Patent ID: 12250625

DETAILED DESCRIPTION

The following describes example embodiments of the present invention. According to the example embodiment of the present invention, a data center, to which a terminal connects via a first wide area network via a base station and a core network or via a wireless LAN (Local Area Network), is adapted to variably control a communication service and the like, provided by a virtual network of the data center according to a network to which the terminal is connected between the first wide area network (Wide Area Network) and the terminal.

In the present embodiment, although not particularly limited, a virtualized EPC (vEPC) may be provided as a virtual network of the data center. The virtualized EPC (vEPC) may be configured by software based implementation of at least one or all of functions of nodes such as SGW, PGW, MME, HSS, PCRF and so forth by an application operating on a virtual machine. For example, as will be described later with reference toFIG.12, the virtualized EPC (vEPC) may be implemented on a general-purpose server or the like arranged in the data center (DC) of a cloud operator that provides a cloud service (or data center service) to a client(s).

FIG.2is a diagram illustrating an example embodiment of the present invention. A virtualized EPC (vEPC)52in a data center50is a virtualized version of at least a part of the EPC20inFIG.1. That is, the vEPC52may be a virtualized version of functions of some nodes of the EPC20such as ePDG27, PGW22, PCRF26, etc. of the EPC20inFIG.1.

A first gateway (GW1)51(Ingress gateway) connects a wide area network (WAN)1(31) such as the Internet with the vEPC52. A second gateway53(Egress gateway) connects a WAN2(32) such as the Internet, IMS, or the like to the vEPC52.

InFIG.2, a wireless LAN40may be a home wireless LAN or a public wireless LAN. The wireless LAN40includes a wireless LAN access point (WLAN AP), a wireless LAN router equipped with NAT (Network Address Transformation)/NAPT (Network Address Port Translation) and the like, and connects to the WAN1(31) via a modem or the like.

Further, the terminal1may access the data center50via the wireless LAN40such as Wi-Fi (registered trademark) by changing setup thereof. In this case, the terminal1connects to the WAN2(32) via the wireless LAN40, and through the WAN1(31), the first gateway51, the vEPC52, and the second gateway53in the data center50.

InFIG.2, a part of the base station10and the EPC20to which the terminal1connects may be such ones that a cloud operator as a MVNO (Mobile Virtual Network Operator) carrier has borrowed from a communication carrier (MNO carrier). It is possible to provide various communication services to a client, as an MVNO carrier, via the virtualized EPC52in the data center50.

There are provided a data center (DC)50of a cloud operator that can connect via the WAN1(31) to an EPC (MNO-EPC)20of an MNO carrier connected to the base station (eNB)10and the wireless LAN40. The terminal1is enabled to select to connect to the wireless LAN40or connect to the base station10. The first gateway51provided in the data center50includes a VPN apparatus which connects by a VPN between the terminal1and the first gateway51when the terminal1connects to the data center50via the wireless LAN40. A virtualized EPC (vEPC)52provided in the data center50virtualizes at least a part of the function of the EPC. The VPN is terminated at the first gateway51, which is connected to the WAN2via the virtualized EPC (vEPC)52and the second gateway53. Furthermore, there is provided a filter54that performs filtering of a packet(s) supplied to the second gateway53, at least from the WAN2(32) side. It is as a matter of course that the filter54may perform filtering of a packet(s) supplied the first gateway51from the WAN1(31) side as well as filtering of a packet(s) supplied to the second gateway (GW)53.

Further, there is provided a control apparatus56that depending on what network via which the terminal1is connected to the WAN1(31), and depending on a type of the network (whether it is a wireless LAN, or a base station and an EPC), controls communication services of the vEPC52(for example, a charging method or a QoS policy) and controls to make a difference between networks to which the terminal1is connected. The control apparatus56is shown as a node connected to the vEPC52for the sake of explanation, but the control apparatus56may, as a matter of course, be provided in the vEPC52, or the control apparatus56may be implemented in an appliance of the vEPC52.

In LTE (Long Term Evolution), QoS control is performed both in a radio access network section between a terminal and a base station and in a core network (EPC). Here, the vEPC52may perform bandwidth guarantee of WAN1and/or WAN2.

In the vEPC52of the data center50, for example, when the terminal1accesses the vEPC52through the base station10and the EPC20(when the terminal connects to 3G/LTE) and via the WAN1(31), charging enforcement in the policy/charging enforcement function PCEF of the vEPC52is activated (that is, charging is carried out according to a charging policy from PCRF). On the other hand, when the terminal1accesses the terminal1accesses the vEPC52via the WAN1(31) through the wireless LAN access point41(for example, when the terminal1connects an untrusted non-3GPP access network), the PCEF in the vEPC52may be controlled such that the terminal1is not charged.

As an example case in which the terminal1is not charged by the vEPC52, there is a wireless LAN IP phone VoWLAN (Voice over Wireless LAN) in which the terminal1connects to the data center50from the wireless LAN access point41via the WAN1(31) without going through the EPC20. Further, when the terminal1performs Wi-Fi (registered trademark)-calling via the wireless LAN access point41and via the WAN1(31), connection from the ePDG of the MNO or MVNO to PGW of the EPC20or the vEPC52is performed. In this case, the terminal1may not be charged by the PCEF in the vEPC52(free).

In the example embodiment, allocation of an appliance(s) in the MNO-EPC20(see the EPC20inFIG.1) and an appliance(s) in the vEPC52(for example, SGW is one in MNO-EPC20, PGW is one in vEPC52, etc.) is arbitrary.

However, as will be described later, ePDG, PGW, PCRF and the like are provided in the vEPC52of the data center50, and a cloud company, as a communication carrier (MVNO), may provide the Wi-Fi (registered trademark)-calling service to the terminal1and may perform charging for the service and QoS control.

The EPS bearer in the data center50is different between the case where the terminal1is connected to the vEPC52of the data center50via the wireless LAN, WAN1(31), by Wi-Fi (registered trademark)-calling, and the ePDG in the vEPC52is set as a security gateway; and the case where the terminal1is connected to the vEPC52of the data center50via the base station10, the MNO-EPC20, and the WAN1(31). Management and control such as instantiation (generation) and activation of an instance (virtual machine: VM) of a virtual network function (VNF) may be performed by a control apparatus (not shown) that manages and controls a virtual network function in the vEPC52.

A VPN tunnel60is established between the first gateway51in the data center50and the terminal1, where the WAN1(31) is provided between the data center50the wireless LAN access point41to which the terminal1connects.

A VPN apparatus (VPN router) is installed in the first gateway51and functions as a VPN gateway. The wireless LAN access point41is connected to the WAN1(31) via a wireless LAN router (not shown), a modem (not shown), and so forth. The terminal1is equipped with a VPN apparatus and functions as a VPN client. In the terminal1, the VPN connection with the data center50is set via the wireless LAN. The VPN connection includes tunneling and encryption. When the WAN1(31) is the Internet, this VPN is a so-called Internet VPN.

According to the present embodiment, in the data center50of the cloud provider, it is possible to realize secure connection (voice call/SMS and data communication between the data center50and access via the wireless LAN40and the wide area network WAN1).

Further, on the network (virtual network)55between the first gateway51and the second gateway53, a filter54to perform packet filtering is provided.

The filter54is configured to perform filtering control of a packet (downlink) input to the second gateway53from the WAN2(32) side. The filter54may is configured to perform filtering control of a packet (uplink) from the terminal1to the WAN2(32) side. The filter54is connected between the first gateway51and the second gateway53. The filter54may be mounted on a server or the like managing the security policy. The filter54may be operated on a virtual machine on the server.

When the terminal1accesses the data center50via the wireless LAN40and the WAN1(31), control (packet filtering, or the like) provided by the core network (EPC) of the communication carrier is usually not performed, but according to the present embodiment, the filter54in the data center50provides a packet filtering function, or the like.

InFIG.2, in the case of providing a service such as voice call, SMS, etc. to the terminal1, in the data center50, for example, via the first gateway51, the vEPC52, the second gateway53, and via the WAN2(32), connection is made to a target terminal of voice communication or SMS message communication. On the other hand, a packet (traffic) for data communication between the terminal1and the WAN2(32) may be offloaded such that the packet does not pass through the vEPC52, but is transmitted to the network (virtual network)55in the data center50.

However, it goes without saying that inFIG.2, a voice packet may be transferred to the network55between the first gateway51and the second gateway53of the data center50. It is a matter of course that a data packet (data communication) between the terminal1and the WAN2(32) may be forwarded through the vEPC52in the data center50.

It is noted that the filter54of the data center50may be configured as a packet filter type firewall that accepts/rejects a packet based on a packet header information (address, port number, protocol, etc.). However, the present invention is not limited to such a configuration, and may include a state-full inspection function (in which a connection is established between a proxy and a connection destination which is established by an application gateway (connection from the terminal is a proxy (firewall) that performs filtering at an application layer (seventh layer) such as HTTP (Hypertext Transfer Protocol) or FTP (File Transfer Protocol)), a session table is created based on the packet header information (address, port number, protocol, etc.), and controls communication based on a direction and state of the communication. The application gateway type can restrict inappropriate browsing of Web sites, or the like.

Since the private IP address is assigned to the terminal1connected to the wireless LAN/3GPP access network and the address/port number is converted by NAT/NAPT, a packet having the private IP address set as a destination or a source in a header of the packet does not flow. In order to block IP address spoofing, the filter54may be configured to reject packets from the WAN2(32) destined for the private IP address.

In the case where the WAN2(32) is an IMS (IP Multimedia Subsystem), for example, a SIP (Session Initiation Protocol) message transmitted from the terminal1is sent from a proxy session control function P-CSCF (Proxy Call Session Control Function) to a serving session control function S-CSCF (Serving Call Session Control Function) on a home network side of the IMS and analyzed, and then a SIP message is sent to a S-CSCF on a called side or media gateway control function MGCF. From the S-CSCF on the called side, the Internet, another IMS, or a MGW (Media Gateway) between an IP network and an existing telephone network, or from a SGW (Signaling Gateway) that is provided between a Circuit Switched (CS) network and the IP network and terminates a call control signal from an SS7 common line signaling network and converts the call control signal to a call control signal on the IP network, a communication service is provided to a line switching domain or the like.

Alternatively, in the data center50, at least a part of the IMS function may be implemented on the virtual network55. For example, a function of a SIP server (for example, P-CSCF) or the like may be implemented on the virtual network55. The filter54may be operated on a virtual machine, wherein content filtering for analyzing and blocking contents of a speech and a call rejection list for prohibiting an incoming call from an inappropriate number may be provided. It is noted that a configuration in which a control apparatus including content filtering and a call rejection list prohibiting incoming from an inappropriate number is not implemented on a virtual machine but implemented as a real apparatus connected between the first and second gateways51and53.

Although not particularly limited thereto, the first gateway51as a VPN gateway, performs such processing as follows:Establishment of a VPN tunnel between first gateway51and the terminal1via a wireless LAN, and WAN1;Negotiation of security parameters:User authentication;Assigning private IP addresses;Data encryption and decryption;Management of security keys;Management of data transfer via a VPN tunnel;Management of transmission and reception data transmission as an endpoint of a VPN tunnel or a router, and so forth.

It is noted that assignment of private IP addresses may be performed not by the gateway51but by PGW or the like in the vEPC52.

As a VPN tunneling protocol, PPTP (Point-to-Point Tunneling Protocol). L2TP (Layer 2 Tunneling Protocol), IPsec, GRE (Generic Route Encapsulation) and the like may be used, for example. The protocol that performs encryption is IPsec. When IPsec is used as the VPN tunneling protocol, as described above, it is encapsulated by the ESP protocol. For IPSec-SA setting, key exchange is performed by IKE protocol (in IKE, port 500 of UDP (User Datagram Protocol) is used).

For example, since a router or the like installed in a wireless LAN connects to a plurality of terminals (VPN clients), it has a NAPT function that converts a private IP address and a global IP address of a terminal, and a port number in a Transmission Control Protocol (TCP)/User Datagram Protocol (UDP) header.

In a tunneling mode of IPSec, an IP header and a data portion (FIG.13A) are collectively encrypted, and a new IP header (New IP Header inFIG.13C) is added and transmitted (IETF RFC 4303). In NAPT, an IP address field of an IP header and a port number of a TCP/UDP header are changed. In an ESP protocol, as shown inFIG.13C, an ESP header (SPI, Serial Number) is placed next to the IP header, and there is no port number field in the ESP header. Therefore, NAPT for address translation does not work. That is, if a NAPT exists between the terminal1and the first gateway51inFIG.3, the VPN using IPsec will not be established by the NAPT.

In this case, in order to make IPsec VPN correspond to NAPT, as shown inFIG.13D, UDP encapsulation (UDP Encapsulation of IPsec Packets) method in which a UDP header is added to the ESP packet, may be used. In the case of a UDP capsulation, inFIG.13D, the first IP header is an IP header used for forwarding, and source and destination port numbers of the added UDP header are 500 which is the same port number used in IKE. When the port number is changed by NAT/NAPT, the changed number is used as it is. A checksum field (checksum) of the added UDP header is set to 0. A non-IKE marker following the UDP header is setting information for distinguishing it from the IKE packet (in which 0 is entered). This is to indicate that the packet is not an IKE packet, because the port number of the added UDP header uses the same port number as the port number of the IKE packet. In this portion of the IKE packet, a cookie (cookie) value, for example, a cookie value generated by an initiator of the negotiation of ISAKMP_SA and a cookie value generated by a response side of the negotiation of ISAKMP_SA are included.

L2TP, by encapsulating a Point-to-Point Protocol (PPP) frame with UDP, enables exchange the encapsulated frame over the IP network and realizes VPN between two sites, LAC (L2TP Access Concentrator) and LNS (L2TP Network Server). L2TP/IPsec is a protocol that performs encryption by IPsec in L2TP which does not have a mechanism of encryption. In L2TP/IPsec, a connection (SA) by IPSec is first established.FIG.13Eis a diagram illustrating a packet format of L2TP/IPsec.

In order to make a VPN tunnel correspond to NAT/NAPT, in addition to UDP encapsulation, a NAT traversal method that automatically detects NAT by detecting a change in an IP address or a port number may be used.

Next, a procedure of setting up a VPN tunnel using IPsec between the VPN client (terminal1) and the VPN gateway (GW51) will be described.(1) Key generation information is generated and exchanged from a pre-shared key set with a communication partner by IPsec communication, an IKE SA (ISAKMP SA) is established, and the key is created from the key creation information (IKE Phase1). Note that the authentication algorithm, the encryption algorithm, and the pre-shared key are the same between the VPN client (terminal1) and the VPN gateway (GW51).(2) Next, an IPsec tunnel for data communication is set up. Communication on IKE SA is performed and SA for data communication is established. If the authentication algorithm and key are the same as those of the connection destination, IPsec SA is established. A key for communication with IPsec SA (IKE Phase2) is created. IPsec disappears within a certain time. IKE SA is kept for a long time as compared with IPsec SA.(3) Next, encryption and decryption are performed on data to be encrypted using the encryption algorithm and a key created by IPsec SA. The encrypted data is transferred over IPsec SA. As the encryption algorithm, DES (Data Encryption Standard), 3DES (Triple Data Encryption Standard), or the like may be used, and MD5 (Message Digest Five), SHA-1 (Secure Hash Algorithm) or the like is used as the authentication algorithm.

FIG.3Ais a diagram illustrating a configuration of the terminal1and the VPN apparatus of the first gateway51in the data center50. A VPN setting unit512of the VPN apparatus511of the first gateway51controls VPN setting and stores setting information in the VPN information storage unit513. A VPN communication control unit514controls the connection of the VPN tunnel (IKE phases1and2), and controls communication of data communication via the VPN tunnel by encryption and decryption. The terminal1has the same configuration.

In the case of IPsec VPN, when setting the VPN tunnel in the first gateway51, the VPN setting unit512sets a VPN identifier (VPN tunnel identifier) for identifying the VPN, a pre-shared key, a communication target (name, etc.), an authentication algorithm, an encryption algorithm, presense or absense of IKE keep-alive (when disconnecting VPN, reconnecting). Furthermore, a network address (IP address+netmask) of a route is set as routing information. Furthermore, the presence/absence of user authentication by XAUTH (eXtended AUTHENTICATION) and presence/absence of NAT traversal are set. XAUTH encrypts and exchanges a user name and a password between a VPN remote client and a server after IKE phase1(apparatus authentication), and performs user authentication.

Also in the VPN setting unit102of the VPN apparatus101of the terminal1, a setting name, a pre-shared key, a client name, a connection destination gateway (IP address or name), an authentication algorithm, an encryption algorithm, a connection destination network, presence/absence of NAT traversal, etc. are set.

In the VPN information storage unit513, for example,IKE cryptographic algorithms (3DES-CBC (Cipher Block Chaining Mode), DES-CBC, AES (Advanced Encryption Standard)—CBC);IKE hash algorithm (MD5, SHA-1);Encapsulation of ESP (Encapsulated by UDP and transmitted/received so as to enable IPsec communication in an environment not able to pass ESP by NAT);Pre-shared key (pre-shared-key);The policy of SA (for example, policy identifier (Policy_ID), VPN gateway identifier (gateway), authentication header (AH), authentication algorithm, a network identifier of an own apparatus's side and a network identifier of a target side);Transport mode definition (source port list, destination port list), andPresence or absence of NAT traversal, and so forth, may be included. These items of information may be set by the command input by the VPN setting section.

FIG.3Bis a diagram illustrating one example of the VPN management information set by the VPN setting unit512and stored in the VPN information storage unit513. The VPN is given a VPN identifier and managed for each terminal (user). InFIG.3B, a connection partner IP address is a private IP address (local IP address) of the VPN client (terminal1) allocated by the first gateway51or the like (DHCP server). The terminal ID/name of the connection destination may be an ID of the terminal1(for example, IMSI (International Mobile Subscriber Identity)) or the user ID. The apparatus address is an IP address of the VPN tunnel side of the first gateway51(router). A connection network is a network to which the VPN communication is transmitted, and is a network address of the VPN tunnel side.

In the example ofFIG.3B, an IP address assigned to the terminal1inFIG.3Ais set to 100.1.100.1 and an IP address assigned to a connection network is set to 100.1.100.1 (net mask: 32) which is an IP address assigned to the terminal1. A packet addressed to the terminal1from the data center50is searched by a wireless LAN router connected to the WAN1(31) and transmitted via the wireless LAN access point connected to the corresponding port to the terminal1by VPN.

In a case where a plurality of wireless LAN access points are included in one WLAN, in addition to the IP address of the terminal1, the terminal ID, or the like, as VPN management information, for example, there may be provided a name of a wireless LAN access point name (APN) of the connection destination of the terminal1, or port information of a wireless LAN router to which the wireless LAN access point connects, or the like. It is noted that the VPN information shown inFIG.3Bis an example, and it is as a matter of course that the present invention is not limited to such a configuration.

FIG.3Cis a diagram illustrating an example of VPN management information set by the VPN setting unit102of the VPN client terminal1and stored in the VPN information storage unit103. A connection destination may be designated by a host name of the site (for example, Fully Qualified Domain Name (FQDN) of the data center50). The connection network is a network to which a VPN communication from the VPN client (terminal1) is transmitted and is a network address of a VPN tunnel side of the first gateway51. A connection network is set to a VPN side address of the first gateway51: 100.1.1.0/24 (netmask: 24).

The VPN communication control units514and104terminate the VPN tunnel, manage the security key, manage the data transfer via the VPN tunnel, control transmission of the transmission/reception data as the VPN tunnel end point or the router, encrypt the data and packet transfer by encapsulation, decapsulation and decryption of a packet.

InFIGS.3B and3C, an example of IPv4 (Internet Protocol Version 4) is illustrated, but it is a matter of course that it is not limited to IPv4. Also, IP addresses inFIGS.3B and3Care imaginary addresses.

InFIGS.3B and3C, an example in which an IPsec tunnel is used as the VPN tunnel has been described, but when L2TP/IPsec is used, an L2TP tunnel is arranged in the IPsec tunnel. A connection control message and a session control message are used for establishing the L2TP tunnel. When constructing a VPN with L2TP/IPsec, a session is established by a session control message after creating a tunnel with a connection control message.

As described above, the VPN is allocated in units of terminals (terminal ID, common account). InFIG.3B, in addition to a user ID, a field of the terminal ID/name may be a user account (for example: “aaa@example.com”) provided to the user by a cloud company of the data center50. That is, in the first gateway51, in addition to an IP address of the terminal1(VPN client), information specific to a user (a user account or a Web mail address, etc.) may be used for management of the VPN.

When the terminal1first accesses the wireless LAN access point41, the wireless LAN access point41forwards an access request packet from the terminal1to the main data center50via the WAN1(31). The first gateway51of the data center50assigns an IP address (private IP address) to the terminal1and puts up a VPN tunnel60. When the VPN tunnel60is an IPsec tunnel, the establishment of IKE SA (IKE phase)1, and the establishment of IPsec SA (IKE phase2) are performed as described above, and encrypted communication is performed on the IPsec SA.

FIG.4is a diagram for explaining an example of an attach process of the terminal1and a sequence to be connected to a connection destination that is connected to the WAN2(32) in the system of the embodiment ofFIG.2.

InFIG.4, there is schematically shown an example of an operation sequence of the terminal1, the WLAN 40 (WLAN AP), the first gateway51, the vEPC52, the second gateway53(GW2), and the connection destination on the side of the WAN2(32) inFIG.2. The numbers assigned to each sequence operation are sequence numbers for explanation.1. The terminal1establishes a connection with the wireless LAN (WLAN)40, and authentication and authorization (authentication & authorization) is performed by, for example, HSS/AAA (not shown) in the vEPC52. In the example ofFIG.4, it is assumed that the first gateway51is set as a gateway to which the terminal1is connected, when accommodating the wireless LAN40which is non-3GPP wireless access (Untrusted Non-3 GPP IP Access) which is not reliable for security.2. From the terminal1side, the IKE authentication/tunnel setup procedure with the first gateway (GW1)51is executed. This corresponds to the IKE phases1and2described above. It may be an IKEv2 authentication tunnel setup.3. The vEPC52includes an SGW and a PGW. When the setting of the bearer is required, the first gateway (GW1)51may function as an MME and transmit a bearer setting request (Create Session Request) to the SGW. In this case, a PGW connected to the packet data network of the connection destination is selected, and a GTP (GPRS (General Packet Radio System) Tunneling Protocol) tunnel is established in the S8 interface between the SGW and the PGW.4. A bearer setting response (Create Session Response) is transmitted from the SGW of the vEPC52to the first gateway (GW1)51functioning as the MME.5. This completes the setup of the IPsec VPN tunnel.6. The IP address assigned to the terminal1is notified to the terminal1from the first gateway (GW1), using the IKEv 2 message.7. The IP connection from the terminal1to the first gateway (GW1) is set at this point. The above corresponds to the sequence of the attach process.8. Upon reception of a connection request to the connection destination on the WAN2(32) side from the terminal1side, IP routing from the first gateway (GW1)51to the connection destination (WAN2side) is performed.9. This completes the setting of connection, from the terminal1via the VPN and the vEPC52of the data center50, with the connection destination on the WAN2side. A packet in a downlink direction from the WAN2(32) side to the terminal1is forwarded by the PGW in the vEPC52to the first gateway51according to a policy such as PCRF, and then forwarded from the first gateway51via the VPN tunnel60to the terminal1.

FIG.5Ais a diagram showing an example of a configuration of the filter54inFIG.2. Referring toFIG.5A, the filter54includes a communication unit541, a filter information storage unit543, a transfer control unit542, and a filter information setting unit544. The communication unit541receives a packet and causes a permitted packet to perform voice communication under control of the transfer control unit542.

The filter information storage unit543stores filter information for controlling discarding and passing of a packet.

The communication unit541extracts an address, a port, and a protocol from a header of a packet received, compares the extracted information with a condition in the filter information storage unit543, determines rejection and permission of the packet, and notifies the communication unit541of the determination result.

The filter information setting unit544sets filter information in the filter information storage section543. The filter information setting unit544may set the filter information in the filter information storage unit543from a management terminal (not shown) in the data center50ofFIG.2or from a bearer resource correction request from the terminal1or the like.

FIG.5Bshows an example of packet filter information as the configuration of the filter information storage unit543ofFIG.5A. Referring toFIG.5B, a type (handling of packet conforming to filter condition: passing or discarding), direction (direction of filter evaluation: a direction from a wireless LAN to WAN2to WAN2is set to UP, from WAN2to a wires LAN is set DOWN). A protocol (IP protocol of a packet to be filtered), a source address (source IP protocol of a packet to be filtered), a transmission port (a source port of a packet to be filtered), a destination address Destination IP protocol of a packet to be subjected to packet), a destination port (destination port of a packet to be filtered), and the like.

For the filter ID=1, a packet from a port 23 (telnet) to the first gateway (GW1)51may be discarded (blocking the telnet port (23)). For filter ID=2, a packet destined for a private IP address of terminal1may be discarded. For filter ID=3, a packet destined to a specific destination address from the terminal1is discarded. Note that the symbol “*” inFIG.5Brepresents arbitrary (any).

InFIG.5B, the filter information of filter ID=2, 3, etc. is information unique to terminal1(subscriber). It is a matter of course that the filter information of filter ID=1 (a packet with destination GW1, transmission port=23) inFIG.5Bmay be included in the filter information corresponding to terminal1(subscriber).

When allocating the function block54for each terminal (subscriber) in the function block54ofFIG.5B, the filter information ofFIG.5Bmay be set for each terminal (subscriber) by the filter information setting unit544. The filter information may be managed in association with the terminal, and other units such as the transfer control unit542, the communication unit541, and the filter information setting unit544may be realized by using common codes for a plurality of terminals. In the data center50, regarding the management of the terminal1(subscriber), a user account assigned to a user by the data center50may be used for a user of the terminal1.

FIG.6Illustrates the controller56that controls a charging method, a communication quality (QoS), and the like performed in the vECP52of the data center50according to whether a network to which the terminal1is connected is a wireless LAN, or the base station10and the EPC20inFIG.2.

Referring toFIG.6, the control unit56includes a connection destination network determination unit561that determines a network to which the terminal is connected, a service control unit562that performs setting and control of necessary services according to a network type (wireless LAN, 3G/LTE, etc.) determined by the connection destination network determination unit561, a charge execution unit563that performs charging on a packet basis based on setting information (charge policy) from the service control unit562, a communication quality control unit564that controls communication quality on a packet basis on the basis of setting information (QoS policy) set by the service control unit562, and a communication unit565that exchanges a captured packet with the charging execution unit563and is controlled by the communication quality control unit564.

The connection destination network determination unit561may be configured to obtain from the terminal, information as to whether the connection destination of the terminal is a non-3GPP access network (wireless LAN access point) or a 3 GPP access network (base station) when the terminal establishes a connection, for example. Alternatively, the connection destination network determination unit561may obtain connection destination network information of the terminal from radio bearer information managed by MME, or authentication result information at the HSS, 3 GPP AAA server, or the like, when the terminal establishes connection. The communication unit565stores the received packet in a reception buffer (not shown), and under the control of the communication quality control unit564, performs priority control such as taking out packets in descending order of priority to send the packets, and performs bandwidth control necessary for bandwidth guarantee or the like of WAN1and/or WAN2.

FIG.7is a diagram illustrating an example of the above-described embodiment. Referring toFIG.7, an IPsec tunnel is established between the ePDG527of the vEPC52in the data center50and the terminal1. The ePDG527functions as a VPN gateway and terminates the VPN tunnel.

The ePDG527functions as a VPN gateway to perform the followings:Establishment of a VPN (IPsec) tunnel with the terminal1via the wireless LAN40, and WAN1(31);Negotiation of security parameters;User authentication;Assigning a private IP address to terminal1;Data encryption and decryption;Management of security keys;Management of data forwarding via VPN tunnel; andManagement of transmission and reception of data as an endpoint of VPN tunnel.

It is noted that the assignment of the private IP address to the terminal1may be performed by the PGW522of the vEPC52.

The EAP message is transmitted to the ePDG527from the terminal1using IKEV 2, and relayed to the 3 GPP AAA server525of the vEPC52, where the EAP-SIM/EAP-AKA authentication is performed. The ePDG527of the vEPC52and the PGW522are connected via GTP or PMIPv6 tunnel.

In the case where a proxy mobile IP (PMIPv6 tunnel) is used between the PGW522and the ePDG527in the vEPC5, when an IPsec tunnel is established between the terminal1and the ePDG527of the vEPC52, the ePDG527transmits a proxy binding update (Proxy Binding Update) to the PGW522. As a result, in the PGW522of the vEPC52, the destination of an incoming call to the terminal1is switched to the ePDG527of the vEPC52, and the incoming call is notified to the terminal1via the VPN tunnel60and via the wireless LAN40.

The PGW522includes, for example, a filter529having a TFT (Traffic Flow Template) related to an EPS bearer. As described above, setting (addition, modification, deletion, etc.) of a packet filter in a downstream direction from the WAN2to the terminal1side in the filter529may be performed with a Request Bearer Resource Modification message of the bearer resource correction procedure from the terminal1. Alternatively, setting may be performed in connection processing such as an Attach Request message or the like from the terminal1, or at an occurrence of a predetermined event, or the like. It is a matter of course that the filter529may be configured to have a function of performing filtering in an application layer or to have stateful inspection function. Alternatively, the filter529may be provided with a call rejection list for rejecting incoming calls from the WAN2(32).

When the WAN2(32) is configured by IMS, P-CSCF (Proxy-Call Session Control Function) and Serving-CSCF connected to vEPC52may be configured to have content filtering that analyzes contents of voice for blocking and a call rejection list for prohibiting incoming calls from inappropriate numbers.

The control apparatus56is composed of the control apparatus56described with reference toFIG.6. In this embodiment, the control apparatus56is connected to the PCRF526, and based on accounting information and QoS policy information notified from the PCRF526, the control apparatus56carries out a control to make a difference in charging control and QoS policy according to a network to which the terminal1is connected. The control apparatus56may be implemented as a PCEF node. Alternatively, the control apparatus56may be mounted in the PGW522.

The service control unit562(FIG.6) of the control apparatus56sets charging and QoS policies according to a network type to which the terminal1is connected, based on charging information and QoS policy information notified from the PCRF526via a Gx interface, for example. The connection destination network determination unit561ofFIG.6may determine, from a result of SIM authentication in the ePDG527, HSS524and 3 GPP AAA525, that a path from the terminal1includes the wireless LAN40. It is noted that the first and second gateways51and53may be constituted by routers (edge routers).

InFIG.7, the ePDG527and the PGW522are implemented as the vEPC52. However, the ePDG527and the PGW522may be ePDG27and PGW22(FIG.1) of MNO (Mobile Network Operator) that a cloud operator as MVNO (Mobile Virtual Network Operator) has borrowed from the MNO.

For example, regarding Wi-Fi (Registered Trademark)-Calling from the terminal1, a VPN60(IPsec tunnel) via the wireless LAN40and WAN1(31) is established between the terminal1and the ePDG527and a tunnel of GTP/PMIPv 6 is established between the ePDG527and the PGW522, and connection is made from the PGW522to a connection destination via the WAN2(32) composed of IMS, for example.

That is, Wi-Fi (registered trademark)-Calling is controlled as a communication service by a cloud operator (MVNO) to provide a secure connection and through the filter529provide protection from unauthorized incoming calls and harmful sites etc. Note that the PGW522has a function of the second gateway53inFIG.3.

The filter54inFIG.7is the same as the filter54described with reference toFIG.2and the explanation is omitted.

InFIG.7, it is as a matter of course that in addition to the nodes (virtual machines) and the control apparatus56which virtualize network functions of the vEPC52, the filters54, or the like may be also realized by programs executed on a computer such as a server to realize functions and processing thereof, Of course it is also possible to do so.

FIG.8is a diagram for explaining an attach processing of the terminal1and a sequence for communication connection to a connection destination that connects to the WAN2(32) in the system ofFIG.7.FIG.7illustrates an example of an operation sequence in the terminal1, WLAN 40 (WLAN AP), ePDG527, PGW522, HSS524/AAA server525, PCRF526, and a connection destination on side of WAN2(32) inFIG.6. The numbers assigned to each sequence operation are sequence numbers for explanation. InFIG.8, for example, when replacing the ePDG527with the first gateway (GW1) and replacing the PGW522with the second gateway (GW2), the operation can partially correspond to the operation described with reference toFIG.4.1. The terminal1establishes a connection with the wireless LAN (WLAN)40, and performs authentication/authorization (Authentication & Authorization), for example, by the HSS524/AAA525in the vEPC52.2. From the terminal1side, the IKEv2 authentication/tunnel setup procedure between the ePDG527and the terminal1(IKEv 2 phases1and2, etc.) is executed.3. The ePDG527transmits to the PGW522a Proxy Binding Update (request message transmitted by MAG (Mobile Access Gateway) to LMA (Local Mobility Anchor), in order to establish a binding between a mobile node's home network prefix and the MAG to which the mobile node is connected).4. The PGW522cooperates with the PCRF526to establish an IP connection access network (IP-CAN (Connection Access Network)) session.5. The PGW522notifies the AAA server525of identification information (PGW ID) of the PGW, and the AAA server525notifies the HSS524of an ID of the PGW522and an APN (Access Point Name) corresponding to the terminal1for registration.6. The PGW522performs a proxy binding update processing and creates a binding cache entry corresponding to the terminal1. As a result, the PGW522transmits a packet addressed to the terminal1to the ePDG527in accordance with contents held in the binding cache entry. The PGW522transmits a Proxy Binding Ack to the ePDG527.7. The above completes the setup of the IPsec VPN tunnel.8. An IP address is notified from the ePDG527to the terminal1by an IKEv2 message.9. Setup of IP connection from the terminal1is completed. An Psec tunnel between the terminal1and the ePDG527and a tunnel such as PMIP (Proxy Mobile Internet Protocol) between the ePDG527and the PGW522are established. The above corresponds to the sequence of the attach process.10. When a connection request from the terminal1side to a connection destination of the WAN2(32) side is received from the ePDG527via the PMIP tunnel, IP routing from the PGW522to the connection destination (WAN2side) is performed. In this case, a SIP message from the terminal1is transmitted to the P-CSCF of the IMS via the second gateway53and is connected via S-CSCF, MGCF, and MGW to the connection destination of PSTN (Public Switched Telephone Networks), for example. Alternatively, it may be connected from the S-CSCF to the Internet or a connection destination connected to the other IMS.

InFIG.8, it is assumed that the terminal1has already been registered in the IMS. The P-CSCF of IMS and the PGW522(SGi interface) communicate with IPsec (VPN).11. This completes the setting of the connection with the connection destination on the WAN2side via the VPN from the terminal1and the vEPC52of the data center50. A packet in a downlink direction from the WAN2(32) side to the terminal1is forwarded to the ePDG527via the PIMP tunnel to the ePDG527by the PGW522in the vEPC52based on a binding cashe entry, and forwarded from the ePDG527to the terminal1via the VPN tunnel60.

The following describes a configuration of the node of vEPC52with reference toFIG.12. A virtual machine (VM)571on a server57in the data center50connects to a virtual port: A of a virtual switch (vSwitch)576via a virtual network interface controller (vNIC)575, and is connected from a virtual port: B of the virtual switch (vSwitch)576to a physical port C of a physical switch (Physical Switch)58via a physical NIC (pNIC)577and is connected to the physical port C of the physical switch58through a physical port D of the physical switch58to a network (virtual network)59such as a LAN. The virtual machine571includes a guest OS (Operating System)573and an application572to realize a part or all of functions of the EPC network node (for example, functions of the ePDG527inFIG.7or functions of other nodes). The network59is connected, for example, to the first gateway (router)51inFIG.7.

A virtual NIC (vNIC), a virtual switch (vSwitch), and the like are provided by a hypervisor574which is a virtualization mechanism on the server57. It is noted that the physical switch58may be configured by an L2 (Layer 2) switch and the network59may be configured by a virtual network such as a VLAN (Virtual LAN).

Likewise, the filter54ofFIG.2may be implemented by the virtual machine571ofFIG.12and the network55ofFIG.2may be configured by a virtual network59, such as a VLAN. InFIG.12, management units of NFV (Network Functions Virtualization) (NFV Orchestrator (NFVO), and VNF (Virtualized Network Function) Manager. or the like), that is a manager that manages and integrates virtualization of network functions are omitted.

FIG.9is a diagram illustrating another example embodiment of the present invention. In the embodiment shown inFIG.9, the terminal1connects via one of a wireless LAN access point41provided by a cloud operator possessing the data center50,a wireless LAN access point43provided by another carrier (another carrier) different from the cloud operator43,a base station10of another carrier and an EPC20connected with the base station10and via the WAN1to the data center50.

In the data center50, a control apparatus (not shown) (56inFIG.6), depending on a network to which the terminal1is connected being which one of:a wireless LAN access point41provided to a business entity possessing the data center50;a wireless LAN access point43provided by another carrier different from the cloud operator of the data center50, anda base station10and the EPC20of a communication carrier (another carrier different from the cloud provider), controls charging control method and QoS control in the vEPC52to be different from each other.
A QCI (QoS Class Identifier) is used as a parameter of QoS control. QCI of voice call (VoIP) is set to a high value (priority) of 2 in LTE.

Although there is no particular limitation, it is also possible to provide a difference in the following services depending on a network to which the terminal1is connected.

When the terminal1connects to the wireless LAN access point41of the cloud operator and connects to the vEPC52of the data center50, charging for use of the vEPC52is not performed (free).

When the terminal1connects to the wireless LAN access point43of another carrier and connects to the vEPC52of the data center50, predetermined charging for use of the vEPC52with setting such as X yen per unit time, for example.

When the terminal1connected to the base station20of another carrier to connect to the vEPC52of the data center50, predetermined charging with setting such as Y yen (Y>X) per unit time.

Further, as QoS control in the vEPC52of the data center50, when the terminal1connects to the wireless LAN access point41of the cloud operator to connect to the vEPC52of the data center50, quality is set to high. When the terminal1connects to the wireless LAN access point43of another carrier to connect to the vEPC52of the data center50, quality is set to low.

When the terminal1connects to the base station20of another carrier to connect to the vEPC52of the data center50, quality is set to low or intermediate.

FIGS.10A to10C are diagrams for explaining yet another example embodiment of the present invention. Referring toFIG.10A, in this embodiment, the terminal1will be described as a smart apparatus such as a smart phone, a tablet terminal, and the like. It is noted that the terminal1may be another type of terminal. For example, it may be a conventional mobile phone (feature phone) that is not a smartphone. The display unit11may be a touch panel combining a display apparatus and a position input apparatus such as a touch pad. When a user taps an icon111of a receiver (telephone) mark displayed on a home screen of the display unit11inFIG.10A, an application screen is displayed, and when the user taps a phone book icon, a name list is displayed. When a user taps from the list a name of a calling partner to whom the user wishes to make a call: NICHIDEN TARO112, a telephone number113is displayed as shown inFIG.10B. When the user taps the telephone number113, a receiver114(making a telephone call) and a Wi-Fi (registered trademark) telephone115are displayed.

The user makes a call to the other party by selecting either the receiver (making a telephone call)114or the Wi-Fi (registered trademark) telephone115.

When the user taps the receiver (calling)114, the terminal1connects to the base station to connect to the calling partner.

When the user selects the Wi-Fi (registered trademark) telephone115, the terminal1connects to a Wi-Fi (registered trademark) access point and connects to the calling party with Wi-Fi (registered trademark)-Calling (from a wireless LAN via a security gateway to a carrier's switch).

In the example ofFIG.10AandFIG.10B, a Wi-Fi (registered trademark) telephone is selected when making a call, but as shown inFIG.10C, on a network setup screen116on the display unit11, on/off117of Wi-Fi (registered trademark) communication, on/off118of Wi-Fi (registered trademark) telephone may be set. The on/off setting may be a touch type or a slide type.

InFIG.10B, SMS by Wi-Fi (registered trademark)-Calling may be displayed as one of selection items.

Further, inFIG.10B, the mark of the Wi-Fi (registered trademark) telephone115may be variable so as to represent a received radio wave intensity (electric field intensity) from a Wi-Fi (registered trademark) access point. When the received radio wave intensity (electric field strength) from the Wi-Fi (registered trademark) access point is large, the number of arcs (waves) representing radio waves increases and when the received radio wave intensity (electric field strength) is small, the number of arcs (waves) representing radio waves may be reduced, or a display may be changed.

In the case of setting in advance on a network setting (setup) screen116, priorities and conditions according to the type of the network to which the terminal is connected may be provided.

FIG.11Ais a diagram schematically illustrating a configuration of the terminal1described with reference toFIG.10AtoFIG.10C. Referring toFIG.11A, the terminal1includes a touch panel1001for displaying the screen ofFIG.10AtoFIG.10C, a touch panel input and output unit that outputs data and images to the touch panel1001and performs position detection of an input to the touch panel1001, an application (application program)1003activated by a tap of the receiver icon111(FIG.10A) to execute a telephone call, a control unit1004that establishes a connection with a wireless LAN or a base station based on the processing result of the application1003, a communication module (3G/LTE communication module)1006that communicates with a base station, a Wi-Fi (registered trademark) communication module (IEEE 802.11 a/b/h/n interface)1008and an application1003(application program) (3G/LTE communication module)1006and an antenna1007that communicate with the base station, a control unit1004that establishes a connection with a wireless LAN or a base station based on the processing result in the Wi-Fi) communication module (IEEE 802.11 a/b/h/n interface)1008and an antenna1009. Processing of the application1003, the control unit1004may be realized by a program executed by a CPU (Central Processing Unit) (not shown) of the terminal1.

The communication module1006or the communication module1008may be selected in response to a change in the connection destination network from the terminal1or the like at the start of the call, as illustrated inFIG.10AandFIG.10B. That is, in a case where the setting information is not stored in the storage unit1005, the application1003determines which one of the telephone (3GPP access network telephone or Wi-Fi (registered trademark) phone) is selected on the touch panel1001. The control unit1004selects the communication module1006or the communication module1008and communicates with the base station or the Wi-Fi (registered trademark) access point.

On the other hand, when the setting information as shown inFIG.11B is preset in the storage unit1005, when the user taps the telephone number (113inFIG.10B) of a call partner to whom the user makes a phone call, the application1003selects a Wi-Fi (registered trademark) telephone to connect to a Wi-Fi (registered trademark) access point (wireless LAN access point) from the Wi-Fi (registered trademark) communication module1008and the antenna1009by the control unit1004. InFIG.11A, the control unit1004stores the setting information (FIG.10B) input from the setup screen116ofFIG.10Cin the storage unit1005. The on/off of the Wi-Fi (registered trademark) telephone may all the time be performed from the setup screen116ofFIG.10C.

According to each of the embodiments described above, it is possible to provide a secure network connection to a terminal accessing the data center via the wireless LAN, the WAN1, and to provide to Wi-Fi (registered trademark)-Calling from the terminal communication services (charging, communication quality) according to the network type to which the terminal connects. In addition, it enables protection from harmful sites, denial of harmful contents and rejection of improper incoming calls, etc.

The disclosure of the above Non-Patent Literature 1 is incorporated herein by reference. Within the framework of the entire disclosure (including the scope of claims) of the present invention, it is possible to change/adjust the embodiment or example based on the basic technical concept. Also, various combinations or selections of various disclosed elements (including each element of each claim, each element of each embodiment, each element of each drawing, etc.) are possible within the scope of the claims of the present invention. That is, it goes without saying that the present invention includes various modifications and modifications that could be made by those skilled in the art according to the entire disclosure including the claims, and technical concepts.

The above-described embodiments may be attached, for example, as follows (but not limited to the following).

Supplementary Note 1

A communication system includinga data center adapted to connect via a first wide area network to a core network connected with a base station and to a wireless LAN (Local Area Network), wherein the data center includes:a virtual core network that virtualizes at least a part of functions of the core network and is adapted to connect to the first wide area network; anda control apparatus that variably controls a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station, and that connects to the data center, in accordance with a network connected between the terminal and the first wide area network.

Supplementary Note 2

The communication system according to supplementary note 1, wherein in the data center, in accordance with a type of a network to which the terminal connects, the type of the network corresponding to whether the terminal connects to the data center via the base station and the core network and via the first wide area network, or the terminal connects to the data center via the wireless LAN and the first wide area network, andin a case where the terminal connects to the data center via the wireless LAN and the first wide area network, in accordance with a type of the wireless LAN to which the terminal connects, the type of the wireless LAN corresponding to whether an access point of the wireless LAN is provided by an operator of the data center, or by another operator that is different from the operator of the data center,the control apparatus variably controls at least one of a charging method and a communication quality service provided to the terminal in the virtual core network.

Supplementary Note 3

The communication system according to supplementary note 1 or 2, wherein the data center includesa VPN apparatus that, in a case where the terminal connects to the data center via the wireless LAN and via the first wide area network, connects to the terminal by a VPN (Virtual Private Network) extending through the first wide area network and the wireless LAN.

Supplementary Note 4

The communication system according to supplementary note 3, wherein the data center comprises:a first gateway that is adapted to connect to the first wide area network and that includes the VPN apparatus:a second gateway that is adapted to connect to a second wide area network, wherein the first gateway and the second gateway are connected to the virtual core network; anda filter that is arranged between the first gateway and the second gateway and that performs filtering of at least one of a packet input thereto from the first wide area network and a packet input thereto from the second wide area network.

Supplementary Note 5

The communication system according to supplementary note 4, wherein in the data center, the filter controls access denial or permission of an incoming call and a message destined to the terminal from the second wide area network side.

Supplementary Note 6

The communication system according to any one of supplementary notes 3 to 5, whereinthe terminal communicates from the VPN via the VPN apparatus and the virtual core network and via the second wide area network with a connection destination, andthe terminal receives, through the VPN, an incoming call or data destined to the terminal from the second wide area network from the virtual core network and the VPN apparatus in the data center.

Supplementary Note 7

The communication system according to any one of supplementary notes 3 to 6, wherein the VPN apparatus of the data center manages the VPN between the terminal and the VPN apparatus, on a per terminal basis or on a per terminal user basis.

Supplementary Note 8

The communication system according to any one of supplementary notes 1 to 7, wherein the terminal comprisesa selector that selects to communicate either via the base station or via the wireless LAN.

Supplementary Note 9

The communication system according to any one of supplementary notes 1 to 8, wherein an access point of the wireless LAN includes at least one ofan access point provided by an operator of the data center, andan access point provided by another communication carrier.

Supplementary Note 10

A communication apparatus comprising:an apparatus adapted to connect via a first wide area network to a core network connected with a base station and to a wireless LAN (Local Area Network);a virtual core network that virtualizes at least a part of functions of the core network and is adapted to connect to the first wide area network; anda control apparatus that variably controls a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station and connect to the data center, in accordance with a network connected between the terminal and the first wide area network.

Supplementary Note 11

The communication apparatus according to supplementary note 10, wherein the control apparatus variably controls at least one of a charging method and a communication quality service provided to the terminal in the virtual core network,in accordance with a type of a network to which the terminal connects, the type of the network corresponding to whether the terminal connects to the data center via the base station and the core network and via the first wide area network, or the terminal connects to the data center via the wireless LAN and the first wide area network, andin a case where the terminal connects to the data center via the wireless LAN and the first wide area network, in accordance with a type of the wireless LAN to which the terminal connects, the type of the wireless LAN corresponding to whether an access point of the wireless LAN is provided by an operator of the data center, or by another operator that is different from the operator of the data center.

Supplementary Note 12

The communication apparatus according to supplementary note 10 or 11, comprisinga VPN apparatus that, in a case where the terminal connects to the data center via the wireless LAN and via the first wide area network, connects to the terminal by a VPN (Virtual Private Network) extending through the first wide area network and the wireless LAN.

Supplementary Note 13

The communication apparatus according to supplementary note 12, comprising:a first gateway that is adapted to connect to the first wide area network and that includes the VPN apparatus;a second gateway that is adapted to connect to a second wide area network, wherein the first gateway and the second gateway are connected to the virtual core network; anda filter that is arranged between the first gateway and the second gateway and that performs filtering of at least one of a packet input thereto from the first wide area network and a packet input thereto from the second wide area network.

Supplementary Note 14

The communication apparatus according to supplementary note 13, wherein the filter controls access denial or permission of an incoming call and a message destined to the terminal from the second wide area network side.

Supplementary Note 15

The communication apparatus according to any one of supplementary notes 12 to 14, wherein the terminal communicates from the VPN via the VPN apparatus and the virtual core network and via the second wide area network with a connection destination, andthe terminal receives, through the VPN, an incoming call or data destined to the terminal from the second wide area network from the virtual core network and the VPN apparatus in the data center.

Supplementary Note 16

The communication apparatus according to any one of supplementary notes 10 to 15, wherein the VPN apparatus of the data center manages the VPN between the terminal and the VPN apparatus, on a per terminal basis or on a per terminal user basis.

Supplementary Note 17

A communication method by a data center that is adapted to connect to a core network connected with a base station and to a wireless LAN (Local Area Network) through a first wide area network (Wide Area Network),providing a virtual core network that virtualizes at least a part of functions of the core network and is adapted to connect to the first wide area network; andvariably controlling a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station, and that connects to the data center, in accordance with a network connected between the terminal and the first wide area network.

Supplementary Note 18

The communication method according to supplementary note 17, comprisingvariably controlling, in the data center, at least one of a charging method and a communication quality service provided to the terminal in the virtual core network, in accordance with a type of a network to which the terminal connects, the type of the network corresponding to whether the terminal connects to the data center via the base station and the core network and via the first wide area network, or the terminal connects to the data center via the wireless LAN and the first wide area network, andin a case where the terminal connects to the data center via the wireless LAN and the first wide area network, in accordance with a type of the wireless LAN to which the terminal connects, the type of the wireless LAN corresponding to whether an access point of the wireless LAN is provided by an operator of the data center, or by another operator that is different from the operator of the data center.

Supplementary Note 19

The communication method according to supplementary note 17 or 18, wherein in a case where the terminal connects to the data center via the wireless LAN and via the first wide area network, connection between the terminal and the data center by a VPN (Virtual Private Network) extending through the first wide area network and the wireless LAN.

Supplementary Note 20

The communication method according to supplementary note 19, wherein in the data center are provided:a first gateway connecting to the first wide area network;a second gateway adapted to connect to a second wide area network, wherein the first gateway and the second gateway are connected to the virtual core network; the method comprisingby a filter that is arranged between the first gateway and the second gateway, performing filtering of at least one of a packet input thereto from the first wide area network and a packet input thereto from the second wide area network.

Supplementary Note 21

The communication method according to supplementary note 20, comprisingcontrolling by the filter access denial or permission of an incoming call and a message destined to the terminal from the second wide area network side.

Supplementary Note 22

The communication method according to any one of supplementary notes 19 to 21, comprising:the terminal communicating with the connection destination from the VPN via the VPN apparatus and the virtual core network via the second wide area network, andthe terminal receiving from the virtual core network and the VPN apparatus in the data center via the VPN an incoming call or data destined to the terminal from the second wide area network side.

Supplementary Note 23

The communication method according to any one of supplementary notes 19 to 22, comprisingthe VPN apparatus of the data center managing the VPN between the terminal and the VPN apparatus, on a per terminal basis or on a per terminal user basis.

Supplementary Note 24

A terminal comprising:a communicator for communicating with a base station of a mobile network or a wireless LAN (Local Area Network); anda selector being able to select whether to make a call via the base station of the mobile network or to make a call via the wireless LAN, when originating a call.

Supplementary Note 25

A terminal comprising:a communicator for communicating with a base station of a mobile network or a wireless LAN (Local Area Network); andan application selector being able to select whether to make a call via the base station of the mobile network or to make a call via the wireless LAN, when originating a call.

Supplementary Note 26

A terminal comprising:a communicator for communicating with a base station of a mobile network or a wireless LAN (Local Area Network); anda selector being able to select, at a setup, whether to make a call via the base station of the mobile network or to make a call via the wireless LAN.

Supplementary Note 27

The terminal according to any one of supplementary notes 24 to 26, comprising:a connector that when connecting to a data center via the wireless LAN and the first wide area network, connects between the terminal and the data center with a VPN through the wireless LAN and the first wide area network.

Supplementary Note 28

A non-transitory computer readable medium storing therein a program causing a computer arranged in a data center adapted to connect via a first wide area network to a core network connected with a base station and to a wireless LAN (Local Area Network) to execute processing comprising:operating a virtual core network that virtualizes at least a part of functions of the core network and is adapted to connect to the first wide area network; andvariably controlling a service provided by the virtual core network to a terminal enabled to select connection to either the wireless LAN or the base station and connect to the data center, in accordance with a network connected between the terminal and the first wide area network.

Supplementary Note 29

The non-transitory computer readable medium according to supplementary note 28, the program stored therein casing the computer to execute processing that variably controls at least one of a charging method and a communication quality service provided to the terminal in the virtual core network,in accordance with a type of a network to which the terminal connects, the type of the network corresponding to whether the terminal connects to the data center via the base station and the core network and via the first wide area network, or the terminal connects to the data center via the wireless LAN and the first wide area network, andin a case where the terminal connects to the data center via the wireless LAN and the first wide area network, in accordance with a type of the wireless LAN to which the terminal connects,the type of the wireless LAN corresponding to whether an access point of the wireless LAN is provided by an operator of the data center, or by another operator that is different from the operator of the data center.

Supplementary Note 30

The non-transitory computer readable medium according to supplementary note 28 or 29, the program stored therein casing the computer to executeprocessing that in a case where the terminal connects to the data center via the wireless LAN and via the first wide area network, connects to the terminal by a VPN (Virtual Private Network) extending through the first wide area network and the wireless LAN.

Supplementary Note 31

A non-transitory computer readable medium storing therein a program causing a computer included in a terminal to execute processing comprising:communicating with a base station of a mobile network or a wireless LAN (Local Area Network); andenabling to select whether to make a call via the base station of the mobile network or to make a call via the wireless LAN, when originating a call.

Supplementary Note 32

A non-transitory computer readable medium storing therein a program causing a computer included in a terminal to execute processing comprising:communicating with a base station of a mobile network or a wireless LAN (Local Area Network); andenabling to select, at a setup, whether to make a call via the base station of the mobile network or to make a call via the wireless LAN.