Control device, communication system, control method, and program

Abstract

This control device, in a communication system that transfers data via a VPN tunnel between a terminal-side communication device connected to an access network and a server-side communication device, comprises: an acquisition unit that acquires information relating to the terminal-side communication device and / or information relating to the server-side communication device; and a notification unit that notifies the server-side communication device of path information of the VPN tunnel on the basis of the information relating to the terminal-side communication device or the information relating to the server-side communication device.

Description

Control device, communication system, control method, and program

[0001] The present invention relates to a control device, a communication system, a control method, and a program.

[0002] In the Internet of Things (IoT) or connected cars, there is a technology in which a gateway accommodates multiple communication terminals and communicates with an application server on a cloud. In addition, a gateway may also exist on the cloud side, and a technology is known in which a VPN tunnel is constructed between the gateways as a site-to-site VPN (Virtual Private Network) (see, for example, Patent Documents 1 and 2).

[0003] International Publication No. 2021 / 106201 International Publication No. 2021 / 111516

[0004] When a terminal moves, the IP address of the terminal changes depending on the access network to which it is connected, which causes the problem that the session between the terminal and the server cannot be maintained. Therefore, in conventional technology, this problem is solved by installing a gateway between the terminal and the server and building a VPN tunnel using SRv6, thereby fixing the IP address used by the terminal.

[0005] When a new IP address is assigned to the source gateway at the destination, it is necessary to notify the destination gateway of the address update. In conventional technology, the source gateway requests the destination gateway to update the address, but this method has the problem that the load on the source gateway and the destination gateway increases when the number of destinations increases.

[0006] An embodiment of the present invention has been made in consideration of the above-mentioned problems, and suppresses an increase in the load on a communication device in a communication system in which data is transferred via a VPN tunnel between a communication device on a terminal side connected to an access network and a communication device on a server side.

[0007] In order to solve the above problem, a control device according to an embodiment of the present invention is a communication system in which data is transferred via a VPN tunnel between a terminal-side communication device connected to an access network and a server-side communication device, and includes an acquisition unit that acquires information about the terminal-side communication device and / or information about the server-side communication device, and a notification unit that notifies the server-side communication device of route information for the VPN tunnel based on the information about the terminal-side communication device or the information about the server-side communication device.

[0008] According to an embodiment of the present invention, in a communication system in which data is transferred via a VPN tunnel between a communication device on a terminal side connected to an access network and a communication device on a server side, an increase in the load on the communication device can be suppressed.

[0009] 1 is a diagram illustrating an example of a system configuration of a communication system according to Example 1. FIG. 1 is a diagram illustrating an example of a functional configuration of a terminal-side GW according to Example 1. FIG. 2 is a diagram illustrating an image of information managed by a terminal-side GW according to Example 1. FIG. 3 is a diagram illustrating an image of information managed by a control device according to Example 1. FIG. 4 is a diagram illustrating an example of a functional configuration of a server-side GW according to Example 1. FIG. 5 is a sequence diagram illustrating an example of a process of the communication system according to Example 1. FIG. 6 is a flowchart illustrating an example of a process of a terminal-side GW according to Example 1. FIG. 7 is a flowchart illustrating an example of a call notification process according to Example 1. FIG. 8 is a flowchart illustrating an example of a process of a control device according to Example 1. FIG. 9 is a sequence diagram illustrating an example of a process of a server-side GW according to Example 1. FIG. 10 is a diagram illustrating an example of a system configuration of a communication system according to Example 2. FIG. 11 is a sequence diagram illustrating an example of a process of a communication system according to Example 2. FIG. 12 is a flowchart illustrating an example of a process of a control device according to Example 2. FIG. 13 is a flowchart illustrating an example of a process of a server-side GW according to Example 2. FIG. 14 is a diagram illustrating an example of a system configuration of a communication system according to Example 3. FIG. 15 is a diagram illustrating an example of a functional configuration of a management device according to Example 3. FIG. 16 is a diagram illustrating an example of a functional configuration of a control device according to Example 3. FIG. 17 is a sequence diagram illustrating an example of a process of a communication system according to Example 3.

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0011] [First Embodiment] <System Configuration> Fig. 1 is a diagram illustrating an example of the system configuration of a communication system according to a first embodiment. In the example of Fig. 1, a communication system 100 includes a control device 110, terminal-side gateways (hereinafter referred to as terminal-side GWs) 120a, 120b, and 120c, and server-side gateways (hereinafter referred to as server-side GWs) 130a and 130b. In addition, in the example of Fig. 1, terminals 103a, 103b, and 103c are connected to the terminal-side GWs 120a, 120b, and 120c, respectively, and servers 104a and 104b are connected to the server-side GWs 130a and 130b, respectively.

[0012] In the following description, when referring to any one of the terminal-side GWs 120a, 120b, and 120c, the term "terminal-side GW 120" is used. When referring to any one of the server-side GWs 130a and 130b, the term "server-side GW 130" is used. When referring to any one of the terminals 103a, 103b, and 103c, the term "terminal 103" is used. When referring to any one of the servers 104a and 104b, the term "server 104" is used. The numbers of the terminal-side GWs 120, server-side GWs 130, terminals 103, and servers 104 shown in FIG. 1 are merely examples, and may be any other number greater than or equal to two.

[0013] The communication system 100 is a system that transfers data between a terminal-side GW 120 connected to access networks (hereinafter referred to as access NWs) 101a, 101b, and 101c and a server-side GW 130 via a VPN tunnel 106. In the following description, when referring to any of the access NWs 101a, 101b, and 101c, the term "access NW 101" is used.

[0014] The access NW 101 is, for example, a network such as a wireless WAN (Wide Area Network) or a wireless LAN (Local Area Network) for connecting a mobile terminal 103 to a communication network such as the Internet 102 .

[0015] The VPN tunnel 106 is a virtual private network constructed using, for example, SRv6 (Segment Routing over IPv6), which is segment routing that uses an extension header of IPv6 (Internet Protocol Version 6) called SRH (Segment Routing Header).

[0016] The terminal-side GW 120 and the server-side GW 130 are network devices such as gateways or routers that perform ENCAP processing and / or DECAP processing as the start and end points of the VPN tunnel 106. The terminal-side GW 120 is an example of a communication device on the terminal side that connects to the access NW 101. The server-side GW 130 is an example of a communication device on the server side.

[0017] The ENCAP process is a packet process that encapsulates a packet received from, for example, the terminal 103 or the server 104, and sets an SRH (Segment Routing Header) and an IPv6 outer header. The DECAP process is a packet process that removes the SRH from the encapsulated packet and forwards the packet without the SRH to the destination.

[0018] (Regarding the Problem) When the terminal 103 moves, the IP address of the terminal 103 changes depending on the access NW 101 to which it is connected, which causes a problem that the session between the terminal 103 and the server 104 cannot be maintained. Therefore, in the conventional technology, the above problem is solved by installing a gateway between the terminal 103 and the server 104, constructing a VPN tunnel 106 using SRv6, and fixing the IP address used by the terminal 103.

[0019] When a new IP address is assigned to the terminal-side GW 120 at the destination, it is necessary to notify the server-side GW 130 of the address update. In conventional technology, the terminal-side GW 120 requests the server-side GW 130 to update the address, but with this method, the load on the terminal-side GW 120 to make update requests increases as the number of communication destinations increases. Furthermore, with this method, the server-side GW 130, which accommodates the server 104 that communicates with many terminals 103, also has to process a large number of update notifications received from the moving terminal-side GW 120, which increases the load.

[0020] (Processing Overview) In the first embodiment, for example, the terminal-side GW 120a monitors communication from the terminal 103 to the server 104, and if the communication is unknown, the terminal-side GW 120 issues a call notification to the control device 110 (step S1). This call notification includes, for example, information on the source terminal 103a, information on the terminal-side GW 120a, and information on the destination server 104b.

[0021] When the control device 110 receives the call notification, it transmits route information (route advertisement) to the multiple server-side GWs 130a and 130b in the communication system 100 (step S2). This route information includes, for example, information on the source terminal 103a, information on the terminal-side GW 120a, information on the destination server 104b, and information on the server-side GW 130b corresponding to the destination server 104.

[0022] When the server-side GW 130 receives the route information, it determines whether or not it is necessary to update the setting of the VPN tunnel 106. For example, when the received route information includes the address of the server-side GW 130, which is the server-side GW 130 itself, the server-side GW 130 determines that it is necessary to update the setting of the VPN tunnel 106, and updates the setting of the VPN tunnel 106.

[0023] <Functional Configuration> Next, the functional configurations of the terminal-side GW 120, the control device 110, and the server-side GW 130 will be described.

[0024] (Functional Configuration of Terminal-Side GW) Fig. 2 is a diagram illustrating an example of the functional configuration of the terminal-side GW according to Example 1. As illustrated in Fig. 2, the terminal-side GW (terminal-side communication device) 120 has functional components such as a tunnel information generation unit 201, a call processing unit 202, an input / output unit 203, and a storage unit 204.

[0025] For example, the terminal-side GW 120 has a computer configuration and realizes the above-mentioned functional configurations by executing a predetermined program on the computer. Note that at least a part of the above-mentioned functional configurations may be realized by hardware.

[0026] The tunnel information generating unit 201 monitors communications from the terminal 103, performs call processing using the call processing unit 202, and executes tunnel information generating processing to generate tunnel information 205 as shown in FIG. 3, for example.

[0027] 3 is a diagram illustrating an example of information managed by the terminal-side GW according to the first embodiment. In the example of FIG. 3, the tunnel information 205 includes information such as a "tunnel identifier," a "destination GW," and an "accommodated destination terminal / server identifier" as items. The "tunnel identifier" is identification information for identifying the VPN tunnel 106. The "destination GW" is identification information for the server-side GW 130, which is the communication destination of the VPN tunnel 106. The "accommodated destination terminal / server identifier" is identification information for a destination terminal or a destination server accommodated in the "destination GW."

[0028] Preferably, the tunnel information 205 also includes identification information of the own device (terminal-side GW 120) and identification information of the terminal 103 accommodated in the own device. Note that the identification information of each device may be an IP address or the like.

[0029] When a new communication from the terminal 103 to the server 104 occurs, the call processing unit 202 executes a call processing to transmit a call notification including identification information of the terminal 103 and identification information of the server 104 to the control device 110. The call notification also includes identification information of the terminal-side GW 120.

[0030] The input / output unit 203 executes input / output processing for inputting and outputting information to and from external devices. The storage unit 204 stores various information, data, programs, etc., including tunnel information 205 as shown in FIG.

[0031] (Functional Configuration of Control Device) Fig. 4 is a diagram illustrating an example of the functional configuration of the control device according to Example 1. As illustrated in Fig. 4, the control device 110 has functional components such as an acquisition unit 401, a call notification processing unit 402, a notification unit 403, an input / output unit 505, and a storage unit 405.

[0032] For example, the control device 110 includes a computer and executes a predetermined program on the computer to realize the above-described functional configurations. Note that at least a part of the above-described functional configurations may be realized by hardware.

[0033] The acquisition unit 401 executes an acquisition process to acquire information on the terminal-side GW 120 or information on the server-side GW 130. In the first and second embodiments, the acquisition unit 401 acquires a call notification sent from the terminal-side GW 120 when a new communication from the terminal 103 to the server 104 occurs. This call notification includes identification information of the terminal 103 and identification information of the server 104. Preferably, this call notification also includes identification information of the terminal-side GW 120.

[0034] The call notification processing unit 402 executes a call notification process for processing a call notification notified from the terminal-side GW 120. For example, the call notification processing unit 402 returns a call notification answer including identification information of the server-side GW 130 corresponding to the destination server 104 to the terminal-side GW 120 that sent the call notification. Preferably, this call notification answer includes identification information of the source terminal 103, identification information of the destination server 104, etc.

[0035] The notification unit 403 executes a notification process to notify the plurality of server-side GWs 130a, 130b in the communication system 100 of route information of the VPN tunnel 106, based on the information of the terminal-side GW 120 or the information of the server-side GW 130 acquired by the acquisition unit 401. This route information includes, for example, identification information of the source terminal 103, identification information of the destination server 104, identification information of the terminal-side GW 120, and identification information of the server-side GW 130 corresponding to the destination server 104.

[0036] In the first embodiment, the notification unit 403 notifies the plurality of server-side GWs 130 a and 130 b in the communication system 100 of route information including identification information of the server-side GW 130 corresponding to the destination server 104. Preferably, the notification unit 403 transmits the above-mentioned route information to all of the server-side GWs 130 in the communication system 100 simultaneously.

[0037] The input / output unit 404 executes input / output processing for inputting and outputting information to and from external devices. The storage unit 405 stores various information, data, programs, etc., including, for example, tunnel information 406 and GW accommodation information 407 as shown in FIG. 5 .

[0038] 5 is a diagram illustrating an example of information managed by the control device according to the first embodiment. In the example of FIG. 5, the tunnel information 406 includes information such as a "tunnel identifier," a "GW identifier 1," and a "GW identifier 2" as items. The "tunnel identifier" is identification information for identifying the VPN tunnel 106. The "GW identifier 1" is identification information for the terminal-side GW 120 connected to one of the two ends of the VPN tunnel 106. The "GW identifier 2" is identification information for the server-side GW 130 connected to the other end of the VPN tunnel 106.

[0039] The GW accommodation information 407 also includes items such as a "GW identifier" and a "terminal / server identifier accommodated in the GW." The "GW identifier" is identification information for identifying the terminal-side GW 120 and the server-side GW 130. The "terminal / server identifier accommodated in the GW" is identification information of the terminal 103 accommodated in the terminal-side GW 120 identified by the "GW identifier," or identification information of the server 104 accommodated in the server-side GW 130 identified by the "GW identifier."

[0040] (Functional Configuration of Server-Side GW) Fig. 6 is a diagram illustrating an example of the functional configuration of the server-side GW according to Example 1. As illustrated in Fig. 6, the server-side GW 130 has functional components such as a route information processing unit 601, an input / output unit 602, and a storage unit 603.

[0041] For example, the server-side GW 130 has a computer configuration and realizes the above-mentioned functional configurations by executing a predetermined program on the computer. Note that at least a part of the above-mentioned functional configurations may be realized by hardware.

[0042] The route information processing unit 601 executes route information processing for processing route information (route advertisement) notified from the control device 110. In the first embodiment, the route information processing unit 601 determines whether or not the route information notified from the control device 110 includes identification information of the own device, and if the identification information of the own device is included, updates the setting of the VPN tunnel 106 based on the route information.

[0043] The input / output unit 602 executes input / output processing for inputting and outputting information to and from external devices. The storage unit 603 stores various information, data, programs, etc., including, for example, tunnel information 604. The tunnel information 604 managed by the server-side GW 130 is similar to the tunnel information 205 managed by the terminal-side GW 120 described in Fig. 3. However, the "destination GW" stores identification information of the terminal-side GW 120, which is the communication destination of the VPN tunnel 106.

[0044] <Processing Flow> Next, the processing flow of the control method according to the first embodiment will be described.

[0045] (Processing of the Communication System) Fig. 7 is a diagram illustrating an example of processing of the communication system according to the embodiment 1. This processing shows an overview of the processing executed by the communication system 100 described with reference to Figs.

[0046] In step S701, it is assumed that as the terminal 103 moves, a new IP address is assigned to the terminal-side GW 120 from the access NW 101 at the movement destination.

[0047] In step S702, the tunnel information generation unit 201 of the terminal-side GW 120 starts monitoring outbound communications (for example, communications addressed to the server 104).

[0048] In step S703, it is assumed that the terminal 103 starts new communication addressed to the server 104. As a result, when the tunnel information generation unit 201 of the terminal-side GW 120 detects unknown outbound communication in step S704, in step S705 the call processing unit 202 of the terminal-side GW 120 transmits a call notification to the control device 110. This call notification includes, for example, identification information of the sender terminal 103, identification information of the terminal-side GW 120, and identification information of the communication destination server 104, etc.

[0049] As a result, the acquisition unit 401 of the control device 110 acquires the call notification sent by the terminal side GW 120, which includes information such as the IP address of the sending terminal 103, the IP address of the terminal side GW 120, and the communication destination server 104.

[0050] In step S706, the call notification processing unit 402 of the control device 110 stores the identification information of the sending terminal 103, the identification information of the terminal side GW 120, and the identification information of the communication destination server 104 contained in the call notification in the memory unit 405, etc.

[0051] In step S707, the notification unit 403 of the control device 110 notifies the plurality of server-side GWs 130 a, 130 b of the communication system 100 of the route information (route advertisement). This route information includes, for example, identification information of the destination server 104, identification information of the server-side GW 130 corresponding to the destination server 104, identification information of the source terminal 103, identification information of the terminal-side GW 120, etc.

[0052] The notification unit 403 can specify the server-side GW 130 corresponding to the communication destination server 104 by using, for example, GW accommodation information 407 as shown in FIG.

[0053] In step S708, the call notification processing unit 402 of the control device 110 returns a call notification response to the call notification to the terminal-side GW 120. This call notification response includes, for example, identification information of the source terminal 103, identification information of the destination server 104, and identification information of the server-side GW 130 corresponding to the destination server 104.

[0054] In addition, if separate identification information is provided to recognize the pair of call notification and call notification answer, the call notification answer does not need to include the identification information of the sending terminal 103 and the identification information of the communication destination server 104.

[0055] In step S709, upon receiving the route information, the route information processing unit 601 of the server-side GW 130 determines whether or not it is necessary to update the tunnel information 604, and if it determines that it is necessary to update the tunnel information 604, it updates the tunnel information 604 based on the route information. For example, if the received route information includes identification information of its own device, the route information processing unit 601 determines that it is necessary to update the tunnel information 604.

[0056] In step S710, the terminal-side GW 120 starts tunneling to the communication destination server 104 through the VPN tunnel 106 using the identification information of the server-side GW 130 included in the call notification response.

[0057] In step S711, the terminal-side GW 120 transfers the server-destined communication received from the terminal 103 in step S703 to the server 104 as the communication destination via the VPN tunnel 106.

[0058] In step S712, the terminal 103 and the server 104 can transmit and receive data to and from each other via the VPN tunnel 106.

[0059] (Processing of Terminal-Side GW) Fig. 8 is a flowchart illustrating an example of processing of the terminal-side GW according to the embodiment 1. This processing illustrates an example of processing executed by the terminal-side GW 120 in the processing of the communication system described in Fig. 7 .

[0060] In step S801, when the terminal-side GW 120 connects to the access NW 101 and acquires an IP address, the terminal-side GW 120 executes the processes from step S802 onwards.

[0061] In step S802, the tunnel information generation unit 201 determines whether the IP address of the terminal-side GW 120 has been changed. If the IP address of the terminal-side GW 120 has been changed, the tunnel information generation unit 201 shifts the process to step S803. On the other hand, if the IP address of the terminal-side GW 120 has not been changed, the tunnel information generation unit 201 shifts the process to step S806.

[0062] In step S803, the tunnel information generation unit 201 starts monitoring the communication of the terminal 103 under the control of the terminal-side GW 120.

[0063] In step S804, the tunnel information generation unit 201 determines whether there is outbound communication (e.g., communication addressed to the server 104) from the terminal 103. If there is outbound communication from the terminal 103, the tunnel information generation unit 201 shifts the process to step S805. On the other hand, if there is no outbound communication from the terminal 103, the tunnel information generation unit 201 repeatedly executes the process of step S804.

[0064] In step S805, the call processor 202 executes, for example, a call notification process as shown in FIG.

[0065] In step S806, the terminal-side GW 120 starts tunneling to the server 104 of the communication destination.

[0066] (Call Notification Processing) Fig. 9 is a flowchart showing an example of call notification processing according to embodiment 1. This processing shows an example of call notification processing executed by the terminal-side GW 120 in step S805 of Fig. 8 .

[0067] In step S901, the call processing unit 202 determines whether or not there is tunnel information for the communication destination server 104. For example, the call processing unit 202 identifies the server-side GW 130 that accommodates the communication destination server 104 from the GW accommodation information 407 as shown in Fig. 5. The call processing unit 202 also determines whether or not there is tunnel information connecting the identified server-side GW 130 and the terminal-side GW 120, which is the call processing unit's own device, from the tunnel information 406 as shown in Fig. 5.

[0068] If there is tunnel information for the destination server 104, the call processing unit 202 ends the processing in Fig. 9. On the other hand, if there is no tunnel information for the destination server 104, the call processing unit 202 shifts the processing to step S902.

[0069] In step S902, the call processing unit 202 transmits to the control device 110 a call notification including the identification information of the terminal 103, the identification information of the terminal-side GW 120, and the identification information of the destination server.

[0070] In step S903, the call processing unit 202 receives a call notification response including the identification information of the server-side GW 130 from the control device 110.

[0071] In step S904, the tunnel information generation unit 201 determines whether the server-side GW 130 is unknown. For example, if the identification information of the server-side GW 130 included in the call notification response is not registered in the "destination GW" field of the tunnel information 205 as shown in FIG. 3, the tunnel information generation unit 201 determines that the server-side GW 130 is unknown. If the server-side GW 130 is not unknown, the tunnel information generation unit 201 shifts the process to step S905. On the other hand, if the server-side GW 130 is unknown, the tunnel information generation unit 201 shifts the process to step S906.

[0072] In step S905, the tunnel information generation unit 201 updates the accommodation server information of the GW in the connection destination information of the tunnel information 205. For example, the tunnel information generation unit 201 registers the identification information of the communication destination server 104 in the "accommodated destination terminal / server identifier" field corresponding to the identification information of the server-side GW 130 included in the call notification response in the tunnel information 205 as shown in FIG.

[0073] On the other hand, when the process proceeds to step S906, the tunnel information generation unit 201 registers the GW information in the tunnel information 205. For example, the tunnel information generation unit 201 registers the identification information of the server-side GW 130 included in the call notification response in the "destination GW" field in the tunnel information 205 as shown in FIG.

[0074] (Processing of Control Device) Fig. 10 is a flowchart illustrating an example of processing of the control device according to Example 1. This processing illustrates an example of processing executed by the control device 110 in the processing of the communication system described with reference to Fig. 7 .

[0075] In step S1001, when the control device 110 receives a call notification transmitted by the terminal-side GW 120, it executes the processes from step S1002 onwards.

[0076] In step S1002, the notification unit 403 notifies all server-side GWs 130 of a route advertisement including information about the source terminal 103 and the terminal-side GWs. For example, the notification unit 403 refers to the GW accommodation information 407 as shown in Fig. 5 to identify the identification information (GW identifier) ​​of the server-side GW 130 that accommodates the destination server 104. The notification unit 403 also broadcasts a route advertisement (route information) including the identification information of the source terminal 103, the identification information of the identified server-side GW 130, the identification information of the destination server 104, and the identification information of the terminal-side GW 120.

[0077] In step S1003, the call notification processing unit 402 transmits a call notification response to the terminal-side GW 120 that transmitted the call notification. This call notification response includes at least the identification information of the server-side GW 130 that accommodates the server 104 of the communication destination.

[0078] (Processing of Server-Side GW) Fig. 11 is a flowchart illustrating an example of processing of the server-side GW according to the embodiment 1. This processing illustrates an example of processing executed by the server-side GW 130 in the processing of the communication system described with reference to Fig. 7 .

[0079] In step S1101, the route information processing unit 601 of the server-side GW 130 determines whether the own device is the server-side GW 130 specified in the route advertisement notified from the control device 110. If the own device is not the server-side GW 130 specified in the route advertisement, the route information processing unit 601 discards or ignores the notified route advertisement and ends the processing of Fig. 11. On the other hand, if the own device is the server-side GW 130 specified in the route advertisement, the route information processing unit 601 transitions the processing to step S1102.

[0080] In step S1102, the route information processing unit 601 determines whether or not a tunnel exists between the terminal 103 specified in the route advertisement and the GW accommodating the server 104. For example, if the combination of the identification information of the communication source terminal 103 included in the route advertisement and the identification information of the terminal-side GW 120 is registered in the tunnel information 604, the route information processing unit 601 determines that a tunnel exists between the terminal 103 and the GW accommodating the server 104. If there is no tunnel between the terminal 103 specified in the route advertisement and the GW accommodating the server 104, the route information processing unit 601 shifts the process to step S1103. On the other hand, if there is a tunnel between the terminal 103 specified in the route advertisement and the GW accommodating the server 104, the route information processing unit 601 shifts the process to step S1104.

[0081] In step S1103, the route information processing unit 601 newly registers tunnel information. The tunnel information 604 managed by the server-side GW 130 has the same configuration as the tunnel information 205 managed by the terminal-side GW 120, for example, as shown in FIG. 3. The route information processing unit 601 registers a new "tunnel identifier" in the tunnel information 604. In addition, the route information processing unit 601 registers the identification information of the terminal-side GW 120 contained in the route advertisement in the "destination GW" field, and registers the identification information of the destination server 104 contained in the route advertisement in the "accommodated destination terminal / server identifier" field.

[0082] On the other hand, when the process proceeds to step S1104, the route information processing unit 601 determines whether the terminal 103 is unknown. For example, if the identification information of the communication source terminal 103 included in the route advertisement is not registered in the "accommodated destination terminal / server identifier" of the tunnel information 604, the route information processing unit 601 determines that the terminal 103 is unknown. If the terminal 103 is not unknown, the route information processing unit 601 proceeds to step S1105. On the other hand, if the terminal 103 is unknown, the route information processing unit 601 proceeds to step S1106.

[0083] In step S1105, the route information processing unit 601 updates the tunnel information 604. For example, the route information processing unit 601 updates the "destination GW" and "accommodated destination terminal / server identifier" of the tunnel information 604 so that they match the route information.

[0084] On the other hand, when the process proceeds to step S1106, the route information processing unit 601 updates the information relating to the terminal 103 in the tunnel information 604. For example, the route information processing unit 601 registers the identification information of the source terminal 103 included in the route advertisement in the "accommodated destination terminal / server identifier" field of the tunnel information 604.

[0085] By the processing of Figures 7 to 11, the terminal-side GW 120 notifies the control device 110 of the necessary and sufficient information about the terminal 103 and the terminal-side GW 120, and updates the tunnel information of the server-side GW 130, thereby suppressing an increase in the load on the terminal-side GW 120 and the server-side GW 130.

[0086] 12 is a diagram illustrating an example of a system configuration of a communication system according to Example 2. The system configuration of the communication system 100 according to Example 2 may be similar to the system configuration of the communication system 100 according to Example 1 described with reference to FIG.

[0087] In the second embodiment, the terminal-side GW 120 monitors communication from the terminal 103 to the server 104, and if the communication is unknown, the terminal-side GW 120 issues a call notification to the control device 110 (step S11). This call notification includes, for example, information on the source terminal 103a, information on the terminal-side GW 120a, and information on the destination server 104b.

[0088] When the control device 110 receives the call notification, it identifies the server-side GW 130b that accommodates the destination server 104b, and notifies the identified server-side GW 103b of the route information of the VPN tunnel 106 (step S12).

[0089] The server-side GW 130b updates the setting of the VPN tunnel 106 based on the route information notified from the control device 110 (step S13). In this way, in the second embodiment, the control device 110 notifies the route information only to the server-side GW 130 that accommodates the communication destination server 104.

[0090] <Functional Configuration> The functional configurations of the terminal-side GW 120, the control device 110, and the server-side GW 130 according to the second embodiment may be the same as those of the first embodiment. However, the notification unit 403 of the control device 110 notifies the route information only to the server-side GW 130 that accommodates the destination server 104.

[0091] <Processing Flow> Next, the processing flow of the control method according to the second embodiment will be described.

[0092] (Processing of communication system) Fig. 13 is a diagram illustrating an example of processing of the communication system according to the embodiment 2. This processing shows an overview of processing executed by the communication system 100 according to the embodiment 2. Note that the processing of steps S701 to S706 in Fig. 13 is similar to the processing of the communication system according to the embodiment 1 described with reference to Fig. 7, and therefore description thereof will be omitted here.

[0093] In step S1301, the notification unit 403 of the control device 110 notifies the server-side GW 130 accommodating the destination server 104 of route information (route advertisement). This route information includes, for example, identification information of the destination server 104, identification information of the source terminal 103, and identification information of the terminal-side GW 120. Note that the notification unit 403 can specify the server-side GW 130 corresponding to the destination server 104 by using, for example, GW accommodation information 407 as shown in FIG. 5 .

[0094] In step S1302, the call notification processing unit 402 of the control device 110 returns a call notification answer to the call notification to the terminal-side GW 120. This call notification answer includes, for example, identification information of the communication destination server 104 and identification information of the server-side GW 130 corresponding to the communication destination server 104. Note that if separate identification information is provided to recognize the pair of the call notification and the call notification answer, the call notification answer does not need to include the identification information of the communication destination server 104.

[0095] In step S1303, upon receiving the route information, the route information processing unit 601 of the server-side GW 130 updates the tunnel information 604 based on the route information.

[0096] In step S1304, the terminal-side GW 120 starts tunneling to the communication destination server 104 through the VPN tunnel 106 using the identification information of the server-side GW 130 included in the call notification response.

[0097] In step S1305, the terminal-side GW 120 transfers the server-destined communication received from the terminal 103 in step S703 to the server 104 as the communication destination via the VPN tunnel 106.

[0098] In step S 1306 , the terminal 103 and the server 104 can transmit and receive data to and from each other via the VPN tunnel 106 .

[0099] (Processing of Terminal-Side GW) The processing of the terminal-side GW according to the second embodiment may be similar to the processing of the terminal-side GW according to the first embodiment described with reference to Fig. 8. Furthermore, the call notification processing according to the second embodiment may be similar to the call notification processing according to the first embodiment described with reference to Fig. 9.

[0100] (Processing of Control Device) Fig. 14 is a flowchart showing an example of processing of the control device according to the second embodiment. This processing shows an example of processing executed by the control device 110 in the processing of the communication system according to the second embodiment described in Fig. 13. Note that the basic processing content is similar to the processing of the control device according to the first embodiment described in Fig. 10, and therefore detailed description of the processing similar to that of the first embodiment will be omitted here.

[0101] In step S1401, when the control device 110 receives a call notification transmitted by the terminal-side GW 120, it executes the processes from step S1402 onwards.

[0102] In step S1402, the notification unit 403 identifies the server-side GW 130 that accommodates the destination server 104 indicated in the call notification. For example, the notification unit 403 refers to the GW accommodation information 407 as shown in Fig. 5 to identify the identification information (GW identifier) ​​of the server-side GW 130 that accommodates the destination server 104.

[0103] In step S1403, the notification unit 403 notifies the specified server-side GW 130 of route information including information on the source terminal 103 and the terminal-side GW 120. Preferably, this route information includes identification information of the destination server 104, identification information of the source terminal 103, identification information of the terminal-side GW 120, etc.

[0104] In step S1404, the call notification processing unit 402 transmits a call notification response to the terminal-side GW 120 that transmitted the call notification. This call notification response includes at least the identification information of the server-side GW 130 that accommodates the server 104 of the communication destination.

[0105] (Processing of Server-Side GW) Fig. 15 is a flowchart showing an example of processing of the server-side GW according to the second embodiment. This processing shows an example of processing executed by the server-side GW 130 in the processing of the communication system according to the second embodiment described in Fig. 13. Note that the basic processing content is similar to the processing of the server-side GW according to the first embodiment described in Fig. 11, and therefore detailed description of the processing similar to that of the first embodiment will be omitted here.

[0106] In step S1501, the route information processing unit 601 of the server-side GW 130 determines whether or not there is a tunnel between the terminal 103 specified in the route information and the GW that accommodates the server 104. If there is no tunnel between the terminal 103 specified in the route information and the GW that accommodates the server 104, the route information processing unit 601 shifts the process to step S1502. On the other hand, if there is a tunnel between the terminal 103 specified in the route information and the GW that accommodates the server 104, the route information processing unit 601 shifts the process to step S1503.

[0107] In step S1502, the route information processing unit 601 newly registers tunnel information. For example, the route information processing unit 601 registers a new "tunnel identifier" in the tunnel information 604, registers identification information of the terminal-side GW 120 in the "destination GW", and registers identification information of the destination server 104 in the "accommodated destination terminal / server identifier".

[0108] On the other hand, when the process proceeds to step S1503, the route information processing unit 601 determines whether or not the terminal 103 is unknown. If the terminal 103 is not unknown, the route information processing unit 601 proceeds to step S1504. On the other hand, if the terminal 103 is unknown, the route information processing unit 601 proceeds to step S1505.

[0109] In step S1504, the route information processing unit 601 updates the tunnel information 604. For example, the route information processing unit 601 updates the "destination GW" and "accommodated destination terminal / server identifier" of the tunnel information 604 so that they match the route information.

[0110] On the other hand, when the process proceeds to step S1505, the route information processing unit 601 updates the information relating to the terminal 103 in the tunnel information 604. For example, the route information processing unit 601 registers the identification information of the source terminal 103 included in the route advertisement in the "accommodated destination terminal / server identifier" field of the tunnel information 604.

[0111] According to the second embodiment, the terminal-side GW 120 notifies the control device 110 of the necessary and sufficient information about the terminal 103 and the terminal-side GW 120, and updates the tunnel information of the server-side GW 130, thereby further suppressing the increase in the load on the terminal-side GW 120 and the server-side GW 130.

[0112] 16 is a diagram illustrating an example of a system configuration of a communication system according to Example 3. The communication system 100 according to Example 2 includes, for example, a management device 1601 in addition to the system configuration of the communication system 100 according to Example 1 described with reference to FIG.

[0113] The server 104 in the data center virtual infrastructure 1602 may be accessed by a large number of terminals 103, which may cause the server-side GW 130 to become a bottleneck. To avoid this, a technique is known for dynamically increasing or decreasing the number of server-side GWs 130 depending on the load on the server-side GW 130, etc. (See, for example, Patent Document 2).

[0114] An increase or decrease in the number of server-side GWs 130 also increases or decreases the number of VPN tunnels 106. For example, the management device 1601 monitors the load status of the server 104 and adds tunnels to equalize the load on the server-side GWs 130, etc. The management device 1601 also reduces the number of settings and load on the terminal-side GWs 120 by removing tunnels in advance.

[0115] In the third embodiment, the management device 1601 monitors the load status of each server 104 in the data center virtual infrastructure 1602 (step S21). When the load of a server 104 exceeds a threshold, the management device 1601 instructs the server-side GW 130 and the server 104 to increase or decrease (step S22).

[0116] When the management device 1601 instructs the expansion of the server-side GW 130 and the server 104, the server 104 secures resources in the data center virtual infrastructure 1602 and performs duplication (expansion) of the server 104 and the server-side GW 130 (step S23). On the other hand, when the management device 1601 instructs the removal of the server-side GW 130 and the server 104, the server 104 deletes the server 104 and the server-side GW 130 from the data center virtual infrastructure 1602 and releases the resources.

[0117] The management device 1601 also shares the increase / decrease information of the server-side GW 130 and the servers 104 with the control device 110 (step S24).

[0118] The control device 110 identifies the VPN tunnels 106 to be added or removed based on the existing tunnel information, the added or removed server-side GW 130, and the server 104, and notifies the terminal-side GW 120 and the server-side GW 130 at both ends, or the server-side GW 130, of the route information (step S25).

[0119] The increase or decrease of the server side GW 130 and the server 104 is performed on the data center virtual infrastructure 1602, but the following patterns are possible, and similarly, notification destinations can be predicted to respond in advance to the increase or decrease of tunnels: A) Replicating the server side GW 130 and the server 104 in a physically separate data center. B) Replicating the server side GW 130 and the server 104 in the same data center. C) Replicating only the server side GW 130 in the same data center. D) Replicating only the server 104 in the same data center (in this case, there is no impact on the number of tunnels).

[0120] <Functional Configuration> Next, a description will be given of the functional configuration of the management device 1601 and the control device 110 according to the third embodiment. The functional configuration of the terminal-side GW 120 and the server-side GW 130 according to the third embodiment may be the same as that of the first embodiment.

[0121] 17 is a diagram illustrating an example of the functional configuration of a management device according to Example 3. The management device 1601 has various functional components, such as an expansion / reduction notification unit 1701 and an input / output unit 1702.

[0122] For example, the management device 1601 includes a computer and executes a predetermined program on the computer to realize the above-described functional configurations. Note that at least a part of the above-described functional configurations may be realized by hardware.

[0123] The expansion / reduction notification unit 1701 executes expansion / reduction notification processing for notifying the control device 110 of expansion / reduction information of the server-side GW 130 and / or the server 104 in the data center virtual infrastructure 1602 .

[0124] The input / output unit 602 executes input / output processing for inputting and outputting information to and from an external device.

[0125] (Functional Configuration of Control Device) Fig. 18 is a diagram illustrating an example of the functional configuration of a control device according to Example 3. The control device 110 according to Example 3 includes an expansion / reduction support unit 1801 in addition to the functional configurations of the control device 110 according to Example 1 described in Fig. 4 .

[0126] The expansion / reduction accommodation unit 1801 is realized by, for example, a program executed by a computer included in the control device 110. The expansion / reduction accommodation unit 1801 notifies the necessary route information by utilizing the notification unit 403 based on the expansion / reduction information notified from the management device 1601. The acquisition unit 401 according to the third embodiment acquires the expansion / reduction information notified from the management device 1601. The expansion / reduction information is an example of information of the server-side communication device.

[0127] <Processing Flow> Next, the processing flow of the control method according to the third embodiment will be described.

[0128] (Processing of communication system) Fig. 19 is a diagram illustrating an example of processing of a communication system according to the third embodiment. This processing shows an example of processing executed by a communication system 100 according to the third embodiment. Note that, here, a notification processing of route information when the number of servers 104 and / or server-side GWs 130 increases or decreases, which is a feature of the third embodiment, will be described. Note that the third embodiment can be applied in combination with the first embodiment or the second embodiment.

[0129] In step S1901, it is assumed that the terminal 103 is transmitting and receiving data to and from the server 104 via the VPN tunnel 106a provided between the terminal-side GW 120 and the server-side GW 130a.

[0130] In step S1902, the expansion / reduction support unit 1801 of the management apparatus 1601 detects an expansion event of the server-side GW 130a according to the load status of the server-side GW 130a.

[0131] In step S1903, the expansion / reduction support unit 1801 of the management apparatus 1601 instructs the server-side GW 130a to expand the server-side GW 130b.

[0132] In step S1904, when the server-side GW 130b is added, the addition / reduction notification unit 1701 of the management apparatus 1601 notifies the control apparatus 110 that the server-side GW 130b has been added.

[0133] In step S1905, the expansion / reduction support unit 1801 of the control device 110 determines a notification destination of the route information and the route information. For example, the expansion / reduction support unit 1801 determines route information for newly establishing a VPN tunnel 106b between the server-side GW 130b and the terminal-side GW 120 and switching the VPN tunnel 106b.

[0134] In step S1906, the notification unit 403 of the control device 110 notifies the server-side GW 130b of the path information determined by the expansion / reduction support unit 1801.

[0135] As a result, a new VPN tunnel 106b is established between the terminal-side GW 120 and the server-side GW 130b, and in step S1907, the terminal 103 becomes able to send and receive data to and from the server 104 via the VPN tunnel 106b.

[0136] 19 shows an example of a sequence when a server-side GW 130 is added. When a server 104 is added, the expansion / reduction support unit 1801 can determine the route to be notified and the GW to notify the route information by notifying the control device 110 of which server 104 the added server 104 is a scale-out of.

[0137] 19 , even if a server 104 or a server-side GW 130 is added, route information is not notified to the terminal-side GW 120, and the terminal-side GW 120 and the terminal 103 that are already communicating are not reconnected to the new server 104 and server-side GW 130. This describes a pattern in which a new server-side GW 130 or server 104 is connected only for new connections. However, this is not limited to this, and the control device 110 may notify the terminal-side GW 120 or the terminal 103 of route information and cause them to reconnect to the new server 104 or server-side GW 130.

[0138] Furthermore, when the server-side GW 130 or the server 104 is removed, the control device 110 may or may not notify the terminal-side GW 120 or the terminal 103 to connect to the server-side GW 130 or the server 104 that remains after the removal.

[0139] In addition, when notifying the terminal-side GW 120 of route information when adding or removing the server-side GW 130 or the server 104, the terminal-side GW 120 is also provided with a route information notification function, and the notification unit 403 of the control device 110 is also capable of notifying the terminal 103 of route information. Alternatively, it is possible to perform a general reallocation process when adding or removing a server, without notifying the terminal-side GW 120 of route information, and to perform the process related to the tunnel creation described above for the new connection destination.

[0140] <Hardware Configuration> The control device 110, the terminal side GW 120, the server side GW 130, the management device 1601, and the like according to this embodiment have the hardware configuration of a computer 2000 as shown in FIG. 20, for example.

[0141] Fig. 20 is a diagram showing an example of the hardware configuration of a computer. In the example of Fig. 20, a computer 2000 includes a processor 1001, a memory 1002, a storage device 1003, a communication I / F 1004, an input device 1005, an output device 1006, a bus B, etc.

[0142] The processor 1001 is, for example, an arithmetic device such as a CPU (Central Processing Unit) that realizes various functions by executing a predetermined program. The memory 1002 is a storage medium that can be read from and written to by the computer 2000, and includes, for example, a RAM (Random Access Memory) and a ROM (Read Only Memory). The storage device 1003 is a large-capacity storage medium that can be read from and written to by the computer, and may include, for example, a HDD (Hard Disk Drive), an SSD (Solid State Drive), various optical disks, and magneto-optical disks.

[0143] The communication I / F 1004 is an interface for communicating with other devices via a wireless or wired network. The input device 1005 is an input device that accepts input from the outside and may include, for example, a keyboard, a mouse, a microphone, a switch, a button, a sensor, etc. The output device 1006 is an output device that outputs to the outside and may include, for example, a display, a speaker, an LED lamp, etc.

[0144] The bus B is commonly connected to the above components and transmits, for example, address signals, data signals, and various control signals. The processor 1001 may be, in addition to (or instead of) a CPU, a digital signal processor (DSP), a programmable logic device (PLD), a field programmable gate array (FPGA), or the like.

[0145] The program executed by computer 2000 may be for realizing some of the functions described above, or may be capable of realizing the functions described above in combination with a program already stored in computer 2000. Furthermore, some or all of the functional configuration of each device may be realized using hardware such as a PLD or FPGA.

[0146] <Effects of the embodiment> According to the present embodiment, in a communication system in which data is transferred via a VPN tunnel between a communication device on a terminal side connected to an access network and a communication device on a server side, an increase in the load on the communication device can be suppressed.

[0147] Furthermore, according to this embodiment, even when applied to IoT services on the order of millions to billions of devices or services for mobile devices such as connected cars, it is possible to register a necessary and sufficient number of terminals 103 and terminal-side GWs 120 in the control device 110 and the server-side GW 130. Therefore, even if a large number of communication path updates occur, the system functions normally, and the scalability of the entire system can be improved.

[0148] Summary of Embodiments This specification discloses at least the control device, communication system, control method, and program of the following paragraphs: (Item 1) A communication system for transferring data via a VPN tunnel between a terminal-side communication device connected to an access network and a server-side communication device, the control device comprising: an acquisition unit that acquires information about the terminal-side communication device and / or information about the server-side communication device; and a notification unit that notifies the server-side communication device of route information of the VPN tunnel based on the information about the terminal-side communication device or the information about the server-side communication device. (Item 2) The control device described in Item 1, wherein the acquisition unit acquires a call notification that includes identification information of the terminal and identification information of the server, which is notified from the terminal-side communication device when communication from the terminal to a server occurs, and the notification unit notifies multiple server-side communication devices of the communication system of the route information that includes identification information of the server-side communication device corresponding to the server. (Clause 3) The control device according to Clause 1, wherein the acquisition unit acquires a call notification, including identification information of the terminal and identification information of the server, notified from a terminal-side communication device when communication from the terminal to a server occurs, and the notification unit notifies the server-side communication device corresponding to the server of the route information. (Clause 4) The control device according to Clause 1, wherein the acquisition unit acquires increase / decrease information of the server-side communication device and / or the server, and the notification unit notifies the server-side communication device of the VPN tunnel to be increased or decreased of route information of the VPN tunnel to be increased or decreased, based on information of the existing VPN tunnels and the increase / decrease information. (Clause 5) A communication system including the control device according to Clause 2 or 3 and the terminal-side communication device, wherein the terminal-side communication device has a call processing unit that, when new communication from the terminal to a server occurs, sends a call notification, including identification information of the terminal and identification information of the server, to the control device.(Clause 6) A communication system including the control device according to paragraph 2 and the plurality of server-side communication devices, wherein the server-side communication device has a route information processing unit that updates the settings of the VPN tunnel based on the route information when the route information includes identification information of the server-side communication device. (Clause 7) A control method in a communication system that transfers data via a VPN tunnel between a terminal-side communication device connected to an access network and a server-side communication device, wherein the control device executes the following processes: acquiring information about the terminal-side communication device or the server-side communication device; and notifying the server-side communication device of the route information of the VPN tunnel based on the information about the terminal-side communication device or the information about the server-side communication device. (Clause 8) A program that causes a computer to function as each unit in the control device according to any one of paragraphs 1 to 4.

[0149] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0150] 100 Communication system 101, 101a to 101c Access NW (access network) 106, 106a, 106b VPN tunnel 110 Control device 120, 120a to 120c Terminal side GW (terminal side communication device) 130, 130a, 130b Server side GW (server side communication device) 202 Call processing unit 401 Acquisition unit 402 Call notification processing unit 403 Notification unit 601 Route information processing unit 2000 Computer

Claims

1. A control device in a communication system that transfers data via a VPN tunnel between a terminal-side communication device connected to an access network and a server-side communication device, comprising: an acquisition unit that acquires information about the terminal-side communication device or the server-side communication device; and a notification unit that notifies the server-side communication device of route information for the VPN tunnel based on the information about the terminal-side communication device or the information about the server-side communication device.

2. The control device according to claim 1, wherein the acquisition unit acquires a call notification including identification information of the terminal and identification information of the server, which is notified from the terminal-side communication device when communication from the terminal to the server occurs, and the notification unit notifies multiple server-side communication devices of the communication system of the route information including identification information of the server-side communication device corresponding to the server.

3. The control device according to claim 1, wherein the acquisition unit acquires a call notification including identification information of the terminal and identification information of the server, which is notified from a communication device on the terminal side when communication from the terminal to the server occurs, and the notification unit notifies the communication device on the server side corresponding to the server of the route information.

4. The control device according to claim 1, wherein the acquisition unit acquires information on the increase or decrease of the server-side communication device and / or server, and the notification unit notifies the server-side communication device of the VPN tunnel that is to be increased or decreased of route information of the VPN tunnel that is to be increased or decreased based on information on the existing VPN tunnel and the increase or decrease information.

5. A communication system including the control device according to claim 2 or 3 and a terminal-side communication device, wherein the terminal-side communication device has a call processing unit that transmits a call notification including identification information of the terminal and identification information of the server to the control device when communication from the terminal to a server occurs.

6. A communication system including the control device according to claim 2 and the plurality of server-side communication devices, wherein the server-side communication device has a route information processing unit that updates the settings of the VPN tunnel based on the route information when the route information includes identification information of the server-side communication device.

7. A control method in a communication system that transfers data via a VPN tunnel between a terminal-side communication device connected to an access network and a server-side communication device, wherein a control device executes the following processes: acquiring information about the terminal-side communication device or the server-side communication device; and notifying the server-side communication device of route information for the VPN tunnel based on the information about the terminal-side communication device or the server-side communication device.

8. A program that causes a computer to function as each part of the control device according to any one of claims 1 to 4.

Images