JP2006121728A - Communication system, mobile terminal device, gateway device, and communication control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication system in which a device different from a certain mobile terminal device can access resources within a communication provider network to which the mobile terminal device belongs from a local network via the mobile terminal device. <P>SOLUTION: When a mobile terminal 20 receives the request of access to the side of a mobile communication network 12 via the present mobile terminal device from a communication apparatus on a local network 3 or from a communication apparatus connected via a gateway device 1 via the local network 3, the mobile terminal 20 authenticates the communication apparatus and when the authentication is successful, the mobile terminal starts processing to repeat a packet from the communication apparatus to the side of the mobile communication network 12. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a mobile terminal device that can be simultaneously connected to both a mobile communication network and a local network, a gateway device that relays between a fixed communication network and a local network, a communication system including them, and a communication control method.

  With the explosive spread of mobile phones and the spread of the Internet, the development of Internet services using mobile phones as terminals is being promoted by mobile communication companies. A module for processing a communication protocol called TCP / IP used on the Internet is incorporated in a mobile phone to perform WWW service, mail distribution, image information transfer, and the like. As a result, there is an advantage that not only the information closed only within the communication carrier but also the information in the Internet spreading all over the world can be freely accessed, and the number of users is rapidly expanding.

  Now, there is a serious problem of how to assign an address to each terminal for a cellular phone Internet service having a huge number of users. Currently, in the Internet, it is said that IP address depletion is a problem with the number of nodes (routers and terminals) that are expanding. Generally, in the current IPv4, for example, in a corporate network, it is a private address. A closed address pair system is used, and only access to the outside is performed using a global address by performing address translation. Even in the case of Internet service using a mobile phone, an address translation device (NAT) is placed at the boundary between the IP packet network of the mobile phone company and the global Internet, so that the mobile phone network can be built with a private address. This is the current situation.

  On the other hand, IPv6 is being studied as a next-generation IP protocol. In IPv6, an IP address that was 32 bits wide in IPv4 can be expanded to 128 bits wide, so that a much larger number of nodes can be accommodated than in IPv4. Also in the mobile phone Internet, by adopting IPv6, a unique global address can be assigned to all terminals. As a result, using a wide address space, it is possible to communicate seamlessly between ends without using a relay device such as NAT in the middle of the route, which is advantageous in various aspects such as security and guarantee of communication quality. It has been broken. In addition, IPv6 has a feature of automatic address configuration that automatically generates an address from a network ID managed by each router and a device-specific ID, and is characterized by easy operation of the end host.

  Recently, with the development of wireless technology, technology for connecting various devices locally via a wireless network has been spreading. As an example, there is a wireless standard called Bluetooth (registered trademark) that connects devices in a short distance using a 2.4 GHz Unlicensed radio wave band. In Bluetooth (registered trademark), devices constitute an ad-hoc network called pico-net (registered trademark), and data communication can be performed mutually. Similar network rules include HomeRF, which aims to be a home network.

  Here, for example, a situation is assumed in which a packet service is introduced based on the IPv6 system in a mobile phone network, and Internet access is possible via the mobile phone network and ISP network using IPv6. Here, in the home network, it is assumed that Internet connection is made via a gateway device, and the gateway device is connected to various devices via a local (wireless) network such as Bluetooth (registered trademark). On the other hand, it is assumed that the mobile terminal can be connected to the Internet via a mobile phone network and can also be connected to a Bluetooth (registered trademark) network via another communication interface. That is, the user of the mobile phone is connected to the IP network of the mobile phone network outside the house to receive service, and is connected to the gateway connected to the fixed ISP network through the Bluetooth (registered trademark) network inside the house. Assume a situation of receiving.

  Now, when a certain portable terminal is connected to a Bluetooth (registered trademark) network in the home, not all portable terminals are connectable. Considering that it is in the home, portable terminals with access authority or access qualifications such as portable terminals owned by family members can be connected, but other portable terminals are connected via the Bluetooth (registered trademark) network. Control that does not allow is conceivable. However, with this method, visitors other than family members are not allowed to access the Internet using the home network, so it can be said that the policy is inflexible. In particular, in the case of a fixed access network that is not limited to a home, a terminal with membership can be connected free of charge, but it is desirable to control so that a non-member can connect if paying an appropriate price. Or, at least when a terminal that is not licensed in advance connects to the access network even if there is no charge, only the log information is obtained and monitored so that a malicious user does not cheat. It is necessary.

  To summarize the above, it is not only permitted to connect only to the mobile terminal for which user registration has been performed, but also to permit connection to a terminal that has not been previously permitted after performing predetermined accounting and log acquisition processing. Is desirable.

  Also, in the reverse direction, there is a problem of how to access resources in the mobile phone network by accessing the devices in the fixed network or from the Internet via the gateway. In general, since all access is attributed to the mobile phone user, the mobile phone needs to operate as a proxy after an appropriate authentication sequence. For example, by communicating a predetermined message and authentication code with a mobile phone or entering a mobile network access list provided in the gateway to prove the legitimacy of access, only when this is cleared, It is necessary for the mobile terminal to access the telephone network side resource and to filter other messages to prevent the telephone network side resource from being attacked or illegally used.

  The present invention has been made in view of the above circumstances, and a device different from a certain mobile terminal device is transferred from a local network to a resource in a communication carrier network to which the mobile terminal device belongs via the mobile terminal device. It is an object to provide a communication system, a mobile terminal device, a gateway device, and a communication control method that allow access.

  The present invention relates to a communication system including a mobile terminal device that can be simultaneously connected to both a mobile communication network and a local network, and a gateway device that relays between a fixed communication network and the local network. When a request for access to the mobile communication network side via its own mobile terminal device is received from a communication device on the local network or a communication device connected via the gateway device via the local network And means for authenticating the communication device, and means for starting a process of relaying a packet from the communication device to the mobile communication network when the authentication is successful. To do.

  Further, the present invention provides a communication system including a mobile terminal device that can be simultaneously connected to both a mobile communication network and a local network, and a gateway device that relays between the fixed communication network and the local network. Whether the packet should be relayed to the mobile terminal apparatus based on a predetermined attribute of the packet when a packet is received from the fixed communication network side to the mobile communication network side via the mobile terminal apparatus Means for determining whether or not, and means for transferring a packet determined to be relayed by this means to the mobile terminal device via the local network, the mobile terminal device comprising: Means for authenticating the communication device when a request for access to the mobile communication network side via the mobile terminal device is received from a communication device on the local network; Upon successful authentication, characterized by comprising a means for initiating the process of relaying the packet to the mobile communication network side from the communication device.

  The present invention is also a mobile terminal device that can be simultaneously connected to both a mobile communication network and a local network, the first communication interface for inputting / outputting data to / from the mobile communication network, and the local network A second communication interface for inputting / outputting data to / from the packet, a packet communication unit for performing packet communication via the first communication interface, and packet communication via the second communication interface; Means for authenticating the communication device when a request for access to the mobile communication network side via the mobile terminal device is received from the communication device on the local network via the second communication interface And means for starting a process of relaying a packet from the communication device on the local network to the mobile communication network when the authentication is successful. Characterized in that was.

  The present invention is a gateway device that relays between a fixed communication network and a local network, and includes a first communication interface for inputting / outputting data to / from the fixed mobile communication network, and data to the local network. A second communication interface for inputting / outputting; a packet communication means for performing packet communication via the first communication interface; and packet communication via the second communication interface; When a packet is received from the fixed communication network side via the communication interface to the mobile communication network side via a mobile terminal device that can be simultaneously connected to both the mobile communication network and the local network, the packet has Means for determining whether to relay the packet to the mobile terminal device via the second communication interface based on a predetermined attribute A packet is determined to be relayed by this means, it is characterized in that a means for transferring to the mobile terminal device via the second communication interface.

  The present invention relating to the apparatus is also established as an invention relating to a method, and the present invention relating to a method is also established as an invention relating to an apparatus. Further, the present invention relating to an apparatus or a method has a function for causing a computer to execute a procedure corresponding to the invention (or for causing a computer to function as a means corresponding to the invention, or for a computer to have a function corresponding to the invention. It can also be realized as a computer-readable recording medium on which a program (for realizing) is recorded.

  According to the present invention, by going through an authentication or access permission procedure, a device different from a certain mobile terminal device is connected from the local network via the mobile terminal device to the communication carrier network to which the mobile terminal device belongs. The resource can be accessed.

  Hereinafter, embodiments of the invention will be described with reference to the drawings.

  FIG. 1 shows a configuration example of a communication system according to the present embodiment.

  In FIG. 1, the area surrounded by a dotted line indicated by 12 is a portion of the mobile communication carrier network. In the mobile carrier network 12, a plurality of network links are connected via the mobile phone network 6 and the router device 4. The router device 4 has at least a function as a normal router (for example, a router corresponding to IPv4 or IPv6).

  Although it is assumed that the mobile communication carrier network 12 originally provides a normal voice call service, the configuration for providing a normal voice call service is omitted in FIG. In the present embodiment, a case where one mobile communication carrier manages the packet communication network provided by him / her as one management domain will be described as an example. There are cases where there are multiple management domains, and cases where a plurality of mobile carriers are affiliated to have a common management domain, and combinations thereof are also conceivable.

  The mobile terminal device (for example, mobile terminal, mobile phone) 20 is connected to the corresponding network link via the radio base station 5 according to the geographical location where the mobile terminal device 20 exists. Then, the mobile terminal device 20 includes a node in the same network link, a node in the same management domain via the router device 4, and a node outside the management domain from the router device 4 via the Internet 7 (for example, the server 8). ) And packet communication (by IPv4 or IPv6). When a server 14 for performing a member-dedicated service exists in the cellular phone network 6, packet communication with the server 14 (using IPv4 or IPv6) is possible.

  There may be a plurality of mobile communication carrier networks 12 operated by different mobile communication carriers. In this case, it is assumed that the mobile terminal device 20 belongs to one of the mobile communication carriers.

  On the other hand, in FIG. 1, the area surrounded by the dotted line 11 is the home network portion. In the home network 11, various devices 2 and the gateway device 1 are connected via the home local network 3. In the present embodiment, the home local network 3 is a local wireless network, and a specific example thereof is Bluetooth (registered trademark). The mobile terminal device 20 also has a function for connecting to the home local network 3.

  A plurality of home networks 11 to 11 ′ can be connected to one ISP network 9. Each of the home networks 11 to 11 'has the same basic configuration (specific configuration may be different).

  The gateway device 1 of the home network 11 is connected to an external Internet 7 via a fixed communication network (here, ISP network) 9. In this embodiment, a case where one ISP provider manages the ISP network provided by the ISP as one management domain will be described as an example. However, in addition to this, one provider manages a plurality of management domains. There are cases where there is a common management domain, such as cases where multiple businesses are affiliated, and combinations thereof are also conceivable.

  The mobile terminal device 20 and the device 2 connected to the home local network 3 (with a predetermined procedure) and the server 8 on the Internet 7 via the gateway device 1 and the ISP network 9 (by IPv4 or IPv6, etc.) ) Packet communication is possible. Further, for example, when a server 10 for providing a member-dedicated service exists in the ISP network 9, packet communication with the server 10 (using IPv4 or IPv6) is possible.

  The dotted lines indicated by 11 and 12 are for logical explanation of the basic configuration and do not indicate the coverage area of the wireless network. In the present embodiment, the mobile terminal device 20 can be simultaneously connected to the mobile communication carrier network 12 and the home local network 3.

  In FIG. 2, the structural example of the gateway apparatus 1 of this embodiment is shown.

  The gateway device 1 includes a first communication interface 31 for connecting to the ISP network 9, a second communication interface 32 for connecting to the home local network 3, a data relay unit 33 for relaying these communication interfaces, A network connection permission list 34, a telephone network access permission list 35, and an authentication / billing processing unit 36 are provided. If necessary, the data relay device 33 may include a function for performing protocol conversion, media conversion, and the like when relaying these communication interfaces.

  The local network connection permission list 34 is for holding a list of device IDs of devices that can be connected to the local network 3 on the second communication interface 32 side. The authentication / billing processing unit 36 searches for a server group such as a necessary billing server and log server based on a message from the mobile terminal device 20 and performs a necessary transaction. The telephone network access permission list 35 is a source address and protocol that allows direct access from the ISP network 9 side to the mobile phone network 6 side via the gateway device 1 / home local communication network 3 / mobile terminal device 20. It is a list showing types, port numbers, and the like.

  The local network connection permission list 34 is necessary when adopting a configuration that supports billing and log functions. The authentication / billing processing unit 36 is required when adopting a configuration that supports a billing function. The telephone network access permission list 35 is required when the mobile terminal device 20 adopts a configuration in which the local network 3 relays to the mobile phone network 6 and the gateway device 1 determines permission / inhibition.

  FIG. 3 shows a configuration example of the mobile terminal device 20 of the present embodiment.

  As shown in FIG. 3, the mobile terminal device 20 includes a first communication interface 23 for connecting to the mobile carrier network 12, a second communication interface 24 for connecting to the home local network 3, A voice call mechanism 21 for normal voice call, a packet communication mechanism 22 for packet communication (by IPv4 or IPv6, etc.), an ID register 25, an identification message generator 26, and an authenticator 27 are provided.

  Identification information such as the device ID of the mobile terminal device 20 (information that uniquely identifies the device) and affiliated carrier information (affiliated carrier ID that is information that uniquely identifies the mobile communication carrier to which the mobile terminal device 20 belongs) is stored in an ID register. 25. The identification message generator 26 generates a message including the identification information and transfers it via an appropriate interface when necessary. The authentication unit 27 includes an authentication key storage memory 28 and an authentication processing unit 29, and performs predetermined authentication processing when accessing the mobile phone network 6 from the local network 3 side.

  The ID register 25 and the identification message generator 26 are necessary when adopting a configuration that supports accounting and log functions. The authentication unit 27 is necessary when the mobile terminal device 20 adopts a configuration that relays from the local network 3 side to the mobile phone network 6.

  Hereinafter, the operation of this embodiment will be described in detail.

  Here, first, an authentication policy when the mobile terminal device is connected to the local network is considered. In general, it is not preferable from the viewpoint of security that an arbitrary terminal is connected to the local network, so some kind of authentication processing is required. For example, when considering a home network, only a mobile phone owned by a family is connected to the local network. That is, the policy is to check the ID of the device, check this against a pre-registered access permission list, and permit connection only to the matching device. However, in this case, for example, a service in which a visitor accesses the ISP via the home network cannot be performed unless complicated processing such as rewriting the setting file is performed. In the present embodiment, it is considered that a certain level of service is provided to such unregistered users.

  Now, considering the reason that unspecified users do not want to use the local network, there are mainly the following two reasons.

(1) We would like you to pay the price for using the local network.
This becomes clearer when considering an example in which the mobile operator A provides a local wireless service for a public area as well as a home network (see FIG. 4). Since this local wireless network is configured with an open standard such as Bluetooth (registered trademark), it holds not only mobile terminals for mobile phone operator A but also mobile terminals of other mobile phone operators B and C. Even if the user is a user, the service can be provided in terms of the wireless standard, but the mobile phone operator A allows a contractor of another operator to use the local wireless network that it has made a capital investment without any consideration. It is considered impossible. However, if there is a mechanism that can charge an appropriate usage fee to a user who uses the mobile terminal of the mobile phone carrier B or C, the local wireless network can be used only by the user who has approved the charge for the convenience of the user. It may be possible to respond to the connection to. That is, even a non-registered user may accept a connection if he / she pays a usage fee. For this purpose, a link with a charging mechanism and an authentication mechanism is required.

(2) I would like to authorize the use after monitoring to prevent unauthorized actions such as malicious network attacks.
On the other hand, if there is a user who performs malicious acts such as a network attack with malicious intent, it is unspecified from the viewpoint of security and the current ISP contract covers the guarantee responsibility to the user holding the local network. There is a notion that it is not desirable to allow devices to be used. That is, there may be a policy of permitting connection on the condition that a job of a connected user is monitored by a predetermined server and log management is performed so that the user does not perform an illegal act. Of course, an action such as rejecting the connection may occur for a user who has had an illegal act in the past.

  In order to satisfy the above conditions, an authentication billing message system is required that spans multiple servers and clients, such as mobile terminal device identification information, mobile carrier billing server, and ISP network user history information server.

  First, the case where the user of the mobile terminal device 20 bears the consideration for the local network connection shown in (1) above will be described with reference to FIG.

  The local network connection permission list 34 of the gateway device 1 of a certain home network 11 includes the device ID of one or more mobile terminal devices 20 used by the one or more users and the device ID of other devices 2. Suppose that it is registered in advance.

  When connecting to the home local network 3 (to use the ISP network 9), the mobile terminal device 20 first notifies the gateway device 1 of a message including the device ID of the mobile device. The same applies to the device 2.

  The gateway device 1 that has received this message checks whether or not the device ID included in the message is registered in the local network connection permission list 34, and if it is registered, the gateway device 1 sends the message to the mobile terminal device 20. A gateway service is provided to the mobile terminal device 20 so that the mobile terminal device 20 can connect to the ISP network 9 via the gateway device 1 (a message to that effect is transmitted from the gateway device 1 to the mobile terminal device 20). May be) In this case, the usage fee for the ISP network 9 is charged to the contractor. The same applies to the registered device 2.

  On the other hand, if the device ID is not registered in the local network connection permission list 34 of the gateway device 1, the gateway device 1 returns a message indicating that to the mobile terminal device 20.

  The mobile terminal device 20 that has received this message transmits a message including affiliated company information such as affiliated company ID to the gateway apparatus 1. FIG. 6 shows an example of this message.

  In the above description, the device ID and the affiliated company information are transmitted as separate messages, but the device ID and the affiliated company information may be transmitted from the mobile terminal device 20 to the gateway device 1 as a single message. .

  Now, the gateway device 1 checks the charging server 101 of the ISP network 9 to which the mobile terminal device 20 that has not been registered in the local network connection permission list 34 is connected, and belongs to the affiliated business notified from the mobile terminal device 20. The charging server 102 of the mobile telecommunications carrier to which the mobile terminal device 20 belongs is checked on the Internet 7 based on the user information (if either the charging server 101 or the charging server 102 cannot be accessed, the processing is performed). Shall be terminated). Further, based on a predetermined fee system for guest use of the ISP network 9 (this information may be stored in advance, or may be obtained from the billing server 102 when necessary), the ISP operator side Are presented to the mobile terminal device 20 and a message is sent to inquire whether or not to accept the conditions.

  The mobile terminal device 20 that has received this message presents information related to conditions such as a charge burden to the user, and also provides an input from the user as to whether or not to accept the use of the ISP network 9 under the charge burden condition. Accept.

  If the user inputs that the usage under the fee sharing condition is accepted or rejected, the mobile terminal device 20 transmits a message indicating the acceptance or rejection to the gateway device 1.

  When the gateway device 1 receives a message of rejection from the mobile terminal device 20, the gateway device 1 terminates the process (the gateway device 1 does not provide the gateway service to the mobile terminal device 20). Become).

  When the gateway device 1 receives an approval message from the mobile terminal device 20, the gateway device 1 sends an approval message including the device ID of the mobile terminal device 20 and affiliated company information to the ISP network. 9 to the charging server 101 (the gateway device 1 provides the gateway service to the mobile terminal device 20).

  The billing server 101 of the ISP network 9 that has received the message from the mobile terminal device 20 sends a billing message to the billing server 102 of the mobile communication carrier to which the mobile terminal device 20 belongs and receives a charge transfer (note that the gateway The apparatus 1 may send a charging message to the charging server 102). This amount is not limited to a fixed fee, but may be a pay-as-you-go bill depending on the connection time. In that case, the ISP provider measures the connection time, and the mobile carrier charges according to the result. A billing message is sent to the server 102.

  The gateway device 1 that has received an acknowledgment message from the mobile terminal device 20 returns a confirmation response message to the mobile terminal device 20, and after receiving the confirmation response message, the mobile terminal device 20 Communication may be started.

  In the above description, the user of the mobile terminal apparatus 20 inputs approval or rejection. However, the mobile terminal apparatus 20 is previously notified of the relationship between the conditions such as the charge amount and the approval or rejection (for example, a table or a function). It is also possible to automatically determine and respond without presenting conditions to the user and confirming acceptance or rejection.

  Further, in the message of FIG. 6, the user class (for example, the fee structure and the contents of services that can be enjoyed by the user class) in the telecommunications carrier to which the mobile terminal device 20 belongs (the telecommunications carrier indicated by the telecommunications carrier ID in FIG. 6). It is also possible to change the control content according to the user class. For example, depending on the user class on the telecommunications carrier side, the billing fee system for the mobile terminal device 20 (or its user), the contents of the service to be provided, etc. may be made different on the ISP network 9 side. Alternatively, only the mobile terminal device 20 having a service class of a certain level or more can be made accessible to the ISP network 9 (subject to the above-mentioned user's approval).

  Next, with reference to FIG. 7, a case will be described in which the user action of the mobile terminal device 20 (2) described above is log-managed.

  The local network connection permission list 34 of the gateway device 1 of a certain home network 11 includes the device ID of one or more mobile terminal devices 20 used by the one or more users and the device ID of other devices 2. Suppose that it is registered in advance.

  When connecting to the home local network 3 (to use the ISP network 9), the mobile terminal device 20 first notifies the gateway device 1 of a message including the device ID of the mobile device. The same applies to the device 2.

  The gateway device 1 that has received this message checks whether or not the device ID included in the message is registered in the local network connection permission list 34, and if it is registered, the gateway device 1 sends the message to the mobile terminal device 20. A gateway service is provided to the mobile terminal device 20 so that the mobile terminal device 20 can connect to the ISP network 9 via the gateway device 1 (a message to that effect is transmitted from the gateway device 1 to the mobile terminal device 20). May be) The same applies to the registered device 2.

  On the other hand, if the device ID is not registered in the local network connection permission list 34 of the gateway device 1, the gateway device 1 returns a message indicating that to the mobile terminal device 20.

  The mobile terminal device 20 that has received this message transmits a message (eg, FIG. 6) including affiliated company information such as the affiliated company ID to the gateway device 1.

  In the above description, the device ID and the affiliated company information are transmitted as separate messages, but the device ID and the affiliated company information may be transmitted from the mobile terminal device 20 to the gateway device 1 as a single message. .

  Now, the gateway device 1 searches the log server 201 in the ISP network 7 for the mobile terminal device 20 that has not been registered in the local network connection permission list 34 based on the device ID and affiliated company information.

  When the gateway device 1 first sends a search message including the device ID including the user information of the mobile terminal device 20 and the affiliated company information to the log server 201, the log server 201 examines the user information list, and in the past Check whether there is an unauthorized user mark indicating the history of unauthorized access.

  When an unauthorized user mark is recorded for the mobile terminal device 20, the log server 201 transmits a message to the gateway device 1 that denies access, and the gateway device 1 returns the message to the mobile terminal device 20. (This mobile terminal device 20 cannot access the ISP network 9).

  When the unauthorized user mark is not recorded for the mobile terminal device 20, the log server 201 transmits a message for permitting access to the gateway device 1, and the gateway device 1 sends the message to the mobile terminal device 20. Reply (this mobile terminal device 20 can access the ISP network 9).

  When access is granted to the mobile terminal device 20 (user), all the gateway device 1 grasps (or only the ISP network 7 side job) from the subsequent actions of the mobile terminal device 20 is the gateway device. 1 to the log server 201. The log server 201 stores a user information list and log information, and stores logs of jobs on the ISP network 7 side of the mobile terminal device 20. Log analysis is performed by a back-end log analysis server (not shown). If an illegal action is included, an unauthorized user mark is added to the user information list.

  The gateway device 1 that has received an acknowledgment message from the mobile terminal device 20 returns a confirmation response message to the mobile terminal device 20, and after receiving the confirmation response message, the mobile terminal device 20 Communication may be started.

  The above procedure is performed for each ISP access in the unregistered mobile terminal device 20.

  As in (1), consent to record a log as a connection condition from an unregistered mobile terminal device 20 (or an unauthorized user if a log is recorded and unauthorized access is permitted. If it is registered as, and after that (acknowledgment that access will be denied), connection may be made possible.

  In FIG. 7, the case where the dedicated log server 201 is arranged on the ISP network 7 side has been described as an example. However, the log server may be attached to the gateway device 1, for example.

  By the way, the (1) billing configuration described in FIG. 5 and the (2) log configuration described in FIG. 7 can be implemented in combination. In this case, when the user of the unregistered mobile terminal device 20 approves the charge and there is no unauthorized user mark for the mobile terminal device 20, the mobile terminal device 20 uses the gateway device 1. It is possible to access the ISP network 9 via the network.

  FIG. 8 shows an operation that summarizes the above.

  When the mobile terminal device 20 connects to the home local network 3, the identification message generation unit 26 generates an identification message based on the contents of the ID register 25 such as the affiliated company ID as well as its own device ID. This is transferred to the gateway device 1 via the second communication interface 24 (step S1).

  On the gateway device 1 side, first, the contents of the local network connection permission list 34 and the device ID of the mobile terminal device 20 are compared to determine whether there is a corresponding entry.

  If there is a corresponding entry, it can be accessed (step S2).

  If there is no corresponding entry, an access condition is inquired to an authentication server (not shown) on the ISP network 7 side based on the affiliated company ID, user information, etc. (step S3).

  Since the authentication server presents conditions (billing, log management, etc.) for the mobile terminal device 20 to use the ISP network 7 (step S4), the gateway device 1 relays the conditions (step S5), and the mobile terminal device Wait for responses from 20 users.

  If the user approves (step S6), necessary condition processing is performed.

  When charging is performed, the charging server 101 of the ISP network 7 is notified of the charging destination server (for example, the charging server 102 of the mobile communication carrier) and the charging conditions (step S7). As a result, charging is performed according to the usage amount.

  Further, when log acquisition is performed, a check against the unauthorized user list in the log server 201 is performed (step S7). 20 is notified.

  Next, referring to FIG. 9, in a state where the mobile terminal device 20 bridges the mobile phone network 6 and the home local network 3, the device 2 on the home local network 3 side is moved to the mobile phone network 6 side. A case where a certain resource (server) 301 is accessed will be described.

  For example, an example is conceivable in which the PDA device 2 connected to the home local network 3 accesses and synchronizes PIM data 301 (for example, a schedule table) 301 on the mobile phone network 6 side. In addition, access from the home local network 3 side to the mobile phone network 6 is not limited to the device 2 directly connected to the home local network 3, but is performed via the gateway device 1 from the ISP network 7 side, for example. It can happen.

  In this case, since the mobile terminal device 20 lends its access right to access from the home local network 3 side, a procedure for permitting access is necessary only when the mobile terminal device 20 permits use. is there.

  For access from the ISP network 7 side, entry to the telephone network access permission list 35 provided in the gateway apparatus 1 proves the legitimacy of access, and only when this is cleared, the mobile terminal The device 20 needs to access resources on the mobile phone network 6 side and filter other messages to prevent the resource 301 on the mobile phone network 6 side from being attacked or illegally used.

  Specifically, it is assumed that a certain device 2 desires access to the mobile phone network 6 when the mobile terminal device 20 is connected by both interfaces 23 and 24.

  FIG. 10 shows an example of processing of the transfer terminal device 20 in this case.

  In this case, it is assumed that the device 2 has previously registered access to the mobile phone network 6 and has registered a key for authentication. The key is stored in the authentication key storage memory 28 of the mobile terminal device 20 as a pair with the ID information of the device 2.

  When the device 2 accesses the mobile phone network 6, a message authentication code based on a one-way hash function such as MD5 is assigned to a message in a predetermined format using this authentication key and sent to the mobile terminal device 20.

  When receiving this message (step S11), the mobile terminal device 20 performs an authentication process (step S12). For example, an authentication key is searched using the ID information (for example, IP address) of the message header as a key, the message authentication code is calculated by the same method (for example, MD5) when the device 2 generates the message authentication code, and is given to the message It is checked whether the message authentication code (generated by the device 2) matches the message authentication code generated by the device itself.

  If the authentication is successful, for example, if the two message authentication codes match in the above example (step S12), Ack is returned to the device 2 and subsequent access from the device 2 is transferred to the mobile phone network 6 ( Step S13).

  On the other hand, if the authentication fails, for example, if the two message authentication codes do not match in the above example (step S12), Nack is returned to the device 2 (step S13). Subsequent access from the device 2 to the mobile phone network 6 is not performed.

  Similarly, when the access from the ISP network 7 side of a certain device is desired to access the mobile phone network 6 side via the mobile terminal device 20, the authentication key Sharing and a sequence by message authentication code can be used (see FIG. 10).

  However, generally, when there is little access from the ISP network 7 side, the telephone network access permission list 35 in the gateway device 1 and the matching of the source address, protocol type, port number, etc. are inspected, You may make it give access permission (the gateway apparatus 1). In this case, the mobile terminal device 20 does not perform the authentication as described above for the packet transferred via the gateway device 1.

  As described above, according to this embodiment, a certain mobile terminal device can access an ISP network via a local network (such as Bluetooth (registered trademark)) / gateway. If the user does not have access qualifications, the procedure is performed through a procedure for paying the consideration from the user of the mobile terminal device to the ISP provider and a procedure for recording and monitoring the log for the mobile terminal device. The mobile terminal device can access the ISP network via the local network / gateway. In addition, when a mobile terminal device can be connected to a mobile phone network and a local network, a device on the local network or a device on the fixed communication network (via the gateway / local network) can perform authentication or access permission procedures. Through the mobile terminal device, it becomes possible to access resources on the mobile phone network side via the mobile terminal device. In this embodiment, the access control list on the gateway, authentication sent by the mobile phone via the gateway, and a billing message are combined to respond to the former request, and authentication between the home network device and the transfer terminal device An authenticated telephone network access can be made possible by defining a sequence and allowing the mobile phone network side resources to access only those that have cleared the sequence. Furthermore, these detailed setting conditions can be finely adjusted according to the policies of various networks (home network, mobile phone network, fixed communication network, etc.). For example, for mobile phone network operator A, if there is a tie-up relationship such as proxying access log processing on the fixed communication network business B side, authentication and billing message transfer should be performed taking this into account Is also possible. Such customization can be freely considered (as long as the basic policy of each network is not overturned).

  Until now, the mobile terminal device has been described assuming that it has a normal voice call function. However, in addition to or instead of this function, a communication function for text communication and other forms of information is provided. You may have it. Moreover, the apparatus which can utilize only an internet service may be sufficient. The same applies to services provided by mobile carriers.

  In the above description, the home network has been described as an example. Of course, the present invention can be similarly applied to other local networks.

  The present invention can also be applied without changing the operation of existing IPv4 or IPv6 equipment, and can also be applied without changing the conventional IPv4 or IPv6 addressing architecture. Therefore, it is desirable in terms of compatibility with existing equipment.

  Note that this embodiment can be easily expanded in accordance with network management policies of various mobile communication carriers. In addition, the present invention is not limited to IPv4 or IPv6, and can be applied to a packet communication network using cellular phones that are currently proposed in various ways. The present invention is not limited to the above-described embodiment, and various in the technical scope thereof. It can be implemented with deformation.

  The above functions can also be realized as software. Further, the present embodiment is a computer readable recording program for causing a computer to execute predetermined means (or for causing a computer to function as predetermined means or for causing a computer to realize predetermined functions). It can also be implemented as a recording medium.

  Note that the configuration illustrated in each embodiment is an example, and is not intended to exclude other configurations, and a part of the illustrated configuration may be replaced with another, or a part of the illustrated configuration may be omitted. Other configurations obtained by adding another function to the illustrated configuration or combining them are also possible. Also, another configuration that is logically equivalent to the exemplified configuration, another configuration that includes a portion that is logically equivalent to the exemplified configuration, another configuration that is logically equivalent to the main part of the illustrated configuration, and the like are possible. is there. Further, another configuration that achieves the same or similar purpose as the illustrated configuration, another configuration that achieves the same or similar effect as the illustrated configuration, and the like are possible. Various variations of various components can be implemented in appropriate combination. In addition, each embodiment includes an invention as an individual device, an invention about two or more related devices, an invention as a whole system, an invention about components within an individual device, or an invention of a method corresponding to them. Including or including inventions relating to various viewpoints, stages, concepts, or categories. Therefore, the present invention can be extracted from the contents disclosed in the embodiments of the present invention without being limited to the exemplified configuration.

  The present invention is not limited to the embodiment described above, and can be implemented with various modifications within the technical scope thereof.

The figure which shows the basic structural example of the communication system which concerns on one Embodiment of this invention. The figure which shows the structural example of the gateway apparatus which concerns on the same embodiment The figure which shows the structural example of the mobile terminal device which concerns on the same embodiment Illustration for explaining a case where a provider provides a local wireless service for a public area The figure for demonstrating the example which a mobile telephone user bears the price of local network connection A figure showing an example of a message containing company information The figure for demonstrating the example which carries out log management of the action of a mobile terminal device The figure which shows an example of a processing sequence in case a mobile terminal device enters a local network The figure for demonstrating the example in which the apparatus of the local network side accesses the resource which exists in the mobile telephone network side The flowchart which shows an example of the process sequence in case a mobile terminal device relays packet communication

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Gateway apparatus, 2 ... Apparatus, 3 ... Home local network, 4 ... Router apparatus, 5 ... Wireless,
DESCRIPTION OF SYMBOLS 6 ... Mobile telephone network, 7 ... Internet, 8 ... Server apparatus, 9 ... ISP network, 10 ... Server in ISP network, 14 ... Server in mobile telephone network, 20 ... Mobile terminal device, 21 ... Voice communication mechanism, 22 ... Packet Communication mechanism, 23, 24, 31, 32 ... communication interface, 25 ... ID register, 26 ... identification message generation unit, 27 ... authentication unit, 33 ... data relay unit, 34 ... local network connection permission list, 35 ... telephone network access Permit list, 36 ... authentication / billing processing unit, 101,102 ... billing server, 201 ... log server

Claims (10)

In a communication system including a mobile terminal device that can be simultaneously connected to both a mobile communication network and a local network, and a gateway device that relays between the fixed communication network and the local network,
The mobile terminal device
When a request for access to the mobile communication network via its own mobile terminal device is received from a communication device on the local network or a communication device connected via the gateway device via the local network Means for authenticating the communication device;
And a means for starting a process of relaying a packet from the communication device to the mobile communication network when the authentication is successful. In a communication system including a mobile terminal device that can be simultaneously connected to both a mobile communication network and a local network, and a gateway device that relays between the fixed communication network and the local network,
The gateway device is
Whether a packet should be relayed to the mobile terminal apparatus based on a predetermined attribute of the packet when a packet is received from the fixed communication network side to the mobile communication network side via the mobile terminal apparatus Means for determining whether or not
Means for transferring a packet determined to be relayed by this means to the mobile terminal device via the local network,
The mobile terminal device
Means for authenticating the communication device when a request for access to the mobile communication network side via the mobile terminal device is received from the communication device on the local network;
And a means for starting a process of relaying a packet from the communication device to the mobile communication network when the authentication is successful. A mobile terminal device capable of simultaneous connection to both a mobile communication network and a local network,
A first communication interface for inputting / outputting data to / from the mobile communication network;
A second communication interface for inputting / outputting data to / from the local network;
Packet communication means for performing packet communication via the first communication interface and packet communication via the second communication interface;
For authenticating the communication device when a request for access to the mobile communication network side via the mobile terminal device is received from the communication device on the local network via the second communication interface. Means,
A mobile terminal device comprising: means for starting a process of relaying a packet from the communication device on the local network to the mobile communication network when the authentication is successful.   The mobile terminal apparatus according to claim 3, wherein Bluetooth (registered trademark) is supported as a local network connected to the second communication interface.   4. The mobile terminal apparatus according to claim 3, further comprising means for voice call. A gateway device that relays between a fixed communication network and a local network,
A first communication interface for inputting / outputting data to / from the fixed dynamic communication network;
A second communication interface for inputting / outputting data to / from the local network;
Packet communication means for performing packet communication via the first communication interface and packet communication via the second communication interface;
When receiving a packet from the fixed communication network side via the first communication interface to the mobile communication network side via a mobile terminal device that can be simultaneously connected to both the mobile communication network and the local network, Means for determining whether or not to relay the packet to the mobile terminal device via the second communication interface based on a predetermined attribute of the packet;
A gateway device comprising: means for transferring a packet determined to be relayed by the means to the mobile terminal device via the second communication interface. A communication control method for a mobile terminal device capable of simultaneous connection to both a mobile communication network and a local network,
Authenticating the communication device when a request for access to the mobile communication network side via the mobile terminal device is received from the communication device on the local network;
And a step of relaying a packet from the communication device on the local network to the mobile communication network when the authentication is successful. A gateway device communication control method for relaying between a fixed communication network and a local network,
When a packet is received from the fixed communication network side to the mobile communication network side via a mobile terminal device that can be simultaneously connected to both the mobile communication network and the local network, based on a predetermined attribute of the packet Determining whether or not to relay the packet to the mobile terminal device via the second communication interface;
And a step of transferring the packet determined to be relayed in this step to the mobile terminal device. A computer-readable recording medium recording a program for causing a computer incorporated in a mobile terminal device capable of simultaneous connection to both a mobile communication network and a local network to execute communication control,
Authenticating the communication device when a request for access to the mobile communication network side via the mobile terminal device is received from the communication device on the local network;
A computer-readable record recording a program for causing the computer to execute a step of relaying a packet from the communication device on the local network to the mobile communication network when the authentication is successful Medium. A computer-readable recording medium recording a program for causing a computer to function as a gateway device that relays between a fixed communication network and a local network,
When a packet is received from the fixed communication network side to the mobile communication network side via a mobile terminal device that can be simultaneously connected to both the mobile communication network and the local network, based on a predetermined attribute of the packet Determining whether or not to relay the packet to the mobile terminal device via the second communication interface;
A computer-readable recording medium storing a program for causing a computer to execute a step of transferring a packet determined to be relayed in this step to the mobile terminal device.

Images