Patent Application
20180213472
The present invention relates to a communication system, a communication apparatus, a communication method, a terminal, and non-transitory medium storing a program.
The present invention is based on the priority of the Japanese Patent Application: Japanese Patent Application No. 2015-154492 (filed on Aug. 4, 2015), the entire contents of which are incorporated by reference in this application with citation.
Evolved Packet System(EPS) includes 3GPP (3rd Generation Partnership Project) access network as well as non-3GPP access network. The 3GPP access network includes UTRAN (UMTS (Universal Mobile Tel System) Terrestrial Radio Access Network), E-UTRAN (Evolved UTRAN), GERAN (GSM (Registered Trademark) (Global system for mobile communications) (EDGE Radio Access Network) and so forth.
The Non-3GPP access network is an IP (Internet Protocol) access network using an access technology with specifications outside a scope of 3GPP. The Non-3GPP access network includes a Wi-Fi (Wireless Fidelity) network (registered trademark: Wireless Fidelity) specified by the IEEE (Institute of Electrical and Electronics Engineers, Inc.) 802.11x standard and a wireless LAN (Wireless Local Area Network: WLAN) such as WiMAX (Worldwide Interoperability for Microwave Access) specified by the IEEE 802.16 standard. For non-3GPP access, for example, reference may be made to 3GPP TS 23.402: Architecture enhancements for non-3 GPP accesses, or the like.
Wi-Fi (registered trademark)-Calling is a Voice over IP (VoIP) service provided on a Wi-Fi (registered trademark) network by communication carrier (operator). For example, a terminal (User Equipment (UE)) into which a SIM (Subscriber Identity Module) of a communication carrier is inserted is connected to a security gateway of the communication carrier via a Wi-Fi (registered trademark) network, and when authenticated with SIM authentication by the security gateway, the terminal (User Equipment (UE)) is connected to an exchange node of a core network (Evolved Packet Core: EPC), thereby making it possible for the terminal to use a voice call service based on a telephone number and Short Message Service (SMS), etc., each provided by the communication carrier (Non-Patent Literature 1). Further, when the terminal is connected to Wi-Fi (registered trademark) and Wi Fi (registered trademark)-Calling is set on in the terminal, the security gateway, on reception of an incoming call to the terminal calls the terminal via a Wi-Fi (registered trademark) network.
An MME (Mobility Management Entity) 23 of EPC 20 performs various processing such as mobility management and authentication of the terminal 1, setting of a user data transfer route, and the like. In addition, the MME 23 performs user authentication, or the like, in cooperation with an HSS 24 (Home Subscriber Server which holds subscriber profile). The MME 23 establishes/releases a user data transfer route in a section (S1-U) from an SGW (Serving Gateway) 21 to the base station 10. The SGW 21 exchanges user data with the base station 10, for example, and establishes/releases a communication path between the SGW 21 and a POW (Packet Data Network) PDN 22.
The PGW 22 is connected to a packet data network (PDN) 30 such as IMS (Internet Multimedia Subsystem) or the Internet, for example.
Further, the PGW 22 performs, for example, allocation of an IP address (private IP address) to the terminal 1, packet filtering for a user, charging support, lawful interception, packet screening, and so forth.
A PCRF (Policy and Charging Rules Function) 26 determines a policy control such as QoS (Quality of Service) and a charging control rule. Based on notification information from the PCRF 26, the PGW 22 and SGW 21 perform policy control, on a per packet basis, for example.
A PCEF (Policy and Charge Enforcement Function) (not shown), which is connected to the PCRF 26 via a Gx interface, is a policy and charging function node in a communication network, and is arranged, for example, in the PGW 22.
In
Regarding a packet filter in the PGW 22, a terminal (UE) 1 sets traffic flow templates (TFTs) of EPS bearers managed by the PGW 22, for example, by using a UE requester bearer resource modification procedure. In the PGW 22, the packet filter is managed to be distinguished between uplink (UL) and downlink (DL), for example.
In a bearer modification (UE requested bearer resource modification) according to a request from the terminal (UE) 1, the terminal 1 transmits, for example, a bearer resource modification request (Request Bearer Resource Modification) to the MME 23 via the base station (eNB). The bearer resource modification request includes, for example, a request (TAD (Traffic Aggregate Description)) such as addition, modification, deletion or the like of a packet filter in the PGW 22. In a case of addition, the bearer resource modification request includes packet filter information to be added. The MME 23 transmits a bearer resource command to the PGW 22 via the SGW 21, and the PGW 22 interacts with the PCRF 26, for example, to determine PCC (Policy and Charging Control) (PCEF Initiated IP-CAN (IP Connectivity Access Network) Session Modification) (e.g. see 3GPP TS 23.203: Policy and charging control architecture etc.).
The PGW 22 provides, for example, content of the TAD and a GBR (Guaranteed Bit Rate) change related to packet filter information included in the TAD to the PCRF 26. When the request is accepted, the PGW 22 inserts, modifies, or deletes one or more packet filters in TFT of an EPS bearer corresponding to the TAD.
In Wi-Fi (registered trademark)-Calling, etc., a call request from the terminal 1 is forwarded, as an Un-Trusted Access (unreliable access), via a wireless LAN access point 41 and via an ePDG (evolved packet data gateway) 27 of a communication carrier to the PGW 22, and is then connected to PDN 30 (for example, EMS service).
The ePDG 27 is an IPsec gateway that terminates an IPsec (Security Architecture for Internet Protocol) connection from a mobile interface (Swu). When the terminal (UE) 1 switches to a non-3GPP access that is not trusted in security, or the terminal (UE) 1 first connects to a non-3GPP access, the terminal 1 detects an ePDG 27 and performs key exchange (IKEv 2) with the ePDG 27, and establishment of an IPsec tunnel, and then establishes a PDN (Packet Data Network) connection with the PGW 22 over the established IPsec tunnel. In order for the terminal 1 to access the non-3GPP access network, it is necessary to perform authentication. The ePDG 27 relays an EAP (Extensible Authentication Protocol) message from the terminal 1 to a 3GPP AAA (Authentication Authorization Accounting) server 25. The 3GPP AAA server 25 performs EAP-SIM (Extensible Authentication Protocol-Subscriber Identity Module) Authentication, or EAP-AKA (Extensible Authentication Protocol-Authentication and Key Agreement) authentication (reference may be made to 3GPP TS 33.402: Security aspects of non-3GPP accesses, etc., for example).
The ePDG 27 sets up a tunnel (Proxy Mobile IP or GPRS (General Packet Radio System) Tunneling Protocol) toward the PGW 22 in S2b interface (reference may be made to 3 GPP TR 23.834: Study on GPRS Tunneling Protocol (GTP) based S2b etc., for example).
When the non-3GPP access corresponds to PMIPv6 (Proxy Mobile IPv6), it can connect to the PGW 22 via a PMIPv6. In the case of using a proxy mobile IP between the PGW 22 and the ePDG 27, when an IPsec tunnel is established between the terminal 1 and the ePDG 27, the ePDG 27 transmits a proxy binding update message to the PGW 22. As a result, in the PGW 22, a transmission destination of data to the terminal 1 is switched to the ePDG 27. It is noted that the PMIPv6 is a mobility control protocol that establishes and releases a tunnel for data transfer (GRE (Generic Routing Encapsulation) tunnel) between a mobility anchor (LMA: Local Mobility Anchor) and a mobility access gateway (MAG: Mobility Access Gateway) (reference may be made to IETF (The Internet Engineering Task Force) RFC (Request For Comments) 5213). The LMA forwards a packet to the MAG to which the terminal is connected (switches a communication route and forwards the packet addressed to the terminal to a visiting area). When the terminal moves from one MAG to another MAG, a tunnel for data transfer is established between the LMA that established the data transfer tunnel before, and a MAG to which the terminal newly connects.
The 3GPP AAA server 25 provides network access authentication, authorization, and accounting services from users. Authorization of non-3GPP access is performed among terminal 1, 3 GPP AAA server 25, and HSS 24. For example, when the terminal 1 establishes an IPsec tunnel with the ePDG 27, mutual authentication is performed between the terminal 1 and the network based on, for example, EAP-AKA.
When the terminal 1 moves or first connects to the trusted non-3GPP access (trusted wireless LAN access point 42 in
IPSec is a protocol that encrypts and authenticates packets at a network layer level. AH (Authentication Header) performs authentication of such as connection destination of a VPN (Virtual Private Network), presence or absence of tampering in a packet (reference may be made to IETF RFC 2402). ESP (Encapsulating Security Payload) performs packet encryption and authentication (connection destination/packet falsification) (reference may be made to IETF RFC 2406), For IPSec communication, there are a transport mode (IPsec between hosts on which IPsec is implemented) and a tunnel mode (IPsec between VPN apparatuses such as routers equipped with IPsec). In the transport mode, data of layer 4 or more of a packet is encrypted (see
An ESP packet has a format including an ESP header, a payload, an ESP trailer, and authentication data (ESP Authentication data) (see
The ESP header (ESP header) includes an SPI (Security Parameter Index: a 32-bit value uniquely identifying an SA (Security Association) for that datagram), and a sequence number (sequence number of the packet: 32 bits).
The ESP trailer includes a padding (padding field for adjusting payload length), a pad length (number of bytes of padding), a next header (Protocol after ESP: TCP (Transmission Control Protocol)/UDP (User Datagram Protocol)).
Authentication data (HMAC (Hash-based Message Authentication Code)) is a variable length field including an Integrity Check Value (ICV) calculated from an ESP packet except authentication data.
A security association (SA), which is a logical connection, is established between VPN apparatuses for performing IPsec communication. Since SA is a one-way tunnel, two SAs are provided for transmission and reception of packets. SA is established for each traffic that performs VPN communication. SA includes IPsec parameters (security information) (e.g., SPI (Security Parameter Index), mode, protocol, cryptographic algorithm, key, authentication algorithm, IP address of tunnel endpoint, etc.).
IKE (Internet Key Exchange) is a key exchange protocol for SA setting (reference may be made to IETF RFC 4306, for example). ISAKMP (Internet Security Association and Key Management Protocol) _SA (Security Association) is an SA for encrypting control information of IKE for transmission and reception between peers (reference may be made to IETF RFC 4306, for example).
Recently, as a form of a telecommunication business, an MVNO (Mobile Virtual Network Operator) that borrows necessary infrastructures from an MNO (Mobile Network Operator) which is a communication carrier (carrier) possessing communication infrastructures such as wireless communication facilities and core networks) is widespread. In this specification, MVNO communication carriers are referred to as MVNO carriers. A terminal contracted to an MVNO carrier is composed of, for example, a SIM (Subscriber Identity Module) free terminal. In this specification, an MNO is also referred to as an MNO carrier.
Next-generation Wi-Fi Calling Using IMS and 3GPP Wi-Fi Access, Internet search (searched on 26 Apr. 2015) <URL: http: //www.aptilo.com/wi-fi-calling/next-generation-wi-fi-calling-solution>
In a data center or the like, a mechanism for providing a communication service corresponding to a type of an access network to which a terminal is connected (for example, non-3GPP access network, 3GPP access network) or the like is desired.
The present invention has been invented in consideration of the above issue and it is an object of the present invention to provide a system, a method, an apparatus, and a non-transitory computer readable medium storing a program, each making it possible to provide a communication service according to a network to which a terminal is connected.
According to one aspect of the present invention, there is provided a communication system comprising a data center connected to a core network connected with a base station and a wireless LAN, via a first wide area network (WAN 1), wherein the data center comprises:
a virtual core network that virtualizes at least a part of core network functions and is adapted to connect to the first wide area network; and
a control unit configured to select connection to either the wireless LAN or the base station being selectable, and to variably control a service in the virtual core network according to a network to which a terminal connecting to the data center is connected between the network and the first wide area network.
According to another aspect of the present invention, there is provided a communication apparatus comprising:
an apparatus adapted to connect via a first wide area network to a core network connected with a base station and to a wireless LAN (Local Area Network);
a virtual core network that virtualizes at least a part of functions of the core network and is adapted to connect to the first wide area network; and
a control apparatus that variably controls a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station and connect to the data center, in accordance with a network connected between the terminal and the first wide area network.
According to another aspect of the present invention, there is provided a communication method by a data center that is adapted to connect to a core network connected with a base station and to a wireless LAN (Local Area Network) through a first wide area network (Wide Area Network),
providing a virtual core network that virtualizes at least a part of functions of the core network and is adapted to connect to the first wide area network; and
variably controlling a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station, and that connects to the data center, in accordance with a network connected between the terminal and the first wide area network.
According to another aspect of the present invention, there is provided a terminal comprising:
means for communicating with a base station of a mobile network or a wireless LAN (Local Area Network); and
means being able to select, at a setup, whether to make a call via. the base station of the mobile network or to make a call via the wireless LAN.
According to another aspect of the present invention, there is provided a program causing a computer arranged in a data center adapted to connect via a first wide area network to a core network connected with a base station and to a wireless LAN (Local Area Network) to execute processing comprising;
operating a virtual core network that virtualizes at least a part of functions of the core network and is adapted to connect to the first wide area network; and
variably controlling a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station and connect to the data center, in accordance with a network connected between the terminal and the first wide area network.
According to yet another aspect of the present invention, there is provided a program causing a computer included in a terminal to execute processing comprising:
communicating with a base station of a mobile network or a wireless LAN (Local Area Network); and
enabling to select whether to make a call via the base station of the mobile network or to make a call via the wireless LAN, when originating a call.
According to yet another aspect of the present intention, there is provided a program causing a computer included in a terminal to execute processing comprising:
communicating with a base station of a mobile network or a wireless LAN (Local Area Network); and
enabling to select, at a setup, whether to make a call via the base station of the mobile network or to make a call via the wireless LAN.
According to the present invention, there is provided a computer readable recording medium (a storage such as a semiconductor memory, CD (Compact Disk)/DVD (Digital Versatile Disk) or the like) in which the program is recorded.
According to the present invention, it is possible to provide a communication service corresponding to a network to which terminal is connected.
Still other features and advantages of the present invention will become readily apparent to those skilled in this art from the following detailed description in conjunction with the accompanying drawings wherein only exemplary embodiments of the invention are shown and described, simply by way of illustration of the best mode contemplated of carrying out this invention. As will be realized, the invention is capable of other and different embodiments, and its several details are capable of modifications in various obvious respects, all without departing from the invention. Accordingly, the drawing and description are to be regarded as illustrative in nature, and not as restrictive.
The following describes example embodiments of the present invention. According to the example embodiment of the present invention, a data center, to which a terminal connects via a first wide area network via a base station and a core network or via a wireless LAN (Local Area Network), is adapted to variably control a communication service and the like, provided by a virtual network of the data center according to a network to which the terminal is connected between the first wide area network (Wide Area Network) and the terminal.
In the present embodiment, although not particularly limited, a virtualized EPC (vEPC) may be provided as a virtual network of the data center. The virtualized EPC (vEPC) may be configured by software based implementation of at least one or all of functions of nodes such as SGW, PGW, MME, HSS, PCRF and so forth by an application operating on a virtual machine. For example, as will be described later with reference to
A first gateway (GW 1) 51 (Ingress gateway) connects a wide area network (WAN) 1 (31) such as the Internet with the vEPC 52. A second gateway 53 (Egress gateway) connects a WAN 2 (32) such as the Internet, IMS, or the like to the vEPC 52.
In
Further, the terminal 1 may access the data center 50 via the wireless LAN 40 such as Wi-Fi (registered trademark) by changing setup thereof. In this case, the terminal 1 connects to the WAN 2 (32) via the wireless LAN 40, and through the WAN 1 (31), the first gateway 51, the vEPC 52, and the second gateway 53 in the data center 50.
In
There are provided a data center (DC) 50 of a cloud operator that can connect via the WAN 1 (31) to an EPC (MNO-EPC) 20 of an MNO carrier connected to the base station (eNB) 10 and the wireless LAN 40. The terminal 1 is enabled to select to connect to the wireless LAN 40 or connect to the base station 10. The first gateway 51 provided in the data center 50 includes a VPN apparatus which connects by a VPN between the terminal 1 and the first gateway 51 when the terminal 1 connects to the data center 50 via the wireless LAN 40. A virtualized EPC (vEPC) 52 provided in the data center 50 virtualizes at least a part of the function of the EPC. The VPN is terminated at the first gateway 51, which is connected to the WAN 2 via the virtualized EPC (vEPC) 52 and the second gateway 53. Furthermore, there is provided a filter 54 that performs filtering of a packet(s) supplied to the second gateway 53, at least from the WAN 2 (32) side. It is as a matter of course that the filter 54 may perform filtering of a packet(s) supplied the first gateway 51 from the WAN 1 (31) side as well as filtering of a packet(s) supplied to the second gateway (GW) 53.
Further, there is provided a control apparatus 56 that depending on what network via which the terminal 1 is connected to the WAN 1 (31), and depending on a type of the network (whether it is a wireless LAN, or a base station and an EPC), controls communication services of the vEPC 52 (for example, a charging method or a QoS policy) and controls to make a difference between networks to which the terminal 1 is connected. The control apparatus 56 is shown as a node connected to the vEPC 52 for the sake of explanation, but the control apparatus 56 may, as a matter of course, be provided in the vEPC 52, or the control apparatus 56 may be implemented in an appliance of the vEPC 52.
In LTE (Long Term Evolution), QoS control is performed both in a radio access network section between a terminal and a base station and in a core network (EPC). Here, the vEPC 52 may perform bandwidth guarantee of WAN 1 and/or WAN 2.
In the vEPC 52 of the data center 50, for example, when the terminal 1 accesses the vEPC 52 through the base station 10 and the EPC 20 (when the terminal connects to 3G/LTE) and via the WAN 1 (31), charging enforcement in the policy/charging enforcement function PCEF of the vEPC 52 is activated (that is, charging is carried out according to a charging policy from PCRF). On the other hand, when the terminal 1 accesses the terminal 1 accesses the vEPC 52 via the WAN 1 (31) through the wireless LAN access point 41 (for example, when the terminal 1 connects an untrusted non-3GPP access network), the PCEF in the vEPC 52 may be controlled such that the terminal 1 is not charged.
As an example case in which the terminal 1 is not charged by the vEPC 52, there is a wireless LAN IP phone VoWLAN (Voice over Wireless LAN) in which the terminal 1 connects to the data center 50 from the wireless LAN access point 41 via the WAN 1 (31) without going through the EPC 20. Further, when the terminal 1 performs Wi-Fi (registered trademark)-calling via the wireless LAN access point 41 and via the WAN 1 (31), connection from the ePDG of the MNO or MVNO to PGW of the EPC 20 or the vEPC 52 is performed. In this case, the terminal 1 may not be charged by the PCEF in the vEPC 52 (free).
In the example embodiment, allocation of an appliance(s) in the MNO-EPC 20 (see the EPC 20 in
However, as will be described later, ePDG, PGW, PCRF and the like are provided in the vEPC 52 of the data center 50, and a cloud company, as a communication carrier (MVNO), may provide the Wi-Fi (registered trademark)-calling service to the terminal 1 and may perform charging for the service and QoS control.
The EPS bearer in the data center 50 is different between the case where the terminal 1 is connected to the vEPC 52 of the data, center 50 via the wireless LAN, WAN 1 (31), by Wi-Fi (registered trademark)-calling, and the ePDG in the vEPC 52 is set as a security gateway; and the case where the terminal 1 is connected to the vEPC 52 of the data center 50 via the base station 10, the MNO-EPC 20, and the WAN 1 (31). Management and control such as instantiation (generation) and activation of an instance (virtual machine: VM) of a virtual network function (VNF) may be performed by a control apparatus (not shown) that manages and controls a virtual network function in the vEPC 52.
A VPN tunnel 60 is established between the first gateway 51 in the data center 50 and the terminal 1, where the WAN 1 (31) is provided between the data center 50 the wireless LAN access point 41 to which the terminal 1 connects.
A VPN apparatus (VPN router) is installed in the first gateway 51 and functions as a VPN gateway. The wireless LAN access point 41 is connected to the WAN 1 (31) via a wireless LAN router (not shown), a modem (not shown), and so forth. The terminal 1 is equipped with a VPN apparatus and functions as a VPN client. In the terminal 1, the VPN connection with the data center 50 is set via the wireless LAN. The VPN connection includes tunneling and encryption. When the WAN 1 (31) is the Internet, this VPN is a so-called Internet VPN.
According to the present embodiment, in the data center 50 of the cloud provider, it is possible to realize secure connection (voice call/SMS and data communication between the data center 50 and access via the wireless LAN 40 and the wide area network WAN1).
Further, on the network (virtual network) 55 between the first gateway 51 and the second gateway 53, a filter 54 to perform packet filtering is provided.
The filter 54 is configured to perform filtering control of a packet (downlink) input to the second gateway 53 from the WAN 2 (32) side. The filter 54 may is configured to perform filtering control of a packet (uplink) from the terminal 1 to the WAN 2 (32) side. The filter 54 is connected between the first gateway 51 and the second gateway 53. The filter 54 may be mounted on a server or the like managing the security policy. The filter 54 may be operated on a virtual machine on the server.
When the terminal 1 accesses the data center 50 via the wireless LAN 40 and the WAN 1 (31), control (packet filtering, or the like) provided by the core network (EPC) of the communication carrier is usually not performed, but according to the present embodiment, the filter 54 in the data center 50 provides a packet filtering function, or the like.
In
However, it goes without saying that in
It is noted that the filter 54 of the data center 50 may be configured as a packet filter type firewall that accepts/rejects a packet based on a packet header information (address, port number, protocol, etc.). However, the present invention is not limited to such a configuration, and may include a state-full inspection function (in which a connection is established between a proxy and a connection destination which is established by an application gateway (connection from the terminal is a proxy (firewall) that performs filtering at an application layer (seventh layer) such as HTTP (Hypertext Transfer Protocol) or FTP (File Transfer Protocol)), a session table is created based on the packet header information (address, port number, protocol, etc.), and controls communication based on a direction and state of the communication. The application gateway type can restrict inappropriate browsing of Web sites, or the like.
Since the private IP address is assigned to the terminal 1 connected to the wireless LAN/3GPP access network and the address/port number is converted by NAT/NAPT, a packet having the private IP address set as a destination or a source in a header of the packet does not flow. In order to block IP address spoofing, the filter 54 may be configured to reject packets from the WAN 2 (32) destined for the private IP address.
In the case where the WAN 2 (32) is an IMS (IP Multimedia Subsystem), for example, a SIP (Session Initiation Protocol) message transmitted from the terminal 1 is sent from a proxy session control function P-CSCF (Proxy Call Session Control Function) to a serving session control function S-CSCF (Serving Call Session Control Function) on a home network side of the IMS and analyzed, and then a SIP message is sent to a S-CSCF on a called side or media gateway control function MGCF. From the S-CSCF on the called side, the Internet, another IMS, or a MGW (Media Gateway) between an IP network and an existing telephone network, or from a SGW (Signaling Gateway) that is provided between a Circuit Switched (CS) network and the IP network and terminates a call control signal from an SS7 common line signaling network and converts the call control signal to a call control signal on the IP network, a communication service is provided to a line switching domain or the like.
Alternatively, in the data center 50, at least a part of the IMS function may be implemented on the virtual network 55. For example, a function of a SIP server (for example, P-CSCF) or the like may be implemented on the virtual network 55. The filter 54 may be operated on a virtual machine, wherein content filtering for analyzing and blocking contents of a speech and a call rejection list for prohibiting an incoming call from an inappropriate number may be provided. It is noted that a configuration in which a control apparatus including content filtering and a call rejection list prohibiting incoming from an inappropriate number is not implemented on a virtual machine but implemented as a real apparatus connected between the first and second gateways 51 and 53.
Although not particularly limited thereto, the first gateway 51 as a VPN gateway, performs such processing as follows:
Establishment of a VPN tunnel between first gateway 51 and the terminal 1 via a wireless LAN, and WAN 1;
Negotiation of security parameters;
User authentication;
Assigning private IP addresses;
Data encryption and decryption;
Management of security keys;
Management of data transfer via a VPN tunnel;
Management of transmission and reception data transmission as an endpoint of a VPN tunnel or a router, and so forth.
It is noted that assignment of private IP addresses may be performed not by the gateway 51 but by PGW or the like in the vEPC 52.
As a VPN tunneling protocol, PPTP (Point-to-Point Tunneling Protocol), L2TP (Layer 2 Tunneling Protocol), IPsec, GRE (Generic Route Encapsulation) and the like may be used, for example. The protocol that performs encryption is IPsec. When IPsec is used as the VPN tunneling protocol, as described above, it is encapsulated by the ESP protocol. For IPSec-SA setting, key exchange is performed by IKE protocol (in IKE, port 500 of UDP (User Datagram Protocol) is used).
For example, since a router or the like installed in a wireless LAN connects to a plurality of terminals (VPN clients), it has a NAPT function that converts a private IP address and a global IP address of a terminal, and a port number in a Transmission Control Protocol (TCP)/User Datagram Protocol (UDP) header.
In a tunneling mode of IPSec, an IP header and a data portion (
In this case, in order to make IPsec VPN correspond to NAPT, as shown in
L2TP, by encapsulating a Point-to-Point Protocol (PPP) frame with UDP, enables exchange the encapsulated frame over the IP network and realizes VPN between two sites, LAC (L2TP Access Concentrator) and LNS (L2TP Network Server). L2TP/IPsec is a protocol that performs encryption by IPsec in L2TP which does not have a mechanism of encryption. In L2TP/IPsec, a connection (SA) by IPSec is first established.
In order to make a VPN tunnel correspond to NAT/NAPT, in addition to UDP encapsulation, a NAT traversal method that automatically detects NAT by detecting a change in an IP address or a port number may be used.
Next, a procedure of setting up a VPN tunnel. using IPsec between the VPN client (terminal 1) and the VPN gateway (GW 51) will be described.
(1) Key generation information is generated and exchanged from a pre-shared key set with a communication partner by IPsec communication, an IKE SA (ISAKMP SA) is established, and the key is created from the key creation information (IKE Phase 1). Note that the authentication algorithm, the encryption algorithm, and the pre-shared key are the same between the VPN client (terminal 1) and the VPN gateway (GW 51).
(2) Next, an IPsec tunnel for data communication is set up. Communication on IKE SA is performed and SA for data communication is established. If the authentication algorithm and key are the same as those of the connection destination, IPsec SA is established. A key for communication with IPsec SA (IKE Phase 2) is created. IPsec disappears within a certain time. IKE SA is kept for a long time as compared with IPsec SA.
(3) Next, encryption and decryption are performed on data to be encrypted using the encryption algorithm and a key created by IPsec SA. The encrypted data is transferred over IPsec SA. As the encryption algorithm, DES (Data Encryption Standard), 3DES (Triple Data Encryption Standard), or the like may be used, and MD5 (Message Digest Five), SHA-1 (Secure Hash Algorithm) or the like is used as the authentication algorithm.
In the case of IPsec VPN, when setting the VPN tunnel in the first gateway 51, the VPN setting unit 512 sets a VPN identifier (VPN tunnel identifier) for identifying the VPN, a pre-shared key, a communication target (name, etc.), an authentication algorithm, an encryption algorithm, presense or absense of IKE keep-alive (when disconnecting VPN, reconnecting). Furthermore, a network address (IP address+netmask) of a route is set as routing information. Furthermore, the presence/absence of user authentication by XAUTH (eXtended AUTHENTICATION) and presence/absence of NAT traversal are set. XAUTH encrypts and exchanges a user name and a password between a VPN remote client and a server after IKE phase 1 (apparatus authentication), and performs user authentication.
Also in the VPN setting unit 102 of the VPN apparatus 101 of the terminal 1, a setting name, a pre-shared key, a client name, a connection destination gateway (IP address or name), an authentication algorithm, an encryption algorithm, a connection destination network, presence/absence of NAT traversal, etc. are set.
In the VPN information storage unit 513, for example,
IKE cryptographic algorithms (3DES-CBC (Cipher Block Chaining Mode), DES-CBC, AES (Advanced Encryption Standard)-CBC);
IKE hash algorithm (MDS, SHA-1);
Encapsulation of ESP (Encapsulated by UDP and transmitted/received so as to enable IPsec communication in an environment not able to pass ESP by NAT);
Pre-shared key (pre-shared-key);
The policy of SA (for example, policy identifier (Policy_ID), VPN gateway identifier (gateway), authentication header (AH), authentication algorithm, a network identifier of an own apparatus's side and a network identifier of a target side);
Transport mode definition (source port list, destination port list), and
Presence or absence of NAT traversal, and so forth, may be included. These items of information may be set by the command input by the VPN setting section.
In the example of
In a case where a plurality of wireless LAN access points are included in one WLAN, in addition to the IP address of the terminal 1, the terminal ID, or the like, as VPN management information, for example, there may be provided a name of a wireless LAN access point name (APN) of the connection destination of the terminal 1, or port information of a wireless LAN router to which the wireless LAN access point connects, or the like. It is noted that the VPN information shown in
The VPN communication control units 514 and 104 terminate the VPN tunnel, manage the security key, manage the data transfer via the VPN tunnel, control transmission of the transmission/reception data as the VPN tunnel end point or the router, encrypt the data and packet transfer by encapsulation, decapsulation and decryption of a packet.
In
In
As described above, the VPN is allocated in units of terminals (terminal ID, common account). In
When the terminal 1 first accesses the wireless LAN access point 41, the wireless LAN access point 41 forwards an access request packet from the terminal 1 to the main data center 50 via the WAN 1 (31). The first gateway 51 of the data center 50 assigns an IP address (private IP address) to the terminal 1 and puts up a VPN tunnel 60. When the VPN tunnel 60 is an IPsec tunnel, the establishment of IKE SA (IKE phase) 1, and the establishment of IPsec SA (IKE phase 2) are performed as described above, and encrypted communication is performed on the IPsec SA.
In
1. The terminal 1 establishes a connection with the wireless LAN (WLAN) 40, and authentication and authorization (authentication & authorization) is performed by, for example, HSS/AAA (not shown) in the vEPC 52. In the example of
2. From the terminal 1 side, the IKE authentication/tunnel setup procedure with the first gateway (GW 1) 51 is executed. This corresponds to the IKE phases 1 and 2 described above. It may be an IKEv2 authentication tunnel setup.
3. The vEPC 52 includes an SGW and a PGW. When the setting of the bearer is required, the first gateway (GW 1) 51 may function as an MME and transmit a bearer setting request (Create Session Request) to the SGW. In this case, a PGW connected to the packet data network of the connection destination is selected, and a GTP (GPRS (General Packet Radio System) Tunneling Protocol) tunnel is established in the S8 interface between the SGW and the PGW.
4. A bearer setting response (Create Session Response) is transmitted from the SGW of the vEPC 52 to the first gateway (GW 1) 51 functioning as the MME.
5. This completes the setup of the IPsec VPN tunnel.
6. The IP address assigned to the terminal 1 is notified to the terminal 1 from the first gateway (GW 1), using the IKEv 2 message.
7. The IP connection from the terminal 1 to the first gateway (GW 1) is set at this point. The above corresponds to the sequence of the attach process.
8. Upon reception of a connection request to the connection destination on the WAN 2 (32) side from the terminal 1 side, IP routing from the first gateway (GW 1) 51 to the connection destination (WAN 2 side) is performed.
9. This completes the setting of connection, from the terminal 1 via the VPN and the vEPC 52 of the data center 50, with the connection destination on the WAN 2 side. A packet in a downlink direction from the WAN 2 (32) side to the terminal 1 is forwarded by the PGW in the vEPC 52 to the first gateway 51 according to a policy such as PCRF, and then forwarded from the first gateway 51 via the VPN tunnel 60 to the terminal 1.
The filter information storage unit 543 stores filter information for controlling discarding and passing of a packet.
The communication unit 541 extracts an address, a port, and a protocol from a header of a packet received, compares the extracted information with a condition in the filter information storage unit 543, determines rejection and permission of the packet, and notifies the communication unit 541 of the determination result.
The filter information setting unit 544 sets filter information in the filter information storage section 543. The filter information setting unit 544 may set the filter information in the filter information storage unit 543 from a management terminal (not shown) in the data center 50 of
For the filter ID=1, a packet from a port 23 (telnet) to the first gateway (GW 1) 51 may be discarded (blocking the telnet port (23)). For filter ID=2, a packet destined for a private IP address of terminal 1 may be discarded. For filter ID=3, a packet destined to a specific destination address from the terminal 1 is discarded. Note that the symbol “*” in
In
When allocating the function block 54 for each terminal (subscriber) in the function block 54 of
Referring to
The connection destination network determination unit 561 may be configured to obtain from the terminal, information as to whether the connection destination of the terminal is a non-3GPP access network (wireless LAN access point) or a 3 GPP access network (base station) when the terminal establishes a connection, for example. Alternatively, the connection destination network determination unit 561 may obtain connection destination network information of the terminal from radio bearer information managed by MME, or authentication result information at the HSS, 3 GPP AAA server, or the like, when the terminal establishes connection. The communication unit 565 stores the received packet in a reception buffer (not shown), and under the control of the communication quality control unit 564, performs priority control such as taking out packets in descending order of priority to send the packets, and performs bandwidth control necessary for bandwidth guarantee or the like of WAN1 and/or WAN 2.
The ePDG 527 functions as a VPN gateway to perform the followings:
Establishment of a VPN (IPsec) tunnel with the terminal 1 via the wireless LAN 40, and WAN 1 (31);
Negotiation of security parameters;
User authentication;
Assigning a private IP address to terminal 1;
Data encryption and decryption;
Management of security keys;
Management of data forwarding via VPN tunnel; and
Management of transmission and reception of data as an endpoint of VPN tunnel.
It is noted that the assignment of the private IP address to the terminal 1 may be performed by the PGW 522 of the vEPC 52.
The EAP message is transmitted to the ePDG 527 from the terminal 1 using IKEV 2, and relayed to the 3 GPP AAA server 525 of the vEPC 52, where the EAP-SIM/EAP-AKA authentication is performed. The ePDG 527 of the vEPC 52 and the PGW 522 are connected via GTP or PMIPv6 tunnel.
In the case where a proxy mobile IP (PMIPv6 tunnel) is used between the PGW 522 and the ePDG 527 in the vEPC 5, when an IPsec tunnel is established between the terminal 1 and the ePDG 527 of the vEPC 52, the ePDG 527 transmits a proxy binding update (Proxy Binding Update) to the PGW 522. As a result, in the PGW 522 of the vEPC 52, the destination of an incoming call to the terminal 1 is switched to the ePDG 527 of the vEPC 52, and the incoming call is notified to the terminal 1 via the VPN tunnel 60 and via the wireless LAN 40.
The PGW 522 includes, for example, a filter 529 having a TFT (Traffic Flow Template) related to an EPS bearer. As described above, setting (addition, modification, deletion, etc.) of a packet filter in a downstream direction from the WAN 2 to the terminal 1 side in the filter 529 may be performed with a Request Bearer Resource Modification message of the bearer resource correction procedure from the terminal 1. Alternatively, setting may be performed in connection processing such as an Attach Request message or the like from the terminal 1, or at an occurrence of a predetermined event, or the like. It is a matter of course that the filter 529 may be configured to have a function of performing filtering in an application layer or to have stateful inspection function. Alternatively, the filter 529 may be provided with a call rejection list for rejecting incoming calls from the WAN (32).
When the WAN 2 (32) is configured by IMS, P-CSCF (Proxy-Call Session Control Function) and Serving-CSCF connected to vEPC 52 may be configured to have content filtering that analyzes contents of voice for blocking and a call rejection list for prohibiting incoming calls from inappropriate numbers.
The control apparatus 56 is composed of the control apparatus 56 described with reference to
The service control unit 562 (
In
For example, regarding Wi-Fi (Registered Trademark)-Calling from the terminal 1, a VPN 60 (IPsec tunnel) via the wireless LAN 40 and WAN 1 (31) is established between the terminal 1 and the ePDG 527 and a tunnel of GTP/PMIPv 6 is established between the ePDG 527 and the PGW 522, and connection is made from the PGW 522 to a connection destination via the WAN 2 (32) composed of IMS, for example. That is, Wi-Fi (registered trademark)-Calling is controlled as a communication service by a cloud operator(MVNO) to provide a secure connection and through the filter 529 provide protection from unauthorized incoming calls and harmful sites etc. Note that the PGW 522 has a function of the second gateway 53 in
The filter 54 in
In
1. The terminal 1 establishes a connection with the wireless LAN (WLAN) 40, and performs authentication/authorization (Authentication & Authorization), for example, by the HSS 524/AAA 525 in the vEPC 52.
2. From the terminal 1 side, the IKEv2 authentication/tunnel setup procedure between the ePDG 527 and the terminal 1 (IKEv 2 phases 1 and 2, etc.) is executed.
3. The ePDG 527 transmits to the PGW 522 a Proxy Binding Update (request message transmitted by MAG (Mobile Access Gateway) to LMA (Local Mobility Anchor), in order to establish a binding between a mobile node's home network prefix and the MAG to which the mobile node is connected).
4. The PGW 522 cooperates with the PCRF 526 to establish an IP connection access network (IP-CAN (Connection Access Network)) session.
5. The PGW 522 notifies the AAA server 525 of identification information (PGW ID) of the PGW, and the AAA server 525 notifies the HSS 524 of an ID of the PGW 522 and an APN (Access Point Name) corresponding to the terminal 1 for registration.
6. The PGW 522 performs a proxy binding update processing and creates a binding cache entry corresponding to the terminal 1. As a result, the PGW 522 transmits a packet addressed to the terminal 1 to the ePDG 527 in accordance with contents held in the binding cache entry. The PGW 522 transmits a Proxy Binding Ack to the ePDG 527.
7. The above completes the setup of the IPsec VPN tunnel.
8. An IP address is notified from the ePDG 527 to the terminal 1 by an IKEv2 message.
9. Setup of IP connection from the terminal 1 is completed. An Psec tunnel between the terminal 1 and the ePDG 527 and a tunnel such as PMIP (Proxy Mobile Internet Protocol) between the ePDG 527 and the PGW 522 are established. The above corresponds to the sequence of the attach process.
10. When a connection request from the terminal 1 side to a connection destination of the WAN 2 (32) side is received from the ePDG 527 via the PMIP tunnel, IP routing from the PGW 522 to the connection destination (WAN 2 side) is performed. In this case, a SIP message from the terminal 1 is transmitted to the P-CSCF of the IMS via the second gateway 53 and is connected via S-CSCF, MGCF, and MGW to the connection destination of PSTN (Public Switched Telephone Networks), for example. Alternatively, it may be connected from the S-CSCF to the Internet or a connection destination connected to the other IMS. In
11. This completes the setting of the connection with the connection destination on the WAN 2 side via the VPN from the terminal 1 and the vEPC 52 of the data center 50. A packet in a downlink direction from the WAN 2 (32) side to the terminal 1 is forwarded to the ePDG 527 via the PIMP tunnel to the ePDG 527 by the PGW 522 in the vEPC 52 based on a binding cashe entry, and forwarded from the ePDG 527 to the terminal 1 via the VPN tunnel 60.
The following describes a configuration of the node of vEPC 52 with reference to
A virtual NIC (vNIC), a virtual switch (vSwitch), and the like are provided by a hypervisor 574 which is a virtualization mechanism on the server 57. It is noted that the physical switch 58 may be configured by an L2 (Layer 2) switch and the network 59 may be configured by a virtual network such as a VLAN (Virtual LAN).
Likewise, the filter 54 of
a wireless LAN access point 43 provided by another carrier (another carrier) different from the cloud operator 43,
a base station 10 of another carrier and an EPC 20 connected with the base station 10 and via the WAN 1 to the data center 50.
In the data center 50, a control apparatus (not shown) (56 in
a wireless LAN access point 41 provided to a business entity possessing the data center 50;
a wireless LAN access point 43 provided by another carrier different from the cloud operator of the data center 50, and
a base station 10 and the EPC 20 of a communication carrier (another carrier different from the cloud provider),
controls charging control method and QoS control in the vEPC 52 to be different from each other.
A QCI (QoS Class Identifier) is used as a parameter of QoS control. QCI of voice call (VoIP) is set to a high value (priority) of 2 in LTE.
Although there is no particular limitation, it is also possible to provide a difference in the following services depending on a network to which the terminal 1 is connected.
When the terminal 1 connects to the wireless LAN access point 41 of the cloud operator and connects to the vEPC 52 of the data center 50, charging for use of the vEPC 52 is not performed (free).
When the terminal 1 connects to the wireless LAN access point 43 of another carrier and connects to the vEPC 52 of the data center 50, predetermined charging for use of the vEPC 52 with setting such as X yen per unit time, for example.
When the terminal 1 connected to the base station 20 of another carrier to connect to the vEPC 52 of the data center 50, predetermined charging with setting such as Y yen (Y>X) per unit time.
Further, as QoS control in the vEPC 52 of the data center 50, when the terminal 1 connects to the wireless LAN access point 41 of the cloud operator to connect to the vEPC 52 of the data center 50, quality is set to high. When the terminal 1 connects to the wireless LAN access point 43 of another carrier to connect to the vEPC 52 of the data center 50, quality is set to low.
When the terminal 1 connects to the base station 20 of another carrier to connect to the vEPC 52 of the data center 50, quality is set to low or intermediate.
The user makes a call to the other party by selecting either the receiver (making a telephone call) 114 or the Wi-Fi (registered trademark) telephone 115.
When the user taps the receiver (calling) 114, the terminal 1 connects to the base station to connect to the calling partner.
When the user selects the Wi-Fi (registered trademark) telephone 115, the terminal 1 connects to a Wi-Fi (registered trademark) access point and connects to the calling party with Wi-Fi (registered trademark)-Calling (from a wireless LAN via a security gateway to a carrier's switch).
In the example of
In
Further, in
In the case of setting in advance on a network setting (setup) screen 116, priorities and conditions according to the type of the network to which the terminal is connected may be provided.
The communication module 1006 or the communication module 1008 may be selected in response to a change in the connection destination network from the terminal 1 or the like at the start of the call, as illustrated in
On the other hand, when the setting information as shown in
According to each of the embodiments described above, it is possible to provide a secure network connection to a terminal accessing the data center via the wireless LAN, the WAN 1, and to provide to Wi-Fi (registered trademark)-Calling from the terminal communication services (charging, communication quality) according to the network type to which the terminal connects. In addition, it enables protection from harmful sites, denial of harmful contents and rejection of improper incoming calls, etc.
The disclosure of the above Non-Patent Literature 1 is incorporated herein by reference. Within the framework of the entire disclosure (including the scope of claims) of the present invention, it is possible to change/adjust the embodiment or example based on the basic technical concept. Also, various combinations or selections of various disclosed elements (including each element of each claim, each element of each embodiment, each element of each drawing, etc.) are possible within the scope of the claims of the present invention. That is, it goes without saying that the present invention includes various modifications and modifications that could be made by those skilled in the art according to the entire disclosure including the claims, and technical concepts.
The above-described embodiments may be attached, for example, as follows (but not limited to the following).
A communication system including
a data center adapted to connect via a first wide area network to a core network connected with a base station and to a wireless LAN (Local Area Network), wherein the data center includes:
a virtual core network that virtualizes at least a part of functions of the core network and is adapted to connect to the first wide area network; and
a control apparatus that variably controls a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station, and that connects to the data center, in accordance with a network connected between the terminal and the first wide area network.
The communication system according to supplementary note 1, wherein in the data center, in accordance with a type of a network to which the terminal connects, the type of the network corresponding to whether the terminal connects to the data center via the base station and the core network and via the first wide area network, or the terminal connects to the data center via the wireless LAN and the first wide area network, and
in a case where the terminal connects to the data center via the wireless LAN and the first wide area network, in accordance with a type of the wireless LAN to which the terminal connects, the type of the wireless LAN corresponding to whether an access point of the wireless LAN is provided by an operator of the data center, or by another operator that is different from the operator of the data center,
the control apparatus variably controls at least one of a charging method and a communication quality service provided to the terminal in the virtual core network.
The communication system according to supplementary note 1 or 2, wherein the data center includes
a VPN apparatus that, in a case where the terminal connects to the data center via the wireless LAN and via the first wide area network, connects to the terminal by a VPN (Virtual Private Network) extending through the first wide area network and the wireless LAN.
The communication system according to supplementary note 3, wherein the data center comprises:
a first gateway that is adapted to connect to the first wide area network and that includes the VPN apparatus;
a second gateway that is adapted to connect to a second wide area network, wherein the first gateway and the second gateway are connected to the virtual core network; and
a filter that is arranged between the first gateway and the second gateway and that performs filtering of at least one of a packet input thereto from the first wide area network and a packet input thereto from the second wide area network.
The communication system according to supplementary note 4, wherein in the data center, the filter controls access denial or permission of an incoming call and a message destined to the terminal from the second wide area network side.
The communication system according to any one of supplementary notes 3 to 5, wherein
the terminal communicates from the VPN via the VPN apparatus and the virtual core network and via the second wide area network with a connection destination, and
the terminal receives, through the VPN, an incoming call or data destined to the terminal from the second wide area network from the virtual core network and the VPN apparatus in the data center.
The communication system according to any one of supplementary notes 3 to 6, wherein the VPN apparatus of the data center manages the VPN between the terminal and the VPN apparatus, on a per terminal basis or on a per terminal user basis.
The communication system according to any one of supplementary notes 1 to 7, wherein the terminal comprises
a selector that selects to communicate either via the base station or via the wireless LAN.
The communication system according to any one of supplementary notes 1 to 8, wherein an access point of the wireless LAN includes at least one of
an access point provided by an operator of the data center, and
an access point provided by another communication carrier.
A communication apparatus comprising:
an apparatus adapted to connect via a first wide area network to a core network connected with a base station and to a wireless LAN (Local Area Network);
a virtual core network that virtualities at least a part of functions of the core network and is adapted to connect to the first wide area network; and
a control apparatus that variably controls a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station and connect to the data center, in accordance with a network connected between the terminal and the first wide area network.
The communication apparatus according to supplementary note 10, wherein the control apparatus variably controls at least one of a charging method and a communication quality service provided to the terminal in the virtual core network,
in accordance with a type of a network to which the terminal connects, the type of the network corresponding to whether the terminal connects to the data center via the base station and the core network and via the first wide area network, or the terminal connects to the data center via the wireless LAN and the first wide area network, and
in a case where the terminal connects to the data center via the wireless LAN and the first wide area network, in accordance with a type of the wireless LAN to which the terminal connects, the type of the wireless LAN corresponding to whether an access point of the wireless LAN is provided by an operator of the data. center, or by another operator that is different from the operator of the data center.
The communication apparatus according to supplementary note 10 or 11, comprising
a VPN apparatus that, in a case where the terminal connects to the data center via the wireless LAN and via the first wide area network, connects to the terminal by a VPN (Virtual Private Network) extending through the first wide area network and the wireless LAN.
The communication apparatus according to supplementary note 12, comprising:
a first gateway that is adapted to connect to the first wide area network and that includes the VPN apparatus;
a second gateway that is adapted to connect to a second wide area network, wherein the first gateway and the second gateway are connected to the virtual core network; and
a filter that is arranged between the first gateway and the second gateway and that performs filtering of at least one of a packet input thereto from the first wide area network and a packet input thereto from the second wide area network.
The communication apparatus according to supplementary note 13, wherein the filter controls access denial or permission of an incoming call and a message destined to the terminal from the second wide area network side.
The communication apparatus according to any one of supplementary notes 12 to 14, wherein the terminal communicates from the VPN via the VPN apparatus and the virtual core network and via the second wide area network with a connection destination, and
the terminal receives, through the VPN, an incoming call or data destined to the terminal from the second wide area network from the virtual core network and the VPN apparatus in the data center.
The communication apparatus according to any one of supplementary notes 10 to 15, wherein the VPN apparatus of the data center manages the VPN between the terminal and the VPN apparatus, on a per terminal basis or on a per terminal user basis.
A communication method by a data center that is adapted to connect to a core network connected with a base station and to a wireless LAN (Local Area Network) through a first wide area network (Wide Area Network),
providing a virtual core network that virtualizes at least a part of functions of the core network and is adapted to connect to the first wide area network; and
variably controlling a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station, and that connects to the data center, in accordance with a network connected between the terminal and the first wide area network.
The communication method according to supplementary note 17, comprising
variably controlling, in the data center, at least one of a charging method and a communication quality service provided to the terminal in the virtual core network, in accordance with a type of a network to which the terminal connects, the type of the network corresponding to whether the terminal connects to the data center via the base station and the core network and via the first wide area network, or the terminal connects to the data center via the wireless LAN and the first wide area network, and
in a case where the terminal connects to the data center via the wireless LAN and the first wide area network, in accordance with a type of the wireless LAN to which the terminal connects, the type of the wireless LAN corresponding to whether an access point of the wireless LAN is provided by an operator of the data center, or by another operator that is different from the operator of the data center.
The communication method according to supplementary note 17 or 18, wherein in a case where the terminal connects to the data center via the wireless LAN and via the first wide area network, connection between the terminal and the data center by a VPN (Virtual Private Network) extending through the first wide area network and the wireless LAN.
The communication method according to supplementary note 19, wherein in the data center are provided:
a first gateway connecting to the first wide area network;
a second gateway adapted to connect to a second wide area network, wherein the first gateway and the second gateway are connected to the virtual core network; the method comprising
by a filter that is arranged between the first gateway and the second gateway, performing filtering of at least one of a packet input thereto from the first wide area network and a packet input thereto from the second wide area network.
The communication method according to supplementary note 20, comprising
controlling by the filter access denial or permission of an incoming call and a message destined to the terminal from the second wide area network side.
The communication method according to any one of supplementary notes 19 to 21, comprising:
the terminal communicating with the connection destination from the VPN via the VPN apparatus and the virtual core network via the second wide area network, and
the terminal receiving from the virtual core network and the VPN apparatus in the data center via the VPN an incoming call or data destined to the terminal from the second wide area network side.
The communication method according to any one of supplementary notes 19 to 22, comprising
the VPN apparatus of the data center managing the VPN between the terminal and the VPN apparatus, on a per terminal basis or on a per terminal user basis.
A terminal comprising:
a communicator for communicating with a base station of a mobile network or a wireless LAN (Local Area Network); and a selector being able to select whether to make a call via the base station of the mobile network or to make a call via the wireless LAN, when originating a call.
A terminal comprising:
a communicator for communicating with a base station of a mobile network or a wireless LAN (Local Area Network); and
an application selector being able to select whether to make a call via the base station of the mobile network or to make a call via the wireless LAN, when originating a call.
A terminal comprising:
a communicator for communicating with a base station of a mobile network or a wireless LAN (Local Area Network); and
a selector being able to select, at a setup, whether to make a call via the base station of the mobile network or to make a call via the wireless LAN.
The terminal according to any one of supplementary notes 24 to 26, comprising:
a connector that when connecting to a data center via the wireless LAN and the first wide area network, connects between the terminal and the data center with a VPN through the wireless LAN and the first wide area network.
A non-transitory computer readable medium storing therein a program causing a computer arranged in a data center adapted to connect via a first wide area network to a core network connected with a base station and to a wireless LAN (Local Area Network) to execute processing comprising;
operating a virtual core network that virtualizes at least a part of functions of the core network and is adapted to connect to the first wide area network; and
variably controlling a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station and connect to the data center, in accordance with a network connected between the terminal and the first wide area network.
The non-transitory computer readable medium according to supplementary note 28, the program stored therein casing the computer to execute processing that variably controls at least one of a changing method and a communication quality service provided to the terminal in the virtual core network,
in accordance with a type of a network to which the terminal connects, the type of the network corresponding to whether the terminal connects to the data center via the base station and the core network and via the first wide area network, or the terminal connects to the data center via the wireless LAN and the first wide area network, and
in a case where the terminal connects to the data center via the wireless LAN and the first wide area network, in accordance with a type of the wireless LAN to which the terminal connects,
the type of the wireless LAN corresponding to whether an access point of the wireless LAN is provided by an operator of the data center, or by another operator that is different from the operator of the data center.
The non-transitory computer readable medium according to supplementary note 28 or 29, the program stored therein casing the computer to execute
processing that in a case where the terminal connects to the data center via the wireless LAN and via the first wide area network, connects to the terminal by a VPN (Virtual Private Network) extending through the first wide area network and the wireless LAN.
A non-transitory computer readable medium storing therein a program causing a computer included in a terminal to execute processing comprising:
communicating with a base station of a mobile network or a wireless LAN (Local Area Network); and
enabling to select whether to make a call via the base station of the mobile network or to make a call via the wireless LAN, when originating a call.
A non-transitory computer readable medium storing therein a program causing a computer included in a terminal to execute processing comprising:
communicating with a base station of a mobile network or a wireless LAN (Local Area Network); and
enabling to select, at a setup, whether to make a call via the base station of the mobile network or to make a call via the wireless LAN.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2015-154492 | Aug 2015 | JP | national |
This application is a National Stage of International Application No. PCT/JP2016/072782, filed on Aug. 3, 2016, which claims priority from Japanese Patent Application No. 2015-154492, filed on Aug. 4, 2015, the contents of all of which are incorporated herein by reference in their entirety.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2016/072782 | 8/3/2016 | WO | 00 |
