NETWORK SYSTEM, COMMUNICATION CONTROL DEVICE, AND COMMUNICATION CONTROL METHOD

It is provided a network system that transfers data, the network system comprising: a first network; a second network connected with the first network and to which a server is connected; a third network connected with the first network and in which a terminal is accommodated; a terminal identification device, wherein the terminal identification device is configured to hold terminal identification information in which the address information of the gateway device in the first network, an identifier of the terminal, and the connection availability of the terminal to the second network are associated with each other, determine the connection availability of the terminal to the second network based on the terminal identification information, and acquire the address information of the gateway device in the first network and the identifier of the terminal from the gateway device to register or update the terminal identification information.

CLAIM OF PRIORITY

The present application claims priority from Japanese patent application JP 2022-101778 filed on Jun. 24, 2022, the content of which is hereby incorporated by reference into this application.

BACKGROUND OF THE INVENTION

The present invention relates to a network system, particularly to a method of identifying and managing a communication terminal.

The local 5G that has been institutionalized in December, 2019 enables freely construction of a high-speed, low-delay, and secure wireless communication infrastructure as compared to Wi-Fi. Therefore, the local 5G has been expected to be utilized as a stable wireless communication infrastructure that takes the place of Wi-Fi in various industries such as manufacturing, logistics, and building. In recent years, particularly in the field of manufacturing, aggregation of data acquired by IoT devices such as sensors and cameras in each factory to a trunk system in a trunk network for the purpose of monitoring and optimizing manufacturing processes by management of devices in the entire factory has been drawn attention. Therefore, interconnection between the local 5G network in each factory and the trunk network is desired. IoT devices are vulnerable since IoT devices have few hardware resources and cannot perform sufficient security measurement. For this reason, in order to reduce the security risk of the trunk network at the time of interconnection, connection availability of each IoT device to the trunk network needs to be controlled.

As a connection mode of the IoT device to the local 5G network, there are a method of directly connecting the IoT device with the local 5G network and a method of connecting the IoT device via a mobile router having an address conversion function. In a case of interconnecting the local 5G network and the trunk network, IoT devices connected by these connection methods need to be identified in order to control connection availability for each IoT device.

For identification of the IoT device, there is a method of identifying the IoT device by installing a terminal identification device in a connection interface of the local 5G and the trunk network, inputting in advance and managing correspondence between an identifier (for example, ID, static IP address, and MAC address) of the IoT device and header information of a packet in the terminal identification device by a network administrator of the local 5G, and performing a search in a correspondence table by using header information of a reception packet in the terminal identification device to acquire the identifier of the IoT device.

As a background art of the present technical field, there is a prior art as follows. Non Patent Literature 1 discloses a terminal identification device installed between a local 5G network that transfers a packet by using an IP in a layer 3 of an OSI model and a trunk network that transfers a packet by using a MAC in a layer 2 of the OSI model, in interconnection between the local 5G network and the trunk network. The terminal identification device associates the local 5G side IP of the IoT device, the trunk network side MAC, and the trunk network side IP with each other and holds them in the form of a table. Before communication, the terminal identification device is authenticated by an authentication unit in the trunk network by using the trunk network side MAC input by a network administrator. In a case where the terminal identification device is authenticated, the terminal identification device acquires the trunk network side IP from a DHCP server and updates the table. The terminal identification device identifies the IoT device by using the transmission IP for each packet transferred from the local 5G network to the trunk network. Then, in a case where the IoT device has been authenticated, the terminal identification device converts a transmission source of the packet from the local 5G side IP into the trunk network side IP and transfers the trunk network side IP to the trunk network, and in a case where the IoT device has not been authenticated, the terminal identification device discards the packet. As a result, in the method of connecting the IoT device directly with the local 5G network, it is possible to identify the IoT device and then control the connection availability to the trunk network.

Non Patent Literature

SUMMARY OF THE INVENTION

In the background art as described above, the IoT device is identified on the basis of the transmission source IP address of the packet at the connection interface in the method of connecting the IoT device directly with the local 5G network, and identification of the IoT device in the method of connecting the IoT device with the local network via the mobile router is not considered. In a case of connecting the IoT device with the local 5G network via the mobile router, the transmission source IP address and the port number of the packet are converted from the IP address and the port number of the controlled IoT device into the IP address and the port number of the mobile router by the address conversion function of the mobile router. Therefore, in the method of connecting the IoT device with the local 5G network via the mobile router, the terminal identification device at the connection interface cannot identify the IoT device on the basis of the transmission source IP address.

The present invention provides a technology of, in a case where an IoT device is connected with a trunk network via an address conversion function, acquiring and updating address information for a terminal identification device at a connection interface identifying the IoT device from a device having the address conversion function to identify the IoT device and control connection availability to a trunk network for each device.

The representative one of inventions disclosed in this application is outlined as follows. There is provided a network system that transfers data, the network system comprising: a first network; a second network connected with the first network and to which a server is connected; a third network connected with the first network and in which a terminal having address information different from address information of the first network is accommodated; a terminal identification device that determines connection availability of the terminal to the second network; and a gateway device that converts address information attached to data transferred between the first network and the third network, wherein the gateway device is configured to convert the address information of the gateway device in the first network attached to the data transferred from the first network to the third network, into address information of the terminal in the third network, and convert the address information of the terminal in the third network attached to the data transferred from the third network to the first network, into the address information of the gateway device in the first network, and the terminal identification device is configured to hold terminal identification information in which the address information of the gateway device in the first network, an identifier of the terminal, and the connection availability of the terminal to the second network are associated with each other, determine the connection availability of the terminal to the second network based on the terminal identification information, and acquire the address information of the gateway device in the first network and the identifier of the terminal from the gateway device to register or update the terminal identification information.

According to an aspect of the present invention, connection availability to another network can be controlled for each IoT device under control of a gateway device. Problem to be solved, configuration and effects other than those described above will be made clear in the description of embodiments described below.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

First Embodiment

In the description below, the “memory” may be one or more memory devices as an example of one or more storage devices, and is typically a main storage device. At least one memory device in the memory may be a volatile memory device and may be a non-volatile memory device.

In the description below, the “non-transient storage device” may be one or more non-transient storage devices as an example of one or more storage devices. The non-transient storage device is typically a non-volatile storage device (for example, an auxiliary storage device). Specifically, the non-transient storage device may be a hard disk drive (HDD), a solid state drive (SSD), a non-volatile memory express (NVMe) drive, or a storage class memory (SCM), for example.

In the description below, the “storage device” may be either a memory or a non-transient storage device.

In the description below, the “processor” may be one or more processor devices. At least one processor device is typically a microprocessor device such as a central processing unit (CPU). However, at least one processor device may be a processor device of other type such as a graphics processing unit (GPU). At least one processor device may be of a single core or a multi-core. At least one processor device may be a processor core. At least one processor device may be a processor device in a broad sense such as a circuit as an aggregate of gate arrays that performs part or all of processing by a hardware description language (for example, a field-programmable gateway array (FPGA), a complex programmable logic device (CPLD), or an application specific integrated circuit (ASIC)).

In the description below, information in which an output can be obtained in response to an input is described with the expression “xxx table”. The information may be data of any structure (for example, may be structured data and may be non-structured data), and may be a learning model represented by a neural network, genetic algorithm, and random forest in which an output is generated in response to an input. Accordingly, “xxx table” may be referred to as “xxx information”. In the description below, a configuration of each table is an example. One table may be divided into two or more tables. All or part of two or more tables may be one table.

In the description below, a function is described with the expression “yyy unit”. However, the function may be achieved by one or more computer programs being executed by a processor, may be achieved by one or more hardware circuits (for example, FPGA or ASIC), or may be achieved by a combination thereof. In a case where the function is achieved by a program being executed by a processor, determined processing is performed while using a storage device and/or a communication device as appropriate, and therefore, the function may be at least part of the processor. The processing described with a function as a subject may be processing performed by a processor or a device including the processor. The program may be installed from a program source. The program source may be, for example, a recording medium (for example, a non-transient recording medium) readable by a program distribution computer or a computer. Description of each function is an example and a plurality of functions may be collected as one function and one function may be divided into a plurality of functions.

FIG.1is a diagram illustrating a configuration example of a network system of a first embodiment.

A network system of the first embodiment illustrated inFIG.1includes a trunk network3, a local 5G network2, and a terminal identification device1installed between the trunk network3and the local 5G network2. The terminal identification device1is only required to be installed at a position that a packet transferred between the trunk network3and the local 5G network2passes, the position being logically between the trunk network3and the local 5G network2. The local 5G network2and the trunk network3are networks in which a packet is transferred by using an internet protocol (IP) in a layer3of an OSI model. The terminal identification device1identifies an IoT device24under control of a mobile router as a transmission source and an IoT device22not under control of the mobile router to control connection availability of the trunk network3on the basis of header information such as an IP address and a port number of a packet transferred from the local 5G network2to the trunk network3. The IP address is an address used in a layer3of the OSI model, and the port number is identification information used in a layer4of the OSI model. A setting terminal4is connected to the terminal identification device1. The setting terminal4receives a setting input by a network administrator, and registers a local 5G side IP (local 5G side IP150) of the mobile router21used in the local 5G side network2, in a mobile router management table15of the terminal identification device1. The setting terminal4receives a setting input by the network administrator, and registers the IoT device24under control of a mobile router for which connection to the trunk network3is permitted and an identifier (IoT device identifier160) such as an IP address and a MAC address of the IoT device22not under control of the mobile router, in a connection availability management table16of the terminal identification device1. The configurations of the mobile router management table15and the connection availability management table16will be described later with reference toFIGS.4and5.

The local 5G network2includes the mobile router21, the IoT device22not under control of the mobile router, a LAN network23of the mobile router21, the IoT device24under control of the mobile router, a base station device25, and a mobile core device26. The mobile router21and the IoT device22include an interface of the local 5G network2, and are connected with the base station device25by a wireless line of the local 5G. The mobile core device26has a function of authenticating the mobile router21and the IoT device22on the basis of identification information (for example, IMSI) assigned to a mounted SIM card and performing assignment of the IP (local 5G side IP) used in the local 5G network2, session management, traffic aggregation, and the like, to control the local 5G network2. The mobile router21and the IoT device22are connected with the local 5G network2by using the local 5G side IP assigned by the mobile core device26.

The mobile router21has an NAPT conversion function and converts a transmission source IP address and a transmission source port number of a packet transmitted from the IoT device24under control of the mobile router from an IP address and a port number of the IoT device24under control of the mobile router into an IP address and a port number of the mobile router21. The IoT device24under control of the mobile router is connected to the LAN network23of the mobile router21. By using the NAPT conversion function of the mobile router21, the IoT device24under control of a plurality of mobile routers can be connected to the local 5G network2by using the local 5G side IP address of the mobile router21.

The trunk network3includes a remote site32including a trunk network server33and an intranet31. The intranet31is configured by, for example, the IP-VPN or wide area ethernet, and connects the local 5G network2and a plurality of remote sites32. The remote site32is a site in which a network that is connected with the intranet31is laid, and the trunk network server33is a server that is connected with the trunk network3. For example, there is a data center as the remote site32, and an execution server of a production management system as the trunk network server33.

FIG.2is a diagram illustrating a configuration example of the terminal identification device1of the first embodiment.

The terminal identification device1of the first embodiment includes a plurality of types of physical hardware resources such as a local 5G side interface10, an IoT device identification unit11, a trunk network side interface12, a storage device6, and a processor7connected to the components.

Data is transmitted and received through the interfaces10,12, and18. The storage device6stores the mobile router management table15, the connection availability management table16, and the IoT device identification table17. These tables15,16, and17are tables in which the terminal identification device1stores and deletes information. By the processor7executing a program in the storage device6, an address information update unit13, an IoT device identification unit11, and a control unit14are achieved. The processor7includes one or a plurality of operation devices such as CPU cores, and executes a predetermined program.

The local 5G side interface10is an interface that connects the terminal identification device1to the local 5G network2. The trunk network side interface12is an interface that connects the terminal identification device1to the trunk network3. The setting interface18is an interface that connects the terminal identification device1to the setting terminal4.

The IoT device identification table17holds address information such as IP addresses and port numbers for identifying the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router, identifiers for identifying the IoT devices22,24, and information on connection availability to the trunk network3. The IoT device identification table17is registered by the address information update processing by the terminal identification device1. The configuration of the IoT device identification table17is described later with reference toFIG.6. The IoT device identification unit11searches for address information such as an IP address and a port number of the IoT device identification table17, the address information being header information such as a transmission source IP address and a transmission source port number of a packet transferred from the local 5G network2to the trunk network3, to identify the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router that are the transmission sources. In a case where the IoT device24of under control of the mobile router and the IoT device22not under control of the mobile router can be connected to the trunk network3, the IoT device identification unit11transfers the packet to the trunk network server33. In a case where the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router cannot be connected to the trunk network3, the IoT device identification unit11discards the packet. The packet transferred from the trunk network3to the local 5G network2is subjected to header processing and is transferred to the local 5G network2.

The mobile router management table15holds information for managing the mobile router21used in the local 5G network2. The connection availability management table16holds information for controlling the connection availability of the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router to the trunk network3. The mobile router management table15and the connection availability management table16are set from the setting terminal4on the basis of a setting input by the network administrator through the user interface (seeFIG.10). The configurations of the mobile router management table15and the connection availability management table16will be described later with reference toFIGS.4and5. The address information update unit13refers to the mobile router management table15, requests the mobile router21for an NAPT table217and an ARP table216, creates association between the identifier of the IoT device24under control of the mobile router and the address information (IP address and port number) from the acquired tables, and updates the IoT device identification table17. The association between the identifier of the IoT device24under control of the mobile router and the address information (IP address and port number) may be created by receiving the NAPT table217and the ARP table216by the terminal identification device1, and may be created by the mobile router21and transmitted to the terminal identification device1.

The control unit14receives the setting input from the setting terminal4, and controls operation of the terminal identification device1, for example, controls data registration to the mobile router management table15, the connection availability management table16, and the IoT device identification table17.

FIG.3is a diagram illustrating a configuration example of the mobile router21of the first embodiment.

The mobile router21is a gateway device including a plurality of types of physical hardware resources such as a LAN side interface210, a local 5G side interface211, a mobile router storage device8, and a mobile router processor9connected to those components.

Data is transmitted and received through the interfaces210,211. The mobile router storage device8stores a routing table215, the ARP table216, and the NAPT table217. These tables215,216, and217are tables in which information is stored and from which information is deleted by the mobile router21. By the mobile router processor9executing a program in the mobile router storage device8, the routing processing unit213, the address conversion unit212, and the address information transmission unit214are achieved. The mobile router processor9includes one or more CPU cores and executes a predetermined program.

The LAN side interface210is an interface that connects the mobile router21to the LAN network23. The local 5G side interface211is an interface that connects the mobile router21to the local 5G network2. The local 5G side interface211decides whether the destination of the reception packet is the mobile router21. In a case where the destination of the reception packet is the mobile router21, the local 5G side interface211performs reception processing. In a case where the destination is not the mobile router21, the local 5G side interface211transfers the packet to the address conversion unit212. For example, a request message of the ARP table216and the NAPT table217to the mobile router21is transferred by the packet whose destination is the terminal identification device1.

The ARP table216holds an IP address2160and a MAC address2161of the IoT device24under control of the mobile router and the trunk network server33in association with an output destination interface2162. For example, the ARP table216is registered by ARP protocol processing of associating the IP address with the MAC in response to that the address conversion unit212requests the IP address for the MAC address of the IP address. The routing table215holds a destination network address2150of a packet transferred between the LAN network23and the local 5G network2, a next hop terminal IP address2151, and an output destination interface2152of the packet in association with each other.

For example, the routing table215is registered by OSPF routing protocol processing performed by the routing processing unit213. The routing processing unit213searches for the destination network address2150of the routing table215by using the destination IP address of the packet transferred from the address conversion unit212, and determines the next hop terminal IP address2151and the output destination interface2152of a matching entry.

The routing processing unit213performs a search in the ARP table216by using the IP address of the next hop terminal, rewrites the destination MAC address of the packet with the MAC address2161of the matching entry, and outputs the packet from the determined output destination interface. In a case where there is no matching entry, the routing processing unit213transmits an ARP request to the IP address of the next hop terminal from the output destination interface, and waits for reception of an ARP reply in the output destination interface2152. After reception, the routing processing unit213acquires the MAC of the next hop terminal from the ARP reply, records the MAC in the MAC address2161of the ARP table216, then rewrites the destination MAC address of the packet to the MAC address of the next hop terminal, and transmits the packet from the output destination interface2152. The configurations of the ARP table216and the routing table215will be described later with reference toFIGS.7and8.

The NAPT table217holds the IP address (local 5G side IP address2170) and the port number (local 5G side port number2171) of the mobile router21in association with the IP address (LAN side IP address2172) and the port number (LAN side port number2173) of the IoT device24under control of the mobile router. The NAPT table217is registered by the address conversion unit212performing address conversion processing, for example. The configuration of the NAPT table217will be described later with reference toFIG.9.

The address conversion unit212searches for the LAN side IP address2172and the LAN side port number2173in the NAPT table217by using the transmission source IP address and the transmission source port number of the packet transferred from the LAN network23to the local 5G network2, and rewrites the transmission source IP address and the port number of the packet with the local 5G side IP address2170and the local 5G side port number2171of a matching entry.

The address conversion unit212searches for the local 5G side IP address2170and the local 5G side port number2171in the NAPT table217by using the transmission source IP address and the transmission source port number of the packet transferred from the local 5G network to the LAN network23, and rewrites the transmission source IP address and port number of the packet with the LAN side IP address2172and the LAN side port number2173of a matching entry. As a result, the address information of the LAN network23and the address information of the local 5G network2included in the packet transferred between the LAN network23and the local network2are converted to each other.

The address information transmission unit214acquires the ARP table216and the NAPT table217held by the mobile router21in response to that the local 5G side interface211receives a request message of the ARP table216and the NAPT table217from the terminal identification device1, and transmits the ARP table216and the NAPT table217from the local 5G side interface211to the terminal identification device1.

FIG.4is a diagram illustrating a configuration example of the mobile router management table15of the first embodiment.

The mobile router management table15holds the local 5G side IP address150of the mobile router21used in the local 5G network2.

FIG.5is a diagram illustrating a configuration example of the connection availability management table16of the first embodiment.

The connection availability management table16holds the IoT device identifier160that is an identifier of the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router for which connection to the trunk network3is permitted. The IoT device identifier160may be either the IP address and the MAC address. The IoT device identifier160registered in the connection availability management table16is preferably the MAC address, but may be a unique identifier assigned by the administrator.

FIG.6is a diagram illustrating a configuration example of the IoT device identification table17of the first embodiment.

The IoT device identification table17holds the local 5G side IP address170of the mobile router21or the IoT device22, the port number (mobile router port number171) used by the mobile router21, the identifier (IoT device identifier172) of the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router, and the connection availability173to the trunk network3in association with each other. The local 5G side IP address170is an IP address of the IoT device22in a case of the IoT device22not under control of the mobile router, and is an IP address of the mobile router21in a case of the IoT device24under control of the mobile router. The mobile router port number171is set to a different value for each IoT device24, and is used for identifying the IoT device24under control of the mobile router. The IoT device identifier172is preferably the MAC address, but may be a unique identifier assigned by the administrator, and the same identifier as the IoT device identifier160of the connection availability management table16is used as the IoT device identifier172.

FIG.7is a diagram illustrating a configuration example of the routing table215of the first embodiment.

The routing table215holds the destination network address2150of the packet transferred between the LAN network23and the local 5G network2, the next hop terminal IP address2151that is the IP address of the transfer destination of the packet, and the output destination interface2152that is the interface to which the packet is output, in association with each other.

FIG.8is diagram illustrating a configuration example of the ARP table216of the first embodiment.

The ARP table216holds the destination IP address and the destination MAC address of the packet transferred between the LAN network23and the local 5G network2in association with each other.

FIG.9is a diagram illustrating a configuration example of the NAPT table217of the first embodiment.

The NAPT table217holds the local 5G side IP address2170, the local 5G side port number2171, the LAN side IP address2172, and the LAN side port number2173in association with each other.

FIGS.10and11are diagrams illustrating an example of a sequence of the address information update processing of the first embodiment. In the address information update processing, a combination is registered in the IoT device identification table17, the combination being a combination of the connection availability and the address information such as the IP address and the port number of the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router so that execution of the IoT device identification processing that requires reference to the IoT device identification table17is enabled. The sequence of the address information processing is performed by the control unit14of the terminal identification device1in response to the operation of the execution button414of the user interface40(seeFIG.15) of the setting terminal4, the time interval specified by a periodic execution interval415, and in a case where the IoT device under control of the mobile router cannot be identified in the IoT device identification sequence (S204ofFIG.16).

FIG.10is a sequence diagram of an example of the address information update processing for the IoT device24under control of the mobile router.

First, the setting terminal4receives a setting input by the network administrator, and registers the IP address of the mobile router21used in the local 5G network2in the local 5G side IP address150of the mobile router management table15. The setting terminal4receives a setting input by the network administrator, and registers the identifier of the IoT device24under control of the mobile router for which connection to the trunk network3is permitted in the IoT device identifier160of the connection availability management table16(S100).

Next, the address information update unit13of the terminal identification device1transmits a request message of the ARP table216and the NPAT table217from the local 5G side interface10to the mobile router21by using the local 5G side IP address150of the mobile router management table15as the destination IP address (S101).

The address information transmission unit214of the mobile router21receives the request message of the ARP table216and the NAPT table217from the local 5G side interface211. After receiving the request message, the address information transmission unit214acquires the ARP table216and the NAPT table217held by the mobile router21, and transmits the ARP table216and the NAPT table217from the local 5G side interface211to the terminal identification device1(S102). In step S102, the ARP table216and the NAPT table217may be transmitted as it is, or data of a set including the local 5G side IP address of the mobile router21, the port number used by the mobile router21, and the identifier of the IoT device24under control of the mobile router may be transmitted. It is preferable that the processing adopted from among these is changed according to the processing capacity and surplus resource amount of the mobile router21and the terminal identification device1.

The address information update unit13of the terminal identification device1receives the ARP table216and the NAPT table217from the local 5G side interface In the NAPT table217, the IP address of the IoT device24under control of the mobile router, the port number of the IoT device24under control of the mobile router, the IP address of the mobile router21, and the port number of the mobile router21are registered respectively as the local 5G side IP address2170, the local 5G side port number2171, the LAN side IP address2172, and the LAN side port number2173. In the ARP table216, the IP address of the IoT device24under control of the mobile router and the MAC of the IoT device24under control of the mobile router are registered respectively as the IP address2160and the MAC2161.

Accordingly, after the ARP table216and the NAPT table217are received, the local 5G side IP address2170of the NAPT table217corresponding to the IP address2160of the ARP table216, the local 5G side port number2171, and the MAC2161of the ARP table216are registered respectively as the local 5G side IP address170, the mobile router port number171, and the IoT device identifier172in the IoT device identification table17.

At this time, in a case where there is an entry matching the local 5G side IP address170in the IoT device identification table17, the entry is updated. In a case where a search for the IoT device identifier172of the IoT device identification table17is performed by using the IoT device identifier160of the connection availability management table16and there is a matching entry, the address information update unit13updates the entry so as to set the connection availability173to available, and in a case where there is no matching entry, the address information update unit13updates the entry so as to set the connection availability173to unavailable (S103).

FIG.11is a sequence diagram of an example of the address information update processing for the IoT device22not under control of the mobile router.

First, the setting terminal4receives a setting input from the network administrator, and registers the identifier of the IoT device22for which connection to trunk network3is permitted, in the IoT device identifier160of the connection availability management table16(S104).

The setting terminal4receives a setting input by the network administrator, and registers the local 5G side IP address and the identifier of the IoT device22in the local 5G side IP address170and the IoT device identifier172of the IoT device identification table17(S105).

The address information update unit13of the terminal identification device1searches for the IoT device identifier172of the IoT device identification table17by using the IoT device identifier160of the connection availability management table16, and updates the entry so as to set the connection availability173to available in a case where there is a matching entry and unavailable in a case where there is no matching entry (S106).

FIG.12is a flowchart of an example of the address information update processing of the first embodiment.

A case where the address information update processing is performed on the IoT device24under control of the mobile router will be described below.FIG.13is a diagram illustrating a change in the mobile router management table16, the connection availability management table16, and the IoT device identification table17in a case where the address information update processing is performed for the IoT device24under control of the mobile router.

First, the control unit14of the terminal identification device1receives registration of the mobile router management table15, the connection availability management table16, the IoT device identification table17from the setting terminal4(S1000). The setting terminal4receives the setting input by the network administrator and registers the identifier of the IoT device24under control of the mobile router in the IoT device identifier160of the connection availability management table16(S1001). The setting terminal4receives the setting input by the network administrator and registers the IP address of the mobile router21in the local 5G side IP address150of the mobile router management table15(S1002).

At the time of the end of step S1002, as illustrated in the upper part inFIG.13, the IP address of the mobile router21is registered in the local 5G side IP address150of the mobile router management table15and the identifier of the IoT device24under control of the mobile router is registered in the IoT device identifier160of the connection availability management table16.

Next, the control unit14of the terminal identification device1decides whether an entry has been added to the mobile router management table15or an entry has been added to the IoT device identification table17in step S1002(S1003).

In a case where address information update processing is performed on the IoT device24under control of the mobile router, an entry is added to the mobile router management table15(Yes in S1003), the address information update unit13of the terminal identification device1transmits the request message of the ARP table216and the NAPT table217from the local 5G side interface10to the mobile router21by using the local 5G side IP address150of the mobile router management table15as the destination IP address (S1004).

The address information update unit13of the terminal identification device1decides whether the ARP table216and the NAPT table217can be received within a timeout time set from the setting terminal4(S1005).

In a case where the ARP table216and the NAPT table217are received within the timeout time (Yes in S1005), after receiving the ARP table216and the NAPT table217, the address information update unit13registers the local 5G side IP address2170of the NAPT table217corresponding to the IP address2160of the ARP table216, the local 5G side port number2171, and the MAC2161of the ARP table216, respectively as the local 5G side IP address170, the mobile router port number171, and the IoT device identifier172of the IoT device identification table17. At this time, in a case where there is a matching entry with the local 5G side IP address170in the IoT device identification table17, the address information update unit13updates the entry (S1006). In a case where the ARP table216and the NAPT table217are not received within the timeout time (No in S1005), the address information update unit13notifies the setting terminal4of an error (S1014).

At the time of the end of step S1014, as illustrated in the middle part ofFIG.13, in the IoT device identification table17, the IP address of the mobile router21, the port number of the mobile router21, and the identifier of the IoT device24under control of the mobile router are registered respectively as the local 5G side IP address170, the mobile router port number171, and the IoT device identifier172.

Next, the control unit14of the terminal identification device1searches for the IoT device identifier172of the IoT device identification table17by using the IoT device identifier160of the connection availability management table16(S1007) and decides whether there is a matching entry (S1008). In a case where there is a matching entry (Yes in S1008), the control unit14updates the entry so as to set the connection availability173of the entry to available (S1009). In a case where there is no matching entry (No in S1008), the control unit14updates the entry so as to set the connection availability173of the entry to unavailable (S1013).

At the time of the end of step S1013, as illustrated in the lower part ofFIG.13, in the IoT device identification table17, the IP address of the mobile router21, the port number of the mobile router21, the identifier of the IoT device24under control of the mobile router, and the connection availability of the IoT device24under control of the mobile router are registered respectively as the local 5G side IP address170, the mobile router port number171, the IoT device identifier172, and the connection availability173.

The address information update processing ends by the above processes, and the terminal identification device1can start the IoT device identification sequence (seeFIG.16) for the IoT device24under control of the mobile router.

Next, a case where the address information update processing is performed for the IoT device22not under control of the mobile router will be described below.FIG.14is a diagram illustrating a change in the mobile router management table15, the connection availability management table16, and the IoT device identification table17in a case where the address information update processing is performed for the IoT device22.

First, the control unit14of the terminal identification device1receives registration of the mobile router management table15, the connection availability management table16, the IoT device identification table17from the setting terminal4(S1000). The setting terminal4receives a setting input by the network administrator and registers the identifier of the IoT device22in the IoT device identifier160of the connection availability management table16(S1001). The setting terminal4receives a setting input by the network administrator and registers the IP address and the identifier of the IoT device22in the local 5G side IP address170and the IoT device identifier172of the IoT device identification table17(S1002).

At the time of the end of step S1002, as illustrated in the upper part ofFIG.14, the identifier of the IoT device22is registered in the IoT device identifier160of the connection availability management table16. In addition, the IP address and the identifier of the IoT device22are registered in the local 5G side IP address170and the IoT device identifier172of the IoT device identification table17.

Next, the control unit14of the terminal identification device1decides whether an entry has been added to the mobile router management table15in step S1002or whether an entry has been added to the IoT device identification table17(S1003).

In a case where the address information update processing is performed for the IoT device22, since an entry is added to the IoT device identification table17(No in S1003), the control unit14searches for the local 5G side IP address150(S1010) of the mobile router management table15by using the local 5G side IP address170of the entry (S1010), and decides whether there is a matching entry (S1011).

In a case where there is a matching entry (Yes in S1011), the control unit14deletes an entry including the local 5G side IP address170and the IoT device identifier172of the IoT device22that have been registered in the IoT device identification table17in step S1002(S1012) and the process returns to step S1002.

In a case where there is no entry (No in S1011), the control unit14of the terminal identification device14searches for the IoT device identifier172of the IoT device identification table17by using the IoT device identifier160of the connection availability management table16(S1007) and decides whether there is a matching entry (S1008). In a case where there is a matching entry (Yes in S1008), the control unit14updates the entry so as to set the connection availability173of the entry to available (S1009). In a case where there is no matching entry (No in S1008), the control unit14updates the entry so as to set the connection availability173of the entry to unavailable (S1013).

At the time of the end of step S1013, as illustrated in the lower part ofFIG.14, in the IoT device identification table17, the IP address of the mobile router21, the identifier of the IoT device24under control of the mobile router, and the connection availability of the IoT device24under control of the mobile router are registered respectively as the local 5G side IP address170, the IoT device identifier172, and the connection availability173.

The address information update processing ends by the above processes, and the terminal identification device1can start the IoT device identification sequence (seeFIG.16) for the IoT device22.

FIGS.15A and15Bare diagrams illustrating an example of the user interface user in the address information update processing of the first embodiment.

As illustrated inFIG.15A, before execution of the address information update processing, the local 5G side IP address150of the mobile router management table15is input to a local 5G side IP address column410, and a check is input to a corresponding mobile router check column411. A combination of the local 5G side IP address170and the IoT device identifier172of the IoT device22is input to a combination of the local 5G side IP address column410and the IoT device identifier column412of a connection management area41. A combination of the IoT device24under control of the mobile router of the connection availability management table16and the IoT device identifier160of the IoT device22not under control of the mobile router is input to a combination of a IoT device identifier column420and a connection availability column421of a connection availability management area42. The address information update processing is performed in response to an operation of an execution button414of the connection management area41or a timing set in a periodic execution interval415.

As illustrated inFIG.15B, after execution of the address information update processing, the local 5G side IP address170, the IoT device identifier172, and the connection availability173of the IoT device identification table17are respectively displayed on the local 5G side IP address column410, the IoT device identifier column412, and a connection availability column413of the connection management area41.

FIG.16is a sequence diagram of an example of the IoT device identification processing for the IoT device24under control of the mobile router of the first embodiment. The IoT device identification processing illustrated inFIG.16is performed after the address information update sequence and after another IoT device identification sequence.

First, the IoT device24under control of the mobile router transmits a packet to the trunk network server33.

The mobile router21converts a transmission source IP address and a transmission source port number of the packet transmitted from the IoT device24under control of the mobile router from the IP address and the port number of the IoT device24under control of the mobile router into the IP address and the port number of the mobile router21by the NAPT conversion function, registers a correspondence relationship in the NAPT table217, and then, transfers the packet to the trunk network server33(S201).

The terminal identification device1searches for the local 5G side IP address150of the mobile router management table15by using the transmission source IP address of the packet in order to identify whether the transmission source is the IoT device24under control of the mobile router or the IoT device22. InFIG.16, since the transmission source is the IoT device24under control of the mobile router, there is an entry, and the process proceeds to step S203(S202).

The IoT device identification unit11of the terminal identification device1searches for the local 5G side IP address170and the mobile router port number171of the IoT device identification table17by using the transmission source IP address and the port number of the packet (S203). In a case where there is no matching entry, the process proceeds to step S204, and the address information update sequence is performed. In a case where there is a matching entry, the process proceeds to step S205. Even when there is no matching entry in S203, the IoT device24may be decided to be connection unavailable without performing the address information update sequence in step S204. The address information update sequence (step S204) may be performed a plurality of times.

In a case where there is no matching entry in S203, the IoT device identification unit11performs the address information update sequence to update the IoT device identification table17, and then, searches again for the local 5G side IP address170and the mobile router port number171in the IoT device identification table17by using the transmission IP address and the port number of the packet. In a case where there is a matching entry in the IoT device identification table17, the process proceeds to S205. In a case where there is no matching entry in the IoT device identification table17, the IoT device identification unit11discards the packet (S204).

In a case where the connection availability173of the entry is available, the IoT device identification unit11of the terminal identification device1transfers the packet to the trunk network server33. In a case where the connection availability173of the entry is unavailable, the IoT device identification unit11discards the packet (S205).

The trunk network server33receives the packet, performs predetermined processing, and then, returns a response to the mobile router21(S206).

The IoT device identification unit11of the terminal identification device1performs header processing on the received packet, and transfers the processed packet to the mobile router21(S207).

The mobile router21searches for the local 5G side IP address2170and the local 5G side port number2171of the NAPT table217by using the destination IP address and the port number of the received packet, rewrites the destination IP address and the port number by using the LAN side IP address2172and the LAN side port number2173of a matching entry, and transfers the packet to the IoT device24under control of the mobile router. In a case where there is no matching entry, the mobile router21discards the packet (S208).

By the above processes, the IoT device24under control of the mobile router can communicate with the trunk network server33after receiving identification and control of connection availability by the terminal identification device1(S209).

Thereafter, the IoT device identification sequence is repeatedly performed for each packet transmission from the IoT device24under control of the mobile router.

FIG.17is a sequence diagram of an example of the IoT device identification processing for the IoT device22of the first embodiment. The IoT device identification processing illustrated inFIG.17is performed after the address information update sequence or another IoT device identification sequence.

First, the IoT device22transmits the packet to the trunk network server33(S200).

The terminal identification device1searches for the local 5G side IP address150of the mobile router management table15by using the transmission source IP address in order to identify whether the transmission source is the IoT device24under control of the mobile router or the IoT device22not under control of the mobile router. InFIG.17, since the transmission source is the IoT device22not under control of the mobile router, there is no entry, and the process proceeds to step S210(S202).

The IoT device identification unit11of the terminal identification device1searches for the local 5G side IP address170of the IoT device identification table17by using the transmission source IP address of the packet (S210).

In a case where the connection availability173of the entry is available, the IoT identification unit11of the terminal identification device1transfers the packet to the trunk network server33. In a case where the connection availability173of the entry is unavailable, the IoT device identification unit11discards the packet (S205).

The trunk network server33receives the packet, performs predetermined processing, and then, returns a response to the mobile router21(S206).

The IoT device identification unit11of the terminal identification device1performs header processing on the received packet, and transfers the processed packet to the IoT device22(S211).

By the above processes, the IoT device22can communicate with the trunk network server33after receiving identification and control of connection availability by the terminal identification device1(S209).

Thereafter, the IoT device identification sequence is repeatedly performed for each packet transmission from the IoT device24under control of the mobile router.

FIG.18is a flowchart of an example of the IoT device identification processing including the address information update processing.

First, in the address information update unit13of the terminal identification device1, the address information update processing is performed (seeFIGS.10,11, and12), and updates the IoT device identification table17(S2000).

Thereafter, the IoT device identification unit11waits for reception of the packet from the local 5G side interface10or the trunk network side interface12(S2001). Upon receiving the packet, the IoT device identification unit11decides the interface that has received the packet (S2002). In a case where the interface that has received the packet is the local 5G side interface10(Yes in S2002), the IoT device identification unit11performs the IoT device identification processing (seeFIG.19). On the other hand, In a case where the interface that has received the packet is the trunk network side interface12(No in S2002), the IoT device identification unit11performs header processing and transfers the packet from the local 5G side interface (S2004).

FIG.19is an example of a flowchart of the IoT device identification processing.

The IoT device identification unit11of the terminal identification device1searches for the local 5G side IP address150of the mobile router management table by using the transmission source IP address of the reception packet (S20030), and decides whether the transmission source IoT device is the IoT device24under control of the mobile router or the IoT device22not under control of the mobile router (S20031).

In a case where there is a matching entry (Yes in S20031), since the transmission source IoT device is the IoT device24under control of the mobile router, the IoT device identification unit11searches for the local 5G side IP address170and the mobile router port number171in the IoT device identification table17by using the transmission source IP address and the port number of the packet (S20032), and decides whether there is a matching entry (S20033). In a case where there is a matching entry (Yes in S20033), the process proceeds to step S20034. In a case where there is no matching entry (No in S20033), the IoT device identification unit11performs the address information update processing and updates the IoT device identification table17, and the process proceeds to step S20030again.

In a case where there is no entry including the transmission source IP address of the reception packet in the mobile router management table15(No in S20031), since the transmission source IoT device is the IoT device22not under control of the mobile router, the IoT device identification unit11searches for the local 5G side IP address170in the IoT device identification table17by using the transmission source IP address of the packet (S20036), and decides whether there is a matching entry (S20037). In a case where there is a matching entry (Yes in S20037), the process proceeds to step S20034. In a case where there is no matching entry (No in S20037), the IoT device identification unit11discards the packet (S20038).

In a case where there is an entry including the transmission source IP address and the port number of the packet in the IoT device identification table17(Yes in S20033), or in a case where there is an entry including the transmission source IP address of the packet in the IoT device identification table17(Yes in S20037), the IoT device identification unit11decides whether the connection availability174of the entry is available (S20034). In a case where the connection availability174of the entry is available (Yes in S20034), the IoT device identification unit11transfers the packet from the trunk network side interface12(S20035). In a case where the connection availability174of the entry is unavailable (No in S20034), the IoT device identification unit11discards the packet (S20038).

By the above processes, the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router can communicate with the trunk network server33after receiving identification and control of connection availability by the terminal identification device1.

As described above, in the first embodiment of the present invention, in a case where the local 5G network and the trunk network are interconnected, the IoT device connected to the trunk network can be identified via the address conversion function and the connection availability to the trunk network for each IoT device can be controlled

The terminal identification device1uses the address information (IP address and port number) of the mobile router21to request the mobile router21for the identification (MAC address) of the IoT device24, and uses the address information of the mobile router21in the local 5G network2acquired from the mobile router21and the identifier of the IoT device24to register or update the IoT device identification table17, so that the IoT device identification table17can be dynamically updated as necessary.

In a case where the address information (IP address and port number) of the mobile router21added to data transferred from the local 5G network2to the trunk network3is not registered in the IoT device identification table17, the terminal identification device1acquires the identifier of the terminal that transmits the data and registers the identifier in the IoT device identification table17, so that the IoT device identification table17can be updated in real time by using the information of the mobile router21.

Second Embodiment

Next, a second embodiment will be described. In the second embodiment, the terminal identification device1receives a setting input from the authentication unit5in the trunk network3in addition to the setting input from the setting terminal4, and registers the connection availability management table16. In the second embodiment, the components and functions same as those in the first embodiment as described above are denoted with the same reference numerals and redundant descriptions will be omitted.

FIG.20is a diagram illustrating a network system configuration example of the second embodiment.

The network system of the second embodiment exemplified inFIG.20includes the trunk network3, the local 5G network2, the terminal identification device1installed in between the trunk network3and the local 5G network2, and the authentication unit The terminal identification device1is only required to be installed at a position logically between the trunk network3and the local 5G network2, the position being a position in which the packet transferred between the trunk network3and the local 5G network2passes. The authentication unit5is connected to the terminal identification device1, receives the authentication request message from the terminal identification device1, and transmits a response message including the identifier of the IoT device24under control of the mobile router or the IoT device22not under control of the mobile router for which connection to the trunk network3is permitted, to the terminal identification device1. As a result, the connection availability of the IoT device to the trunk network3can be managed by the authentication unit5of the trunk network3.

FIG.21is a diagram illustrating a configuration example of the terminal identification device1of the second embodiment.

The terminal identification device1of the second embodiment includes a plurality of types of physical hardware resources such as a local 5G side interface10, an IoT device identification unit11, a trunk network side interface12, the storage device6, an authentication interface19, the IoT device management table20, and a processor7connected to the components.

The authentication interface19is an interface that connects the terminal identification device1to the authentication unit5. The IoT device management table holds the identifier of the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router for which authentication is requested to the authentication unit5as the IoT device identifier200. The IoT device management table20is set from the setting terminal4on the basis of a setting input by the network administrator through the user interface40(seeFIG.15). The configuration of the IoT device management table20will be described later with reference toFIG.22.

The control unit14achieved by the processor7receives a setting input from the setting terminal4and the authentication unit5in addition to the functions described in the first embodiment, and controls operation of the terminal identification device1, for example, controls the data registration to the mobile router management table15, the connection availability management table16, and the IoT device identification table17. The control unit14transmits an authentication request message for the IoT device identifier200input as an entry to the IoT device management table20, to the authentication unit5. Thereafter, the control unit14registers the IoT device identifier160of the connection availability management table16on the basis of the response message received from the authentication unit5.

FIG.22is a diagram illustrating a configuration example of the IoT device management table20of the second embodiment.

The IoT device management table20holds the identifier of the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router as the IoT device identifier200.

FIG.23is a sequence diagram of an example of the IoT device authentication processing.

In the IoT device authentication processing, the authentication request message of the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router is transmitted to the authentication unit5on the basis of the IoT device identifier200input as an entry to the IoT device management table20, and the IoT device identifier160of the connection availability management table16is registered on the basis of the response message.

First, the setting terminal4receives a setting input by the network administrator, and registers the identifier of the IoT device24under control of the mobile router and the identifier of the IoT device22not under control of the mobile router for which the authentication request to the authentication unit5is performed, in the IoT device identifier200of the IoT device management table20(S300).

Next, the control unit14of the terminal identification device1causes the IoT device identifier200in the IoT device management table20to be included in the authentication request message and transmits the authentication request message from the authentication interface19to the authentication unit5(S301). At this time, the terminal identification device1may request authentication for each MAC address of the IoT device24, or may request authentication for all IoT devices24under control of the mobile router by transmitting the authentication request message including the IoT device identification table17to the authentication unit5.

The authentication unit5collates a list of the IoT device identifiers for which the authentication is permitted by using the IoT device identifier200included in the authentication request message, causes the identifier of the IoT device for which connection to the trunk network3is permitted to be included in the response message, and transmits the response message to the terminal identification device1(S302).

The control unit14of the terminal identification device1receives the response message from the authentication unit5, through the authentication interface19. The control unit14registers the identifier of the IoT device for which connection to the trunk network3is permitted, included in the response message in the IoT device identifier160of the connection availability management table16. At this time, in a case where there is an entry that the IoT device identifier160matches in the connection availability management table16, the control unit14updates the entry (S303).

FIG.24is a flowchart of an example of the IoT device authentication processing.

First, the control unit14of the terminal identification device1receives registration of the IoT device management table20from the setting terminal4(S3000). The setting terminal4receives a setting input by the network administrator, and registers the identifier of the IoT device24under control of the mobile router and the IoT device22not under control of the mobile router for which authentication to the authentication unit5is requested, in the IoT device identification200of the IoT device management table20(S3001).

The control unit14of the terminal identification device1causes the IoT device identifier200of the IoT device management table20to be included in the authentication request message, transmits the authentication request message to the authentication unit5(S3002), and decides whether a response message can be received within a timeout time set from the setting terminal4(S3003).

In a case where the response message is received (Yes in S3003), the control unit14of the terminal identification device1registers the identifier of the IoT device for which connection to the trunk network3is permitted, included in the response message, in the IoT device identifier160of the connection availability management table16. At this time, in a case where there is an entry that the IoT device identifier160matches in the connection availability management table16, the control unit14updates the entry (S3004). In a case where the response message is not received (No in S3003), the control unit14notifies the setting terminal4of an error (S3005).

As described above, in the second embodiment of the present invention, in addition to the effects of the first embodiment, information on the authentication availability of the IoT devices22,24is acquired from the authentication unit5, so that the connection availability of the IoT devices22,24to the trunk network3can be collectively managed on the trunk network3side.

This invention is not limited to the above-described embodiments but includes various modifications. The above-described embodiments are explained in details for better understanding of this invention and are not limited to those including all the configurations described above. A part of the configuration of one embodiment may be replaced with that of another embodiment; the configuration of one embodiment may be incorporated to the configuration of another embodiment. A part of the configuration of each embodiment may be added, deleted, or replaced by that of a different configuration.

The above-described configurations, functions, processing modules, and processing means, for all or a part of them, may be implemented by hardware: for example, by designing an integrated circuit, and may be implemented by software, which means that a processor interprets and executes programs providing the functions.

The information of programs, tables, and files to implement the functions may be stored in a storage device such as a memory, a hard disk drive, or an SSD (a Solid State Drive), or a storage medium such as an IC card, or an SD card.

The drawings illustrate control lines and information lines as considered necessary for explanation but do not illustrate all control lines or information lines in the products. It can be considered that almost of all components are actually interconnected.