Communication device, communication system, communication method, and program

Abstract

A communication device that performs packet communication, said communication device comprising: a data storage unit that holds a rule of a value added service policy; a control unit that adds a rule for a terminal to the data storage unit as trigger for commencement of communication of that terminal; and a reception unit that receives a packet relating to the communication of the terminal, wherein the control unit performs a process relating to the value added service with respect to the packet, on the basis of the added rule.

Description

[Technical Field]

[0001] The present invention relates to a communication device that performs packet communication. [Background technology]

[0002] A widely used communication format is one in which a packet transmitted from a terminal is forwarded to an external server by a gateway (GW). The gateway has, for example, a network address port translation (NAPT) function.

[0003] Between the GW and an external server, a GW (called a VAS-GW) that provides value added services (VAS) such as packet filtering may be installed. The VAS-GW generally performs processing related to value added services based on the 5-tuple of a packet. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Suzuki et al., "Development of Core Network (EPC) Accommodating LTE," NTT DOCOMO Technical Journal, Vol. 19, No. 1, Apr. 2011, https: / / www.nttdocomo.co.jp / binary / pdf / corporate / technology / rd / technical_journal / bn / vol19_1 / vol19_1_026jp.pdf [Non-patent document 2] Juniper NETWORKS, "Network Address Port Translation," 17,Feb,2021. https: / / www.juniper.net / documentation / us / en / software / junos / interfaces-adaptive-services / topics / topic-map / network-address-port-translation.html Summary of the Invention [Problem to be solved by the invention]

[0005] In conventional technologies, the VAS-GW must also maintain rules for terminals that are not communicating. Therefore, in an environment with a large number of terminals, the number of rule entries to be searched becomes large regardless of whether the terminal is communicating or not, and it takes time to apply rules for value-added services. As a result, performance may be degraded.

[0006] The present invention has been made in consideration of the above points, and aims to provide a technology that makes it possible to exclude rules related to terminals that are not engaged in communication in a device that provides value-added services for packet communication. [Means for solving the problem]

[0007] According to the disclosed technology, there is provided a communication device that performs packet communication, a data storage unit for storing rules of value-added service policies; A terminal The device has received communication start information from another communication device, including NAPT session information or DHCP address assignment information, which indicates that the device has started communication. a control unit that, upon receipt of the request, adds a rule for the terminal to the data storage unit; a receiving unit for receiving packets related to communication of the terminal; the control unit executes a process related to a value-added service for the packet based on the added rule. and If no communication regarding the terminal occurs for a predetermined period of time, or if a signal indicating that communication regarding the terminal has ended is detected, the rule regarding the terminal is deleted. communication equipment is provided. [Effects of the Invention]

[0008] The disclosed technology provides a technology that enables a device that provides value-added services for packet communications to exclude rules related to terminals that are not performing communications. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating a basic system configuration. [Figure 2] FIG. 1 is a diagram for explaining a problem. [Figure 3] FIG. 1 is a diagram for explaining an overview of an embodiment. [Figure 4] FIG. 10 is a diagram for explaining an operation example. [Figure 5] FIG. 1 is a diagram illustrating an example of the configuration of an apparatus. [Figure 6] FIG. 2 illustrates an example of a hardware configuration of the apparatus. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0011] (Basic configuration) First, the basic system configuration and operation related to this embodiment will be described, and then the problems will be described.

[0012] An example of the system configuration is shown in Figure 1. Figure 1 (and Figure 2) show an example of a configuration that does not have the functions according to the present invention in order to explain the problem. Note that Figures 1 and 2 are not publicly known.

[0013] As shown in Fig. 1, this system includes a GW 10, a VAS-GW (value added service - gateway) 20, and a server 30, and UEs (user equipments) 1 to 3 are connected to the GW 10. The devices are connected to each other via a wired or wireless network, and can communicate as shown in the figure.

[0014] A UE is a device that transmits and receives packet communications. Examples of a UE include a PC, a smartphone, and an IoT device. A UE may also be called a terminal.

[0015] The GW 10 may be any network device that processes packets. The GW 10 has network functions such as L2 / L3 forwarding, firewall, VPN connection, DPI, proxy, etc. The GW 10 may also be called a communication device.

[0016] The GW 10 may be an S-GW or P-GW in the EPC, a UPF in 5GC, a base station (eNodeB, gNodeB, etc.), a router, a switch, etc. The GW 10 may be a physical device or a virtual device.

[0017] The above explanation about the GW10 also applies to the VAS-GW20. The VAS-GW20 differs from the GW10 in that it has the function of providing value-added services.

[0018] In Fig. 1, UEs 1 to 3 are connected to a GW 10 and communicate with a server 30 connected to the GW 10. The server 30 is, for example, an application server. A VAS-GW 20 is installed between the GW 10 and the server 30. The VAS-GW 20 provides, for example, the following value-added services to user communications.

[0019] Packet filtering QoS control (prioritizing communications from specific UEs or specific ports, etc.) Communication anomaly detection Policy-based routing In these processes, the VAS-GW 20 checks the packet header (5 tuples, etc.) of the received packet to determine whether or not processing of the packet is necessary. The 5 tuples consist of the source IP address, source port number, destination IP address, destination port number, and protocol number.

[0020] As an example, the VAS-GW 20 holds a value-added service policy for filtering, as shown in Fig. 1. By having rules for each UE in the value-added service policy, it is possible to perform various processes on user traffic.

[0021] Furthermore, in a configuration where a large number of UEs are connected, for example, the GW10 is equipped with a NAPT function, as shown in Figure 2. In Figure 2, this is shown as NAT-GW10. By performing NAPT (Network Address Port Translation) in NAT-GW10, it is possible to conceal UE addresses and conserve global IP addresses. Note that NAPT processing may also be called address translation. Furthermore, "NAPT" also includes the operation of performing only address translation without converting port numbers.

[0022] (About the assignment) The issues will be explained with reference to Figure 2. The VAS-GW20 stores rules for each UE and performs filtering and QoS control for each UE. In such a case, rule entries are required for each UE, and as the number of UEs increases, the number of entries also increases. For example, in the case of an expected huge number of IoT devices, the corresponding number of entries is also expected to become huge.

[0023] In the conventional technology, the value-added service policy may contain entries for UEs that are not performing any communication at all. This means that it takes time for the VAS-GW 20 to search for rules, which may result in performance degradation.

[0024] (Technology of the embodiment) The following describes a technique according to this embodiment that solves the above problems. Fig. 3 shows a system configuration and an outline of operation according to this embodiment. The system configuration shown in Fig. 3 basically corresponds to a configuration in which a policy management device 250 is added to the configuration shown in Fig. 1 or 2. Furthermore, the NAT-GW 100 and VAS-GW 200 correspond to the GWs described in Fig. 1 and Fig. 2 with the functions according to the present invention added.

[0025] In response to a communication start signal notified from the NAT-GW 100 in S101, the VAS-GW 200 acquires an entry (rule) of a value-added service policy from the policy management device 250 in S102.

[0026] This allows the VAS-GW 200 to hold value-added service policy rules (entries) for only those UEs that are currently communicating, thereby eliminating entries related to terminals that are not currently communicating, thereby improving performance.

[0027] The VAS-GW200 may delete an entry related to a certain UE held in the VAS-GW200 if no communication related to the UE occurs for a predetermined period of time. The VAS-GW200 may also delete an entry related to a certain UE held in the VAS-GW200 if it detects a signal indicating that the communication of the UE has ended (e.g., the bearer has been disconnected).

[0028] The VAS-GW 200 may be called a value-added service providing device. Furthermore, both the NAT-GW 100 and the VAS-GW 200 may be called communication devices.

[0029] The NAT-GW 100 that notifies the start of communication may be any device that can recognize the session state of the UE, such as the S-GW, P-GW, UPF, base station, router, switch, etc. as described above, as well as a radius server, DHCP server, 4G / 5G core function unit (SMF, AMF, etc.). The NAT-GW 100 may also be a home gateway or CPE for home use. The NAT-GW 100 may also be replaced with a device that does not have the NAPT function.

[0030] The policy management device 250 to which the communication start notification is sent may be any device that has the function of selecting a device that requires a setting change and the function of inputting the setting to the selected device. The policy management device 250 may be a device such as an OpenFlow Controller that can operate a GW.

[0031] Furthermore, the function of policy management device 250 may be provided within VAS-GW 200. That is, the notification of the start of communication in S101 shown in Fig. 3 may be sent from NAT-GW 100 to VAS-GW 200. In this case, upon receiving the notification, VAS-GW 200 creates a rule entry for the UE that will start communication.

[0032] The NAT-GW100 may notify the policy management device 250 of the start of communication when, for example, a NAPT session is started in the NAT-GW100, a bearer (communication path) is established between the NAT-GW100 and the communication destination (e.g., the UE or the server 30), or an address is assigned to the UE by the NAT-GW100 using the DHCP function.

[0033] The information transmitted from NAT-GW 100 in S101 as a signal to start communication may be any information that can identify the start of communication for a specific UE. This information may be called communication start information.

[0034] NAPT session information or DHCP address assignment information (assigned address) may be added to the information sent from NAT-GW 100 as a signal to start communication. NAPT session information and DHCP address assignment information (assigned address) may be added to the information sent from NAT-GW 100 as a signal to start communication.

[0035] Here, we will explain NAPT session information. In the NAT-GW 100, conversion rules for IP addresses, port numbers, etc. are stored as NAPT rules, and when communication that matches these NAPT rules occurs, a NAPT session is created and the IP address and port number of the communication that matches the session are converted. Information related to the session is the NAPT session information. Session information may also be called conversion information.

[0036] By including NAPT session information or DHCP address assignment information in the information sent as a signal to start communication, it is possible to keep up with dynamically changing IP addresses and port numbers.

[0037] (Specific operation example) An example of operation when NAPT session information is used as information indicating the start of communication will be described with reference to FIG.

[0038] In S201, UE1 starts communication. In S202, when NAT-GW 100 detects that this communication matches a NAPT rule, it generates NAPT session information and transmits the NAPT session information to policy management device 250 in S203.

[0039] After transmitting the NAPT session information, the NAT-GW 100 transmits the NAPT converted packets relating to the communication of the UE 1 to the VAS-GW 200 .

[0040] The session information transmitted from NAT-GW 100 to policy management device 250 is, for example, "5 tuples before conversion and 5 tuples after conversion." Alternatively, the session information may be "part of the 5 tuples before conversion and part of the 5 tuples after conversion." Specifically, the session information transmitted from NAT-GW 100 to policy management device 250 may be "source IP address and source port number before conversion and source IP address and source port number after conversion."

[0041] Policy management device 250, which has received the NAPT session information, uses the NAPT session information to generate a rule (entry) of a value-added service policy for UE 1. For example, assume that policy DB 260 of policy management device 250 stores a rule for UE 1 that has "source IP address before conversion, source port number before conversion."

[0042] When the policy management device 250 receives "the source IP address and source port number before conversion, and the source IP address and source port number after conversion" from the NAT-GW 100 as NAPT session information, it generates a rule in which the "source IP address before conversion, source port number before conversion" in the above rule is changed to "the source IP address after conversion, source port number after conversion."

[0043] In S204, the policy management device 250 notifies the VAS-GW200 of the generated rule. The VAS-GW200 adds the rule as an entry in the value-added service policy (table). Figure 4 shows that an entry based on the IP address and port number after NAPT is added for UE1. It also shows that UE3 is not connected and therefore does not retain the rule.

[0044] In S205, the VAS-GW200 executes processing for the communication from the UE1 based on the 5 tuples after the NAPT conversion.

[0045] After UE1 starts communication, packets related to UE1's communication are sent from NAT-GW100 to VAS-GW200 even before a rule entry for UE1 is added to VAS-GW200. VAS-GW200 stores packets received before the entry is added in a buffer, and processes the packets stored in the buffer after the entry is added.

[0046] Regarding buffering received packets before adding an entry, it is desirable for VAS-GW200 to hold packets in the buffer at the time of the TCP 3-way handshake. This is because after the TCP 3-way handshake, data transmission begins via the established connection, and there is a possibility that the buffer may overflow due to a large number of packets from UE1. By holding packets in the buffer at the time of the TCP 3-way handshake, buffer overflow can be prevented.

[0047] (Device configuration example) 5 is a block diagram showing the functional configuration of a communication device 300 corresponding to the NAT-GW 100 or the VAS-GW 200. The functional configuration of the policy management device 250 is also shown in FIG.

[0048] As shown in FIG. 5, the communication device 300 includes a transmitter 310 that transmits packets, a receiver 320 that receives packets, a controller 330 that processes packets, and a data storage unit 340 that stores various data.

[0049] When the communication device 300 operates as the VAS-GW 200, the data storage unit 340 holds the rules of the value-added service policy. When a certain terminal starts communication, the control unit 330 adds the rules for the terminal to the data storage unit 340. The receiving unit 320 receives packets related to the communication of the terminal, and the receiving unit and the control unit 330 execute processing related to the value-added service for the received packets based on the added rules.

[0050] When the communication device 300 operates as the NAT-GW100, the control unit 330 detects the start of communication by a certain terminal, and the transmission unit 310 transmits communication start information indicating that the terminal has started communication, and after transmitting the communication start information, transmits packets related to the communication of the terminal to the VAS-GW200 having the rules of the value-added service policy generated based on the communication start information.

[0051] When the communication device 300 operates as the policy management device 250, the receiver 320 receives communication start information, and the controller 330 generates rules for the value-added service policy based on the communication start information. The transmitter 310 transmits the rules to the VAS-GW 200.

[0052] (Example of hardware configuration) The communication device 300, which corresponds to the NAT-GW 100, the VAS-GW 200, or the policy management device 300, can be realized, for example, by using a dedicated hardware circuit, or by having a computer execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0053] That is, communication device 300 can be realized by using hardware resources such as a CPU and memory built into a computer to execute a program corresponding to the processing performed by communication device 300. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0054] Fig. 6 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 6 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected via a bus BS.

[0055] A program for realizing processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0056] The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes functions related to the communication device 300 in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like according to the program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0057] (Effects of the embodiment) The technology according to this embodiment allows the VAS-GW200 to store only the necessary rules based on the communication start information. That is, rules related to terminals that are not communicating can be excluded, enabling faster rule application. As a result, high-speed forwarding of user communications becomes possible.

[0058] (Addendum) The following additional clauses are disclosed in relation to the above-described embodiment. (Additional note 1) a memory for storing rules of a value-added service policy; at least one processor coupled to said memory; Including, The processor: When a certain terminal starts communication, a rule for that terminal is added to the memory; receiving a packet related to communication of the terminal; Executes processing related to a value-added service for the packet based on the added rule Communication equipment. (Additional note 2) Memory and at least one processor coupled to said memory; Including, The processor: Detects the start of communication from a certain device, The terminal transmits communication start information indicating that the terminal has started communication, and after transmitting the communication start information, transmits packets related to the communication of the terminal to a value-added service providing device having a value-added service policy rule generated based on the communication start information. Communication equipment. (Additional note 3) A communication system including a communication device, a value-added service providing device, and a policy management device, When the communication device detects that a certain terminal has started communication, the communication device transmits communication start information indicating that the terminal has started communication to the policy management device; the policy management device generates a value-added service policy rule based on the communication start information and transmits the rule to the value-added service providing device; The value-added service providing device receives packets related to communication of the terminal and performs processing related to the value-added service on the packets based on the rule. Communication system. (Additional note 4) A communication method executed by a computer that has a memory for storing rules of a value-added service policy and functions as a communication device that performs packet communication, comprising: adding a rule for a certain terminal to the data storage unit when the terminal starts communication; receiving a packet related to communication of the terminal; performing a process related to a value-added service on the packet based on the added rule; A communication method comprising: (Additional note 5) A communication method executed by a computer functioning as a communication device that performs packet communication, Detecting the start of communication of a terminal; transmitting communication start information indicating that the terminal has started communication, and after transmitting the communication start information, transmitting packets related to the communication of the terminal to a value-added service providing device having a value-added service policy rule generated based on the communication start information; A communication method comprising: (Additional note 6) A communication method in a communication system including a communication device, a value-added service providing device, and a policy management device, When the communication device detects that a certain terminal has started communication, the communication device transmits communication start information indicating that the terminal has started communication to the policy management device; the policy management device generates a value-added service policy rule based on the communication start information and transmits the rule to the value-added service providing device; The value-added service providing device receives packets related to communication of the terminal and performs processing related to the value-added service on the packets based on the rule. Communication method. (Additional note 7) A non-transitory storage medium storing a program that causes a computer to execute each process in the communication device described in appended claim 1 or 2.

[0059] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0060] 1~3UE 10 GW 100 NAT-GW 20, 200 VAS-GW 250 Policy management device 260 Policy DB 30 servers 300 Communication Equipment 310 Transmitter 320 Receiving Unit 330 Control Unit 340 Data Storage Unit 1000 Drive Device 1001 Recording media 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output Device

Claims

1. A communication device that performs packet communication, a data storage unit for storing rules of value-added service policies; a control unit that, when communication start information including NAPT session information or DHCP address assignment information indicating that a certain terminal has started communication is received from another communication device, adds a rule for the terminal to the data storage unit; a receiving unit for receiving packets related to communication of the terminal; the control unit is a communication device that executes a process related to a value-added service for the packet based on the added rule, If no communication regarding the terminal occurs for a predetermined period of time, or if a signal indicating that communication regarding the terminal has ended is detected, the rule regarding the terminal is deleted. Communication equipment.

2. A communication device that performs packet communication, a control unit that detects the start of communication of a certain terminal; a transmitting unit that transmits communication start information including NAPT session information or DHCP address assignment information, which indicates that the terminal has started communication, and that transmits packets related to communication of the terminal to a value-added service providing device that has a value-added service policy rule generated based on the communication start information after transmitting the communication start information; In the value-added service providing device, when no communication related to the terminal occurs for a predetermined period of time, or when a signal indicating that communication of the terminal has ended is detected, the rule for the terminal is deleted. Communication equipment.

3. A communication system including a communication device, a value-added service providing device, and a policy management device, When the communication device detects that a certain terminal has started communication, the communication device transmits communication start information indicating that the terminal has started communication, the communication start information including NAPT session information or DHCP address assignment information, to the policy management device; the policy management device generates a value-added service policy rule based on the communication start information and transmits the rule to the value-added service providing device; the value-added service providing device receives a packet related to communication of the terminal, and executes a process related to the value-added service for the packet based on the rule; The value-added service providing device deletes the rule for the terminal when no communication related to the terminal occurs for a predetermined period of time or when it detects a signal indicating that communication of the terminal has ended. Communication system.

4. A communication method executed by a communication device that performs packet communication and that includes a data storage unit that stores rules of a value-added service policy, comprising: adding a rule for a certain terminal to the data storage unit when communication start information including NAPT session information or DHCP address assignment information indicating that the certain terminal has started communication is received from another communication device; receiving a packet related to communication of the terminal; and executing a process related to a value-added service for the packet based on the added rule, If no communication regarding the terminal occurs for a predetermined period of time, or if a signal indicating that communication regarding the terminal has ended is detected, the rule regarding the terminal is deleted. Communication method.

5. A communication method executed by a communication device that performs packet communication, Detecting the start of communication of a terminal; transmitting communication start information including NAPT session information or DHCP address assignment information, which indicates that the terminal has started communication, and, after transmitting the communication start information, transmitting packets related to communication of the terminal to a value-added service providing device having a value-added service policy rule generated based on the communication start information; In the value-added service providing device, when no communication related to the terminal occurs for a predetermined period of time, or when a signal indicating that communication of the terminal has ended is detected, the rule for the terminal is deleted. Communication method.

6. A communication method in a communication system including a communication device, a value-added service providing device, and a policy management device, When the communication device detects that a certain terminal has started communication, the communication device transmits communication start information indicating that the terminal has started communication, the communication start information including NAPT session information or DHCP address assignment information, to the policy management device; the policy management device generates a value-added service policy rule based on the communication start information and transmits the rule to the value-added service providing device; the value-added service providing device receives a packet related to communication of the terminal, and executes a process related to the value-added service for the packet based on the rule; The value-added service providing device deletes the rule for the terminal when no communication related to the terminal occurs for a predetermined period of time or when it detects a signal indicating that communication of the terminal has ended. Communication method.

7. A program for causing a computer to function as each unit in the communication device according to claim 1 or 2.

Images