] FIG. 9 is a sequence diagram for explaining an example of an operation for adding the site C to the extension telephone service in the VPN system shown in FIG. 1, and is a continuation of FIG. [Figure 10] FIG. 10 is a schematic functional configuration diagram of the master gateway 1. As shown in FIG. [Figure 11] FIG. 11 is a flow diagram for explaining the operation of the master gateway 1. As shown in FIG. [Figure 12] FIG. 12 is a flow diagram for explaining the VPN connection process (S303) of FIG. [Figure 13] FIG. 13 is a flow diagram for explaining the VPN connection process (S303) of FIG. 11, and is a continuation of FIG. [Figure 14] FIG. 14 is a flow diagram for explaining the VPN reconnection process (S305) of FIG. [Figure 15] FIG. 15 is a flow diagram for explaining the connection number change process (S307) in FIG. [Figure 16] FIG. 16 is a flow diagram for explaining the VPN connection information change process (S309) of FIG. [Figure 17] FIG. 17 is a flow diagram for explaining the VPN additional connection process (S311) of FIG. [Figure 18]FIG. 18 is a flow diagram for explaining the VPN additional connection process (S311) of FIG. 11, and is a continuation of FIG. [Figure 19] FIG. 19 is a schematic functional configuration diagram of the slave gateway 2. [Figure 20] FIG. 20 is a flow diagram for explaining the operation of the slave gateway 2. [Figure 21] FIG. 21 is a flow diagram for explaining the VPN connection process (S401) of FIG. [Figure 22] FIG. 22 is a flow diagram for explaining the VPN connection process (S401) of FIG. 20, and is a continuation of FIG. [Figure 23] FIG. 23 is a flow diagram for explaining the VPN reconnection process (S403) of FIG. [Figure 24] FIG. 24 is a flow diagram for explaining the connection number change process (S405) in FIG. [Diagram 25] FIG. 25 is a flow diagram for explaining the VPN connection information change process (S407) of FIG. [Figure 26] FIG. 26 is a flow diagram for explaining the first VPN additional connection process (S409) of FIG. [Figure 27] FIG. 27 is a flow diagram for explaining the second VPN additional connection process (S411) of FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] An embodiment of the present invention will be described below with reference to the drawings.

[0017] FIG. 1 is a schematic diagram of a VPN (Virtual Private Network) system according to the present embodiment.

[0018] The VPN system according to the present embodiment establishes a VPN connection between IP (Internet Protocol) telephone systems 3-1 to 3-3 established at a plurality of locations A to C, respectively, and realizes an internal telephone service between the locations A to C via the Internet 5.

[0019] As shown in the figure, the VPN system of this embodiment is configured to include a master gateway (GW) 1 that connects an IP telephone system 3-1 established at site A to the Internet 5, a slave gateway 2-1 that connects an IP telephone system 3-2 established at site B to the Internet 5, and a slave gateway 2-2 that connects an IP telephone system 3-3 established at site C to the Internet 5.

[0020] Here, the IP telephone system 3-1 at the site A has a main unit 30-1 and a plurality of IP telephones 31-1 accommodated in the main unit 30-1 via a LAN (Local Area Network) 32-1, the IP telephone system 3-2 at the site B has a main unit 30-2 and a plurality of IP telephones 31-2 accommodated in the main unit 30-2 via a LAN 32-2, and the IP telephone system 3-3 at the site C has a main unit 30-3 and a plurality of IP telephones 31-3 accommodated in the main unit 30-3 via a LAN 32-3. Also, the master gateway 1 and the slave gateways 2-1 and 2-2 are connected to maintenance terminals 4-1 to 4-3, respectively.

[0021] 2 and 3 are sequence diagrams for explaining an example of an operation for realizing an internal telephone service between the locations A and B in the VPN system shown in FIG.

[0022] At site A, when main unit 30-1 is powered on and starts up (S100), it transmits identification information of site A (for example, a combination of the individual number of main unit 30-1 and the name of the installation location (site A)) to the master gateway 1 (S101).

[0023] In response to this, the master gateway 1 generates a domain name for the location A to which it belongs based on the identification information received from the main unit 30-1 (S102). For example, the domain name for the location A is generated by adding a predetermined top level domain to the identification information.

[0024] In addition, when the master gateway 1 receives setting information including the Internet connection information (address information of DNS (Domain Name System) server, account information, etc.) of its own affiliated base A, VPN connection information (VPN connection method, IPSec information, encryption method, key information, etc.), number information, and identification information of the VPN connection destination base B from its own maintenance terminal 4-1 (S103), it uses the Internet connection information included in this setting information to connect to a PPPoE (Point to Point Protocol over Ethernet) server (not shown), obtains a global IP address of its own affiliated base A (S104), and registers this global IP address by linking it to the domain name of base A. Then, the master gateway 1 uses the Internet connection information to register the address information of base A including the domain name and global IP address of base A in a DNS server (not shown) (S105). As a result, the master gateway 1 connects the IP telephone system 3-1 to the Internet 5.

[0025] Next, the master gateway 1 generates a domain name for site B according to the same generation rules as those used for generating the domain name for site A (S102) based on the identification information for site B included in the setting information received from the maintenance terminal 4-1 (S106). Then, using the Internet connection information included in this setting information, it repeatedly sends an address query for site B, including the specification of the domain name for site B, to a DNS server (not shown) until it acquires the global IP address for site B from the DNS server (S107).

[0026] Meanwhile, at site B, when the main unit 30-2 is powered on and starts up (S108), it transmits identification information of site B (for example, a combination of the individual number of the main unit 30-2 and the name of the installation location (site B)) to the slave gateway 2-1 (S109).

[0027] In response to this, the slave gateway 2-1 generates a domain name for its own affiliated location B based on the identification information received from the main device 30-2 (S110). For example, a predetermined top level domain is added to the identification information to generate the domain name for location B. The domain name for location B generated by the slave gateway 2-1 matches the domain name for location B generated by the master gateway 1 in S106.

[0028] Furthermore, when the slave gateway 2-1 receives setting information including the Internet connection information of its own affiliated base B from its own maintenance terminal 4-2 (S111), it uses the Internet connection information included in this setting information to establish a PPPoE connection to a PPPoE server (not shown) and acquires its own global IP address (S112). Then, the slave gateway 2-1 uses the Internet connection information to register address information of base B, including the domain name and global IP address of base B, in a DNS server (not shown) (S113). As a result, the slave gateway 2-1 connects the IP telephone system 3-2 to the Internet 5.

[0029] Next, in response to the address inquiry for site B (S107), the master gateway 1 acquires the global IP address of site B from the DNS server (S114), links this global IP address of site B to the domain name of site B, registers it, and transmits a VPN connection information notification to the slave gateway 2-1 specified by the global IP address of site B (S115), which includes address information for its own site A and the VPN connection information included in the setting information received from its own maintenance terminal 4-1. In response to this, the slave gateway 2-1 returns a response to the VPN connection information notification to the master gateway 1 (S116).

[0030] As a result, the VPN connection information is shared between the master gateway 1 and the slave gateway 2-1, and the master gateway 1 and the slave gateway 2-1 establish a VPN connection with each other using this VPN connection information (S117). As a result, the IP telephone system 3-1 at site A and the IP telephone system 3-2 at site B are interconnected via the Internet 5.

[0031] Next, the master gateway 1 transmits a connection number notification including the number information of site A contained in the setting information received from its own maintenance terminal 4-1 to the main unit 30-1 and the VPN-connected slave gateway 2-1 (S118, S119).

[0032] In response to this, the main unit 30-1 registers the number information of its own base A, which is included in the connection number notification (S120). The slave gateway 2-1 also returns a response to the connection number notification to the master gateway 1 (S121), and transfers this connection number notification to the main unit 30-2 (S122). In response to this, the main unit 30-2 registers the number information of the VPN connection destination base A, which is included in the connection number notification (S123).

[0033] Next, the slave gateway 2-1 transmits a connection number request to the master gateway 1 connected via VPN (S124).

[0034] In response to this, the master gateway 1 generates number information for site B (S125). For example, the master gateway 1 generates the number information for site B by adding a predetermined value to the number information for site A included in the setting information received from its own maintenance terminal 4-1. The master gateway 1 then registers the generated number information for site B in association with the address information (domain name and global IP address) of site B, and transmits a connection number notification including the number information for sites A and B registered in itself to the main unit 30-1 and the VPN-connected slave gateway 2-1, respectively (S126, S127).

[0035] In response to this, the main unit 30-1 updates the number information of its own base A to the number information of base A included in the connection number notification, and registers the number information of base B included in the connection number notification as the number information of the VPN connection destination (S128). The slave gateway 2-1 also returns a response to the connection number notification to the master gateway 1 (S129), and transfers this connection number notification to the main unit 30-2 (S130). In response to this, the main unit 30-2 registers the number information of base B included in the connection number notification as its own number information of base B, and updates the number information of base A, the VPN connection destination, to the number information of base A included in the connection number notification (S131).

[0036] As a result of the above, number information of the IP telephone system 3-1 at site A and the IP telephone system 3-2 at site B are shared between each other, making it possible to provide an internal telephone service between sites A and B via the Internet 5.

[0037] 4 and 5 are sequence diagrams for explaining an example of operation when the slave gateway 2-1 of the site B is replaced while an extension telephone service is being provided between the sites A and B in the VPN system shown in FIG.

[0038] In the VPN system shown in FIG. 1, it is assumed that the operations shown in FIG. 2 and FIG. 3 are carried out and a VPN connection is established between the master gateway 1 and the slave gateway 2-1 (S140).

[0039] The master gateway 1 periodically transmits a VPN connection confirmation to the slave gateway 2-1, which is the VPN connection destination (S141), and the slave gateway 2-1 returns a response to the master gateway 1 each time it receives a VPN connection confirmation from the master gateway 1 (S142). The master gateway 1 monitors this response to confirm that the VPN connection with the slave gateway 2-1 is being maintained.

[0040] Similarly, the slave gateway 2-1 periodically transmits a VPN connection confirmation to the master gateway 1, which is the VPN connection destination (S143), and the master gateway 1 returns a response to the slave gateway 2-1 every time it receives a VPN connection confirmation from the slave gateway 2-1 (S144). The slave gateway 2-1 monitors this response to confirm that the VPN connection with the master gateway 1 is being maintained.

[0041] Here, it is assumed that a failure occurs in the slave gateway 2-1 at site B, and the slave gateway 2-1 is replaced with a new one (S145). The replaced slave gateway 2-1 is in a state where Internet connection information and the like have not been set, and therefore is not connected to the Internet 5. For this reason, the VPN connection confirmation sent by the master gateway 1 does not reach the replaced slave gateway 2-1 (S146).

[0042] At site A, if the master gateway 1 sends a VPN connection confirmation to the slave gateway 2-1, and then times out after a predetermined time has elapsed without receiving a response from the slave gateway 2-1 (S147), it deletes the global IP address and number information from the information about site B that it stores (S148), leaving only the domain name. Then, using the Internet connection information included in the setting information received from the maintenance terminal 4-1 in S103 of Fig. 2, the master gateway 1 repeatedly sends an address query for site B, accompanied by the specification of the domain name of site B, to a DNS server (not shown) until it acquires the global IP address of site B from the DNS server (S149).

[0043] On the other hand, at site B, when the main unit 30-2 is restarted by pressing the reset button (S150), the main unit 30-2 transmits identification information of site B to the slave gateway 2-1 (S151).

[0044] In response to this, the slave gateway 2-1 generates a domain name for the location B to which it belongs based on the identification information received from the main device 30-2 (S152). As described above, the domain name for the location B generated by the slave gateway 2-1 matches the domain name for the location B generated by the master gateway 1 in S106 of FIG.

[0045] Furthermore, when the slave gateway 2-1 receives setting information including the Internet connection information of its own affiliated base B from its own maintenance terminal 4-2 (S153), it uses the Internet connection information included in this setting information to establish a PPPoE connection to a PPPoE server (not shown) and acquires its own global IP address (S154). Then, the slave gateway 2-1 uses the Internet connection information to register address information of base B including the domain name and global IP address of base B in a DNS server (not shown) (S155). As a result, the replaced slave gateway 2-1 connects the IP telephone system 3-2 of base B to the Internet 5.

[0046] Next, in response to the address inquiry from site B (S149), the master gateway 1 acquires the global IP address of site B from the DNS server (S156), links this global IP address to the domain name of site B, registers it, and transmits a VPN connection information notification to the slave gateway 2-1 identified by this global IP address (S157), which includes address information for its own site A and the VPN connection information included in the setting information received from its own maintenance terminal 4-2 in S103 of Fig. 2. In response to this, the slave gateway 2-1 returns a response to the VPN connection information notification to the master gateway 1 (S158).

[0047] As a result, the VPN connection information is shared between the master gateway 1 and the replaced slave gateway 2-1, and the master gateway 1 and the replaced slave gateway 2-1 use this VPN connection information to establish a VPN connection with each other (S159). As a result, the IP telephone system 3-1 at site A and the IP telephone system 3-2 at site B are interconnected via the Internet 5.

[0048] Then, steps S118 to S131 shown in Figure 3 are carried out (S160), which causes the number information of the IP telephone system 3-1 at site A and the IP telephone system 3-2 at site B to be shared between each other, making internal telephone services available between sites A and B via the Internet 5.

[0049] FIG. 6 is a sequence diagram for explaining an example of an operation when the number information of site B is changed in the VPN system shown in FIG.

[0050] In the VPN system shown in FIG. 1, it is assumed that the operations shown in FIG. 2 and FIG. 3 are carried out and a VPN connection is established between the master gateway 1 and the slave gateway 2-1 (S170).

[0051] At site B, when the slave gateway 2-1 receives new number information of site B to which it belongs from its own maintenance terminal 4-2 (S171), it transmits a connection number change notification including the number information of site B to the master gateway 1 connected via VPN (S172). In response to this, the master gateway 1 returns a response to the connection number change notification to the slave gateway 2-1 (S173), and updates the number information of site B to the connection number of site B included in the connection number change notification (S174).

[0052] Then, steps S126 to S131 shown in Figure 3 are carried out (S175), whereby the new number information of site B is shared between the IP telephone system 3-1 of site A and the IP telephone system 3-2 of site B, making it possible to provide internal telephone service between sites A and B via the Internet 5.

[0053] FIG. 7 is a sequence diagram for explaining an example of operation when VPN connection information is changed in the VPN system shown in FIG. 1 and contains an error.

[0054] In the VPN system shown in FIG. 1, it is assumed that the operations shown in FIG. 2 and FIG. 3 are carried out and a VPN connection is established between the master gateway 1 and the slave gateway 2-1 (S180).

[0055] At site B, when the slave gateway 2-1 receives new VPN connection information from its own maintenance terminal 4-2 (S181), it updates the VPN connection information registered in itself to this new VPN connection information (S182), and sends a VPN connection information change notification including this new VPN connection information to the master gateway 1 to which it is connected via VPN (S183). In response to this, the master gateway 1 at site A returns a response to the VPN connection information change notification to the slave gateway 2-1 (S184), saves the VPN connection information registered in itself as recovery VPN connection information, and updates this VPN connection information to the VPN connection information included in the VPN connection information change notification (S185).

[0056] As a result, new VPN connection information is shared between the master gateway 1 and the slave gateway 2-1. The master gateway 1 and the slave gateway 2-1 then disconnect the VPN connection between them and attempt to establish a VPN connection between them using the new VPN connection information. It is assumed here that there is an error in the updated VPN connection information (for example, an unsupported encryption method is specified, or the number of digits in the key information is not the specified number of digits, etc.), and as a result, the VPN connection between the master gateway 1 and the slave gateway 2-1 using the updated VPN connection information has failed (S186).

[0057] At site A, the master gateway 1 restores the VPN connection information registered therein to the VPN connection information saved as recovery VPN connection information, that is, the VPN connection information used for the previous VPN connection with the slave gateway 2-1 (the VPN connection that was most recently disconnected) (S187). Then, the master gateway 1 transmits a VPN connection information notification including the restored VPN connection information to the slave gateway 2-1 (S188). In response to this, the slave gateway 2-1 at site B returns a response to the VPN connection information notification to the master gateway 1 (S189), and updates its own VPN connection information to the VPN connection information included in the VPN connection information notification (S190).

[0058] As a result, the restored VPN connection information is shared between the master gateway 1 and the slave gateway 2-1, and the master gateway 1 and the slave gateway 2-1 establish a VPN connection with each other using this VPN connection information (S191). As a result, the IP telephone system 3-1 at site A and the IP telephone system 3-2 at site B are interconnected via the Internet 5.

[0059] 8 and 9 are sequence diagrams for explaining an example of an operation for adding the site C to the extension telephone service in the VPN system shown in FIG.

[0060] In the VPN system shown in FIG. 1, it is assumed that the operations shown in FIG. 2 and FIG. 3 are carried out and a VPN connection is established between the master gateway 1 and the slave gateway 2-1 (S200).

[0061] In site A, when the master gateway 1 receives additional setting information including identification information of site C (hereinafter, additional site) which is a new VPN connection destination from its own maintenance terminal 4-1 (S201), it generates a domain name for the additional site C based on the identification information of the additional site C included in this additional setting information, according to the same generation rules as those for generating the domain name of its own site A (S102 in FIG. 2) (S202). Then, using the Internet connection information included in the setting information received from its own maintenance terminal 4-1 in S103 in FIG. 2, it repeatedly transmits an address query for the additional site C, including the specification of the domain name of the additional site C, to a DNS server (not shown) until it acquires the global IP address of the additional site C from the DNS server (S203).

[0062] Meanwhile, at additional location C, when the main unit 30-3 is powered on and starts up (S204), it transmits identification information of the additional location C to which it belongs (for example, a combination of the individual number of the main unit 30-3 and the name of the installation location (location C)) to the slave gateway 2-2 (S205).

[0063] In response to this, the slave gateway 2-2 generates a domain name for the added location C based on the identification information received from the main device 30-3 (S206). For example, a predetermined top level domain is added to the identification information to generate a domain name for the added location C. Note that the domain name for the added location C generated by the slave gateway 2-2 matches the domain name for the added location C generated by the master gateway 1 in S202.

[0064] Furthermore, when the slave gateway 2-2 receives setting information including the Internet connection information of the additional point C from its own maintenance terminal 4-3 (S207), it uses the Internet connection information included in this setting information to establish a PPPoE connection to a PPPoE server (not shown) and acquires its own global IP address (S208). Then, the slave gateway 2-2 uses this Internet connection information to register address information of the additional point C, including the domain name and global IP address of the additional point C, in a DNS server (not shown) (S209). As a result, the slave gateway 2-2 connects the IP telephone system 3-3 to the Internet 5.

[0065] Next, at site A, the master gateway 1 acquires the global IP address of added site C from the DNS server in response to the address inquiry for added site C (S203) (S210), links this global IP address to the domain name of added site C, registers it, and transmits a VPN connection information notification including the address information of its own site A and its registered VPN connection information to the slave gateway 2-2 specified by this global IP address (S211). In response to this, the slave gateway 2-2 of added site C returns a response to the VPN connection information notification to the master gateway 1 (S212).

[0066] As a result, the VPN connection information is shared between the master gateway 1 and the slave gateway 2-2, and the master gateway 1 and the slave gateway 2-2 use this VPN connection information to establish a VPN connection with each other (S213). As a result, the IP telephone system 3-1 at site A and the IP telephone system 3-3 at additional site C are interconnected via the Internet 5.

[0067] Next, at site A, the master gateway 1 transmits a connection number notification including the number information of site A and site B registered in itself to the slave gateway 2-2 connected to the VPN (S214). In response to this, the slave gateway 2-2 returns a response to the connection number notification to the master gateway 1 (S215) and transfers this connection number notification to the main unit 30-3 (S216). The main unit 30-3 registers the number information of site A and site B included in this connection number notification as number information of the VPN connection destination (S217).

[0068] Next, at the additional point C, the slave gateway 2-2 transmits a connection number request to the master gateway 1 connected via VPN (S218).

[0069] In response to this, the master gateway 1 of site A generates number information for the added site C (S219). For example, the master gateway 1 generates the number information for the added site C by adding a predetermined value to the number information it generated last (here, the number information for site B generated in S125 of FIG. 3). Then, the master gateway 1 registers the generated number information for the added site C in association with the address information (domain name and global IP address) of the added site C, and transmits a connection number notification including the number information for the added site C and the number information for sites A and B registered in the master gateway 1 to the main unit 30-1 and the VPN-connected slave gateways 2-1 and 2-2, respectively (S220, S221).

[0070] At location A, when main unit 30-1 receives the connection number notification from master gateway 1, it updates the number information of its own location A to the number information of location A contained in this connection number notification, updates the number information of location B, the VPN connection destination, to the number information of location B contained in this connection number notification, and further registers the number information of additional location C contained in this connection number notification as the number information of the VPN connection destination (S222).

[0071] Also, at the sites B and C, the slave gateways 2-1 and 2-2 return responses to the connection number notification to the master gateway 1 (S223), and transfer the connection number notification to the main units 30-2 and 30-3 (S224, S226). In response to this, the main unit 30-2 at the site B updates the number information of its own home site B to the number information of site B included in the connection number notification, updates the number information of the VPN connection destination site A to the number information of site A included in the connection number notification, and further registers the number information of the additional site C included in the connection number notification as the number information of the VPN connection destination (S225). The main unit 30-3 at the additional site C registers the number information of the additional site C included in the connection number notification as the number information of its own home site C, and updates the number information of the VPN connection destination sites A and B to the number information of sites A and B included in the connection number notification (S227).

[0072] As a result, number information of points A to C is shared between IP telephone system 3-1 at point A, IP telephone system 3-2 at point B, and IP telephone system 3-3 at additional point C. However, at this point, while there is a VPN connection between points A and B and between points A and C, there is no VPN connection between points B and C. Therefore, the provision of internal telephone service between the three points A to C via the Internet 5 has not yet been realized.

[0073] Next, at location A, the master gateway 1 identifies address information of location B, which is a location other than its own location A and the destination of the connection number notification (additional location C), from the address information of the locations registered in itself, and sends a destination domain notification including the domain name of location B contained in this address information to the slave gateway 2-2 of additional location C (S228).

[0074] In response to this, the slave gateway 2-2 of the additional site C returns a response to the destination domain notification to the master gateway 1 (S229), and uses the Internet connection information included in the setting information received from the maintenance terminal 4-3 in S207 to send an address query for site B along with the domain name of site B included in the destination domain notification to a DNS server (not shown) (S230), and acquires the global IP address of site B from the DNS server (S231). Then, the slave gateway 2-2 registers the address information of site B (domain name and global IP address) by linking it to the number information of site B, and transmits a VPN connection information notification including the VPN connection information registered in itself to the slave gateway 2-1 specified by the global IP address of site B (S232). In response to this, the slave gateway 2-1 of site B returns a response to the VPN connection information notification to the slave gateway 2-2 (S233).

[0075] As a result, VPN connection information is shared between the slave gateway 2-1 and the slave gateway 2-2, and the slave gateway 2-1 and the slave gateway 2-2 use this VPN connection information to establish a VPN connection between them (S234). As a result, the IP telephone system 3-2 at site B and the IP telephone system 3-3 at additional site C are interconnected via the Internet 5, and an internal telephone service via the Internet 5 can be used between the three sites A to C.

[0076] Next, the master gateway 1 and the slave gateways 2-1 and 2-2 (hereinafter also simply referred to as the slave gateway 2) constituting the extension telephone system according to the present embodiment will be described in detail.

[0077] First, the master gateway 1 will be described in detail.

[0078] FIG. 10 is a schematic functional configuration diagram of the master gateway 1. As shown in FIG.

[0079] As shown in the figure, the master gateway 1 includes a main unit / maintenance terminal interface unit 100, a network interface unit 101, a relay unit 102, a connection information memory unit 103, a base information memory unit 104, a domain generation unit 105, an address acquisition unit 106, an address registration unit 107, an address resolution unit 108, a VPN connection unit 109, a number information generation unit 110, a connection number notification unit 111, a VPN connection monitoring unit 112, a destination domain notification unit 113, and a main control unit 114.

[0080] The main unit / maintenance terminal interface unit 100 is an interface for connecting to the main unit 30 - 1 and the maintenance terminal 4 - 1 , and the network interface unit 101 is an interface for connecting to the Internet 5 .

[0081] The relay unit 102 relays between the main unit / maintenance terminal interface unit 100 and the network interface unit 101. This connects the IP telephone system 3-1 to the Internet 5.

[0082] The connection information storage unit 103 stores the Internet connection information (DNS server address information, account information, etc.) of the user's own base A, and VPN connection information (VPN connection method, IPSec information, encryption method, key information, etc.).

[0083] The base information storage unit 104 stores address information (domain name, global IP address) and number information of the base A to which the user belongs. The base information storage unit 104 also stores address information and number information of the base to which the user is connected via VPN.

[0084] The domain generating unit 105 generates a domain name based on the identification information of its own base A or the base of the VPN connection destination. For example, a domain name is generated by adding a predetermined top level domain to the identification information.

[0085] Address acquisition unit 106 uses the Internet connection information stored in connection information storage unit 103 to establish a PPPoE connection to a PPPoE server (not shown) and acquires the global IP address of its own base A from the PPPoE server.

[0086] The address registration unit 107 uses the Internet connection information stored in the connection information storage unit 103 to register address information of the base A, including the domain name and global IP address of the base A to which the user belongs, in a DNS server (not shown).

[0087] Using the Internet connection information stored in the connection information memory unit 103, the address resolution unit 108 sends an address query accompanied by specification of the domain name of the base to which the VPN connection is to be made to a DNS server (not shown), and obtains the global IP address of this base from the DNS server.

[0088] The VPN connection unit 109 uses the VPN connection information stored in the connection information storage unit 103 to establish a VPN connection with the VPN connection destination base stored in the base information storage unit 104 .

[0089] The number information generating unit 110 generates number information of a base to which the VPN connection is made. For example, the number information of the base to which the VPN connection is made is generated by adding a predetermined value to the latest number information generated by the unit itself (when generating number information for the first time, the number information of the base A to which the unit itself belongs, which is stored in the base information storage unit 104).

[0090] The connection number notification unit 111 transmits a connection number notification including the number information of each base (its own base A and the base of the VPN connection destination) stored in the base information storage unit 104 to the slave gateway 2 connected via VPN.

[0091] The VPN connection monitor 112 periodically transmits a VPN connection confirmation to the VPN-connected slave gateway 2 and monitors the response, thereby monitoring whether the VPN connection with the slave gateway 2 is being maintained.

[0092] The destination domain notification unit 113 sends a destination domain notification including the domain name of the VPN destination base (excluding the base to which this slave gateway 2 belongs) stored in the base information storage unit 104 to the slave gateway 2 that has been additionally connected via VPN.

[0093] The main control unit 114 comprehensively controls the units 100 to 113 of the master gateway 1.

[0094] The functional configuration of the master gateway 1 shown in Fig. 10 is realized in hardware by an integrated logic IC such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array), or in software by a computer such as a DSP (Digital Signal Processor). Alternatively, it may be realized as a process by a CPU in a general-purpose computer such as a PC equipped with a CPU, a memory, an auxiliary storage device such as a hard disk or a flash memory, and a communication interface such as a NIC (Network Interface Card), by the CPU loading a predetermined program from the auxiliary storage device into the memory and executing it.

[0095] FIG. 11 is a flow diagram for explaining the operation of the master gateway 1. As shown in FIG.

[0096] First, when the main control unit 114 receives identification information from the main unit 30-1 via the main unit / maintenance terminal interface unit 100 (YES in S300), it passes this identification information to the domain generation unit 105. In response, the domain generation unit 105 generates a domain name based on this identification information and passes it to the main control unit 114. The main control unit 114 registers the domain name received from the domain generation unit 105 in the base information storage unit 104 as the domain name of its own base A (S301).

[0097] Next, when the main control unit 114 receives the setting information from the maintenance terminal 4-1 via the main unit / maintenance terminal interface unit 100 (YES in S302), a VPN connection process described below is performed (S303). As a result, a VPN connection is established between site A and the VPN connection destination site, and an internal telephone service between the sites is realized via this VPN connection.

[0098] Thereafter, the VPN connection monitor 112 periodically transmits a VPN connection confirmation to the VPN connection destination base and monitors the response to the VPN connection to monitor whether the VPN connection with this base is being maintained. If it detects that the VPN connection has been disconnected (YES in S304), a VPN reconnection process (described later) is performed (S305). This reestablishes a VPN connection between base A and this base.

[0099] Furthermore, when the main control unit 114 receives a connection number change notification from the VPN connection destination point via the network interface unit 101 (YES in S306), it returns a response to this connection number change notification to the sender of the connection number change notification via the network interface unit 101. Then, the connection number change process described later is executed (S307). This updates the number information of this point.

[0100] Furthermore, when the main control unit 114 receives a VPN connection information change notification from the VPN connection destination base via the network interface unit 101 (YES in S308), it returns a response to this VPN connection information change notification to the sender of the VPN connection information change notification via the network interface unit 101. Then, the VPN connection information change process described below is performed (S309). This updates the VPN connection information used for the VPN connection with the sender of this VPN connection information change notification. Note that if there is an error in the changed VPN connection information, it is restored to the VPN connection information before the change.

[0101] Furthermore, when the main control unit 114 receives additional setting information from the maintenance terminal 4-1 via the main unit / maintenance terminal interface unit 100 (YES in S310), a VPN additional connection process (described later) is performed (S311). As a result, a VPN connection is established between site A and the additional site that is the VPN connection destination, and an internal telephone service is realized between multiple sites including this additional site.

[0102] 12 and 13 are flow diagrams for explaining the VPN connection process (S303) in FIG.

[0103] First, the main control unit 114 registers the Internet connection information and VPN connection information contained in the setting information received from the maintenance terminal 4-1 in the connection information storage unit 103 (S3010), and also registers the number information of its own affiliated base A, which is contained in the setting information, in the base information storage unit 104 (S3011).

[0104] Next, the main control unit 114 passes the Internet connection information to the address acquisition unit 106 to instruct it to connect to the Internet 5. In response to this, the address acquisition unit 106 makes a PPPoE connection to the PPPoE server via the network interface unit 101 using the account information included in the Internet connection information, and acquires a global IP address from the PPPoE server (S3012). Then, the address acquisition unit 106 notifies the main control unit 114 of the acquired global IP address. The main control unit 114 associates the global IP address acquired by the address acquisition unit 106 with the domain name of the base A to which the address acquisition unit 106 belongs, and registers the address in the base information storage unit 104 (S3013).

[0105] Next, main control unit 114 passes address information (domain name, global IP address) of its own base A and the Internet connection information registered in connection information storage unit 103 to address registration unit 107, and instructs it to register the address information on Internet 5. In response to this, address registration unit 107 registers the address information of its own base A in the DNS server specified by the address information of the DNS server included in the Internet connection information via network interface unit 101 (S3014).

[0106] Next, the main control unit 114 passes identification information of the VPN destination base, which is included in the setting information received from the maintenance terminal 4-1, to the domain generation unit 105. In response to this, the domain generation unit 105 generates a domain name based on this identification information and passes it to the main control unit 114. The main control unit 114 registers the domain name received from the domain generation unit 105 in the base information storage unit 104 as the domain name of the VPN destination base (S3015).

[0107] Next, main control unit 114 passes the domain name of the VPN destination base and the Internet connection information registered in connection information storage unit 103 to address resolution unit 108, and instructs it to make an address query. In response to this, address resolution unit 108 transmits an address query accompanied by the designation of the domain name of the VPN destination base to the DNS server specified by the address information of the DNS server included in the Internet connection information via network interface unit 101 (S3016). Then, if the global IP address of the VPN destination base is not received from the DNS server in response to the address query (NO in S3017) and a timeout occurs due to the passage of a predetermined time (YES in S3018), the process returns to S3016, and address resolution unit 108 resends the above-mentioned address query.

[0108] On the other hand, if a global IP address of the VPN destination base is received from the DNS server in response to the address query (YES in S3017), the address resolution unit 108 passes the acquired global IP address to the main control unit 114. In response to this, the main control unit 114 associates the global IP address received from the address resolution unit 108 with the domain name of the VPN destination base, and registers it in the base information storage unit 104 (S3019).

[0109] Next, the main control unit 114 passes to the VPN connection unit 109 the global IP address of the VPN connection destination base registered in the base information storage unit 104 and the VPN connection information stored in the connection information storage unit 103, and instructs the VPN connection unit 109 to establish a VPN connection.

[0110] In response to this, the VPN connection unit 109 transmits a VPN connection information notification including the address information of its own base A and VPN connection information to the slave gateway 2 specified by the global IP address of the VPN connection destination base via the network interface unit 101 (S3020). Then, after receiving a response to the VPN connection information notification from the slave gateway 2 of the VPN connection destination base, the VPN connection unit 109 establishes a VPN connection with this slave gateway 2 using the VPN connection information included in the VPN connection information notification transmitted to this slave gateway 2 (S3021).

[0111] Next, the main control unit 114 passes the number information of the bases stored in the base information storage unit 104 (at this point, only the number information of the base A to which the main control unit 114 belongs) to the connection number notifying unit 111, and instructs the connection number notifying unit 111 to notify the connection number. In response to this, the connection number notifying unit 111 transmits a connection number notification including the base number information received from the main control unit 114 to the main unit 30-1 via the main unit / maintenance terminal interface unit 100, and also transmits it to the base of the VPN connection destination via the network interface unit 101 (S3022). Thereafter, the unit waits for a connection number request to be sent from the base of the VPN connection destination via the network interface unit 101 (S3023).

[0112] When the main control unit 114 receives a connection number request from the VPN connection destination base (YES in S3023), it passes the number information with the largest value among the number information stored in the base information storage unit 104 to the number information generation unit 110 and instructs it to generate number information. In response to this, the number information generation unit 110 generates new number information by adding a predetermined value to the number information received from the main control unit 114, and passes this number information to the main control unit 114. At this point, since only the number information of the base A is stored in the base information storage unit 104, the main control unit 114 passes the number information of the base A to the number information generation unit 110 and instructs it to generate number information, and the number information generation unit 110 generates new number information based on the number information of the base A. The main control unit 114 registers the number information received from the number information generation unit 110 in the base information storage unit 104 as the number information of the VPN connection destination base that is the source of the connection number request (S3024).

[0113] Next, the main control unit 114 passes the number information of each base stored in the base information storage unit 104 (the number information of its own base A and the base of the VPN connection destination) to the connection number notification unit 111 to instruct notification of the connection number. In response to this, the connection number notification unit 111 transmits the connection number notification including the number information of each base received from the main control unit 114 to the main unit 30-1 via the main unit / maintenance terminal interface unit 100, and also transmits it to the base of the VPN connection destination via the network interface unit 101 (S3025). Then, the process proceeds to S304 in FIG. 11.

[0114] FIG. 14 is a flow diagram for explaining the VPN reconnection process (S305) of FIG.

[0115] First, the main control unit 114 deletes the global IP address and number information of the VPN destination base where the disconnection of the VPN connection was detected from the base information storage unit 104 (S3050).

[0116] Then, main control unit 114 reads out the domain name of the VPN destination base where the disconnection of the VPN connection was detected from base information storage unit 104, and passes this domain name together with the Internet connection information stored in connection information storage unit 103 to address resolution unit 108 to instruct an address query. In response to this, address resolution unit 108 transmits an address query accompanied by the designation of the domain name of the VPN destination base to the DNS server specified by the address information of the DNS server included in the Internet connection information via network interface unit 101 (S3051). Then, if the global IP address of the VPN destination base is not received from the DNS server in response to the address query (NO in S3052) and a timeout occurs due to the passage of a predetermined time (YES in S3053), the process returns to S3051, and address resolution unit 108 resends the above-mentioned address query.

[0117] On the other hand, if a global IP address of the VPN destination base is received from the DNS server in response to the address query (YES in S3052), the address resolution unit 108 passes the acquired global IP address to the main control unit 114. In response to this, the main control unit 114 associates the global IP address received from the address resolution unit 108 with the domain name of the VPN destination base and registers it in the base information storage unit 104 (S3054).

[0118] Next, the main control unit 114 passes to the VPN connection unit 109 the global IP address of the VPN connection destination base registered in the base information storage unit 104 and the VPN connection information stored in the connection information storage unit 103, and instructs the VPN connection unit 109 to establish a VPN connection.

[0119] In response to this, the VPN connection unit 109 transmits a VPN connection information notification including the address information of its own base A and VPN connection information to the slave gateway 2 specified by the global IP address of the VPN connection destination base via the network interface unit 101 (S3055). Then, after receiving a response to the VPN connection information notification from the slave gateway 2 of the VPN connection destination base, the VPN connection unit 109 establishes a VPN connection with this slave gateway 2 using the VPN connection information included in the VPN connection information notification transmitted to this slave gateway 2 (S3056).

[0120] Thereafter, steps S3022 to S3025 shown in FIG. 13 are carried out (S3057), and then the process proceeds to S306 in FIG.

[0121] FIG. 15 is a flow diagram for explaining the connection number change process (S307) in FIG.

[0122] First, the main control unit 114 updates the number information of the VPN connection destination base that is the sender of the connection number change notification, among the base number information stored in the base information storage unit 104, to the number information included in this connection number change notification (S3070).

[0123] Next, main control unit 114 passes the number information of each base stored in base information storage unit 104 (including the updated number information of the base of the VPN connection destination) to connection number notification unit 111 to instruct notification of the connection number. In response to this, connection number notification unit 111 transmits the connection number notification including the number information of each base received from main control unit 114 to main unit 30-1 via main unit / maintenance terminal interface unit 100, and also transmits it to the base of the VPN connection destination via network interface unit 101 (S3071). Then, proceed to S308 in FIG. 11.

[0124] FIG. 16 is a flow diagram for explaining the VPN connection information change process (S309) of FIG.

[0125] First, the main control unit 114 registers the VPN connection information used for the VPN connection with the sender of the VPN connection information change notification in the connection information storage unit 103 as restoration VPN connection information with the sender of the VPN connection information change notification, and also registers the VPN connection information included in the VPN connection information change notification as VPN connection information with the sender of the VPN connection information change notification in the connection information storage unit 103. Here, if the VPN connection information with the sender of the VPN connection information change notification is already stored in the connection information storage unit 103, the VPN connection information with the sender of the VPN connection information change notification is updated to the VPN connection information included in the VPN connection information change notification (S3090).

[0126] Next, main control unit 114 passes the global IP address of the sender of the VPN connection information change notification and the VPN connection information contained in the VPN connection information change notification to VPN connecting unit 109, and instructs it to reconnect the VPN.

[0127] In response to this, the VPN connection unit 109 disconnects the VPN connection with the slave gateway 2 identified by the global IP address of the sender of the VPN connection information change notification, and then re-establishes a VPN connection with this slave gateway 2 using the VPN connection information received from the main control unit 114 (VPN connection information included in the VPN connection information change notification) (S3091).

[0128] Here, if the VPN reconnection using the VPN connection information included in the VPN connection information change notification is successful (YES in S3092), the process proceeds to S310 in FIG.

[0129] On the other hand, if there is an error in this VPN connection information (for example, an unsupported encryption method is specified, the number of digits in the key information is not the prescribed number, etc.) and VPN reconnection using this VPN connection information fails (NO in S3092), main control unit 114 restores the VPN connection information with the sender of the VPN connection information change notification stored in connection information storage unit 103 (S3093). That is, it deletes the VPN connection information with the sender of the VPN connection information change notification stored in connection information storage unit 103, and changes the restoration VPN connection information with the sender of the VPN connection information change notification stored in connection information storage unit 103 to the VPN connection information with the sender of the VPN connection information change notification.

[0130] Then, the main control unit 114 passes to the VPN connection unit 109 the global IP address of the sender of the VPN connection information change notification and the VPN connection information with the sender of the VPN connection information change notification stored in the connection information storage unit 103, and instructs the VPN connection unit 109 to establish a VPN connection.

[0131] In response to this, the VPN connection unit 109 transmits a VPN connection information notification including VPN connection information with the sender of the VPN connection information change notification to the slave gateway 2 identified by the global IP address of the sender of the VPN connection information change notification via the network interface unit 101 (S3094). Then, after receiving a response to the VPN connection information notification from the slave gateway 2 that sent the VPN connection information change notification, the VPN connection unit 109 re-establishes a VPN connection with this slave gateway 2 using the VPN connection information included in the VPN connection information notification sent to this slave gateway 2 (S3095). Then, proceed to S310 in Fig. 11.

[0132] 17 and 18 are flow diagrams for explaining the VPN additional connection process (S311) of FIG.

[0133] First, the main control unit 114 passes identification information of the additional base of the new VPN connection destination, which is included in the additional setting information received from the maintenance terminal 4-1, to the domain generation unit 105. In response to this, the domain generation unit 105 generates a domain name based on this identification information, and passes this domain name to the main control unit 114. The main control unit 114 registers the domain name received from the domain generation unit 105 in the base information storage unit 104 as the domain name of the additional base of the VPN connection destination (S3110).

[0134] Next, main control unit 114 passes the domain name of the additional base to which the VPN is connected and the Internet connection information stored in connection information storage unit 103 to address resolution unit 108, and instructs the address resolution unit 108 to make an address query. In response to this, address resolution unit 108 transmits an address query accompanied by the designation of the domain name of the additional base to which the VPN is connected, to the DNS server specified by the address information of the DNS server included in the Internet connection information, via network interface unit 101 (S3111). Then, if the global IP address of the additional base to which the VPN is connected is not received from the DNS server in response to the address query (NO in S3112) and a timeout occurs due to the passage of a predetermined time (YES in S3113), the process returns to S3111, and address resolution unit 108 resends the above-mentioned address query.

[0135] On the other hand, if a global IP address of the additional base to which the VPN is connected is received from the DNS server in response to the address query (YES in S3112), the address resolution unit 108 passes the acquired global IP address to the main control unit 114. In response to this, the main control unit 114 associates the global IP address received from the address resolution unit 108 with the domain name of the additional base to which the VPN is connected, and registers it in the base information storage unit 104 (S3114).

[0136] Next, the main control unit 114 passes to the VPN connection unit 109 the global IP address of the additional base to which the VPN connection is to be made, which is registered in the base information storage unit 104, and the VPN connection information stored in the connection information storage unit 103, and instructs the VPN connection unit 109 to make a VPN connection.

[0137] In response to this, the VPN connection unit 109 transmits a VPN connection information notification including the address information of its own base A and VPN connection information to the slave gateway 2 specified by the global IP address of the additional base to which the VPN is connected via the network interface unit 101 (S3115). Then, after receiving a response to the VPN connection information notification from the slave gateway 2 of the additional base to which the VPN is connected, the VPN connection unit 109 establishes a VPN connection with this slave gateway 2 using the VPN connection information included in the VPN connection information notification transmitted to this slave gateway 2 (S3116).

[0138] Next, the main control unit 114 passes the number information of each base stored in the base information storage unit 104 (the number information of its own base A and the number information of the base of the VPN connection destination) to the connection number notification unit 111, and instructs it to notify the connection number. In response to this, the connection number notification unit 111 transmits the connection number notification including the number information of each base received from the main control unit 114 to the additional base of the VPN connection destination via the network interface unit 101 (S3117). Thereafter, it waits for a connection number request to be sent from the additional base of the VPN connection destination via the network interface unit 101 (S3118).

[0139] Then, when main control unit 114 receives a connection number request from an additional base of the VPN connection destination (YES in S3118), it passes the largest number information value among the number information stored in base information storage unit 104 to number information generation unit 110 and instructs it to generate number information. In response to this, number information generation unit 110 generates new number information by, for example, adding a predetermined value to the number information received from main control unit 114, and passes this number information to main control unit 114. Main control unit 114 registers the number information received from number information generation unit 110 in base information storage unit 104 as number information of the additional base of the VPN connection destination that is the source of the connection number request (S3119).

[0140] Next, the main control unit 114 passes the number information of each base stored in the base information storage unit 104 (the number information of its own base A, the base of the VPN connection destination, and the additional base of the VPN connection destination) to the connection number notifying unit 111 to instruct notification of the connection number. In response to this, the connection number notifying unit 111 transmits a connection number notification including the number information of each base received from the main control unit 114 to the main unit 30-1 via the main unit / maintenance terminal interface unit 100, and also transmits it to the additional base of the VPN connection destination via the network interface unit 101 (S3120). Then, the connection number notifying unit 111 receives a response to the connection number notification from the additional base of the VPN connection destination.

[0141] Next, the main control unit 114 passes the domain name of the VPN destination base stored in the base information storage unit 104 to the destination domain notifying unit 113 to instruct the notification of the destination domain. In response to this, the destination domain notifying unit 113 transmits the destination domain notification including the domain name of the VPN destination base received from the main control unit 114 to the additional VPN destination base via the network interface unit 101 (S3121). Thereafter, the destination domain notifying unit 113 receives a response to the destination domain notification from the additional VPN destination base, and proceeds to S304 in FIG. 11.

[0142] Next, the slave gateway 2 will be described in detail.

[0143] FIG. 19 is a schematic functional configuration diagram of the slave gateway 2.

[0144] As shown in the figure, the slave gateway 2 includes a main unit / maintenance terminal interface unit 200, a network interface unit 201, a relay unit 202, a connection information storage unit 203, a base information storage unit 204, a domain generation unit 205, an address acquisition unit 206, an address registration unit 207, an address resolution unit 208, a VPN connection unit 209, a connection number request unit 210, a VPN connection monitoring unit 211, a VPN connection information notification unit 212, and a main control unit 213.

[0145] The main unit / maintenance terminal interface unit 200 is an interface for connecting to the main units 30-2, 30-3 and the maintenance terminals 4-2, 4-3 (in the case of the slave gateway 2-1, the main unit 30-2 and the maintenance terminal 4-2; in the case of the slave gateway 2-2, the main unit 30-3 and the maintenance terminal 4-3), and the network interface unit 201 is an interface for connecting to the Internet 5.

[0146] The relay unit 202 relays between the main unit / maintenance terminal interface unit 200 and the network interface unit 201. This connects the IP telephone systems 3-2 and 3-3 (the IP telephone system 3-2 in the case of the slave gateway 2-1, and the IP telephone system 3-3 in the case of the slave gateway 2-2) to the Internet 5.

[0147] The connection information memory unit 203 stores Internet connection information (DNS server address information, account information, etc.) of the user's own base (base B in the case of the slave gateway 2-1, base C in the case of the slave gateway 2-2) and VPN connection information (VPN connection method, IPSec information, encryption method, key information, etc.).

[0148] The base information storage unit 204 stores address information (domain name, global IP address) and number information of the base to which the user belongs. The base information storage unit 204 also stores address information and number information of bases to which the user is connected via VPN, including the base A to which the master gateway 1 belongs.

[0149] The domain generating unit 205 generates a domain name based on the identification information of the base where the user belongs. For example, the domain name is generated by adding a predetermined top level domain to the identification information.

[0150] An address acquisition unit 206 establishes a PPPoE connection to a PPPoE server using the Internet connection information stored in the connection information storage unit 203, and acquires the global IP address of the base to which the user belongs from the PPPoE server.

[0151] An address registration unit 207 uses the Internet connection information stored in the connection information storage unit 203 to register the address information of the base, including the domain name and global IP address of the base to which the user belongs, in a DNS server.

[0152] Using the Internet connection information stored in the connection information memory unit 203, the address resolution unit 208 sends an address query specifying the domain name of the base to which the VPN is connected to the DNS server, and obtains the global IP address of this base from the DNS server.

[0153] The VPN connection unit 209 uses the VPN connection information stored in the connection information storage unit 203 to establish a VPN connection with the VPN connection destination base stored in the base information storage unit 204 .

[0154] The connection number request unit 210 transmits a connection number request to the master gateway 1 connected via VPN, and receives from the master gateway 1 a connection number notification including the number information of the base to which the device belongs.

[0155] The VPN connection monitor 211 periodically transmits a VPN connection confirmation to the master gateway 1 and monitors the response thereto, thereby monitoring whether the VPN connection with the master gateway 1 is being maintained.

[0156] The VPN connection information notification unit 212 transmits a VPN connection information notification including the VPN connection information stored in the connection information storage unit 203 to the slave gateway 2 that has been additionally connected via VPN.

[0157] The main control unit 213 comprehensively controls the units 200 to 212 of the slave gateway 2.

[0158] The functional configuration of the slave gateway 2 shown in Fig. 19 is also realized in hardware by an integrated logic IC such as an ASIC or FPGA, or in software by a computer such as a DSP, like the functional configuration of the master gateway 1 shown in Fig. 10. Alternatively, it may be realized as a process by a CPU in a general-purpose computer such as a PC equipped with a CPU, memory, an auxiliary storage device such as a hard disk or flash memory, and a communication interface such as a NIC, by the CPU loading a predetermined program from the auxiliary storage device into the memory and executing it.

[0159] FIG. 20 is a flow diagram for explaining the operation of the slave gateway 2.

[0160] First, when the main control unit 213 receives identification information from a subordinate main unit (main unit 30-2 in the case of the slave gateway 2-1, main unit 30-3 in the case of the slave gateway 2-2) via the main unit / maintenance terminal interface unit 200 (YES in S400), a VPN connection process described below is performed (S401). As a result, the slave gateway 2 and the master gateway 1 are connected via VPN, and an extension telephone service between the bases is realized via this VPN connection.

[0161] Thereafter, the VPN connection monitor 211 periodically transmits a VPN connection confirmation to the VPN-connected master gateway 1 and monitors the response, thereby monitoring whether the VPN connection with the master gateway 1 is maintained. When it detects that the VPN connection has been disconnected (YES in S402), a VPN reconnection process described below is performed (S403). This reestablishes a VPN connection between the slave gateway 2 and the master gateway 1.

[0162] Furthermore, when the main control unit 213 receives number information from a subordinate maintenance terminal (maintenance terminal 4-2 in the case of the slave gateway 2-1, or maintenance terminal 4-3 in the case of the slave gateway 2-2) via the main unit / maintenance terminal interface unit 200 (YES in S404), a connection number change process described later is performed (S405). This updates the number information of the base to which the slave gateway 2 belongs.

[0163] Furthermore, when the main control unit 213 receives setting information including VPN connection information from the subordinate maintenance terminals 4-2, 4-3 via the main unit / maintenance terminal interface unit 200 (YES in S406), it executes a VPN connection information change process (S407) which will be described later. This updates the VPN connection information used for the VPN connection. If there is an error in the changed VPN connection information, it is restored to the VPN connection information before the change.

[0164] Furthermore, when the main control unit 213 receives a destination domain notification from the master gateway 1 via the network interface unit 201 (YES in S408), it returns a response to this destination domain notification to the master gateway 1, and then the first VPN additional connection process described below is performed (S409). As a result, a VPN connection is established between the base having the domain name included in the destination domain notification and the base itself, and an internal telephone service is realized between multiple bases including the base and the base itself.

[0165] Furthermore, when the main control unit 213 receives a VPN connection information notification from another slave gateway 2 (slave gateway 2 of an added site) via the network interface unit 201 (YES in S410), it returns a response to this VPN connection information notification to the other slave gateway 2, and then a second VPN additional connection process, which will be described later, is performed (S411). As a result, a VPN connection is established between the site (added site) to which the VPN connection information notification was sent and the own site, and an internal telephone service is realized between multiple sites including the added site and the own site.

[0166] 21 and 22 are flow diagrams for explaining the VPN connection process (S401) of FIG.

[0167] First, the main control unit 213 passes the identification information received from the subordinate main devices 30-1 and 30-2 to the domain generation unit 205. In response to this, the domain generation unit 205 generates a domain name based on this identification information and passes this domain name to the main control unit 213. The main control unit 213 registers the domain name received from the domain generation unit 205 in the base information storage unit 204 as the domain name of its own base (base B in the case of the slave gateway 2-1, base C in the case of the slave gateway 2-2) (S4010).

[0168] Thereafter, the main control unit 213 waits for setting information to be sent from the subordinate maintenance terminals 4-2, 4-3 via the main device / maintenance terminal interface unit 200 (S4011). Then, when the main control unit 213 receives setting information from the subordinate maintenance terminals 4-2, 4-3 (YES in S4011), it registers the Internet connection information included in this setting information in the connection information storage unit 203 (S4012).

[0169] Next, the main control unit 213 passes the Internet connection information registered in the connection information storage unit 203 to the address acquisition unit 206, and instructs it to connect to the Internet 5. In response to this, the address acquisition unit 206 makes a PPPoE connection to the PPPoE server via the network interface unit 201 using the account information included in the Internet connection information, and acquires a global IP address from the PPPoE server (S4013). Then, it notifies the main control unit 213 of the acquired global IP address. The main control unit 213 associates the global IP address acquired from the address acquisition unit 206 with the domain name of the base to which the main control unit 213 belongs, and registers it in the base information storage unit 204 (S4014).

[0170] Next, main control unit 213 passes the address information of its own base and the Internet connection information registered in connection information storage unit 203 to address registration unit 207, and instructs it to register the address information to Internet 5. In response to this, address registration unit 207 registers the address information of its own base in the DNS server specified by the address information of the DNS server included in the Internet connection information via network interface unit 201 (S4015).

[0171] Then, the main control unit 213 waits for a VPN connection information notification to be sent from the master gateway 1 via the network interface unit 201 (S4016). Then, when the main control unit 213 receives the VPN connection information notification from the master gateway 1 (YES in S4016), it returns a response to this VPN connection information notification to the master gateway 1, and registers the address information of the base A to which the master gateway 1 belongs and the VPN connection information contained in this VPN connection information notification in the base information storage unit 204 and the connection information storage unit 203, respectively (S4017).

[0172] Next, the main control unit 213 instructs the VPN connection unit 209 to establish a VPN connection by passing the global IP address included in the address information of site A registered in the site information storage unit 204 and the VPN connection information registered in the connection information storage unit 203. In response to this, the VPN connection unit 209 uses the VPN connection information received from the main control unit 213 to establish a VPN connection to the master gateway 1 specified by the global IP address received from the main control unit 213 together with this VPN connection information (S4018).

[0173] Next, when the connection number request unit 210 receives a connection number notification from the VPN-connected master gateway 1 (YES in S4019), it returns a response to this connection number notification to the master gateway 1 and passes this connection number notification to the main control unit 213. In response to this, the main control unit 213 registers the number information of the base (base A to which the master gateway 1 belongs) included in this connection number notification in the base information storage unit 204 (S4020).

[0174] Also, the connection number request unit 210 transfers the connection number notification received from the master gateway 1 to the subordinate main units 30-2 and 30-3 via the main unit / maintenance terminal interface unit 200 (S4021).

[0175] Next, the main control unit 213 confirms that the connection number notification received from the master gateway 1 does not include number information of its own base, and instructs the connection number request unit 210 to obtain a connection number. In response to this, the connection number request unit 210 transmits a connection number request to the VPN-connected master gateway 1 (S4022). Then, it waits for the connection number notification to be sent from the master gateway 1 (S4023).

[0176] When the connection number request unit 210 receives a connection number notification from the VPN-connected master gateway 1 (YES in S4023), it returns a response to this connection number notification to the master gateway 1 and passes this connection number notification to the main control unit 213. In response to this, the main control unit 213 registers the number information of each base (base A to which the master gateway 1 belongs and its own base) included in this connection number notification in the base information storage unit 204 (S4024).

[0177] Moreover, the connection number request unit 210 transfers the connection number notification received from the master gateway 1 to the subordinate main units 30-2 and 30-3 via the main unit / maintenance terminal interface unit 200 (S4025).

[0178] FIG. 23 is a flow diagram for explaining the VPN reconnection process (S403) of FIG.

[0179] First, the main control unit 213 deletes the global IP address and number information of the base A to which the master gateway 1 belongs from the base information storage unit 204 (S4030).

[0180] Next, the main control unit 213 waits for a VPN connection information notification to be sent from the master gateway 1 via the network interface unit 201 (S4031). Then, when the main control unit 213 receives the VPN connection information notification from the master gateway 1 (YES in S4031), it returns a response to this VPN connection information notification to the master gateway 1, and registers the global IP address and VPN connection information of the base (base A to which the master gateway 1 belongs) included in this VPN connection information notification in the base information storage unit 204 and the connection information storage unit 203, respectively (S4032).

[0181] Next, the main control unit 213 instructs the VPN connection unit 209 to establish a VPN connection by passing the global IP address of site A registered in the site information storage unit 204 and the VPN connection information registered in the connection information storage unit 203. In response to this, the VPN connection unit 209 uses the VPN connection information received from the main control unit 213 to establish a VPN connection with the master gateway 1 specified by the global IP address received from the main control unit 213 together with this VPN connection information (S4033).

[0182] Thereafter, steps S4019 to S4025 in FIG. 22 are carried out (S4031), and then the process proceeds to S404 in FIG.

[0183] FIG. 24 is a flow diagram for explaining the connection number change process (S405) in FIG.

[0184] First, the main control unit 213 passes the number information received from the subordinate maintenance terminals 4-2 and 4-3 to the connection number request unit 210 and instructs it to send a connection number change notification. In response to this, the connection number request unit 210 transmits a connection number change notification including the number information received from the main control unit 213 to the VPN-connected master gateway 1 (S4050).

[0185] Next, when the connection number request unit 210 receives the connection number notification from the master gateway 1 (YES in S4051), it passes this connection number notification to the main control unit 213. In response to this, the main control unit 213 registers (updates) the number information of each base, including the base A to which the master gateway 1 belongs and its own base, contained in this connection number notification, in the base information storage unit 204 (S4052).

[0186] Moreover, the connection number request unit 210 transmits the connection number notification received from the master gateway 1 to the subordinate main units 30-2 and 30-3 via the main unit / maintenance terminal interface unit 200 (S4053).

[0187] FIG. 25 is a flow diagram for explaining the VPN connection information change process (S407) of FIG.

[0188] First, the main control unit 213 registers the VPN connection information included in the setting information received from the subordinate maintenance terminals 4-2 and 4-3 in the connection information storage unit 203 as the VPN connection information to be used for the VPN connection with the master gateway 1. If the VPN connection information with the master gateway 1 is already stored in the connection information storage unit 203, this VPN connection information is updated to the VPN connection information included in the setting information received from the subordinate maintenance terminals 4-2 and 4-3 (S4070).

[0189] Next, the main control unit 213 passes the global IP address of the master gateway 1 and the VPN connection information contained in the setting information received from the subordinate maintenance terminals 4-2 and 4-3 to the VPN connecting unit 209, and instructs the VPN connecting unit 209 to reconnect.

[0190] In response to this, the VPN connection unit 209 disconnects the VPN connection with the master gateway 1, and then re-establishes a VPN connection with the master gateway 1 using the VPN connection information received from the main control unit 213 (VPN connection information included in the setting information received from the subordinate maintenance terminals 4-2 and 4-3) (S4072).

[0191] Here, if the VPN reconnection using the VPN connection information received from the main control unit 213 is successful (YES in S4072), the process proceeds to S408 in FIG.

[0192] On the other hand, if there is an error in this VPN connection information (for example, an unsupported encryption method is specified, the number of digits in the key information is not the prescribed number, etc.) and the VPN reconnection using this VPN connection information fails (NO in S4072), the main control unit 213 waits for a VPN connection information notification to be sent from the master gateway 1 (S4073). Then, if a VPN connection information notification is received from the master gateway 1 (YES in S4073), the main control unit 213 returns a response to the VPN connection information notification to the master gateway 1, and updates the VPN connection information with the master gateway 1 stored in the connection information storage unit 203 to the VPN connection information included in the VPN connection information notification (S4074).

[0193] Then, the main control unit 213 passes the global IP address of the master gateway 1 and the VPN connection information with the master gateway 1 stored in the connection information storage unit 203 to the VPN connection unit 209, and instructs the VPN connection.

[0194] In response to this, the VPN connection unit 209 re-establishes a VPN connection with the master gateway 1 using the VPN connection information passed from the main control unit 213 (S4075). After that, the process proceeds to S408 in FIG.

[0195] FIG. 26 is a flow diagram for explaining the first VPN additional connection process (S409) of FIG.

[0196] First, the main control unit 213 registers in the base information storage unit 204 the domain name of the VPN destination base included in the destination domain notification received from the master gateway 1, in association with the number information of the VPN destination base already registered in the base information storage unit 204 (S4090).

[0197] Next, main control unit 213 passes to address resolution unit 208 the domain name of the VPN destination base newly registered in base information storage unit 204 and the Internet connection information stored in connection information storage unit 103, and instructs the address resolution unit 208 to perform an address query. In response to this, address resolution unit 208 transmits an address query accompanied by the designation of the domain name of the VPN destination base to the DNS server specified by the address information of the DNS server included in the Internet connection information via network interface unit 201 (S4091). Then, if the global IP address of the VPN destination base is not received from the DNS server in response to the address query (NO in S4092) and a timeout occurs due to the passage of a predetermined time (YES in S4093), the process returns to S4091, and address resolution unit 208 resends the above-mentioned address query.

[0198] On the other hand, if the global IP address of the VPN destination base is received from the DNS server in response to the address query (YES in S4092), the address resolution unit 208 passes the acquired global IP address to the main control unit 213. In response to this, the main control unit 213 links the global IP address of the VPN destination base received from the address resolution unit 208 to the domain name and number information of this VPN destination base stored in the base information storage unit 204, and registers it in the base information storage unit 204 (S4094).

[0199] Next, the main control unit 213 passes the global IP address of the VPN connection destination base registered in the base information storage unit 204 and the VPN connection information stored in the connection information storage unit 203 to the VPN connection unit 209, and instructs the VPN connection.

[0200] In response to this, the VPN connection unit 209 transmits a VPN connection information notification including the address information of its own base (additional base) and VPN connection information to the slave gateway 2 specified by the global IP address of the VPN connection destination base via the network interface unit 201 (S4095). Then, after receiving a response to the VPN connection information notification from the slave gateway 2 of this VPN connection destination base, the VPN connection unit 209 establishes a VPN connection with this slave gateway 2 using the VPN connection information included in the VPN connection information notification transmitted to this slave gateway 2 (S4096). Then, proceed to S410 in Fig. 20.

[0201] FIG. 27 is a flow diagram for explaining the second VPN additional connection process (S411) of FIG.

[0202] First, the main control unit 213 stores the VPN connection information contained in the VPN connection information notification received from another slave gateway 2 in the connection information storage unit 203 as VPN connection information with the affiliated base (additional base) of this slave gateway 2, and registers the address information (domain name and global IP address) of this slave gateway 2 in the base information storage unit 204, linking it to the number information of the additional base already registered in the base information storage unit 204 (S4110).

[0203] Next, the main control unit 213 passes to the VPN connection unit 209 the global IP address of the additional base registered in the base information storage unit 204 and VPN connection information with the additional base registered in the connection information storage unit 203, and instructs the VPN connection.

[0204] In response to this, the VPN connection unit 209 uses the VPN connection information received from the main control unit 213 to establish a VPN connection with another slave gateway 2 specified by the global IP address received from the main control unit 213 (S4111). After that, the process proceeds to S404 in FIG.

[0205] One embodiment of the present invention has been described above.

[0206] According to this embodiment, setting information including Internet connection information, VPN connection information, number information, and identification information of location B to which the VPN connection is made is transmitted from the maintenance terminal 4-1 to the master gateway 1, and setting information including Internet connection information of location B to which the slave gateway 2-1 belongs is transmitted from the maintenance terminal 4-2 to the slave gateway 2-1. This makes it possible to realize an internal telephone service between locations A and B by establishing a VPN connection between the IP telephone systems 3-1 and 3-2 constructed at locations A and B to which the master gateway 1 and the slave gateway 2-1 belong, respectively, without providing a separate management server.

[0207] Furthermore, in this embodiment, the master gateway 1 monitors the VPN connection state with the slave gateway 2 connected via VPN, and when it detects that the VPN connection with this slave gateway 2 has been disconnected, it sends an address query with the specification of the domain name of the base to which this slave gateway 2 belongs to a DNS server, and acquires the global IP address of this base from the DNS server. Then, it sends a VPN connection information notification to the slave gateway 2 specified by the acquired global IP address, and re-establishes a VPN connection with this slave gateway 2. Therefore, according to this embodiment, even if the slave gateway 2 is replaced due to a failure of the slave gateway 2 or the like, the master gateway 1 can automatically establish a VPN connection with the replaced slave gateway 2, improving convenience.

[0208] In addition, in this embodiment, when the slave gateway 2 receives new number information as the number information of its own base from the maintenance terminals 4-2, 4-3 of its own base, it transmits a connection number change notification including this new number information to the VPN-connected master gateway 1. In response to this, the master gateway 1 transmits a connection number change notification including the new number information contained in this connection number change notification as the number information of the base of the slave gateway 2 that sent the connection number change notification to the slave gateways 2 of each VPN-connected base and the main unit 30-1 of the IP telephone system 3-1 constructed at its own base A. Therefore, according to this embodiment, when the number information of the base of the slave gateway 2 is changed to new number information, it is possible to reflect the new number information in the IP telephone systems 3-1 to 3-3 of each base by simply transmitting the new number information from the maintenance terminals 4-2, 4-3 to the slave gateway 2 within this base, which further improves convenience.

[0209] Furthermore, in this embodiment, when the slave gateway 2 receives new VPN connection information from the maintenance terminals 4-2, 4-3 of its own base, it transmits a VPN connection information change notification including this new VPN connection information to the master gateway 1 to which it is connected via VPN. Then, it disconnects the VPN connection with the master gateway 1, and re-establishes a VPN connection with the master gateway 1 using this new VPN connection information. If the VPN connection with the master gateway 1 using this new VPN connection information fails, it receives a VPN connection information notification from the master gateway 1, and establishes a VPN connection with the master gateway 1 using the VPN connection information included in this VPN connection information notification.

[0210] On the other hand, when the master gateway 1 receives a VPN connection information change notification from the VPN-connected slave gateway 2, it disconnects the VPN connection with this slave gateway 2 and re-establishes a VPN connection with this slave gateway 2 using the VPN connection information included in this VPN connection information change notification. If the VPN connection with the slave gateway 2 using the VPN connection information included in the VPN connection information change notification fails, the master gateway 1 transmits to the slave gateway 2 a VPN connection information notification including the VPN connection information that was used up until that point in the VPN connection established with this slave gateway 2, and establishes a VPN connection with this slave gateway 2 using this VPN connection information. Therefore, according to this embodiment, even if there is an error in the new VPN connection information, it is possible to establish a VPN connection between the master gateway 1 and the slave gateway 2, improving convenience.

[0211] In this embodiment, the master gateway 1 generates a domain name for the additional site C based on the identification information of the additional site C of the VPN connection destination included in the additional setting information received from the maintenance terminal 4-1 of the base A of the master gateway 1, and obtains the global IP address of the additional site C of the VPN connection destination linked to this domain name from the DNS server. Then, the master gateway 1 transmits a VPN connection information notification to the slave gateway 2-2 specified by the global IP address of the additional site C of the VPN connection destination, and establishes a VPN connection with the slave gateway 2-2 using the VPN connection information included in the VPN connection information notification. Also, the master gateway 1 generates number information of the additional site C of the VPN connection destination according to a connection number request received from the VPN-connected slave gateway 2-2. Then, the master gateway 1 transmits a connection number notification including the number information of the base A of the master gateway 1, the base B of the VPN connection destination, and the additional site C of the VPN connection destination to the slave gateways 2-1 and 2-2 specified by the global IP addresses of the base B of the VPN connection destination and the additional site C of the VPN connection destination, respectively, and to the main unit 30-1 of the IP telephone system 3-1 constructed in the base A of the master gateway 1. Furthermore, the master gateway 1 transmits a destination domain notification including the domain name of the VPN destination point B to the slave gateway 2-2 specified by the global IP address of the VPN destination point C.

[0212] Meanwhile, the slave gateway 2-2 of the additional site C acquires from the Internet a global IP address linked to the domain name of the VPN connection destination site B contained in the destination domain notification received from the master gateway 1, and transmits a VPN connection information notification containing VPN connection information to another slave gateway 2-1 identified by this global IP address. Then, using the VPN connection information contained in this VPN connection information notification, the slave gateway 2-1 establishes a VPN connection with this other slave gateway 2-1. Furthermore, when the slave gateway 2-1 receives a VPN connection information notification from another slave gateway 2-2, it establishes a VPN connection with the slave gateway 2-2 that sent the VPN connection information notification, using the VPN connection information contained in this VPN connection information notification.

[0213] As described above, according to this embodiment, by transmitting setting information including identification information of the additional base to which the VPN is connected from the maintenance terminal 4-1 to the master gateway 1, and transmitting setting information including Internet connection information of the additional base from the maintenance terminal 4-3 at the additional base to the slave gateway 2-2, in addition to the VPN connection between the master gateway 1 and the slave gateway 2-1, a VPN connection can be established between the master gateway 1 and the slave gateway 2-2 of the additional base, and between the slave gateway 2-1 and the slave gateway 2-2 of the additional base, thereby realizing an internal telephone service between multiple bases A to C including the additional base.

[0214] The present invention is not limited to the above-described embodiment, and various modifications are possible within the scope of the present invention.

[0215] For example, in the VPN connection process S303 shown in Figures 12 and 13, when the master gateway 1 establishes a VPN connection with the slave gateway 2 at the VPN connection destination site (S3021), it transmits a connection number notification to the slave gateway 2 (S3022) prior to receiving a connection number request from the slave gateway 2 (S3023). However, the present invention is not limited to this. The transmission of the connection number notification prior to receiving the connection number request may be omitted.

[0216] 17 and 18, the master gateway 1 may include address information (domain name and global IP address) of the VPN destination base in the destination domain notification sent to the slave gateway 2 of the additional base. By doing so, the slave gateway 2 of the additional base can omit the processes (S4091 to S4093) of sending an address query accompanied by the specification of the domain name of the VPN destination base to the DNS server and acquiring the global IP address of the VPN destination base from the DNS server in the first VPN additional connection process S409 shown in FIG.

[0217] Also, in the VPN additional connection processing S311 shown in Figures 17 and 18, the master gateway 1 transmits a connection number notification (S3120) and a destination domain notification (S3121) to the slave gateway 2 of the additional point of the VPN connection destination, but the contents of the destination domain notification may be included in the connection number notification. [Explanation of symbols]

[0218] 1: Master Gateway 2, 2-1, 2-2: Slave Gateways 3-1~3-3: IP telephone system 4-1~4-3: Maintenance terminal 5: Internet 30-1 to 30-3: Main unit 31-1~31-3: IP phone 32-1~32-3: LAN 100: Main unit / maintenance terminal interface section 101: Network interface unit 102: Relay unit 103: Connection information storage unit 104: Site information storage unit 105: Domain generation section 106: Address acquisition section 107: Address registration unit 108: Address resolution unit 109: VPN connection unit 110: Number information generation unit 111: Connection number notification unit 112: VPN connection monitoring unit 113: destination domain notification unit 114: main control unit 200: Main unit / maintenance terminal interface section 201: Network interface unit 202: relay unit 203: connection information storage unit 204: location information storage unit 205: Domain generation section 206: Address acquisition section 207: Address registration unit 208: Address resolution unit 209: VPN connection section 210: Connection number request section 211: VPN connection monitoring unit 212: VPN connection information notification unit 213: Main control unit

Claims

1. A VPN system that connects IP (Internet Protocol) telephone systems established at each base via a VPN (Virtual Private Network), a master gateway for connecting the IP telephone system installed at any one of the locations to the Internet; a slave gateway that connects the IP telephone system constructed at a site other than the arbitrary site to the Internet, The master gateway, a first domain generating means for generating a domain name of a base based on identification information of the base received from the IP telephone system constructed at the base, and for generating a domain name of a base to which a VPN is connected based on identification information of the base to which a VPN is connected that is included in first setting information received from a first maintenance terminal that is a maintenance terminal of the first domain generating means; a first address acquisition means for connecting to the Internet based on Internet connection information included in the first setting information received from the first maintenance terminal and acquiring a global IP address of a base station; a first address information registration means for registering address information of the base, including the domain name of the base generated by the first domain generation means and the global IP address of the base acquired by the first address acquisition means, on the Internet; a first address resolution means for acquiring, from the Internet, a global IP address of the VPN destination base, which is associated with the domain name of the VPN destination base generated by the first domain generation means; a first VPN connection means for transmitting a first VPN connection information notification to the slave gateway identified by the global IP address of the VPN connection destination base acquired by the first address resolution means, the first VPN connection information notification including address information of the base and VPN connection information included in the first setting information received from the first maintenance terminal, and for VPN connection to the slave gateway using the VPN connection information included in the first VPN connection information notification; a number information generating means for generating number information of a VPN connection destination point in accordance with a connection number request received from the slave gateway of the VPN connection destination point connected by the first VPN connection means; a connection number notification means for transmitting a first connection number notification including the number information of the base included in the first setting information received from the first maintenance terminal and the number information of the VPN destination base generated by the number information generation means to the slave gateway specified by the global IP address of the VPN destination base and the IP telephone system constructed in the base, The slave gateway, a second domain generating means for generating a domain name of the base based on identification information of the base received from the IP telephone system constructed in the base; a second address acquisition means for connecting to the Internet based on Internet connection information of the base of origin included in second setting information received from a second maintenance terminal which is the maintenance terminal of the terminal itself, and acquiring a global IP address of the base of origin; a second address information registration means for registering address information of the home base, including the domain name of the home base generated by the second domain generation means and the global IP address of the home base acquired by the second address acquisition means, on the Internet; a second VPN connection means for establishing a VPN connection with the master gateway by using VPN connection information included in the first VPN connection information notification received from the master gateway; a connection number requesting means for transmitting the connection number request to the master gateway connected to the VPN by the second VPN connecting means, receiving the first connection number notification from the master gateway, and transmitting the first connection number notification to the IP telephone system established at the base of the user's home. A VPN system comprising:

2. 2. The VPN system according to claim 1, The master gateway, a VPN connection monitoring means for monitoring a VPN connection state with the slave gateway connected via the first VPN connection means, In the master gateway, The first address resolution means comprises: when the VPN connection monitoring means detects that the VPN connection with the slave gateway has been disconnected, the VPN connection monitoring means reacquires a global IP address associated with the domain name of the base to which the slave gateway belongs from the Internet; The first VPN connection means includes: The first VPN connection information notification is sent to the slave gateway identified by the global IP address reacquired by the first address resolution means, and a VPN connection is established again with the slave gateway using the VPN connection information included in the first VPN connection information notification. A VPN system comprising:

3. 2. The VPN system according to claim 1, In the slave gateway, The connection number request means when new number information of the base is received from the second maintenance terminal, a connection number change notification including the new number information is sent to the master gateway connected via VPN by the second VPN connection means; In the master gateway, The connection number notification means The first connection number notification, in which the number information of the base of the slave gateway that is the sender of the connection number change notification has been changed to the number information included in the connection number change notification, is transmitted to the slave gateway that is VPN-connected by the first VPN connection means and to the IP telephone system constructed at the base of the slave gateway itself. A VPN system comprising:

4. 2. The VPN system according to claim 1, The slave gateway, a VPN connection information change notification means for, when new VPN connection information of a base is received from the second maintenance terminal, transmitting a VPN connection information change notification including the new VPN connection information to the master gateway connected via VPN by the second VPN connection means; In the slave gateway, The second VPN connection means includes: when the VPN connection information change notification means transmits the VPN connection information change notification to the master gateway, disconnects the VPN connection with the master gateway and re-establishes a VPN connection with the master gateway using the VPN connection information included in the VPN connection information change notification, and if the VPN connection with the master gateway using the VPN connection information included in the VPN connection information change notification fails, receives the first VPN connection information notification from the master gateway and establishes a VPN connection with the master gateway using the VPN connection information included in the first VPN connection information notification; In the master gateway, The first VPN connection means includes: When the VPN connection information change notification is received from the slave gateway during VPN connection, the VPN connection with the slave gateway is disconnected, and the VPN connection with the slave gateway is re-established using the VPN connection information included in the VPN connection information change notification, and if the VPN connection with the slave gateway using the VPN connection information included in the VPN connection information change notification fails, the first VPN connection information notification is sent to the slave gateway, and the VPN connection with the slave gateway is established using the VPN connection information included in the first VPN connection information notification. A VPN system comprising:

5. 5. The VPN system according to claim 1, A plurality of the slave gateways are provided, In the master gateway, The first domain generating means includes: generating a domain name of the additional VPN connection point based on identification information of the additional VPN connection point included in the additional setting information received from the first maintenance terminal; The first address resolution means comprises: Obtaining from the Internet a global IP address of the VPN connection destination additional base that is associated with the domain name of the VPN connection destination additional base generated by the first domain generation means; The first VPN connection means includes: sending the first VPN connection information notification to the slave gateway identified by the global IP address of the VPN connection destination additional base acquired by the first address resolution means, and establishing a VPN connection with the slave gateway using the VPN connection information included in the first VPN connection information notification; The number information generating means generating number information of a VPN connection destination additional point in accordance with a connection number request received from the slave gateway of the VPN connection destination additional point connected by the first VPN connection means; The connection number notification means transmit a second connection number notification including the number information of the base included in the setting information received from the first maintenance terminal and the number information of each of the VPN connection destination base and the VPN connection destination additional base generated by the number information generating means to the slave gateway identified by each of the global IP addresses of the VPN connection destination base and the VPN connection destination additional base, and to the IP telephone system constructed in the base; The master gateway, a destination domain notification means for transmitting a destination domain notification including a domain name of the VPN destination base generated by the first domain generation means to the slave gateway identified by the global IP address of the VPN destination additional base acquired by the first address resolution means, In the slave gateway, The second VPN connection means includes: establishing a VPN connection with the other slave gateway using VPN connection information included in a second VPN connection information notification received from the other slave gateway; The connection number request means Transmitting the second connection number notification received from the master gateway to the IP telephone system established in the home base; The slave gateway, a second address resolution means for acquiring, from the Internet, a global IP address of the VPN connection destination additional base that is associated with a domain name of the VPN connection destination additional base included in the connection destination domain notification received from the master gateway; In the slave gateway, The second VPN connection means further comprises: a second VPN connection information notification including address information of the base and VPN connection information included in the first VPN connection information notification received from the master gateway is transmitted to the other slave gateway specified by the global IP address of the VPN connection destination additional base acquired by the second address resolution means, and a VPN connection is established with the other slave gateway using the VPN connection information included in the second VPN connection information notification; A VPN system comprising:

6. A gateway for connecting an IP (Internet Protocol) telephone system established at an arbitrary site to the Internet, a first domain generating means for generating a domain name of a base based on identification information of the base received from the IP telephone system constructed at the base, and for generating a domain name of a base to which a virtual private network (VPN) is connected based on identification information of the base to which the VPN is connected, the first domain generating means including first setting information received from a first maintenance terminal which is the maintenance terminal of the first domain generating means; a first address acquisition means for connecting to the Internet based on Internet connection information included in the first setting information received from the first maintenance terminal and acquiring a global IP address of a base station; a first address information registration means for registering address information of the base, including the domain name of the base generated by the first domain generation means and the global IP address of the base acquired by the first address acquisition means, on the Internet; a first address resolution means for acquiring, from the Internet, a global IP address of the VPN destination base, which is associated with the domain name of the VPN destination base generated by the first domain generation means; a first VPN connection means for transmitting a first VPN connection information notification including address information of a base to be connected and VPN connection information included in the first setting information received from the first maintenance terminal to a global IP address of the VPN connection destination base acquired by the first address resolution means, and for establishing a VPN connection with the VPN connection destination base using the VPN connection information included in the first VPN connection information notification; a number information generating means for generating number information of a VPN connection destination point in accordance with a connection number request received from a VPN connection destination point connected by the first VPN connection means; a connection number notification means for transmitting a first connection number notification including the number information of the base included in the first setting information received from the first maintenance terminal and the number information of the base to which the VPN is connected generated by the number information generation means to a global IP address of the base to which the VPN is connected and to the IP telephone system constructed at the base to which the VPN is connected. A gateway characterized by:

7. A gateway for connecting an IP (Internet Protocol) telephone system established at an arbitrary site to the Internet, a second domain generating means for generating a domain name of the base based on identification information of the base received from the IP telephone system constructed in the base; a second address acquisition means for connecting to the Internet based on Internet connection information of the base of origin included in second setting information received from a second maintenance terminal which is the maintenance terminal of the terminal itself, and acquiring a global IP address of the base of origin; a second address information registration means for registering address information of the home base, including the domain name of the home base generated by the second domain generation means and the global IP address of the home base acquired by the second address acquisition means, on the Internet; a second VPN connection means for receiving a first VPN connection information notification from a VPN (Virtual Private Network) connection destination base, the first VPN connection information notification including address information of the VPN connection destination base and VPN connection information, and for establishing a VPN connection with the VPN connection destination base using the VPN connection information included in the first VPN connection information notification; a connection number requesting means for transmitting a connection number request to a VPN destination base connected by the second VPN connection means, receiving a first connection number notification including number information of the home base and the VPN destination base from the VPN destination base, and transmitting the first connection number notification to the IP telephone system constructed in the home base. A gateway characterized by:

8. A program that causes a computer to function as a gateway that connects an IP (Internet Protocol) telephone system established at an arbitrary site to the Internet, a first domain generating means for generating a domain name of a base based on identification information of the base received from the IP telephone system constructed at the base, and for generating a domain name of a base to which a virtual private network (VPN) is connected based on identification information of the base to which the VPN is connected, the first domain generating means including first setting information received from a first maintenance terminal which is the maintenance terminal of the first domain generating means; a first address acquisition means for connecting to the Internet based on Internet connection information included in the first setting information received from the first maintenance terminal and acquiring a global IP address of a base; a first address information registration means for registering address information of the base, including the domain name of the base generated by said first domain generation means and the global IP address of the base acquired by said first address acquisition means, on the Internet; a first address resolution means for acquiring, from the Internet, a global IP address of the VPN destination base, which is associated with the domain name of the VPN destination base generated by the first domain generation means; a first VPN connection means for transmitting a first VPN connection information notification including address information of a base to be connected and VPN connection information included in the first setting information received from the first maintenance terminal to a global IP address of the VPN connection destination base acquired by the first address resolution means, and for establishing a VPN connection with the VPN connection destination base using the VPN connection information included in the first VPN connection information notification; a number information generating means for generating number information of a VPN connection destination point in accordance with a connection number request received from a VPN connection destination point connected by the first VPN connection means; and causing the computer to function as a connection number notification means for transmitting a first connection number notification, which includes the number information of the base included in the first setting information received from the first maintenance terminal and the number information of the base to which the VPN is connected generated by the number information generation means, to a global IP address of the base to which the VPN is connected and to the IP telephone system constructed at the base to which the VPN is connected. A program characterized by:

9. A program that causes a computer to function as a gateway that connects an IP (Internet Protocol) telephone system established at an arbitrary site to the Internet, a second domain generating means for generating a domain name of the base based on identification information of the base received from the IP telephone system constructed in the base; a second address acquisition means for connecting to the Internet based on Internet connection information of the base of origin included in second setting information received from a second maintenance terminal which is the maintenance terminal of the terminal itself, and acquiring a global IP address of the base of origin; a second address information registration means for registering address information of the base, including the domain name of the base generated by the second domain generation means and the global IP address of the base acquired by the second address acquisition means, on the Internet; a second VPN connection means for receiving a first VPN connection information notification including address information and VPN connection information of a VPN (Virtual Private Network) destination base from the VPN destination base, and for establishing a VPN connection with the VPN destination base using the VPN connection information included in the first VPN connection information notification; and making the computer function as a connection number requesting means for transmitting a connection number request to a VPN destination base connected by the second VPN connection means, receiving a first connection number notification including number information of the home base and the VPN destination base from the VPN destination base, and transmitting the first connection number notification to the IP telephone system constructed in the home base. A program characterized by:

10. A method for VPN connection between IP telephone systems using a VPN (Virtual Private Network) system including a master gateway for connecting an IP telephone system established at a given site to the Internet, and a slave gateway for connecting an IP telephone system established at a site other than the given site to the Internet, the method comprising: The master gateway, generating a domain name of the home base based on identification information of the home base received from a main device of the IP telephone system constructed at the home base, connecting to the Internet based on Internet connection information included in first setting information received from a first maintenance terminal which is the home base's own maintenance terminal, acquiring a global IP address of the home base, and registering address information of the home base including the domain name and the global IP address on the Internet; generating a domain name of the VPN destination base based on identification information of the VPN destination base included in the first setting information, and acquiring a global IP address of the VPN destination base linked to the domain name of the VPN destination base from the Internet; a first VPN connection information notification including address information of the base and VPN connection information included in the first setting information is transmitted to the slave gateway specified by the global IP address of the VPN connection destination base, and a VPN connection is established with the slave gateway using the VPN connection information included in the first VPN connection information notification; generating number information of a VPN destination base in accordance with a connection number request received from the slave gateway of a VPN destination base connected via VPN, and transmitting a first connection number notification including the number information of the VPN destination base and the number information of an affiliated base included in the first setting information to the slave gateway and the IP telephone system constructed at the affiliated base, respectively; The slave gateway, generating a domain name of the home base based on identification information of the home base received from a main device of the IP telephone system constructed at the home base, connecting to the Internet based on Internet connection information of the home base included in second setting information received from a second maintenance terminal which is the home base's own maintenance terminal, acquiring a global IP address of the home base, and registering address information of the home base including the domain name of the home base and the global IP address of the home base on the Internet; establishing a VPN connection with the master gateway using VPN connection information included in the first VPN connection information notification received from the master gateway; The connection number request is transmitted to the master gateway connected via VPN, the first connection number notification is received from the master gateway, and the first connection number notification is transmitted to the IP telephone system established at the base of the user's home. A VPN connection method comprising:

Images