Management of communication at base connected to mobile communication network

Abstract

To enhance security when a communication system of a communication carrier communicates with a server at a base. The communication system executes application processing in an intermediate segment (S206), executes signal processing for acquiring uplink data from a signal from a terminal via a base antenna (S201), executes relay processing for relaying communication between the terminal and the application processing in an internal network capable of communicating with a core network system (S202), detects an abnormality of communication between the internal network and the intermediate segment (S203), and manages a virtual processing unit for the signal processing, the relay processing, and the application processing under the control of the communication carrier (S208).

Description

Management of communications between mobile communication networks and connected locations

[0001] The present disclosure relates to managing communications between points connected to a mobile communications network.

[0002] Mobile communication operators install equipment, including antennas, at base stations and core network systems in data centers. Mobile communication services are provided through communication between the base station equipment and the core network system. The base station equipment and the core network system are connected by dedicated lines.

[0003] Japanese Patent Application Laid-Open Publication No. 2015-082787 discloses placing two virtual servers in a DMZ and placing multiple virtual servers in an internal segment.

[0004] Japanese Patent Application Laid-Open No. 2003-078571 discloses the construction of a virtual firewall between an intranet and the Internet.

[0005] Japanese Patent No. 3794491 discloses that a virtual server unit included in a firewall device distributes request data to either the internal network 4 or the decoy device 2.

[0006] The inventors are considering installing a server providing some kind of service at a specific base, and establishing a communication path between the server and a mobile terminal using a mobile communication service at that base, without going through the normal core network system for providing the mobile communication service. In this case, it is conceivable that devices of mobile communication carriers will constantly communicate with servers within the base (some of which may not be designed for direct connection to the Internet). For example, if a server within such a base is hacked, it could affect the security of the core network system, even if a firewall is installed.

[0007] The present disclosure has been made in consideration of the above-mentioned problems, and one of its purposes is to provide technology that enhances security when a communication system of a telecommunications carrier communicates with a server at a base station where the service is provided.

[0008] The communication system according to the present disclosure includes a base station antenna and one or more processors disposed at a base station. When an application process providing an application service is being executed in an intermediate segment, which is one of the networks within the base station, at least one of the one or more processors disposed at the base station executes a communication service program, thereby performing signal processing, relay processing, first firewall processing, and management processing. The signal processing is a process of acquiring uplink data, which is data intended for a core network system, from a signal from a terminal via the base station antenna. The relay processing is a process of relaying the acquired uplink data to the intermediate segment based on predetermined conditions in an internal network, which is one of the networks within the base station and capable of communicating with the core network system. The first firewall processing is a process of detecting an abnormality in communication between the internal network and the intermediate segment. The management processing is a process of managing a virtual processing unit that executes at least a portion of the signal processing and the relay processing. The management processing manages the provision of the application service to the terminal.

[0009] The communication control method according to the present disclosure includes application processing, which is performed by at least one of one or more processors located at a base executing a program provided by an application provider, and signal processing, relay processing, first firewall processing, second firewall processing, and management processing, which are performed by at least one of the one or more processors located at the base executing a program provided by a telecommunications carrier other than the application provider. The application processing is a process of communicating in an intermediate segment, which is a network within the base, and providing an application service of the application provider. The signal processing is a process of acquiring uplink data, which is data intended for a core network, from a signal from a terminal via the base antenna. The relay processing is a process of relaying the acquired uplink data to a virtual processing unit that executes the application processing based on predetermined conditions in an internal network, which is one of the networks within the base and is capable of communicating with the core network system. The first firewall processing is a process of detecting an abnormality in communication between the internal network and the intermediate segment. The management processing is a process of managing a virtual processing unit that is controlled by the telecommunications carrier and executes at least a part of the signal processing and the relay processing. The management process controlled by the telecommunications carrier manages the virtual processing units that provide the application services of the application provider.

[0010] 1 is a diagram illustrating an example of a communication system according to an embodiment of the present disclosure; FIG. 2 is a diagram illustrating an example of a communication system according to the present embodiment; FIG. 3 is a diagram illustrating an example of virtualization in a base system; FIG. 4 is a diagram illustrating an example of a network configuration in a communication system; FIG. 5 is a diagram illustrating an example of association between elements established in a communication system according to the present embodiment; FIG. 6 is a flow diagram illustrating an overview of processing in a communication system when a terminal connects to a mobile communication network; FIG. 7 is a diagram illustrating an example of processing in a base system when a terminal accesses an application; FIG. 8 is a diagram illustrating an example of processing in a second firewall; FIG. 9 is a diagram illustrating an example of processing in a distribution system and a virtualization platform.

[0011] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings.

[0012] 1 and 2 are diagrams illustrating an example of a communication system 1 according to an embodiment of the present disclosure. Fig. 1 is a diagram focusing on the locations of facilities included in the communication system 1. The communication system 1 provides a mobile communication network.

[0013] As shown in Fig. 1, the communication system 1 includes, as its facilities, a central data center 11, a regional data center 12, an edge data center 13, base station facilities 14, and base station facilities 16. The base station facilities 16 are facilities that perform mobile wireless communication with terminals 20. The base station facilities 16 include an antenna 17 and an RU (Radio Unit) described below. The base station facilities 14 include an antenna 15, an RU (not shown), and multiple servers 31. The base station facilities 14 correspond to bases such as hospital facilities or office buildings, for example.

[0014] The terminal 20 is called UE (User Equipment). The terminal 20 is a mobile terminal such as a smartphone or laptop, and can connect to a mobile communication network via wireless communication.

[0015] The mobile communication network provides communication between a certain terminal 20 and another terminal 20, and communication between the terminal 20 and the Internet. This communication system 1 may further provide a network site connection network that connects a terminal 20 communicating with an antenna 15 of a certain site facility 14 to a system located at a site corresponding to the site facility 14. Hereinafter, this network will be referred to as a "site connection network," and when simply referred to as a "site connection network," it corresponds to this specific network slice.

[0016] The central data center 11, the regional data centers 12, and the edge data centers 13 are collectively called a data center group. For example, there are several central data centers 11, several tens of regional data centers 12, and several thousand to several tens of thousands of edge data centers 13.

[0017] For example, the central data center 11 is distributed throughout the area (e.g., Japan) covered by the communication system 1. The regional data centers 12 are distributed throughout the area covered by the communication system 1. For example, if the area covered by the communication system 1 is the entirety of Japan, one or two regional data centers 12 may be located in each prefecture.

[0018] Each edge data center 13 is capable of communicating with the base station equipment 16. One edge data center 13 may be capable of communicating with a plurality of base station equipment 16.

[0019] In this embodiment, for example, the central data center 11, the regional data centers 12, and the edge data centers 13 are capable of communicating with each other via a communication network. Furthermore, the central data centers 11, the regional data centers 12, and the edge data centers 13 are also capable of communicating with each other via the communication network.

[0020] In the central data center 11, the regional data center 12, and the edge data center 13 according to this embodiment, a plurality of servers 30 are arranged.

[0021] Each of the multiple servers 30 includes one or multiple processors 30 a, storage 30 b, and a communication unit 30 c. The multiple servers 30 located in the central data center 11, the regional data centers 12, and the edge data centers 13 provide a type of cloud infrastructure using a virtualized application execution environment, which will be described later.

[0022] Each of the plurality of servers 31 arranged in the base facility 14 includes one or more processors 31 a, storage 31 b, and communication unit 31 c. A virtualized application execution environment is implemented on the plurality of servers 31.

[0023] The processors 30a and 31a are program-controlled devices such as microprocessors that operate according to a program. The storage 30b is, for example, a memory element such as a ROM or RAM, a solid-state drive (SSD), or a hard disk drive (HDD). The storages 30b and 31b store programs executed by the processors 30a and 31a. The communication units 30c and 31c are communication interfaces such as a network interface controller (NIC) or a wireless local area network (LAN) module. The communication units 30c and 31c exchange data with other servers and network devices. The communication units 30c and 31c may constitute part of a software-defined networking (SDN). The servers 30 and 31 may be general-purpose computers, but some of the servers 30 and 31 may be special-purpose computers (also referred to as "dedicated servers") that efficiently perform specific processes, such as network communication.

[0024] In this embodiment, a container-type virtualized application execution environment such as Docker (registered trademark) is installed on the servers 30 located in the central data center 11, the regional data centers 12, and the edge data center 13. The container-type virtualized application execution environment can deploy and run containers on these servers 30. A cluster consisting of one or more containers generated by such virtualization technology may be constructed on these servers 30. For example, a Kubernetes cluster managed by a container management tool such as Kubernetes (registered trademark) may be constructed. Then, a processor on the constructed cluster may execute a container-type application.

[0025] A container-based virtualized application execution environment and a container management tool may also be installed on the server 31. A cluster made up of one or more containers generated by such virtualization technology may be constructed on these servers 31.

[0026] 2 is a diagram for explaining the communication system 1 according to the present embodiment in brief, and in particular, the internal functions and processes of the communication system 1.

[0027] From the viewpoint of functionality and processing, the communication system 1 includes a core network system 41, a plurality of base station systems 42, and a base station system 43. The core network system 41, the base station systems 42, and the base station systems 43 are connected by a network (not shown), for example, a software-defined network (SDN), and are capable of communicating with each other.

[0028] Each of the base station systems 42 includes a distributed unit (DU) 45 and a central unit (CU) 46. The core network system 41 includes multiple access and mobility management functions (AMFs) 47, multiple session management functions (SMFs) 48, and multiple user plane functions (UPFs) 49. Each of the base station systems 42 includes a radio unit (RU) 44 and an antenna 17, and the RU 44 is a radio transmitting / receiving device that communicates with terminals 20. The RU 44 is mainly located in the base station equipment 16 and the central facility 14, and communicates with a DU 45 of the same base station system 42.

[0029] The base system 43 includes an RU 44, a DU 45, a CU 46, an AMF 47, an SMF 48, a UPF 49, a first firewall 54, a second firewall 55, a voice communication system 61, a nurse call system 62, and a virtualization platform 71. The base system 43 includes an RU 44 and an antenna 15 located at the base, and the RU 44 is a wireless transmitting / receiving device. The RU 44 communicates with a DU 45 of the same base system 43.

[0030] In terms of network, the DU 45, CU 46, AMF 47, SMF 48, and UPF 49 of the base system 43 are arranged in the internal network 51. The voice communication system 61, nurse call system 62, and database system 63 are examples of applications, and the applications are arranged in the intermediate segment 52 in terms of network. The first firewall 54 is arranged at the boundary between the internal network 51 and the intermediate segment 52 in terms of network. The second firewall 55 is arranged at the boundary between the intermediate segment 52 and the external network 53 in terms of network.

[0031] The base system 43 may include, for example, at least one of a voice communication system 61, a nurse call system 62, and a database system 63 as applications, or may include other application systems.

[0032] The external network 53 connected to the base system 43 via the second firewall 55 may be a LAN of a base hospital or office. The external network 53 is connected to the Internet. The external network 53 may also be a network of a telecommunications carrier that provides connection to the Internet.

[0033] The functions and processes of the core network system 41 and the base station system 42 may be implemented by one or more processors 30a included in one or more servers 30 executing programs (execution instructions) stored in the storage 30b. Note that a so-called container management tool may be used to manage the storage of programs (program modules) corresponding to each unit in the storage 30b and the execution of the processors 30a.

[0034] The functions and processes of the base system 43 may be implemented by one or more processors 31a included in one or more servers 31 executing programs (execution instructions) stored in the storage 31b. A so-called container management tool may manage the storage of programs (program modules) corresponding to each unit in the storage 31b and the execution of the processors 31a.

[0035] The DU 45 and CU 46 included in the base station system 42 and the base station system 43 are the DU and CU in 5G, respectively. The DU 45 performs signal processing by having one or more processors 30a or 31a execute a communication service program, thereby processing an uplink signal acquired from the terminal 20 via the RU 44 and acquiring uplink data. The DU 45 that performs signal processing also converts downlink data destined for the terminal 20 into a downlink signal for wireless transmission. The downlink signal is wirelessly transmitted from the RU 44.

[0036] The DU45 may include, for example, the functions of the PHY-High layer, MAC layer, and RLC layer in so-called 4G and 5G. The functions of the CU46 may include the functions of the PDCP layer and PRC / SDAP layer. The boundary between the functional layers of the DU45 and the CU46 may be different from that in the above example. The MAC layer performs tasks such as allocating radio resources, and the RLC layer performs tasks such as retransmission control.

[0037] The upstream signal is a signal input from the terminal 20 to the DU 45, and the downstream signal is a signal output from the DU 45 to the terminal 20. Data output from the DU 45 to the core network system 41 (e.g., the AMF 47 or the UPF 49) is referred to as upstream data, and data output from the core network system 41 to the DU 45 is referred to as downstream data.

[0038] The DUs 45 and CUs 46 included in the base station system 42 are mainly located in the edge data center 13. More specifically, these DUs 45 and CUs 46 may be implemented by one or more servers 30 located in the edge data center 13. A certain edge data center 13 may be located with multiple sets, each including one or more DUs 45 and one CU 46, and the multiple DUs 45 included in a set may be connected to the CU 46 of that set. Note that the DUs 45 and CUs 46 included in the base station system 42 may be located in a data center different from the edge data center 13.

[0039] The DU 45 and CU 46 included in the base system 43 may be implemented by one or more servers 31 located in the base facility 14.

[0040] Here, the DU 45 and CU 46 included in the base station system 42 and the base system 43 may be a virtual distributed unit (vDU) and a virtual central unit (vCU), respectively, in 4G. Some of the DU 45 and CU 46 may be implemented in the central data center 11 or the regional data center 12, rather than in the edge data center 13. The RU 44, DU 45, and CU 46 constitute a radio access network (RAN).

[0041] The RAN is a computer system equipped with an antenna, equivalent to an eNB (eNodeB) in a fourth-generation mobile communication system (hereinafter referred to as 4G) or a gNB (NR base station) in a fifth-generation mobile communication system (hereinafter referred to as 5G). The core network system 41 and the RAN cooperate with each other to realize a mobile communication network that communicates with the terminal 20.

[0042] The core network system 41 is a system equivalent to an EPC (Evolved Packet Core) in 4G or a 5G core (5GC) in 5G. The core network system 41 according to this embodiment is implemented mainly by a plurality of servers 30 arranged in a central data center 11 and a regional data center 12. As described above, the core network system 41 includes NFs such as a plurality of AMFs 46, a plurality of SMFs 48, and a plurality of UPFs 49 as software functional units. The core network system 41 is connected to an external network such as the Internet.

[0043] The AMF 47 accepts a connection request from the terminal 20 via the gNB and authenticates the terminal 20. When the terminal 20 is authenticated, the AMF 47 registers information (information indicating the location of the terminal 20) for enabling an incoming call to the terminal 20 in an internal database. After the AMF 47 accepts the connection request and the terminal 20 is authenticated, the SMF 48 establishes a communication path (PDU session) between the terminal 20 and an appropriate UPF 49.

[0044] When a connection to a network other than a base station connection network is requested from a terminal 20 that wirelessly communicates with a base station system 42, the SMF 48 establishes a communication path between the terminal 20 and a UPF 49 included in the core network system 41. When a connection to a base station connection network is requested, the SMF 48 may establish a communication path between the terminal 20 and a UPF 49 included in the base system 43.

[0045] The UPF 49 included in the core network system 41 executes a core relay process for relaying communication data between the terminal 20 and an external network such as the Internet, using at least one of the one or more processors 30a.

[0046] The AMF 47, SMF 48, and UPF 49 included in the base system 43 have the same functions as those of the core network system 41, but are located in the base equipment 14. Furthermore, these AMF 47, SMF 48, and UPF 49 are capable of authenticating the terminal 20, establishing a communication path, and relaying communication data, respectively, in processing the network slices of the base connection network.

[0047] The CU 46 included in the base system 43 executes a base request process by having at least one of the one or more processors 31 a execute a communication service program. In the base request process, the CU 46 requests control of communication from the AMF 47 corresponding to the network slice to which the terminal 20 requests connection.

[0048] In a base request process, the CU 46 included in the base system 43 selects either the core network system 41 or the AMF 47 (control process) of the base system 43 and requests communication control. More specifically, in the base request process, when the CU 46 receives a request from the terminal 20 to connect to the base connection network via the base antenna 15, the CU 46 requests the AMF 47 of the base system 43 to control the communication connection of the terminal 20. Based on the request, the AMF 47 controls the communication connection together with the SMF 48. On the other hand, when the CU 46 receives a request from the terminal 20 via the antenna 15 to connect to a network other than the base connection network, the CU 46 requests the AMF 47 of the core network system to control the communication connection of the terminal 20.

[0049] Furthermore, the UPF 49 included in the base system 43 executes a base relay process by having at least one of the one or more processors 31a execute a communication service program. In the base relay process, the UPF 49 establishes a communication path with the terminal 20 under control of the SMF 48 of the base system 43, and relays communication between the terminal 20 and an application in the base system 43 or an external network 53. More specifically, the UPF 49 obtains upstream data from the terminal 20 via the communication path and transmits the upstream data to the application or external network 53. The UPF 49 also receives downstream data from the application or external network 53 and transmits the downstream data to the terminal 20 via the communication path.

[0050] When the terminal 20 communicates with an application or an external network 53 via the antenna 15 of the base facility 14, the communication goes through the UPF 49 of the base system 43, and the core network system 41 is not used. This is called local breakout. Local breakout allows the terminal 20 to communicate efficiently with other systems at the base, and also reduces the load on the core network system 41.

[0051] The application executes application processing by at least one of the one or more processors 31a, including, for example, SIP (Session Initiation Protocol) processing, nurse call processing, and database processing.

[0052] The voice communication system 61 that executes SIP processing realizes calls between external telephone devices and extension telephone devices (for example, the terminal 20) via telephone lines, or calls between extension telephone devices.

[0053] The nurse call system 62 that executes the nurse call process is a system that manages calls from patients in the hospital, and may be connected to communication devices installed in beds and devices installed in a center within the hospital. These devices may be terminals 20 or devices connected to the external network 53. The nurse call system 62 may communicate with the terminals 20 via the UPF 49, or may communicate with devices on the external network 53.

[0054] The database system 63 that executes database processing may realize a database management system, and may, for example, execute medical record management in a hospital, or distribute advertisements registered in a database to the terminal 20.

[0055] Applications including a voice communication system 61, a nurse call system 62, and a database system 63 are not installed directly on the server 31, but rather run as virtualized virtual processing units (e.g., containers, pods, or virtual servers) on one of multiple servers 31.

[0056] The first firewall 54 performs first firewall processing by having at least one of the one or more processors 31a execute a communication service program. The first firewall 54, which performs first firewall processing, detects abnormalities (unauthorized communications) in communications between the internal network 51 and the intermediate segment 52. Here, the internal network 51 is also connected to the core network system 41, and the first firewall 54 is extremely important in preventing intrusions into the core network system 41 from the intermediate segment 51 or the external network 53. The first firewall 54 may perform not only so-called packet filtering, including SPI (Stateful Packet Inspection), but also filtering at the application protocol level and intrusion control processing known as IDS / IPS. The first firewall 54 may also control access from the distribution system 72 to prevent unauthorized intrusions from the core network system 41 side.

[0057] The second firewall 55 performs second firewall processing by having at least one of the one or more processors 31a execute a communication service program. The second firewall 55 that performs the second firewall processing detects anomalies in communication between the intermediate segment 52 and the external network 53. The second firewall 55 may perform the same type of fraud detection processing as the first firewall 54, or may perform a different type of fraud detection processing than the first firewall 54. This enhances security between the base system 43 and the external network 53.

[0058] The first firewall 54 and the second firewall 55 may run in a dedicated device including the processor 31 a, or may run on a general-purpose server 31 including the processor 31 a. Furthermore, the first firewall 54 and the second firewall 55 may each run on one of the multiple servers 31 as a virtualized virtual processing unit (e.g., a container, a pod, or a virtual server).

[0059] The virtualization platform 71 in the base system 43 performs management processing and update processing by having at least one of one or more processors 31a execute a communication service program. The virtualization platform 71 that performs management processing manages virtual processing units that run on one or more servers 31. The management of the virtual processing units may include, for example, starting and ending processing of the virtual processing units, and at least some of the configuration related to the virtual processing units (e.g., setting up the server that runs the virtual processing units, and connecting and disconnecting networks connected to the virtual processing units). The virtualization platform 71 may include a virtualized application execution environment and a container management tool. The update processing will be described later.

[0060] FIG. 3 is a diagram illustrating an example of virtualization in the base system 43. In FIG. 3, components equivalent to the hardware and OS are shown below the virtualization platform 71, and an example of a virtual processing unit is shown above the virtualization platform 71. For ease of explanation, the database system 63 is not shown. Note that some of the virtual processing units shown in FIG. 3 may be executed on physical hardware (e.g., a server). For example, the DU 46 may exist on a server outside the virtualization platform 71, or some routers may not be virtualized and may instead be configured with dedicated hardware.

[0061] The base system 43 physically includes one or more servers 31, a switch 32, and a dedicated server 33. The switch 32 is network-connected to devices such as one or more servers 31 and the dedicated server 33. The switch 32 relays packets at the L2 layer using a virtual local area network (VLAN) to prevent communication between each of multiple segments without going through a router or the like. The dedicated server 33 is a type of server 31 and has a configuration suitable for network communication. The dedicated server 33 may have special hardware as network equipment, such as a communication port or an accelerator.

[0062] The virtual router 56 is a virtualized version of a router. The virtual router 56 is a virtual processing unit that executes processing such as routing, and is connected to one or more network segments.

[0063] In the example of FIG. 3 , the CU 45, DU 46, AMF 47, SMF 48, UPF 49, voice communication system 61, and nurse call system 62 are depicted as being executed by any of multiple servers 31. Each of these may be executed by any server 31 under the virtualization platform 71. In FIG. 3 , the first firewall 54, the second firewall 55, and multiple virtual routers 56 are depicted as being executed by a dedicated server 33, but they may also be executed on general-purpose servers 31. Note that the dedicated server 33 may also be a physical router. In fact, there are products that allow multiple virtual routers to be built on a physical router. Multiple virtual routers 56 may also be built using such a physical router.

[0064] The distribution system 72 executes a distribution process using at least one of the one or more processors 30a arranged in the data center. When the distribution system 72 that executes the distribution process receives a distribution instruction from a third party via the Internet, the distribution system 72 that executes the distribution process distributes an update program for realizing an application to the virtualization platform 71 of the base system 43.

[0065] The virtualization platform 71 that executes the update process updates the program that realizes the processing of the application based on the distributed update program. The application processing is executed based on the updated program. The distribution system 72 distributes the update program from the core network side, where security is easier to ensure, and the virtualization platform 71 updates the application program based on the update program, thereby preventing the distribution of unauthorized update programs. Here, the above update process is an example mainly for the case of container-based virtualization. In the case of virtualization using a virtual server, the update process may be executed in the virtual processing unit that executes the application processing. In this case, the distribution system 72 distributes the update program to the virtual processing unit of the application in the intermediate segment 52 via the first firewall 54.

[0066] The third-party client 73 is a computer that allows an application provider to communicate with the distribution system 72 and give distribution instructions. The third-party client 73 is connected to the distribution system 72 via the Internet.

[0067] 4 is a diagram schematically illustrating an example of a network configuration in the communication system 1. A virtual processing unit of the UPF 49 is connected to an internal network 51. The internal network 51 is connected to a mobile backhaul for connection to the core network system 41. The connected mobile backhaul may have a known network configuration. Virtual processing units of applications such as a voice communication system 61 and a nurse call system 62 are connected to an intermediate segment 52.

[0068] The virtual router 56a and the first firewall 54 are connected in a network manner between the intermediate segment 52 and the internal network 51. The virtual router 56b and the second firewall 55 are connected in a network manner between the intermediate segment 52 and the external network 53.

[0069] In the example of FIG. 4 , a packet (e.g., downstream data) traveling from the intermediate segment 52 to the internal network 51 is forwarded in the order of the virtual router 56 a, the first firewall 54, the virtual router 56 a, and the internal network 51. A packet traveling from the internal network 51 to an application on the intermediate segment 52 is forwarded in the reverse order. Furthermore, a packet (e.g., downstream data) traveling from the external network 53 to the intermediate segment 52 is forwarded in the order of the second firewall 55, the virtual router 56 b, and the intermediate segment 52. A packet traveling from the intermediate segment 52 to the external network 53 is forwarded in the reverse order. In the example of FIG. 5 , the communication route between the virtual router 56 a and the first firewall 54 is somewhat different from the communication route between the virtual router 56 b and the second firewall 55. However, the communication route may be set in any manner as long as the packet passes through the first firewall 54 or the second firewall 55. It should be noted that the virtual router 56 a may forward packets that are clearly not problematic to the intermediate segment 52 without passing them through the first firewall 54 .

[0070] Here, routing between networks may be performed by each virtual processing unit based on the settings of its internal routing table, or only a default gateway may be set in each virtual processing unit and routing between networks may be performed by the virtual router 56. Alternatively, a connection virtual router may be built within the virtualization platform to connect to the virtual processing unit, and this virtual router may perform routing.

[0071] Here, a method for implementing functions of the communication system 1 according to this embodiment will be described. The communication system 1 is composed of multiple functional units (e.g., network functions (NFs)) to realize network services. In this embodiment, the functional units are implemented as NFs realized by virtualization technology. NFs realized by virtualization technology are called VNFs (Virtualized Network Functions). It does not matter what virtualization technology is used for virtualization. For example, in this description, a CNF (Containerized Network Function) realized by container-type virtualization technology is also included in the VNF. In this embodiment, a network service will be described as being implemented by one or more CNFs. Furthermore, the functional units according to this embodiment may correspond to network nodes.

[0072] 5 is a diagram schematically illustrating an example of associations between elements established in the communication system 1 in this embodiment. The symbols M and N shown in FIG. 5 represent any integer greater than or equal to 1 and indicate the relationship between the numbers of elements connected by a link. When both ends of a link are a combination of M and N, the elements connected by the link have a many-to-many relationship, and when both ends of a link are a combination of 1 and N or a combination of 1 and M, the elements connected by the link have a one-to-many relationship.

[0073] As shown in FIG. 5, the network service (NS), network function (NF), CNFC (Containerized Network Function Component), pod, and container have a hierarchical structure.

[0074] The NS corresponds to, for example, a network service configured from a plurality of NFs. Here, the NS may correspond to, for example, a granular element such as 5GC, EPC, 5G RAN (gNB), or 4G RAN (eNB).

[0075] In 5G, the NFs correspond to elements with granularity such as the DU 45, CU 46, and UPF 49. Furthermore, the NFs correspond to elements with granularity such as the AMF 47, SMF, and UPF 49. Furthermore, in 4G, the NFs correspond to elements with granularity such as a Mobility Management Entity (MME), a Home Subscriber Server (HSS), a Serving Gateway (S-GW), a vDU, and a vCU. In this embodiment, for example, one NS includes one or more NFs. That is, one or more NFs are subordinate to one NS.

[0076] A CNFC corresponds to a granularity element such as DU mgmt or DU Processing. A CNFC may be a microservice deployed on the server 30 as one or more containers. For example, a certain CNFC may be a microservice that provides some of the functions of the DU 45, CU 46, etc. Also, a certain CNFC may be a microservice that provides some of the functions of the UPF 49, AMF 47, SMF, etc. In this embodiment, for example, one NF includes one or more CNFCs. In other words, one or more CNFCs are subordinate to one NF.

[0077] A pod is the smallest unit for managing a Docker container in Kubernetes. In this embodiment, for example, one CNFC includes one or more pods. In other words, one CNFC has one or more pods under its control.

[0078] In this embodiment, for example, one pod includes one or more containers. That is, one or more containers are subordinate to one pod. These pods or containers correspond to the above-mentioned virtual processing units, run under the control of the virtualization platform 71, and are managed by the virtualization platform 71.

[0079] Also, as shown in Figure 5, network slices (NSIs) and network slice subnet instances (NSSIs) have a hierarchical structure.

[0080] The NSI can also be considered an end-to-end virtual circuit spanning multiple domains (e.g., from the RAN to the core network system 41). The NSI may be a slice for high-speed, large-capacity communication (e.g., for enhanced Mobile Broadband (eMBB)), a slice for high-reliability and low-latency communication (e.g., for Ultra-Reliable and Low Latency Communications (URLLC)), or a slice for connecting a large number of terminals (e.g., for massive Machine Type Communication (mMTC)). The NSSI can also be considered a virtual circuit of a single domain obtained by dividing the NSI. The NSSI may be a slice of the RAN domain, a slice of the Mobile Back Haul (MBH) domain, or a slice of the core network domain.

[0081] In this embodiment, for example, one NSI includes one or more NSSIs. That is, one or more NSSIs are subordinate to one NSI. Note that in this embodiment, multiple NSIs may share the same NSSI.

[0082] Furthermore, as shown in FIG. 5, NSSIs and NSs generally have a many-to-many relationship.

[0083] Furthermore, in this embodiment, for example, one NF can belong to one or more network slices. Specifically, for example, one NF can be configured with NSSAI (Network Slice Selection Assistance Information) including one or more S-NSSAI (Sub Network Slice Selection Assist Information). Here, S-NSSAI is one piece of information for identifying a network slice. Note that at least some NFs may not belong to a network slice.

[0084] Next, the operation when the terminal 20 connects to the mobile communication network will be described. Fig. 6 is a flow diagram illustrating an overview of the processing of the communication system 1 when the terminal 20 connects to the mobile communication network. Fig. 6 is a diagram illustrating the processing when the terminal 20 starts communication via the antenna 15 arranged in the base facility 14. Note that, since the specific procedure when the terminal 20 connects to the mobile communication network is publicly known, Fig. 6 omits a description of processing that is not particularly related to connection to a network slice of the base connection network.

[0085] In addition, a list of network slices supported by the base station including the CU 46 is registered in advance in the CU 46 included in the base station system 43 and the base station system 42, and each of the CUs 46 is assumed to be able to communicate in advance with the AMF 47 corresponding to the network slice it supports. These AMFs 47 may belong to the core network system 41 or the base station system 43.

[0086] First, the terminal 20 transmits a connection request including identification information of a network slice to which the terminal 20 wishes to connect to the CU 46 via the antenna 15, and the CU 46 acquires the connection request from the terminal 20 (S101). The identification information of the network slice may be, for example, the S-NSSAI included in the NSSAI from the terminal 20, or other information. The terminal 20 may have a table that links applications with identification information (e.g., NSSAI), and the terminal 20 may assign identification information only to the uplink signals of applications registered in the table. Note that if the connection request does not include identification information of the network slice, the network slice is not used.

[0087] Next, the CU 46 checks whether the base station permits connection to the network slice indicated by the identification information acquired from the terminal 20 (S102). The CU 46 may determine that the connection is permitted if the identification information acquired from the terminal 20 is registered in a list of network slices supported by the base station. If connection to the network slice indicated by the identification information acquired from the terminal 20 is not permitted (N in S102), the processing of FIG. 6 ends, and the terminal 20 is not connected.

[0088] On the other hand, if connection to the network slice indicated by the identification information obtained from the terminal 20 is permitted (Y in S102), the CU46 determines whether the network slice to which the terminal 20 is requesting connection is a network slice of a base connection network (S103).

[0089] If the network slice requesting connection is a network slice of a base connection network (Y in S103), the CU 46 transmits a communication control request to the AMF 47 and SMF 48 included in the base system 43 (S104). The AMF 47 and SMF 48 then perform processing such as authentication of the terminal 20 for that network slice, and the SMF 48 establishes a communication path (PDU session) between the terminal 20 and the UPF 49 included in the base system 43 (S105). The UPF 49 then relays communication between the terminal 20 and an application or an external network 53 via that communication path (S106).

[0090] On the other hand, if the network slice requesting connection is a network slice different from that of the base connection network or if the connection request does not include identification information of the network slice (N in S103), the CU46 sends a communication control request to the AMF47 included in the core network system 41 (S107). The AMF47 then performs processing such as authentication of the terminal 20, and the SMF48 establishes a communication path (PDU session) between the terminal 20 and the UPF49 included in the core network system 41 (S108). The UPF49 then relays communication between the terminal 20 and an application or an external network 53 via that communication path (S109). Here, the AMF47 included in the core network system 41 may be set as the primary AMF47 that sends the control request, and the AMF47 included in the base system 43 may be set as the secondary AMF47. In S107, if the CU46 is unable to communicate with the primary AMF47 due to a failure or the like, it may send a control request to the secondary AMF47, and the processing of S108 and S109 may be performed by the AMF47, SMF48, and UPF49 on the base system 43 side.

[0091] Although an explicit determination process is described in S103 of Figure 6, instead, CU46 may acquire information indicating AMF47 stored in association with the network slice to which connection is requested, and send a control request to the acquired AMF47.

[0092] Here, when the terminal 20 starts communication via the antenna 17 included in the base station system 42, processing similar to that shown in Fig. 6 is executed. When the terminal 20 starts communication via the antenna 17, even when connecting to a point connection network, in S104 a communication control request may be transmitted to the AMF 47 corresponding to the point connection network in the core network system 41, and in S105 a communication path may be established by the SMF 48 in the core network system 41. The terminal may be prohibited from connecting to the point connection network via the antenna 17 included in the base station system 42. Furthermore, permission and prohibition of the terminal from connecting to the point connection network via the antenna 17 may be controlled by a system disposed in the core network system 41 or the like.

[0093] Next, the processing performed when the terminal 20 communicates with an application will be described. Fig. 7 is a diagram showing an example of the processing performed by the base system 43 when the terminal 20 communicates with an application. The processing shown in Fig. 7 focuses on one piece of data or a packet, and it appears as if multiple processes are being executed sequentially. In reality, multiple processes may be executed in parallel for different pieces of data or packets.

[0094] First, the DU 45 and CU 46 that execute signal processing generate upstream data from a signal transmitted from the terminal 20 and transmit the upstream data to the UPF 49 via the established communication path (S201). Upon receiving the upstream data, the UPF 49 that executes the base relay processing relays the upstream data to the application (S202).

[0095] The relayed upstream data is input to the first firewall 54 before reaching the application. The first firewall 54, which executes the first firewall processing, determines whether the data destined for the intermediate segment (here, the upstream data destined for the application) is invalid (S203). If the data is determined to be invalid (Y in S203), the first firewall 54 discards the data (S204), and the application does not process it.

[0096] On the other hand, if the data is determined to be normal (N in S203), the first firewall 54 transfers the data (upstream data) to the destination (application) (S205).The application that executes application processing then executes application processing based on the upstream data and transmits downstream data to the terminal 20 (S206).

[0097] Downstream data sent from an application is input to the first firewall 54. The first firewall 54, which executes first firewall processing, determines whether the data destined for the internal network (downstream data in this case) is unauthorized (S207). If the data is determined to be unauthorized (Y in S208), the first firewall 54 discards the data and causes the virtualization platform 71 to stop the virtual processing unit of the application that sent the data (S208). At this time, information indicating the application or virtual processing unit that sent the data determined to be unauthorized may be passed from the first firewall 54 to the virtualization platform 71.

[0098] On the other hand, if the data is determined to be normal (N in S207), the first firewall 54 transfers the data (downstream data) to the UPF 49. The UPF 49, which executes the base relay process, relays the downstream data to the CU 46 via the communication path (S209), and the DU 45 and CU 46 generate a downstream signal based on the downstream data and transmit the signal to the terminal 20 via the RU 44 (S210).

[0099] Here, the virtual processing unit of the application is under the control of a virtualization platform 71 controlled by the telecommunications carrier. Therefore, as shown in S208, if data from the application destined for the internal network 51 is detected as unauthorized, the virtualization platform 71 can reliably stop the application along with the virtual processing unit. This improves security. This is particularly effective in protecting the core network of a telecommunications carrier, which requires high security, from unauthorized communications resulting from local breakouts at bases. In conventional technology, due to the demarcation point of responsibility, the telecommunications carrier's equipment and the server running the application were physically separated. Furthermore, in the past, virtual processing units running applications were not placed under the control of a virtualization platform 71 controlled by a telecommunications carrier.

[0100] In this way, cooperation between the first firewall 54 and the virtualization platform 71 can improve security. Furthermore, the virtualization platform 71 manages not only the virtual processing units but also the networks connected to the virtual processing units. This makes it possible to prevent security problems caused by a third party providing an application or a physical intruder making a network connection different from the intended one.

[0101] In addition, in the base system 43, by combining applications, NFs, etc. into a virtual processing unit, it becomes possible to efficiently utilize the resources of the server 31, and it becomes possible, for example, to reduce the number of servers installed at the base.

[0102] Next, the processing when communication occurs between the intermediate segment 52 and the external network 53 will be described. Fig. 8 is a diagram showing an example of processing by the second firewall. Fig. 8 particularly describes processing for data and packets going from the external network 53 to the intermediate segment 52, but similar processing may be performed for data and packets going in the opposite direction. The description of Fig. 8 focuses on processing for one piece of data or packet, but in reality, this processing may be performed in parallel for multiple pieces of data or packets.

[0103] First, the second firewall 55 that executes the second firewall process acquires transmission data intended for the intermediate segment 52 (for example, an application) from the external network 53 (S301).

[0104] The second firewall 55 determines whether the transmitted data is unauthorized (S302). If the transmitted data is determined to be unauthorized (Y in S302), the second firewall 55 discards the data (S303), and the transmitted data does not reach its destination.

[0105] On the other hand, if the transmission data is determined to be normal (N in S302), the second firewall 55 forwards the transmission data to the destination (e.g., an application) (S304). The destination (e.g., an application that executes application processing) then executes processing based on the transmission data, generates response data, and transmits it to the external network 53.

[0106] The response data is input to the second firewall 55. The second firewall 55, which executes the second firewall process, determines whether the response data is invalid (S306). If it is determined that the response data is invalid (Y in S306), the second firewall 55 discards the response data (S307). On the other hand, if it is determined that the response data is normal (N in S306), the second firewall 55 relays the response data to the external network 53 (S308).

[0107] The intermediate segment 52 is protected by a second firewall 55, and the internal network 51 is further protected by a first firewall 54. The intermediate segment 52 where the application resides has characteristics similar to a DMZ where, for example, a web server is located. By placing the application in the DMZ, it is possible to prevent intrusion from the outside and intrusion into the internal network 51 and the core network. Furthermore, the first firewall 54 can prevent intrusion into the application in the intermediate segment 52 from the core network side. Furthermore, even if an unauthorized intrusion occurs into the virtual processing unit of the application, the first firewall 54 and the second firewall 55 can protect the system on the core network side and the system on the external network side.

[0108] In order to ensure the security of applications, a distribution system 72 for updating applications is placed in the core network of a telecommunications carrier. The distribution of programs (executable instructions) by the distribution system 72 will be described below.

[0109] 9 is a diagram illustrating an example of the processing performed by the distribution system 72 and the virtualization platform 71. The distribution system 72, which first executes the distribution processing, receives an application update program from a third-party client (a third-party administrator) and stores it in the storage 30b (S401). Next, the distribution system 72 acquires a distribution instruction from the third-party client (the third-party administrator) indicating the base system 43 and application to be distributed (S402). Upon acquiring the distribution instruction, the distribution system 72 distributes the application update program indicated by the distribution instruction to the virtualization platform 71 of the base system 43 indicated by the distribution instruction via the internal network 51 (S403).

[0110] When the update program is distributed to the virtualization platform 71, the virtualization platform 71 acquires the update program for the application from the distribution system 72 (S421).Then, the virtualization platform 71 updates the program (executable instructions) of the application based on the update program (S422).

[0111] As previously described, the virtual processing unit of an application is under the control of the virtualization platform 71 controlled by the telecommunications carrier, and the application is managed by the virtualization platform 71, which detects unauthorized communications to the internal network 51, etc. This makes it easy for the telecommunications carrier to take action, for example, by using the virtualization platform 71 to stop the virtual processing unit executing the application when an abnormality occurs, such as the detection of unauthorized communications from an application. This improves security. Furthermore, by enabling application updates from the core network side rather than the Internet and by having the telecommunications carrier manage the distribution system 72, it is possible to prevent unauthorized applications from being distributed, further improving security against external intrusions.

[0112] The present disclosure is not limited to the above-described embodiments. The configurations disclosed in the embodiments can be combined in various ways. Furthermore, part of the configuration described in the present embodiment may be modified within the scope of the technical idea of ​​the present disclosure.

[0113] Furthermore, the functional units according to the present embodiment may be realized using hypervisor-type or host-type virtualization technology instead of container-type virtualization technology. Furthermore, the functional units according to the present embodiment do not need to be implemented by software, but may be implemented by hardware such as electronic circuits. Furthermore, the functional units according to the present embodiment may be implemented by a combination of electronic circuits and software.

[0114] As can be understood from the description of the embodiments described above, this specification discloses various technical ideas, including the following disclosures.

[0115] (1) A communication system including a base antenna and one or more processors located at a base, wherein when an application process for providing an application service is being executed in an intermediate segment that is one of the networks within the base, at least one of the one or more processors located at the base executes a communication service program, thereby executing signal processing to acquire upstream data, which is data intended for a core network system, from a signal from a terminal via the base antenna; relay processing to relay the acquired upstream data to the intermediate segment based on predetermined conditions in an internal network that is one of the networks within the base and is capable of communicating with the core network system; a first firewall processing to detect abnormalities in communication between the internal network and the intermediate segment; and management processing to manage a virtual processing unit that executes at least part of the signal processing and the relay processing, and wherein the provision of the application service to the terminal is managed by the management processing.

[0116] (2) In (1), the management processing is performed in a virtualization platform on which a virtual processing unit that executes at least part of the signal processing, the relay processing, and the first firewall processing, and a virtual processing unit that executes the application processing, are constructed.

[0117] (3) In the communication system according to (1) or (2), the management process further includes a process of stopping the virtual processing unit executing the application process when the first firewall process detects unauthorized communication from the application process.

[0118] (4) In any one of (1) to (3), the application service includes at least a part of nurse call processing, SIP processing, database processing, and advertisement distribution processing.

[0119] (5) In any one of (1) to (4), the internal network is connected to a core network system via a mobile backhaul.

[0120] (6) In any of (1) to (5), when the terminal connects to a network slice corresponding to the base, the upstream data is relayed by the relay processing, and when the terminal does not connect to the network slice, the upstream data is relayed by the core network system.

[0121] (7) In any of (1) to (6), the first firewall processing detects abnormalities in communication between the internal network and the intermediate segment by at least some of packet filtering, application-level filtering, and intrusion detection processing.

[0122] (8) In any of (1) to (7), a communication system in which at least one of the one or more processors located at the base executes a program for the communication service, thereby performing a second firewall process to detect abnormalities in communication between the intermediate segment and an external network.

[0123] (9) In (8), the communication system is configured such that the external network is connected to the Internet.

[0124] (10) In the communication system of (8) or (9), the second firewall processing detects abnormalities in communication between the intermediate segment and the external network by at least some of packet filtering, application-level filtering, and intrusion detection processing.

[0125] (11) In any one of (1) to (10), the program that realizes the application processing is provided by an application provider that provides the application service, different from the provider that manages the communication service.

[0126] (12) In any of (1) to (11), the communication system further includes one or more processors located in a data center, wherein at least one of the one or more processors located in the data center executes a distribution process to distribute an update program for the program that realizes the application processing to the base via the internal network, and at least one of the one or more processors located at the base executes an update process to update the program that realizes the application processing based on the distributed update program.

[0127] (13) In (12), the distribution process includes a process of distributing the update program via the internal network when a distribution instruction is received via the Internet from an application provider other than the provider that manages the communication service.

[0128] (14) A communication management method including: application processing, in which at least one of one or more processors located at a base executes a program of an application provider, communicating in an intermediate segment that is a network within the base and providing an application service of the application provider; signal processing, in which at least one of the one or more processors located at the base executes a program provided by a telecommunications carrier other than the application provider, acquiring uplink data, which is data intended for a core network, from a signal from a terminal via an antenna located at the base; relay processing, in an internal network that is one of the networks within the base and is capable of communicating with the core network system, relaying the acquired uplink data to a virtual processing unit that executes the application processing based on predetermined conditions; and first firewall processing that detects an abnormality in communication between the internal network and the intermediate segment; and management processing, which is controlled by the telecommunications carrier and manages a virtual processing unit that executes at least a part of the signal processing and the relay processing, wherein the virtual processing unit that provides the application service of the application provider is managed by the management processing controlled by the telecommunications carrier.

Claims

1. A communications system comprising a base antenna and one or more processors disposed at a base, wherein when an application process for providing an application service is being executed in an intermediate segment that is one of the networks within the base, at least one of the one or more processors disposed at the base executes a communication service program to execute the following: signal processing for acquiring upstream data, which is data intended for a core network system, from a signal from a terminal via the base antenna; relay processing for relaying the acquired upstream data to the intermediate segment based on predetermined conditions in an internal network that is one of the networks within the base and capable of communicating with the core network system; a first firewall processing for detecting an abnormality in communication between the internal network and the intermediate segment; and management processing for managing a virtual processing unit that executes at least a part of the signal processing and the relay processing, wherein the provision of the application service to the terminal is managed by the management processing.

2. The communication system according to claim 1, wherein the management processing is executed in a virtualization platform on which a virtual processing unit that executes at least a part of the signal processing, the relay processing, and the first firewall processing, and a virtual processing unit that executes the application processing are constructed.

3. The communication system according to claim 1, wherein the management process further includes a process of stopping a virtual processing unit executing the application process when the first firewall process detects unauthorized communication from the application process.

4. The communication system according to claim 1, wherein the application services include at least a part of nurse call processing, SIP processing, database processing, and advertisement distribution processing.

5. The communication system according to claim 1, wherein the internal network is connected to a core network system via a mobile backhaul.

6. A communication system as described in claim 1, wherein when the terminal connects to a network slice corresponding to the base, the upstream data is relayed by the relay processing, and when the terminal is not connected to the network slice, the upstream data is relayed by the core network system.

7. The communication system according to claim 1, wherein the first firewall process detects anomalies in communication between the internal network and the intermediate segment by at least some of packet filtering, application level filtering, and intrusion detection processing.

8. The communication system according to claim 1, wherein at least one of the one or more processors located at the base executes a program for the communication service, thereby performing a second firewall process for detecting anomalies in communication between the intermediate segment and an external network.

9. The communication system according to claim 8, wherein the external network is connected to the Internet.

10. The communication system according to claim 8, wherein the second firewall process detects anomalies in communication between the intermediate segment and an external network by at least some of packet filtering, application level filtering, and intrusion detection processing.

11. The communication system according to claim 1, wherein the program for realizing the application processing is provided by an application provider that provides the application service, and is different from a provider that manages the communication service.

12. The communication system of claim 1, further comprising one or more processors disposed in a data center, wherein at least one of the one or more processors disposed in the data center executes a distribution process for distributing an update program for a program that realizes the application processing to the base via the internal network, and at least one of the one or more processors disposed at the base executes an update process for updating the program that realizes the application processing based on the distributed update program.

13. The communication system according to claim 12, wherein the distribution process includes a process of distributing the update program via the internal network when a distribution instruction is received via the Internet from an application provider other than the provider managing the communication service.

14. A communications management method comprising: application processing for communicating in an intermediate segment, which is a network within the base, and providing an application service of the application provider, by at least one of one or more processors located at the base executing a program of an application provider; signal processing for acquiring uplink data, which is data for a core network, from a signal from a terminal via an antenna located at the base, by at least one of the one or more processors located at the base executing a program provided by a telecommunications carrier different from the application provider; relay processing for relaying the acquired uplink data to a virtual processing unit that executes the application processing based on predetermined conditions in an internal network that is one of the networks within the base and is capable of communicating with the core network system; and first firewall processing for detecting an abnormality in communication between the internal network and the intermediate segment; management processing that is controlled by the telecommunications carrier and manages a virtual processing unit that executes at least a part of the signal processing and the relay processing, wherein the virtual processing unit that provides the application service of the application provider is managed by the management processing controlled by the telecommunications carrier.

Images