Communication control system, communication control method, and communication control program

Abstract

This communication control system (1) comprises a connection terminal number management device (600) which constructs and removes an overlay tunnel path which is for data transmission and is used by terminal devices (100) which belong to a connection network, in order to be connected to a dedicated network for each contract organization. In addition, the connection terminal number management device (600): uses contract information, which is information for identifying the dedicated network for each contract organization, and anchor GW identification information which is information for identifying an overlay tunnel path transmission device (300) that belongs to an area to which the terminal devices (100) are connected, to count the number of connection terminals, which is the number of the terminal devices (100) that access the dedicated network for each contract organization; and performs, on the basis of prescribed conditions, start and stop of a VPN gateway (200), setting for connecting the VPN gateway (200) and the overlay tunnel path transmission device (300) to the dedicated network for each contract organization, and removal of the setting.

Description

[Technical Field]

[0001] The present invention relates to a communication control system, a communication control method, and a communication control program. [Background technology]

[0002] There are cases where mobile service providers provide cloud services to individual organizations or companies. For example, a mobile service provider may build a virtual private cloud for each company within its own cloud computing infrastructure and provide a means of accessing the virtual private cloud using communication devices for accessing the mobile services provided by the mobile service provider. A known method of accessing the virtual private cloud involves setting up overlay tunnels between a virtual private cloud access gateway and the virtual private cloud, and between the virtual private cloud access gateway and a terminal device. The former method uses tunneling protocols such as Generic Routing Encapsulation (GRE) and Multi-Protocol Label Switching (MPLS).

[0003] On the other hand, the latter is a method that combines a PDU (Protocol Data Unit) / PDN (Packet Data Network) session in a mobile network with the above-mentioned tunneling protocol (see, for example, Non-Patent Document 1). Based on the above-mentioned technology, the gateway process analyzes the received packet data, and if the included destination belongs to the target virtual private cloud, it forwards the packet to an overlay tunnel set up toward the target virtual private cloud.

[0004] In some cases, the gateway process is implemented as software and runs on a general-purpose server. In this case, stopping the general-purpose server or the gateway process prevents data transfer to the corresponding virtual private cloud. Therefore, the general-purpose server must keep the gateway process running while there are virtual private cloud service users (hereinafter referred to as "users"), which can result in increased power consumption. Therefore, prior art has adopted a method of consolidating virtual machines on specific servers, improving CPU utilization and reducing the number of servers in operation, thereby reducing the power required to run virtual machines (see, for example, Non-Patent Document 2).

[0005] In the above-mentioned method, if there are few or no users accessing the VPN via the VPN gateway, the resource usage by the gateway process decreases, and as a result, it becomes possible to run virtual machines or containers implementing the gateway on fewer servers. Therefore, as mentioned above, by reducing the number of servers that form the platform, it becomes possible to reduce power consumption. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] Cisco Systems IPSec Tunnel and GRE VPN Configuration, Internet <URL:https: / / www.cisco.com / cisco / web / support / JP / docs / RT / BranchRT / 800RT / CG / 003 / 5332_01_7.html?bid=0900e4b1825ae859> [Non-patent document 2] RA Arockia and S. Arun, Virtual Machine Consolidation Framework for Energy and Performance Efficient Cloud Data Centers, 2019 IEEE International Conference on System, Computation, Automation and Networking (ICSCAN), 2019, pp. 1-7 Summary of the Invention [Problem to be solved by the invention]

[0007] However, in the prior art, it was sometimes impossible to count the number of users in a communication-enabled state within a network and dynamically start and stop a gateway process based on the presence or absence of users.

[0008] Specifically, the current mobile network specifications do not provide a method for counting the number of users within a mobile network for each service, making it impossible to count the number of users, and therefore making it impossible to dynamically start and stop gateway processes based on the presence or absence of users. Therefore, even when there are no virtual private cloud users within the mobile network, it is necessary to keep the general-purpose server running on which the gateway process runs, which can be problematic. [Means for solving the problem]

[0009] In order to solve the above problems and achieve the object, the communication control system of the present invention is a communication control system having a connected terminal number management device that builds and deletes overlay tunnel routes for data transfer that terminal devices belonging to a connection network use to connect to a dedicated network for each contract organization, and the connected terminal number management device is characterized in that it has: a counting unit that counts the number of connected terminals, which is the number of terminal devices accessing the dedicated network for each contract organization, using contract information that is information identifying the dedicated network for each contract organization and anchor GW identification information that is information identifying an overlay tunnel route forwarding device that belongs to the area to which the terminal devices connect; a setting unit that starts a VPN gateway when the number of connected terminals changes from 0 to 1 or more, and configures the VPN gateway and the overlay tunnel route forwarding device to connect to the dedicated network for each contract organization, and builds the overlay tunnel route for data transfer; and a deletion unit that deletes the settings of the VPN gateway and the overlay tunnel route forwarding device, stops the VPN gateway, and deletes the overlay tunnel route for data transfer when the number of connected terminals changes from 1 or more to 0. [Effects of the Invention]

[0010] The present invention has the effect of counting the number of users in a network that are ready to communicate, and dynamically starting and stopping a gateway process based on the presence or absence of users. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram illustrating an example of an outline of a communication control method of a communication control system according to a first embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of the operation of the gateway according to the first embodiment. [Figure 3] FIG. 3 is a diagram illustrating an example of the device configuration of the terminal device according to the first embodiment. [Figure 4]FIG. 4 is a diagram illustrating an example of the device configuration of the VPN gateway according to the first embodiment. [Figure 5] FIG. 5 is a table illustrating an example of information stored in the transfer destination storage unit of the VPN gateway according to the first embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of the device configuration of the overlay tunnel route forwarding device according to the first embodiment. [Figure 7] FIG. 7 is a table diagram illustrating an example of a first table format stored in the forwarding destination storage unit of the overlay tunnel route forwarding device according to the first embodiment. [Figure 8] FIG. 8 is a table diagram illustrating an example of a second table format stored in the forwarding destination storage unit of the overlay tunnel route forwarding device according to the first embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of the device configuration of the terminal location information managing device according to the first embodiment. [Figure 10] FIG. 10 is a table illustrating an example of information stored in the terminal device connected VPN storage unit of the terminal location information managing device according to the first embodiment. [Figure 11] FIG. 11 is a table illustrating an example of information stored in the anchor GW storage unit of the terminal location information managing device according to the first embodiment. [Figure 12] FIG. 12 is a diagram illustrating an example of the device configuration of the contract information management device according to the first embodiment. [Figure 13] FIG. 13 is a table illustrating an example of information stored in the contract information storage unit of the contract information management apparatus according to the first embodiment. [Figure 14] FIG. 14 is a diagram illustrating an example of the device configuration of the connected terminal number management device according to the first embodiment. [Figure 15] FIG. 15 is a table illustrating an example of information stored in the number-of-connected-terminals storage unit of the device for managing the number of connected terminals according to the first embodiment. [Figure 16] FIG. 16 is a diagram illustrating an example of the device configuration of the transfer information management device according to the first embodiment. [Figure 17]FIG. 17 is a table diagram illustrating an example of a connected terminal number management device reply table stored in the address storage unit of the transfer information management device according to the first embodiment. [Figure 18] FIG. 18 is a table diagram illustrating an example of a terminal device reply table stored in the address storage unit of the transfer information management device according to the first embodiment. [Figure 19] FIG. 19 is a diagram illustrating an example of a flowchart of a communication control method according to the first embodiment. [Figure 20] FIG. 20 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to the first embodiment. [Figure 21] FIG. 21 is a diagram illustrating an example of the device configuration of the connected terminal number management device according to the first embodiment. [Figure 22] FIG. 22 is a diagram illustrating an example of a flowchart of a communication control method according to the first embodiment. [Figure 23] FIG. 23 is a diagram showing an example of an outline of a communication control method of the communication control system according to embodiment 1″. [Figure 24] FIG. 24 is a diagram showing an example of a flowchart of a communication control method according to embodiment 1″. [Figure 25] FIG. 25 is a diagram illustrating an example of an outline of a communication control method of the communication control system according to the second embodiment. [Figure 26] FIG. 26 is a diagram illustrating an example of an outline of the operation of the communication control system according to the second embodiment. [Figure 27] FIG. 27 is a diagram illustrating an example of an outline of establishing an encrypted path according to the second embodiment. [Figure 28] FIG. 28 is a diagram illustrating an example of a device configuration of a mobile gateway according to the second embodiment. [Figure 29] FIG. 29 is a table illustrating an example of information stored in a VPN search table storage unit of the mobile gateway according to the second embodiment. [Figure 30] FIG. 30 is a diagram illustrating an example of a flowchart of a communication control method (pattern 1) according to the second embodiment. [Figure 31]FIG. 31 is a diagram illustrating an example of a flowchart of a communication control method (pattern 2) according to the second embodiment. [Figure 32] FIG. 32 is a diagram illustrating an example of an outline of a communication control method of a communication control system according to embodiment 2-1. [Figure 33] FIG. 33 is a diagram illustrating an example of a block diagram of various devices constituting the communication control system according to embodiment 2-1. [Figure 34] FIG. 34 is a diagram illustrating an example of an outline of the operation of the communication control system according to embodiment 2-1. [Figure 35] FIG. 35 is a diagram illustrating an example of the device configuration of an overlay tunnel route forwarding device for an IP network according to embodiment 2-1. [Figure 36] FIG. 36 is a diagram illustrating an example of a flowchart of a communication control method according to embodiment 2-1. [Figure 37] FIG. 37 is a diagram illustrating an example of a computer in which various devices of the communication control system according to each embodiment are realized. DETAILED DESCRIPTION OF THE INVENTION

[0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention (hereinafter referred to as "embodiments") will be described with reference to the drawings. Note that the embodiments are not limited to the following description.

[0013] [1. Overview of the communication control system] The communication control system 1 in each embodiment builds and deletes overlay tunnel routes for data transfer that are used by terminal devices 100 belonging to a connection network to connect to a dedicated network for each contracting organization (e.g., a virtual private cloud, hereafter simply referred to as a "dedicated network").

[0014] The following items will provide an overview of the communication control system 1 in this embodiment. First, a counting unit 631 of a connected terminal number management device 600 included in the communication control system 1 counts the number of connected terminals, which is the number of terminal devices 100 accessing the dedicated network, using contract information (hereinafter referred to as "destination VPN ID") that is information for identifying a dedicated network, and anchor GW identification information (hereinafter referred to as "responsible anchor GW ID") that is information for identifying an overlay tunnel route forwarding device 300 that belongs to the area to which the terminal device 100 is connected.

[0015] Next, the determination unit 632 of the connected terminal count management device 600 determines that the number of connected terminals has been updated from 0 to 1 or more. In this case, the setting unit 634 of the connected terminal count management device 600 starts up the VPN (Virtual Private Network) gateway 200, sets a VPN connection address (hereinafter referred to as "VPN connection address") for connecting to the dedicated network to the VPN gateway 200 and the overlay tunnel route forwarding device 300, and constructs an overlay tunnel route for data transfer.

[0016] Thereafter, the determination unit 632 of the device for managing the number of connected terminals 600 determines that the number of connected terminals has been updated from 1 or more to 0. In this case, the deletion unit 635 of the device for managing the number of connected terminals 600 deletes the settings of the VPN connection addresses of the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, and deletes the overlay tunnel route for data forwarding.

[0017] 2. Embodiment 1: Starting and Stopping VPN Gateways According to the Number of Connected Terminals Hereinafter, as the first embodiment, the "activation and deactivation of VPN gateways according to the number of connected terminals" realized by the communication control system 1 will be described. First, an overview will be given using FIG.

[0018] 1 is a schematic diagram showing a situation in which a terminal device 100 connected to a certain area connects to a dedicated network. First, the terminal device 100 transmits to the terminal location information manager 400 terminal device information (hereinafter referred to as "terminal ID"), which is information for identifying the terminal device 100, the connected VPN ID, and a registration request for registering the above information in the terminal location information manager 400 (see (1) in FIG. 1).

[0019] Here, if the terminal device 100 holds a destination VPN ID, the registration unit 433 of the terminal location information management device 400 registers the terminal ID and destination VPN ID received from the terminal device 100. On the other hand, if the terminal device 100 does not hold a destination VPN ID, the registration unit 433 of the terminal location information management device 400 acquires and registers the destination VPN ID identified by the terminal ID from the contract information management device 500 (see (2) in Figure 1). Then, the terminal location information management device 400 establishes a D-plane session based on the connection request, which is a D-plane session establishment request sent by the terminal device 100 (see (3) in Figure 1).

[0020] Next, the transmitting unit 434 of the terminal location information managing device 400 transmits the responsible anchor GW ID and the connected VPN ID to the connected terminal number managing device 600 (see (4) in FIG. 1). Then, the counting unit 631 of the connected terminal number managing device 600 counts and updates the number of connected terminals, which is the number of connections to the overlay tunnel route forwarding device 300 that belongs to the area to which the terminal device 100 is connected, based on the accepted responsible anchor GW ID and connected VPN ID.

[0021] Next, based on the determination by the determination unit 632 of the device for managing number of connected terminals 600 that the number of connected terminals has been updated from 0 to 1 or more, the acquisition unit 633 of the device for managing number of connected terminals 600 sends the destination VPN ID to the transfer information management device 700 and acquires a VPN connection address corresponding to the dedicated network (see (5) in FIG. 1). Then, the setting unit 634 of the device for managing number of connected terminals 600 starts the VPN gateway 200 and sets the acquired VPN connection address to the VPN gateway 200 and the overlay tunnel route forwarding device 300, thereby constructing an overlay tunnel route for data transfer (see (6) in FIG. 1). Next, the terminal device 100 connects to the dedicated network using the overlay tunnel route for data transfer constructed by the communication control system 1 (see (7) in FIG. 1).

[0022] Thereafter, based on the determination by the determination unit 632 of the connected terminal count management device 600 that the number of connected terminals has been updated from 1 or more to 0, the deletion unit 635 of the connected terminal count management device 600 deletes the settings of the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, and deletes the overlay tunnel route for data forwarding (see (8) in Figure 1).

[0023] From here, a supplementary explanation will be given of the configuration of the VPN according to the first embodiment. The VPN according to the first embodiment is configured by an MEC (Multi Access Edge Cloud) and an overlay tunnel route for data transfer. The MEC contains a front-end server (for example, "front-end server 10" in FIG. 1) that accepts data requests from users and returns results from the system to the users, each of which holds a unique connection address (the aforementioned VPN connection address). On the other hand, a VPN terminal address is assigned to the terminal device 100 by the transfer information management device 700.

[0024] Next, the mechanism by which the VPN gateway 200 and the overlay tunnel route forwarding device 300 distribute packets to the destination overlay tunnel route for data transfer based on the VPN connection address will be explained using Figure 2. First, Figure 2 shows a terminal device 100 with "destination: 10A", a terminal device 101 with "destination: 10C", and a terminal device 102 with "destination: 10B".

[0025] Here, the VPN gateway 200 and the overlay tunnel route forwarding device 300 analyze the packet headers sent by each terminal device and distribute the packets to the data transfer overlay tunnel route according to the destination. Specifically, the VPN gateway 200 and the overlay tunnel route forwarding device 300 distribute the communications of the terminal device 100 and the terminal device 102 to the data transfer overlay tunnel route X, and distribute the communications of the terminal device 101 to the data transfer overlay tunnel route Y.

[0026] [2-1. Communication control system configuration] The configuration of the communication control system 1 in the first embodiment will now be described with reference to Figs. 3 to 18. The communication control system 1 in the first embodiment is configured to include a terminal device 100, a VPN gateway 200, an overlay tunnel route forwarding device 300, a terminal location information management device 400, a contract information management device 500, a connected terminal number management device 600, and a transfer information management device 700. The functional units of each device will be described in detail in the following sections. Note that in the following description, descriptions of functional units (communication units, storage units, control units, etc.) having similar functions in each device will be omitted as appropriate.

[0027] (Terminal device 100) First, the configuration of the terminal device 100 will be described with reference to Fig. 3. As shown in Fig. 3, the terminal device 100 has a communication unit 110, a storage unit 120, and a control unit 130. Although not shown, the terminal device 100 may also have an input unit (e.g., a keyboard, a mouse, etc.) that accepts various operations and a display unit (e.g., a display, etc.) that displays various information. Furthermore, the terminal device 100 may be a desktop personal computer, a notebook PC, a smartphone, a tablet, a PDA (Personal Digital Assistant), etc. Next, detailed functions of each unit will be described below.

[0028] (Communication unit 110) The communication unit 110 is realized by a NIC (Network Interface Card) or the like, and controls communication via an electric communication line such as a LAN (Local Area Network), the Internet, etc. The communication unit 110 is connected to the network by wire or wirelessly as necessary, and can transmit and receive information bidirectionally.

[0029] (Storage unit 120) The storage unit 120 stores data and programs necessary for various processes performed by the control unit 130. The storage unit 120 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

[0030] (control unit 130) The control unit 130 has an address management unit 131 and a communication session management unit 132. The control unit 130 has an internal memory for temporarily storing programs that define various processing procedures and the like and processing data, and is realized by electronic circuits such as a CPU (Central Processing Unit) and an MPU (Micro Processing Unit), and integrated circuits such as an ASIC (Application Specific Integrated Circuit) and an FPGA (Field Programmable Gate Array).

[0031] (Address management unit 131) The address management unit 131 receives a VPN terminal address for the terminal device that is assigned to the terminal device 100 and stores it in the storage unit 120 .

[0032] (Communication session management unit 132) When the terminal device 100 makes a network connection, the communication session management unit 132 makes a request to establish a C-plane and a D-plane session to the terminal location information management device 400. Furthermore, when making the session establishment request, the communication session management unit 132 transmits the terminal ID and, if held by the terminal device 100, the destination VPN ID to the terminal location information management device 400.

[0033] (VPN Gateway 200) Next, the configuration of the VPN gateway 200 will be described with reference to Fig. 4. As shown in Fig. 4, the VPN gateway 200 has a communication unit 210, a storage unit 220, and a control unit 230. The functions of the communication unit 210 are the same as those described for the communication unit 110 of the terminal device 100, and therefore will not be described here. In addition, the VPN gateway 200 controlled by the communication control system 1 may be a virtual gateway (vGW) implemented in software.

[0034] (Storage unit 220) The storage unit 220 stores data and programs required for various processes performed by the control unit 230. The storage unit 220 includes a transfer destination storage unit 221.

[0035] (Transfer destination storage unit 221) The forwarding destination storage unit 221 stores information about forwarding destinations as a forwarding table. Specifically, the forwarding destination storage unit 221 stores the items "Address" and "Destination Tunnel" as shown in FIG. 5. Note that the items stored in the forwarding destination storage unit 221 are not limited to the above-mentioned items, and other items may be stored. Also, the input information for each item shown in FIG. 5 is merely an example and is not limited to the information described.

[0036] (control unit 230) The control unit 230 includes a packet header analysis unit 231 and a transfer processing unit 232 .

[0037] (Packet header analysis unit 231) The packet header analysis unit 231 analyzes the packet header transmitted when the terminal device 100 performs communication, and extracts destination information (for example, IP address, etc.).

[0038] (Transfer processing unit 232) The transfer processing unit 232 distributes the data to the target overlay tunnel route for data transfer based on the destination information.

[0039] (Overlay tunnel route forwarding device 300) Next, the configuration of the overlay tunnel route forwarding device 300 will be described with reference to Fig. 6. As shown in Fig. 6, the overlay tunnel route forwarding device 300 has a communication unit 310, a storage unit 320, and a control unit 330. Note that the function of the communication unit 310 is the same as the function described for the communication unit 110 of the terminal device 100, and therefore will not be described here.

[0040] (Storage unit 320) The storage unit 320 stores data and programs required for various processes performed by the control unit 330. The storage unit 320 includes a transfer destination storage unit 321.

[0041] (Transfer destination storage unit 321) The forwarding destination storage unit 321 stores information related to forwarding destinations as a forwarding table. Specifically, the forwarding destination storage unit 321 analyzes the packet header transmitted from the terminal device 100, and stores items called "address" and "forwarding destination tunnel" as shown in Fig. 7 as table type 1 relating to mapping between included destination information (e.g., IP address, etc.) and the overlay tunnel route for data forwarding of the VPN gateway 200. Furthermore, the forwarding destination storage unit 321 stores items called "mobile NW tunnel" and "forwarding destination tunnel to VPN gateway" as shown in Fig. 8 as table type 2 relating to mapping between tunnels in the mobile network and the overlay tunnel route for data forwarding to the VPN gateway 200.

[0042] Note that the items in Table Type 1 and Table Type 2 are not limited to the above items and may store other items in the transfer destination storage unit 321. Also, the input information for each item shown in Figures 7 and 8 is merely an example and is not limited to the information described.

[0043] (control unit 330) 6, the control unit 330 includes a packet header analysis unit 331 and a transfer processing unit 332.

[0044] (Packet header analysis unit 331) The packet header analysis unit 331 analyzes the packet header transmitted when the terminal device 100 performs communication, and extracts destination information (for example, IP address, etc.).

[0045] (Transfer processing unit 332) The transfer processing unit 332 distributes the data to the target overlay tunnel route for data transfer based on the destination information.

[0046] (Terminal location information management device 400) Next, the configuration of terminal location information managing device 400 will be described with reference to Fig. 9. As shown in Fig. 9, terminal location information managing device 400 has a communication unit 410, a storage unit 420, and a control unit 430. Note that the function of communication unit 410 is the same as the function described for communication unit 110 of terminal device 100, and therefore will not be described. In addition, terminal location information managing device 400 may utilize an MME (Mobility Management Entity) and an AMF (Access and Mobility management Function).

[0047] (Storage unit 420) The storage unit 420 stores data and programs necessary for various processes performed by the control unit 430. The storage unit 420 includes a terminal device connected VPN storage unit 421 and an anchor GW storage unit 422.

[0048] (Terminal device connection destination VPN storage unit 421) The terminal device destination VPN storage unit 421 stores a terminal device-destination VPN management table as information related to data transfer overlay tunnel routes connecting to a dedicated network. Specifically, the terminal device destination VPN storage unit 421 stores the items "Terminal ID" and "Destination VPN ID" as shown in FIG. 10 as the terminal device-destination VPN management table. Note that the information stored in the terminal device destination VPN storage unit 421 is not limited to the above-mentioned items and may store other items. Also, the input information for each item shown in FIG. 10 is merely an example and is not limited to the information described.

[0049] (Anchor GW storage unit 422) The anchor GW storage unit 422 stores a location management table as information for identifying the overlay tunnel route forwarding apparatus 300 that belongs to the area to which the terminal device 100 is connected. Specifically, the anchor GW storage unit 422 stores items of "Terminal ID" and "Responsible Anchor GW ID" as shown in FIG. 11 as the location management table. Note that the information stored in the anchor GW storage unit 422 is not limited to the above-mentioned items and may store other items. Also, the input information for each item shown in FIG. 11 is merely an example and is not limited to the information described.

[0050] (Control unit 430) 9. The control unit 430 includes a receiving unit 431, a notifying unit 432, a registering unit 433, and a transmitting unit 434.

[0051] (Reception Department 431) The reception unit 431 determines that the terminal device 100 holds a destination VPN ID. In that case, the reception unit 431 receives, from the terminal device 100, terminal device information (terminal ID), which is information for identifying the terminal device 100, and contract information (destination VPN ID). On the other hand, the reception unit 431 determines that the terminal device 100 does not hold a destination VPN ID. In that case, the reception unit 431 receives, from the terminal device 100, the terminal device information (terminal ID), which is information for identifying the terminal device 100, and a registration request, which is a request to register the terminal device information (terminal ID) and contract information (destination VPN ID) in the terminal location information management device 400.

[0052] Furthermore, the reception unit 431 receives a connection request, which is a request for connection from the mobile network to the data network, from the terminal device 100. Note that the reception unit 431 is not limited to the information described above, and may receive other information as necessary.

[0053] (Notification section 432) If the terminal device 100 does not hold the destination VPN ID, the notification unit 432 notifies the terminal ID to the contract information management device 500. Note that the notification unit 432 is not limited to the information described above, and may notify other information as necessary.

[0054] (Registration Section 433) When the terminal device 100 holds a destination VPN ID, the registration unit 433 registers the terminal device information (terminal ID) and contract information (destination VPN ID) received from the terminal device 100. On the other hand, when the terminal device 100 does not hold contract information, the registration unit 433 registers the terminal ID received from the terminal device 100 and the contract information (destination VPN ID) acquired from the contract information management device 500 using the terminal device information (terminal ID) based on a registration request.

[0055] In other words, the registration unit 433 registers the terminal ID transmitted by the terminal device 100 and the destination VPN ID transmitted by a transmission unit 532 of the contract information management device 500 (described later). Note that the information received by the registration unit 433 is not limited to the information described above, and may receive other information as necessary.

[0056] (Transmitter 434) Based on the connection request, the transmission unit 434 transmits the contract information (connection destination VPN ID) and anchor GW identification information (responsible anchor GW ID) to the connected terminal number management device 600. Note that the transmission unit 434 is not limited to the information described above, and may transmit other information as necessary.

[0057] (Contract information management device 500) Next, the configuration of the contract information management device 500 will be described with reference to Fig. 12. As shown in Fig. 12, the contract information management device 500 has a communication unit 510, a storage unit 520, and a control unit 530. Note that the functions of the communication unit 510 are the same as those described for the communication unit 110 of the terminal device 100, and therefore will not be described here. In addition, the contract information management device 500 may work in conjunction with a Home Subscriber Server (HSS) and Unified Data Management (UDM).

[0058] (Storage unit 520) The storage unit 520 stores data and programs required for various processes performed by the control unit 530. The storage unit 520 includes a contract information storage unit 521.

[0059] (Contract information storage unit 521) The contract information storage unit 521 stores a contract management table including a destination VPN ID as contract information. Specifically, the contract information storage unit 521 stores the items "Terminal ID" and "Destination VPN ID" as the contract management table, as shown in FIG. 13. Note that the information stored in the contract information storage unit 521 is not limited to the above-mentioned items, and other items may be stored. Also, the input information for each item shown in FIG. 13 is merely an example, and is not limited to the information described.

[0060] (control unit 530) 12. The control unit 530 includes a receiving unit 531 and a transmitting unit 532.

[0061] (Reception Department 531) Receiving unit 531 receives the terminal ID notified by notifying unit 432 of terminal location information managing device 400. Note that receiving unit 531 is not limited to the information described above, and may receive other information as necessary.

[0062] (Transmitter 532) Transmitting unit 532 transmits the destination VPN ID corresponding to the terminal ID received by receiving unit 531 to terminal location information managing device 400. Note that transmitting unit 532 is not limited to transmitting the information described above, and may transmit other information as necessary.

[0063] (Connected terminal number management device 600) Next, the configuration of the connected terminal count management device 600 will be described with reference to Fig. 14. The connected terminal count management device 600 establishes and deletes overlay tunnel routes for data transfer that are used by the terminal devices 100 belonging to the connection network to connect to the dedicated network for each contracted organization. As shown in Fig. 14, the connected terminal count management device 600 has a communication unit 610, a storage unit 620, and a control unit 630. Note that the function of the communication unit 610 is the same as the function described for the communication unit 110 of the terminal device 100, and therefore will not be described here.

[0064] (Storage unit 620) The storage unit 620 stores data and programs necessary for various processes performed by the control unit 630. The storage unit 620 includes a connected terminal number storage unit 621.

[0065] (Number of connected terminals storage unit 621) The connected terminal number storage unit 621 stores a connected terminal number management table as information used to count the number of connected terminals. Specifically, the connected terminal number storage unit 621 stores the following items as the connected terminal number management table, as shown in FIG. 15: "responsible anchor GW ID," "destination VPN ID," and "number of connected terminals." Note that the information stored in the connected terminal number storage unit 621 is not limited to the above-mentioned items, and other items may be stored. Also, the input information for each item shown in FIG. 15 is merely an example, and is not limited to the information described.

[0066] (Control unit 630) 14, the description will be continued. The control unit 630 has a counting unit 631, a determining unit 632, an acquiring unit 633, a setting unit 634, and a deleting unit 635.

[0067] (Counting Department 631) The counting unit 631 counts the number of connected terminals, which is the number of terminal devices 100 accessing the dedicated network for each contracting organization, and updates the number of connected terminals, using contract information (destination VPN ID), which is information for identifying the dedicated network for each contracting organization, and anchor GW identification information (responsible anchor GW ID), which is information for identifying the overlay tunnel route forwarding device 300 that belongs to the area to which the terminal device 100 connects. Note that the counting unit 631 is not limited to the information described above, and may perform counting using other information as necessary.

[0068] (Judgment unit 632) The determination unit 632 determines whether a predetermined condition is met based on the connected terminal number information counted and updated by the counting unit 631. For example, the determination unit 632 determines that the setting unit 634 will perform processing when the number of connected terminals is updated from 0 to 1 or more, and determines that the deletion unit 635 will perform processing when the number of connected terminals has been 0 for a predetermined period of time or longer, i.e., when the number of connected terminals is updated from 1 or more to 0. Note that the determination unit 632 may also determine that the deletion unit 635 will perform processing when the number of connected terminals is updated from 1 or more to 0 and remains 0 for a certain period of time or longer. Furthermore, the determination unit 632 is not limited to the above-mentioned determination conditions and may make a determination based on other determination conditions as necessary.

[0069] (Acquisition part 633) The acquisition unit 633 uses the contract information (destination VPN ID) to acquire information (VPN connection address) for connecting to a dedicated network for each contract organization to which the terminal device 100 is to connect from the transfer information management device 700. Note that the acquisition unit 633 is not limited to the information described above, and may acquire other information as necessary.

[0070] (Setting section 634) If the determination result of the determination unit 632 satisfies a predetermined condition, i.e., if the number of connected terminals changes from 0 to 1 or more, the setting unit 634 starts the VPN gateway 200, configures the VPN gateway 200 and the overlay tunnel route forwarding device 300 to connect to a dedicated network for each contracted organization, and constructs an overlay tunnel route for data transfer. Specifically, if the determination unit 632 determines that the number of connected terminals has been updated from 0 to 1 or more, the setting unit 634 starts the VPN gateway 200, configures VPN connection addresses for the VPN gateway 200 and the overlay tunnel route forwarding device 300, and constructs an overlay tunnel route for data transfer. Note that the setting unit 634 is not limited to the information described above, and may use other information as necessary to perform configuration for any device.

[0071] (Deleted part 635) If the determination result of the determination unit 632 satisfies a predetermined condition, i.e., if the number of connected terminals changes from 1 or more to 0, the deletion unit 635 deletes the settings of the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, and deletes the data forwarding overlay tunnel route. Specifically, if the determination unit 632 determines that the number of connected terminals has been updated from 1 or more to 0, the deletion unit 635 deletes the VPN connection addresses set for the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, and releases the data forwarding overlay tunnel route. Note that the deletion unit 635 is not limited to the information described above, and may delete the settings of any device using other information as necessary.

[0072] (Transfer information management device 700) Next, the configuration of the transfer information management device 700 will be described with reference to Fig. 16. As shown in Fig. 16, the transfer information management device 700 has a communication unit 710, a storage unit 720, and a control unit 730. Note that the function of the communication unit 710 is the same as the function described for the communication unit 110 of the terminal device 100, and therefore will not be described here.

[0073] (Storage unit 720) The storage unit 720 stores data and programs required for various processes performed by the control unit 730. The storage unit 720 includes an address storage unit 721.

[0074] (Address storage unit 721) The address storage unit 721 stores a connected terminal number management device reply table and a terminal device reply table as information related to VPN connection addresses for connecting to the dedicated network. Specifically, the address storage unit 721 stores the items "Destination VPN ID" and "VPN connection address" as the connected terminal number management device reply table, as shown in Fig. 17.

[0075] On the other hand, the address storage unit 721 stores the items "Service connection URI (Uniform Resource Identifier) / URL (Uniform Resource Locator)" and "VPN terminal address" as a terminal device reply table, as shown in FIG. 18. Note that the information stored in the address storage unit 721 is not limited to the above-mentioned items, and other items may be stored. Also, the input information for each item shown in FIGS. 17 and 18 is merely an example, and is not limited to the information described. Furthermore, the address storage unit 721 of the transfer information management device 700 may utilize DNS (Domain Name System) as a function of the terminal reply table.

[0076] (Control unit 730) 16. The control unit 730 includes a receiving unit 731 and a transmitting unit 732.

[0077] (Reception Department 731) The receiving unit 731 receives the connected VPN ID transmitted by the acquisition unit 633 of the connected terminal number management device 600. Note that the information received by the receiving unit 731 is not limited to the information described above, and may receive other information as necessary.

[0078] (Transmitter 732) Based on the connection VPN ID received by the reception unit 731, the transmission unit 732 transmits the corresponding VPN connection address to the connected terminal number management device 600 and the corresponding VPN terminal address to the terminal device 100. Note that the transmission unit 732 is not limited to the information described above, and may transmit other information as necessary.

[0079] [2-2. Communication control method procedure] From here, a communication control method performed by the communication control system 1 in embodiment 1 will be described with reference to Fig. 19. First, the reception unit 431 of the terminal location information management device 400 receives a terminal ID and a registration request to the C-plane of the mobile network from the terminal device 100 (step S11).

[0080] Next, the reception unit 431 of the terminal location information manager 400 determines that the terminal device 100 holds a destination VPN ID (Yes in step S12). In this case, the reception unit 431 of the terminal location information manager 400 receives the destination VPN ID from the terminal device 100 (step S13). Subsequently, the registration unit 433 of the terminal location information manager 400 registers the terminal ID and the destination VPN ID corresponding to the terminal ID (step S16).

[0081] On the other hand, the reception unit 431 of the terminal location information management device 400 determines that the terminal device 100 does not hold a destination VPN ID (No in step S12). In this case, the notification unit 432 of the terminal location information management device 400 notifies the contract information management device 500 of the terminal ID (step S14). Then, the transmission unit 532 of the contract information management device 500 transmits the destination VPN ID corresponding to the terminal ID to the terminal location information management device 400 (step S15). Subsequently, the registration unit 433 of the terminal location information management device 400 registers the terminal ID transmitted by the terminal device 100 and the destination VPN ID transmitted by the contract information management device 500 (step S16).

[0082] Next, the terminal location information managing device 400 establishes a C-plane session with the terminal device 100 (step S17). Subsequently, the reception unit 431 of the terminal location information managing device 400 receives a connection request for establishing a D-plane session from the terminal device 100 (step S18). Subsequently, the terminal location information managing device 400 determines the overlay tunnel route forwarding device 300 to connect to, and establishes a D-plane session within the mobile network (step S19).

[0083] Then, the transmitting unit 434 of the terminal location information managing device 400 transmits the destination VPN ID and the serving anchor GW ID to the connected terminal number managing device 600 (step S20). Subsequently, the counting unit 631 of the connected terminal number managing device 600 counts and updates the number of connected terminals based on the received destination VPN ID and serving anchor GW ID (step S21).

[0084] Then, the determination unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has been updated from 0 to 1 or more (step S22). In this case, the acquisition unit 633 of the connected terminal number management device 600 sends the destination VPN ID to the transfer information management device 700 and acquires a VPN connection address (step S23). Next, the setting unit 634 of the connected terminal number management device 600 starts the VPN gateway 200 and sets the acquired VPN connection address to the VPN gateway 200 and the overlay tunnel route forwarding device 300, thereby constructing a data transfer overlay tunnel route (step S24).

[0085] Next, the transfer information management device 700 transmits the VPN terminal address to the terminal device 100 (step S25). Then, the terminal device 100 connects to the dedicated network via the data transfer overlay tunnel route using the VPN terminal address transmitted by the transfer information management device 700 (step S26). Thereafter, the terminal device 100 continues its connection to the dedicated network (step S27).

[0086] Thereafter, the terminal location information managing device 400 measures the non-communication time of the terminal device 100 (step S28). If the non-communication time exceeds a predetermined threshold, the terminal location information managing device 400 disconnects the D-plane session (step S29). Next, the counting unit 631 of the connected terminal number managing device 600 subtracts the number of connected terminals corresponding to the VPN of the communication destination of the terminal device 100 and the overlay tunnel route forwarding device 300 via which the terminal device 100 communicates (step S30). If the number of connected terminals is changed from 1 or more to 0 as a result of the above-mentioned subtraction, the determining unit 632 of the connected terminal number managing device 600 determines that the number of connected terminals has been updated from 1 or more to 0 (Yes in step S31). In this case, the deletion unit 635 of the connected terminal count management device 600 deletes the VPN connection address set in the VPN gateway 200 and the overlay tunnel route forwarding device 300, stops the VPN gateway 200, releases the overlay tunnel route for data forwarding, and the process ends (step S32).

[0087] On the other hand, if the number of connected terminals does not become 0, the determination unit 632 of the connected terminal number management device 600 determines that the number of connected terminals has not been updated from 1 or more to 0 (No in step S31). In this case, the process returns to normal, and the communication control system 1 continues processing.

[0088] [2-3. Effects] The communication control system 1 of embodiment 1 is a communication control system 1 having a connected terminal number management device 600 that builds and deletes overlay tunnel routes for data transfer that are used by terminal devices 100 belonging to a connection network to connect to a dedicated network for each contracted organization. The connected terminal number management device 600 counts the number of connected terminals, which is the number of terminal devices 100 accessing the dedicated network for each contracted organization, using contract information (destination VPN ID), which is information that identifies the dedicated network for each contracted organization, and anchor GW identification information (responsible anchor GW ID), which is information that identifies the overlay tunnel route forwarding device 300 that belongs to the area to which the terminal device 100 connects; when the number of connected terminals changes from 0 to 1 or more, the VPN gateway 200 is started, and settings are made in the VPN gateway 200 and the overlay tunnel route forwarding device 300 to connect to the dedicated network for each contracted organization, and an overlay tunnel route for data transfer is built; and when the number of connected terminals changes from 1 or more to 0, the settings of the VPN gateway 200 and the overlay tunnel route forwarding device 300 are deleted, the VPN gateway 200 is stopped, and the overlay tunnel route for data transfer is deleted. Therefore, according to this embodiment, the following effects are achieved.

[0089] With the conventional method, it was necessary to prepare a vGW in every area and to pre-configure area-specific instance information. In addition, the vGW had to be activated in every area, and the operational server had to be fixed for each dedicated network. Furthermore, the general-purpose server running the gateway process (hereafter referred to as the "operational server") keeps the gateway process on standby even when no packet data arrives, occupying memory and consuming power. Therefore, when there are multiple gateway processes, each providing gateway functionality to a separate dedicated network, the memory available to the operational server for the gateway process is reduced, potentially resulting in a decline in packet forwarding performance.

[0090] However, the communication control system 1 of embodiment 1 dynamically configures the gateway process depending on the increase or decrease in the number of connected terminals. In other words, by dynamically controlling the VPN gateway 200 and the overlay tunnel route forwarding device 300 that construct the overlay tunnel route for data transfer, it is possible to reduce power consumption and avoid unnecessary resource occupation.

[0091] 3. Embodiment 1': Selection of a VPN Gateway Server Taking into Account the Load on the VPN Gateway Server Next, embodiment 1' will be described as another embodiment. In embodiment 1', the communication control system 1 selects an active server to operate, taking into consideration the load on the active server of the VPN gateway 200. Specifically, the communication control system 1 in embodiment 1' periodically acquires information on the operating status of the VPN gateway 200, such as the CPU usage rate of the active server and the number of active VPN gateways 200, and determines an active server that meets predetermined conditions (for example, low CPU usage rate, high power efficiency, low load, etc.).

[0092] A specific example of the above will be described with reference to Figure 20. Figure 20 shows a situation in which two working servers of VPN gateway 200 exist: working server 20A with a CPU utilization rate of 20% and working server 20B with a CPU utilization rate of 80%. First, monitoring unit 636 of connected terminal number management device 600 monitors the CPU utilization rates of working server 20A and working server 20B, and acquires information about the CPU utilization rates at predetermined time intervals (see (1) in Figure 20).

[0093] Then, based on the acquired information about CPU usage, the monitoring unit 636 of the connected terminal number management device 600 selects an operating server to operate the VPN gateway 200. In the example shown in Fig. 20, the CPU usage of operating server 20A is lower than that of operating server 20B, so the monitoring unit 636 of the connected terminal number management device 600 determines to use operating server 20A as the operating server.

[0094] In the example of Figure 20, CPU usage rate was mentioned, but the monitoring unit 636 of the connected terminal number management device 600 may also determine the operating server to operate using other information such as the number of VPN gateways in operation, memory usage rate, and the number of connected terminals.

[0095] [3-1. Configuration of the communication control system] Next, the configuration of the communication control system 1 in embodiment 1' will be described with reference to FIG. 21. The communication control system 1 in embodiment 1' has a device configuration including a terminal device 100, a VPN gateway 200, an overlay tunnel route forwarding device 300, a terminal location information management device 400, a contract information management device 500, a number-of-connected-terminals management device 600, and a transfer information management device 700. The functional units of each device will be described in detail in the following sections. Note that the system configuration in embodiment 1' is the same as in embodiment 1, and in this section only the monitoring unit 636 of the number-of-connected-terminals management device 600, which is a different functional unit, will be described, and detailed description of the other units will be omitted.

[0096] (Monitoring Department 636) The monitoring unit 636 acquires information about the operating status of the operating server from the operating server that runs the VPN gateway 200, and determines which operating server to operate based on the information about the operating status. For example, the monitoring unit 636 monitors the operating server of the VPN gateway 200 and acquires information about the operating status of the operating server (e.g., CPU usage rate, memory usage rate, memory usage amount, number of VPN gateways in operation, etc.). Note that the monitoring unit 636 is not limited to the information described above, and may monitor and acquire other information as necessary.

[0097] [3-2. Communication control method procedure] Next, a communication control method performed by the communication control system 1 in embodiment 1' will be described with reference to Figure 22. First, the monitoring unit 636 of the device for managing the number of connected terminals 600 monitors the operating status of the operating server of the VPN gateway 200 (step S31). Then, the monitoring unit 636 of the device for managing the number of connected terminals 600 acquires information relating to the operating status of the operating server (step S32). Furthermore, the monitoring unit 636 of the device for managing the number of connected terminals 600 determines the operating server to use based on the information relating to the operating status (step S33).

[0098] [3-3. Effects] In the embodiment 1', the communication control system 1 has the following effects.

[0099] In conventional technology, a static configuration is used in which all gateway process and overlay settings are configured when a dedicated network begins to be used. With this static configuration method, the operating server for the gateway process corresponding to each dedicated network is also determined at the time of configuration. As a result, in conventional technology, there was no method for distributing the load of gateway processes among operating servers according to the operating status of the operating servers and the gateway processes. As a result, when a large number of terminals are connected to a dedicated network managed by a gateway process running on a certain operating server, traffic can become concentrated on a specific operating server, resulting in a degradation of packet forwarding performance.

[0100] However, the communication control system 1 in embodiment 1' dynamically selects the operating server that operates the VPN gateway 200 depending on the operating status of the operating server, thereby providing the effect of balancing the load on the operating servers and suppressing deterioration of packet forwarding performance.

[0101] 4. First Embodiment: Operation when changing overlay tunnel route forwarding device due to area movement Next, a further different embodiment, embodiment 1″, will be described. Embodiment 1″ is an embodiment in which the terminal device 100 moves between areas, and the overlay tunnel route forwarding device 300 in charge is changed.

[0102] An outline of embodiment 1'' will be explained below using FIG. 23. FIG. 23 shows that a terminal device 100 moves between logically different areas, "area A" and "area B." Furthermore, it is assumed that a terminal location information manager 400 belonging to each area holds the anchor GW ID in charge of the overlay tunnel route forwarding device 300 belonging to the corresponding area. Therefore, when the terminal device 100 registers in the mobile network, the terminal location information manager 400 and overlay tunnel route forwarding device 300 in charge are determined depending on the base station to which the terminal device 100 connects.

[0103] Specifically, area A is the terminal location information manager 400A and overlay tunnel route forwarding device 300A, and area B is the terminal location information manager 400B and overlay tunnel route forwarding device 300B. In other words, when the terminal device 100 moves across areas, the terminal location information manager 400 to which it is registered changes, and as a result, the overlay tunnel route forwarding device 300 to which it is connected changes.

[0104] A specific example of embodiment 1'' will now be described with reference to FIG. 23. First, the terminal device 100 moves across areas from area A to area B (see (1) in FIG. 23). Next, the terminal location information managing device 400B in area B, the destination of the movement, registers the terminal ID and the destination VPN ID of the terminal device 100 (see (2) in FIG. 23).

[0105] Next, similar to the procedure of embodiment 1, terminal location information managing device 400B establishes a D-plane session within the mobile network (see (3) in Figure 23). Then, although not shown in Figure 23, counting unit 631 of connected terminal number managing device 600 performs a process of adding the number of connected terminals in area B. Next, when a D-plane session is established in area B, terminal location information managing device 400A terminates the D-plane session in area A (see (4) in Figure 23). Then, although not shown in Figure 23, counting unit 631 of connected terminal number managing device 600 performs a process of subtracting the number of connected terminals in area A.

[0106] [4-1. Communication control system configuration] From here, the configuration of the communication control system 1 in embodiment 1" will be explained. The communication control system 1 in embodiment 1" is an apparatus configuration including a terminal device 100, a VPN gateway 200, an overlay tunnel route forwarding device 300, a terminal location information management device 400, a contract information management device 500, a connected terminal number management device 600, and a transfer information management device 700. Note that the system configuration in embodiment 1" is the same as in embodiment 1, so detailed explanation will be omitted.

[0107] [4-2. Communication control method procedure] Next, a communication control method performed by the communication control system 1 in embodiment 1'' will be described with reference to Figure 24. First, the terminal device 100 moves from an arbitrary area A to a different area B (step S41). Next, the terminal location information manager 500B in the destination area B registers the terminal ID and destination VPN ID of the terminal device 100 that has moved between areas in the terminal location information manager 400B (step S42). Then, the terminal location information manager 400B determines the destination overlay tunnel route forwarding device 300B, as in the procedure of embodiment 1, and establishes a D-plane session within the mobile network (step S43).

[0108] Next, the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals in area B, adds up, and updates (step S44). Next, after a D-plane session is established in area B, the terminal location information management device 500A terminates the D-plane session in area A (step S45). Then, the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals in area A, subtracts, and updates (step S46).

[0109] [4-3. Effects] In the embodiment 1'', the communication control system 1 has the following advantages.

[0110] In the communication control system 1 according to embodiment 1'', even when the terminal device 100 moves between areas and the overlay tunnel route forwarding device 300 in charge changes, the terminal location information management device 400 in the new area acquires information necessary for counting the number of connected terminals from the terminal device 100, and the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals. The setting unit 634 and deletion unit 635 of the connected terminal number management device 600 dynamically control the VPN gateway 200 and the overlay tunnel route forwarding device 300, thereby providing the effect of saving resources on the operating server and improving the load balancing efficiency of the gateway process.

[0111] 5. Embodiment 2: When a terminal device connects to a VPN via Wi-Fi From here, a further different embodiment will be described, which is embodiment 2. In embodiment 2, an embodiment will be described in which the terminal device 100 connects to a VPN via a mobile network instead of WiFi.

[0112] First, an overview of the second embodiment will be described with reference to FIG. 25. First, a terminal device 100 making a WiFi connection connects to a WiFi router R (see (1) in FIG. 25). Next, the WiFi router R transfers packet data to a mobile gateway 800 (see (2) in FIG. 25). Then, the mobile gateway 800 determines the VPN connection address and the destination VPN ID based on the destination information (e.g., IP address) sent by the terminal device 100, based on information related to the destination address (VPN connection address) and information related to the corresponding VPN (destination VPN ID) that it stores in advance, and establishes a D-plane session on behalf of the terminal device 100. Then, the mobile gateway 800 transfers data to the D-plane session corresponding to the destination VPN (see (3) in FIG. 25). Note that the subsequent counting of the number of connected terminals is omitted because it is the same as in the first embodiment.

[0113] Next, we will explain the detailed operation flow of mobile gateway 800. First, there are two methods by which mobile gateway 800 acquires the destination VPN ID: "Case 1: The destination VPN ID is acquired when the terminal device performs VPN authentication" and "Case 2: The terminal device transmits an announcement message for a certain period of time when connected to WiFi." First, we will explain case 1 using Figure 26.

[0114] In FIG. 26, the terminal device 100 transmits a VPN authentication request (including a password and a user ID) to the mobile gateway 800 when starting a VPN connection (see (1) in FIG. 26). Subsequently, the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (see (2) in FIG. 26). Then, the VPN authentication server 900 transmits an authentication response (a destination VPN ID or a VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (see (3) in FIG. 26). Note that when the VPN authentication server 900 transmits the VPN terminal address, the mobile gateway 800 acquires the corresponding destination VPN ID from the contract information management device 500 based on the VPN terminal address (see (4) in FIG. 26).

[0115] Next, the mobile gateway 800 transmits the destination VPN ID acquired from the VPN authentication server 900 or the contract information management device 500 to the terminal location information management device 400 (see (5) in FIG. 26). The terminal location information management device 400 further transmits the destination VPN ID to the transfer information management device 700 and acquires the corresponding VPN connection address (see (6) in FIG. 26). Next, the terminal location information management device 400 transmits the acquired VPN connection address to the mobile gateway 800 (see (7) in FIG. 26). The mobile gateway 800 then maps the acquired VPN connection address to the destination VPN ID it holds and sets it.

[0116] Next, case 2 will be explained using FIG. 27. First, when the terminal device 100 detects a WiFi connection, it establishes an encrypted path C with the mobile gateway 800 (see (1) in FIG. 27). If the terminal device 100 is unable to establish the encrypted path C within a predetermined time, it stops the procedure for establishing the encrypted path C. Then, the mobile gateway 800 performs VPN authentication in the same manner as in the above-described case 1, obtains a VPN connection address and a destination VPN ID, and sets these to itself after mapping. Next, the mobile gateway 800 transmits a registration completion message to the terminal device 100 via the encrypted path C (see (2) in FIG. 27).

[0117] [5-1. Configuration of the communication control system] Next, the configuration of the communication control system 1 in the second embodiment will be described with reference to FIG. 28. The communication control system 1 in the second embodiment has a device configuration including a terminal device 100, a VPN gateway 200, an overlay tunnel route forwarding device 300, a terminal location information management device 400, a contract information management device 500, a connected terminal number management device 600, a transfer information management device 700, and a mobile gateway 800. The functional units of each device will be described in detail in the following sections. Note that the device configuration in the second embodiment other than the mobile gateway 800 is the same as in the first embodiment, and so in this section only the mobile gateway 800, which is different, will be described, and detailed description of the other parts will be omitted.

[0118] (Mobile Gateway 800) 28, the mobile gateway 800 includes a communication unit 810, a storage unit 820, and a control unit 830. Note that the functions of the communication unit 810 are similar to those described for the communication unit 110 of the terminal device 100, and therefore will not be described here.

[0119] (Storage unit 820) The storage unit 820 stores data and programs required for various processes performed by the control unit 830. The storage unit 820 also includes a VPN search table 821 storage unit.

[0120] (VPN search table storage unit 821) The VPN search table storage unit 821 stores a VPN search table that maps and sets the acquired VPN connection address and the destination VPN ID. Specifically, the VPN search table storage unit 821 stores the items "VPN connection address" and "destination VPN ID" as the VPN search table, as shown in FIG. 29. Note that the information stored in the VPN search table storage unit 821 is not limited to the above-mentioned items, and other items may also be stored. Furthermore, the input information for each item shown in FIG. 29 is merely an example, and is not limited to the information described.

[0121] (control unit 830) 28, the description will be continued. The control unit 830 includes a distribution unit 831, a transmission unit 832, a setting unit 833, and a session establishment unit 834.

[0122] (Distribution section 831) The distribution unit 831 determines the VPN connection address and the destination VPN ID based on information about the destination address (VPN connection address) and information about the corresponding VPN (destination VPN ID) that it stores in advance, and the destination information (IP address) sent by the terminal device 100, and distributes communication to the D-plane session corresponding to the destination VPN.

[0123] (Transmitter 832) The transmitting unit 832 transmits an authentication request (including a user ID, a password, etc.) received from the terminal device 100 to the VPN authentication server 900. Furthermore, the transmitting unit 832 transmits the destination VPN ID acquired from the VPN authentication server 900 to the terminal location information managing device 400. The transmitting unit 832 also transmits a registration completion message to the terminal device 100.

[0124] (Setting section 833) The setting unit 833 maps the VPN connection address acquired from the transfer information control device 700 to the destination VPN ID held by the mobile gateway 800 and sets it.

[0125] (Session establishment unit 834) The session establishment unit 834 establishes an overlay tunnel route for data transfer with the terminal location information management device 400 on behalf of the terminal device 100 based on the contract information (destination VPN ID), information for connecting to the dedicated network for each contract organization to which the terminal device 100 is to connect (VPN connection address), and destination information included in the packet data sent by the terminal device 100.

[0126] Specifically, to establish a D-plane session based on a D-plane session establishment request from the terminal device 100, the session establishment unit 834 determines the destination VPN connection address and destination VPN ID from the destination information (IP address) included in the packet data sent by the terminal device 100, based on the mapped VPN connection address and destination VPN ID. Then, the session establishment unit 834 establishes a D-plane session corresponding to the destination VPN and transfers the packet data.

[0127] [5-2. Communication control method procedure] Next, a description will be given of the communication control method performed by the communication control system 1 in embodiment 2. As described above, in embodiment 2, there are two methods for the mobile gateway 800 to acquire the destination VPN ID, and therefore the procedures for each case will be described separately. First, the procedure for the case corresponding to the above-mentioned case 1 will be described using FIG. 30.

[0128] First, the terminal device 100 connects to the WiFi router R (step S51). Next, the terminal device 100 transmits a VPN authentication request (including a password and a user ID) to the mobile gateway 800 when starting a VPN connection (step S52). Next, the transmitting unit 832 of the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (step S53). Then, the VPN authentication server 900 transmits an authentication response (a destination VPN ID or a VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (step S54).

[0129] Next, the transmitting unit 832 of the mobile gateway 800 transmits the destination VPN ID acquired from the VPN authentication server 900 to the terminal location information manager 400 (step S55). Then, the acquiring unit 435 of the terminal location information manager 400 acquires a VPN connection address from the transfer information manager 700 (step S56). Next, the transmitting unit 434 of the terminal location information manager 400 transmits the acquired VPN connection address to the mobile gateway 800 (step S57). The setting unit 833 of the mobile gateway 800 maps the acquired VPN connection address to the stored destination VPN ID and sets it (step S58).

[0130] Next, the WiFi router R transfers the packet data to the mobile gateway 800 (step S59). Subsequently, the session establishment unit 834 of the mobile gateway 800 determines the destination VPN connection address and destination VPN ID from the destination information included in the packet data sent by the terminal device 100, based on the mapped VPN connection address and destination VPN ID (step S60). Then, the session establishment unit 834 of the mobile gateway 800 establishes a D-plane session corresponding to the destination VPN, and transfers the packet data (step S61).

[0131] Next, the procedure for the case corresponding to the above-mentioned Case 2 will be explained using Figure 31. The terminal device 100 connects to the WiFi router R (step S71). At this time, the terminal device 100 establishes an encrypted path C with the mobile gateway 800 (step S72). Next, the terminal device 100 transmits a VPN authentication request (including a password and a user ID) to the mobile gateway 800 when starting the VPN connection (step S73). Next, the transmitting unit 832 of the mobile gateway 800 transmits the authentication request received from the terminal device 100 to the VPN authentication server 900 (step S74). Then, the VPN authentication server 900 transmits an authentication response (a destination VPN ID or a VPN terminal address) to the mobile gateway 800 based on the information included in the received authentication request (step S75).

[0132] Next, the transmitting unit 832 of the mobile gateway 800 transmits the destination VPN ID acquired from the VPN authentication server 900 to the terminal location information manager 400 (step S76). Then, the acquiring unit 435 of the terminal location information manager 400 acquires a VPN connection address from the transfer information manager 700 (step S77). Next, the transmitting unit 434 of the terminal location information manager 400 transmits the acquired VPN connection address to the mobile gateway 800 (step S78). The setting unit 833 of the mobile gateway 800 maps the acquired VPN connection address with the retained destination VPN ID and sets it (step S79). Then, the transmitting unit 832 of the mobile gateway 800 transmits a registration completion message to the terminal device 100 (step S80).

[0133] Next, the WiFi router R transfers the packet data to the mobile gateway 800 (step S81). Subsequently, the session establishment unit 834 of the mobile gateway 800 determines the destination VPN connection address and destination VPN ID from the destination information included in the packet data sent by the terminal device 100, based on the mapped VPN connection address and destination VPN ID (step S82). Then, the session establishment unit 834 of the mobile gateway 800 establishes a D-plane session corresponding to the destination VPN, and transfers the packet data (step S83).

[0134] [5-3. Effects] In the second embodiment, the communication control system 1 provides the following effects.

[0135] In the prior art, when performing WiFi communication, the terminal device 100 only had the destination IP address of the data packet to be forwarded to the VPN as information for identifying the VPN to be accessed, and the mobile gateway 800 had to attach information identifying the VPN to the signaling message for session establishment.

[0136] Furthermore, in the prior art, a device equivalent to the mobile gateway 800 could not derive information identifying the VPN to be accessed from the destination IP address of the arriving packet, and therefore could not establish an overlay tunnel route for data transfer to the VPN via mobile network signaling at the same time as the packet arrived.

[0137] However, the communication control system 1 in embodiment 2 provides the effect of searching for a mapped VPN connection address from the destination information (IP address) of packet data arriving at the mobile gateway 800, establishing an overlay tunnel route for data transfer, and making it possible to count the number of connected terminals.

[0138] 6. Embodiment 2-1: When a terminal device connects to a VPN via an IP network From here, an embodiment 2-1 will be described as a similar embodiment to embodiment 2. In Fig. 32, an embodiment will be described in which the terminal device 100 connects to a VPN from WiFi via an IP network.

[0139] First, Fig. 32 illustrates a case where the terminal device 100 connects to a fixed network access router SR via a WiFi router R, and a case where the terminal device 100 connects directly to the fixed network access router SR. In Fig. 32, when the terminal device 100 accesses via an IP network, the communication control system 1 cannot count the number of connected terminals based on the establishment and release of a D-plane session. Therefore, the communication control system 1 in embodiment 2-1 counts the number of connected terminals using terminal operation confirmation triggered by a "heartbeat," "ping," or the like, after the VPN authentication and establishment of an overlay tunnel route for data transfer described in embodiment 2 are performed.

[0140] Furthermore, as a premise of embodiment 2-1, an overlay tunnel route forwarding device 300 for an IP network (hereinafter referred to as "overlay tunnel route forwarding device 300") is installed between an IP network and a data network. As shown in Fig. 33, the communication control system 1 is configured to include a plurality of VPN authentication servers 900 for IP networks (hereinafter referred to as "VPN authentication servers 900") and a plurality of access points AP (for example, residential Wi-Fi routers, etc.) in order to identify the overlay tunnel route forwarding device 300.

[0141] Next, an overview of the operation of the communication control system 1 in embodiment 2-1 will be described using Fig. 34. First, the terminal device 100 transmits VPN connection information (user ID, password, etc.) to the VPN authentication server 900 via the WiFi router R and the fixed network access router SR, or via only the fixed network access router SR (see (1) in Fig. 34).

[0142] Next, the VPN authentication server 900 notifies the connected terminal number management device 600 of the destination VPN ID and the responsible anchor GW ID (see (2) in FIG. 34). Then, the connected terminal number management device 600 counts and adds up the number of connected terminals connected to the target VPN that is connected to the dedicated network from the corresponding overlay tunnel route forwarding device 300. Note that the procedure for constructing an overlay tunnel route for data transfer after the addition is the same as the method described in embodiment 1.

[0143] Next, the terminal survival confirmation unit 333 of the overlay tunnel route forwarding device 300 confirms the survival of the terminal using "heartbeat", "ping", etc. (see (3) in Figure 34). Then, if the terminal survival confirmation unit 333 of the overlay tunnel route forwarding device 300 finds that the terminal device 100 has stopped responding as a result of the terminal survival confirmation, it notifies the connected terminal number management device 600 of the destination VPN ID and the responsible anchor GW ID (see (4) in Figure 34). Then, based on the above-mentioned notification, the connected terminal number management device 600 counts and subtracts the number of connected terminals connected to the target VPN to be connected to the dedicated network. Note that the procedure for deleting the data forwarding overlay tunnel route after subtraction is the same as the method described in embodiment 1.

[0144] [6-1. Configuration of communication control system] Next, the configuration of the communication control system 1 in embodiment 2-1 will be described. The communication control system 1 in embodiment 2-1 is configured to include a terminal device 100, a VPN gateway 200, an overlay tunnel route forwarding device 300 for an IP network, a terminal location information management device 400, a contract information management device 500, a connected terminal number management device 600, and a forwarding information management device 700.

[0145] The system configuration other than the overlay tunnel route forwarding device 300 in embodiment 2-1 is the same as in embodiment 1, and in this section only the overlay tunnel route forwarding device 300, which is different, will be explained, and detailed explanation of the rest will be omitted. Furthermore, since the overlay tunnel route forwarding device 300 in embodiment 2-1 has the same functions as the overlay tunnel route forwarding device 300 in embodiment 1, only the terminal survival confirmation unit 333, which is a different functional unit, will be explained, and explanation of the rest will be omitted.

[0146] (control unit 330) From here, explanation will be made using Fig. 35. The control unit 330 has a packet header analysis unit 331, a transfer processing unit 332, and a terminal existence confirmation unit 333.

[0147] (Terminal existence confirmation unit 333) The terminal existence confirmation unit 333 transmits an identification signal to the terminal device 100 connected to the dedicated network via the IP network, and confirms whether the terminal device 100 is connected to the dedicated network.

[0148] Specifically, the terminal existence confirmation unit 333 confirms the terminal existence using "heartbeat", "ping", or the like, and determines whether or not there is a response from the terminal device 100. Then, based on the determination result of the above-mentioned terminal existence confirmation, the terminal existence confirmation unit 333 notifies the connected terminal number management device 600 of the connected VPN ID and the responsible anchor GW ID. Then, if the terminal existence confirmation shows that there is no response from the terminal device 100, the terminal existence confirmation unit 333 notifies the connected terminal number management device 600 of the connected VPN ID and the responsible anchor GW ID.

[0149] [6-2. Communication control method procedure] Next, the procedure of the communication control method performed by the communication control system 1 according to embodiment 2-1 will be described with reference to Fig. 36. First, the terminal device 100 transmits VPN connection information (user ID, password, etc.) to the VPN authentication server 900 via the WiFi router R and the fixed network access router SR or via only the fixed network access router SR (step S91). Furthermore, the VPN authentication server 900 notifies the connected terminal number management device 600 of the destination VPN ID and the responsible anchor GW ID (step S92).

[0150] Then, the connected terminal number management device 600 counts the number of connected terminals connected to the target VPN via the corresponding overlay tunnel route forwarding device 300 based on the destination VPN ID and responsible anchor GW ID notified by the VPN authentication server 900, and adds up and updates the count (step S93). Subsequently, the terminal existence confirmation unit 333 of the overlay tunnel route forwarding device 300 confirms the existence of the terminal using "heartbeat", "ping", etc. (step S94).

[0151] Then, the terminal existence confirmation unit 333 of the overlay tunnel route forwarding device 300 determines that there is no longer a response from the terminal device 100 (Yes in step S95). In this case, the terminal existence confirmation unit 333 of the overlay tunnel route forwarding device 300 notifies the connected terminal number management device 600 of the destination VPN ID and the responsible anchor GW ID (step S96). Then, the counting unit 631 of the connected terminal number management device 600 counts the number of connected terminals connected to the target VPN based on the destination VPN ID and the responsible anchor GW ID notified by the terminal existence confirmation unit 333 of the overlay tunnel route forwarding device 300, and updates the count by subtracting the number (step S97).

[0152] On the other hand, the terminal existence confirmation unit 333 of the overlay tunnel route forwarding device 300 determines that there is a response from the terminal device 100, and the process continues (No in step S95).

[0153] [6-3. Effects] In the embodiment 2-1, the communication control system 1 provides the following effects.

[0154] In the communication control system 1, the terminal existence confirmation unit 333 of the overlay tunnel route forwarding device 300 confirms the existence of the terminal device 100 and subtracts the number of connected terminals based on the response result from the terminal device 100. As a result, the communication control system 1 can count the number of connected terminals even in the case of a connection via an IP network, which cannot be counted by the method described in the first embodiment, and provides the effect of enabling dynamic control of the data transfer overlay tunnel route and the overlay tunnel route forwarding device 300.

[0155] [7. Hardware Configuration] The components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of each device can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0156] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can also be performed manually using known methods. In addition, the information including the processing procedures, control procedures, specific names, various data, and parameters shown in the drawings can be changed as desired unless otherwise specified.

[0157] [program] In one embodiment, the various devices constituting the communication control system 1 can be implemented by installing a display program that executes the above-described learning as package software or online software on a desired computer. For example, by executing the display program on an information processing device, the various devices constituting the communication control system 1 can function. The information processing device referred to here includes desktop and notebook personal computers. In addition, the information processing device also includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants).

[0158] 37 is a diagram showing an example of a computer in which various devices constituting the communication control system 1 are realized. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0159] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0160] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes of the various devices that make up the communication control system 1 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configurations of the various devices that make up the communication control system 1 are stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0161] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0162] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a LAN or a WAN (Wide Area Network)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0163] [8. Other] Although the present embodiment has been described above, the present embodiment is not limited by the descriptions and drawings that form part of the disclosure. In other words, other embodiments, examples, operational techniques, etc. that are made by those skilled in the art based on the present embodiment are all included in the scope of the present embodiment. [Explanation of symbols]

[0164] 1. Communication Control System 10 Front-end Server 10A Front-end Server 10B Front-end Server 10C Front-end Server 20A Production Server 20B Production Server 100 Terminal Device 101 Terminal equipment 102 Terminal Equipment 110 Communications Department 120 Storage section 130 Control Unit 131 Address Management Department 132 Communication Session Management Unit 200 VPN gateways 210 Communications Department 220 Storage section 221 Transfer destination memory unit 230 Control Unit 231 Packet Header Analysis Unit 232 Transfer Processing Unit 300 Overlay Tunnel Route Forwarding Device 300A Overlay Tunnel Route Transfer Device 300B Overlay Tunnel Route Forwarding Device 310 Communications Department 320 Storage section 321 Transfer destination memory unit 330 Control Unit 331 Packet Header Analysis Unit 332 Transfer Processing Unit 333 Terminal Survival Verification Unit 400 Terminal location information management device 400A Terminal location information management device 400B Terminal location information management device 410 Communications Department 420 Storage section 421 Terminal device connection destination VPN memory unit 422 Anchor GW Memory Unit 430 Control Unit 431 Reception Department 432 Notification Department 433 Registration Department 434 Transmitter 435 Acquisition Department 500 Contract information management device 510 Communications Department 520 Storage section 521 Contract information storage unit 530 Control Unit 531 Reception Department 532 Transmitter 600 Connection terminal number management device 610 Communications Department 620 Storage section 621 Connected terminal number storage unit 630 Control Unit 631 Counting Department 632 Judgment section 633 Acquisition Department 634 Settings 635 Deleted section 636 Monitoring Department 700 Transfer information management device 710 Communications Department 720 Storage section 721 Address storage section 730 Control Unit 731 Reception Department 732 Transmitter 800 Mobile Gateway 810 Communications Department 820 Storage section 821 VPN search table storage unit 830 Control Unit 831 Sorting section 832 Transmitter 833 Settings Department 834 Session Establishment Unit 900 VPN authentication server R WiFi Router SR fixed network access router AP Access point DN Data Network MN Mobile Network 1000 computers 1010 memory 1011 ROM 1012 RAM 1020 CPU 1030 hard disk drive interface 1040 disk drive interface 1050 serial port interface 1060 video adapter 1070 Network Interface 1080 Bus 1090 hard disk drive 1091 OS 1092 Application Program 1093 Program Module 1094 Program Data 1100 disk drive 1110 Mouse 1120 keyboard

Claims

1. A communication control system having a connected terminal number management device that establishes and deletes a data transfer overlay tunnel route used by a terminal device belonging to a connection network to connect to a dedicated network for each contract organization, the connected terminal number management device is a counting unit that counts the number of connected terminals, which is the number of terminal devices accessing the dedicated network for each contract organization, using contract information that is information that identifies the dedicated network for each contract organization and anchor GW identification information that is information that identifies an overlay tunnel route forwarding device that belongs to an area to which the terminal device is connected; a setting unit that starts a VPN gateway when the number of connected terminals changes from 0 to 1 or more, and configures the VPN gateway and the overlay tunnel route forwarding device to connect to a dedicated network for each contracted organization, thereby constructing the overlay tunnel route for data transfer; a deletion unit that deletes the settings of the VPN gateway and the overlay tunnel route forwarding device, stops the VPN gateway, and deletes the data transfer overlay tunnel route when the number of connected terminals becomes zero from one or more, A communication control system comprising:

2. the communication control system further includes a terminal location information management device; The terminal location information management device includes a reception unit that receives, from the terminal device, terminal device information that is information for identifying the terminal device, the contract information, and a connection request that is a request for connection from a mobile network to a data network; a registration unit that registers the terminal device information and the contract information; a transmission unit that transmits the contract information and the anchor GW identification information to the connected terminal number management device based on the connection request; 2. The communication control system according to claim 1.

3. the communication control system further includes a terminal location information management device and a contract information management device; The terminal location information management device includes a reception unit that receives, from the terminal device, terminal device information that is information for identifying the terminal device, a registration request that is a request to register the terminal device information and the contract information in the terminal location information management device, and a connection request that is a request to connect from a mobile network to a data network; a registration unit that registers the terminal device information and the contract information acquired from the contract information management device using the terminal device information based on the registration request; a transmission unit that transmits the contract information and the anchor GW identification information to the connected terminal number management device based on the connection request; 2. The communication control system according to claim 1.

4. an acquisition unit that acquires, from a transfer information management device, information for connecting to a dedicated network for each contract organization to which the terminal device is to be connected, using the contract information; a monitoring unit that acquires information about the operation status of the operation server that operates the VPN gateway from the operation server, and determines the operation server to be operated based on the information about the operation status; 2. The communication control system according to claim 1.

5. the communication control system further comprises a mobile gateway; The mobile gateway further includes a session establishment unit that establishes an overlay tunnel route for data transfer with the terminal location information management device on behalf of the terminal device based on the contract information, information for connecting to a dedicated network for each contract organization to which the terminal device is to connect, and destination information included in packet data transmitted by the terminal device.

2. The communication control system according to claim 1.

6. The overlay tunnel route forwarding device further includes a terminal existence confirmation unit that transmits an identification signal to the terminal device connected to the dedicated network via an IP network and confirms whether the terminal device is connected to the dedicated network.

2. The communication control system according to claim 1.

7. A communication control system having a connected terminal number management device that establishes and deletes a data transfer overlay tunnel route used by a terminal device belonging to a connection network to connect to a dedicated network for each contract organization, the connected terminal number management device counts the number of connected terminals, which is the number of the terminal devices accessing the dedicated network for each contract organization, using contract information, which is information for identifying the dedicated network for each contract organization, and anchor GW identification information, which is information for identifying an overlay tunnel route forwarding device belonging to an area to which the terminal device is connected; a step of starting up a VPN gateway when the number of connected terminals changes from 0 to 1 or more, configuring the VPN gateway and the overlay tunnel route forwarding device to connect to a dedicated network for each contracted organization, and constructing the overlay tunnel route for data transfer; and when the number of connected terminals becomes zero from one or more, deleting the settings of the VPN gateway and the overlay tunnel route forwarding device, stopping the VPN gateway, and deleting the data transfer overlay tunnel route. A communication control method comprising:

8. A communication control system having a connected terminal number management device that establishes and deletes a data transfer overlay tunnel route used by a terminal device belonging to a connection network to connect to a dedicated network for each contract organization, the connected terminal number management device counts the number of connected terminals, which is the number of the terminal devices accessing the dedicated network for each contract organization, using contract information, which is information for identifying the dedicated network for each contract organization, and anchor GW identification information, which is information for identifying an overlay tunnel route forwarding device belonging to an area to which the terminal device is connected; When the number of connected terminals changes from 0 to 1 or more, starting up a VPN gateway, configuring the VPN gateway and the overlay tunnel route forwarding device to connect to a dedicated network for each contracted organization, and constructing the overlay tunnel route for data transfer; and when the number of connected terminals becomes zero from one or more, deleting the settings of the VPN gateway and the overlay tunnel route forwarding device, stopping the VPN gateway, and deleting the data transfer overlay tunnel route. A communication control program comprising:

Images