JP2011160286A - Call control server, relay server, vpn device, vpn communication system, vpn networking method, program, and storage medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a VPN communication system in which stable VPN communication can be performed by transferring a VPN session to another relay server while continuing the VPN communication, in the VPN communication performing communication via a relay server. <P>SOLUTION: A call control server 202 for establishing a communication session between a plurality of VPN devices 101, 301 performing VPN communication by constructing a VPN on a WAN 200, includes a signal communication part 242 and a relay server selection part 243. The signal communication part 242 receives a relay server change request from a first relay server 203. The relay server selection part 243 then selects a second relay server 204 which is different from the first relay server 203, as a relay server for newly relaying the VPN communication. Then, for the selected second relay server 204 which can relay the VPN communication, the signal communication part 242 transmits to the VPN device 101 a relay server change instruction containing identification information of the second relay server 204. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a call control server, a relay server, a VPN device, a VPN communication system, a VPN networking method, a program, and a storage medium, and in particular, communication between VPN devices performing VPN (Virtual Private Network) communication. The present invention relates to a device involved in the relay of

  A virtual private network (hereinafter referred to as VPN) uses a communication network that shares a bandwidth among a large number of subscribers instead of a dedicated communication line (dedicated line) to which a communication partner is fixed in network communication. Connect etc. For example, a VPN typically connects different network segments to each other via a wide area network (WAN) or the like, such as between two or more local area networks (LANs) in a company. And it is comprised so that the whole may be one private network (private line) virtually by ensuring the secrecy of communication. This enables a communication service similar to that used when a dedicated line is used.

  Such a VPN includes a so-called Internet VPN constructed using a WAN such as the Internet or a public line network, and an IP-VPN constructed using a communication network different from the Internet such as a carrier closed network, It is divided roughly into. In particular, the number of users of the Internet VPN is increasing because it is possible to construct a VPN at a low cost by using a broadband network infrastructure and using the Internet.

  In constructing a VPN, for example, when communication is performed between different bases, there is a risk of communication leakage, wiretapping, tampering and the like because a shared communication network such as the Internet is interposed in the middle of the communication path. Therefore, in the VPN technology, in order to ensure the confidentiality of communication, the basic technical idea is to encrypt and encapsulate data in any layer of the network. Here, wrapping a communication protocol in packets of another communication protocol and sending it is called “encapsulation”.

  Specific examples of encryption protocols used in the VPN technology include IPsec (Security Architecture for Internet Protocol) that performs encryption in the IP (Internet Protocol) layer, TCP (Transmission Control Protocol) layer (particularly HTTP: Hyper Text Transfer Protocol). SSL (Secure Sockets Layer), etc., which performs encryption in a known manner. In addition, as examples of other VPN technologies, SSH, TLS, SoftEther, PPTP, L2TP, L2F, MPLS, and the like are known. The software VPN that constructs the VPN by software uses the tunneling technology using the above-described IPsec or SSL. Here, communicating a certain communication protocol as data of the same or higher layer protocol is referred to as “tunneling”. When constructing a VPN, a virtual tunnel is constructed by encrypting and encapsulating a packet by a VPN device provided in a network relay device or a communication terminal or the like (hereinafter also referred to as “peer”). This establishes a closed communication path (for example, a P2P (Peer to Peer) communication path) connecting the peers.

  For example, as a technology for interconnecting networks, a reverse tunnel technology is used to construct a communication path, transmission of the communication path maintenance data to maintain the communication path, and electronic signatures to prevent communication leakage, etc. And those that perform encryption have been proposed (see, for example, Patent Document 1).

JP 2008-160497 A

  By the way, even if it is desired to perform communication that secures the secrecy of VPN via the P2P communication path between the VPN devices (hereinafter also referred to as VPN communication), the firewall of the device arranged on the NAT router or the network Depending on the function, a P2P communication path cannot be constructed, and VPN communication via a relay server (relay server) may be performed. When VPN communication is performed via a relay server, there are many environments where a public line can be used, and there is an advantage that stable communication is possible.

  However, since the relay server needs to be installed separately outside the LAN (for example, on the Internet), not in the LAN to which the VPN device is connected, installation and maintenance costs are incurred. It is difficult to introduce to.

  In addition, in data communication performed between the VPN devices via the relay server, the amount of data varies depending on the type of data communication, and thus the communication load is not uniquely determined. For example, when data communication is high-compression voice communication, the load on the relay server is small, and when data communication is image data or high-quality voice communication, the load on the relay server is large.

  Further, since the communication load due to the VPN communication is determined when the communication is actually started, the communication load applied to the relay server cannot be predicted when the VPN session is established. When communication is actually started and the communication exceeds the processing capacity of the relay server, it affects not only the communication but also other communication that was being communicated by the relay server. Communication may not be possible.

  In addition, when a VPN session involving a relay server is voluntarily changed to another relay server, such as during maintenance of the relay server, in the conventional system, the VPN session is degenerated (the VPN session is disconnected). And wait until all the VPN sessions in communication are completed, or forcibly disconnect the VPN session in progress. It was not possible to enter the process.

  The present invention has been made in view of the above circumstances, and a call control server, a relay server, and the like that can perform a stable VPN communication by transferring a VPN session to another relay server while continuing the VPN communication. An object is to provide a VPN apparatus, a VPN communication system, a VPN networking method, a program, and a storage medium.

  The call control server of the present invention is a call control server that establishes a communication session between a plurality of VPN devices that perform VPN communication by constructing a virtual private network on a network, and includes a relay server that relays the VPN communication. A relay destination change request signal receiving unit that receives a relay destination change request signal for changing from the first relay server and a second relay server that is different from the first relay server as a relay server that newly relays the VPN communication. When the relay server selection unit that selects the relay server of the second relay server and the second relay server selected by the relay server selection unit can relay the VPN communication, the identification information of the second relay server is included, A relay server change instruction signal for changing a relay server that relays VPN communication from the first relay server to the second relay server; And a relay server change instruction signal transmitting unit that transmits to the PN device.

  According to this configuration, the call control server monitors the necessity of changing the relay server, and when it is necessary to change the relay server, the VPN session is transferred to another relay server while continuing the VPN communication, It is possible to perform stable VPN communication.

  The relay server of the present invention is a relay server that relays VPN communication performed by constructing a virtual private network between a plurality of VPN devices on a network, and the processing load of the relay server is equal to or higher than a predetermined processing load. A usage rate for determining whether or not the usage rate of the used communication band used for VPN communication between the VPN devices relayed by the relay server is equal to or higher than a predetermined usage rate When the determination unit and the processing load determination unit determine that the processing load is equal to or higher than the predetermined processing load, or the usage rate determination unit determines that the usage rate is equal to or higher than the predetermined usage rate. In this case, change communication selection for selecting VPN communication for changing the relay destination from one or more VPN communications relayed by the relay server to another relay server different from the relay server And a relay destination change request signal for changing a relay server for relaying the VPN communication, a communication session between the VPN devices, and information for specifying the VPN communication selected by the changed communication selection unit. A relay destination change request signal transmission unit that transmits to the call control server to be established.

  According to this configuration, even when the load on the relay server increases, it is possible to distribute the load on the relay server and perform stable VPN communication.

  The relay server of the present invention is a relay server that relays VPN communication performed by constructing a virtual private network between a plurality of VPN devices on a network, and transmits the VPN to another relay server different from the relay server. A relay destination change instruction unit that gives an instruction to change a communication relay destination, and a change communication that selects a VPN communication that changes the relay destination to the other relay server from one or more VPN communications relayed by the relay server Communication between VPN devices including a selection unit and a relay destination change request signal for changing a relay server that relays the VPN communication, including information for specifying the VPN communication selected by the changed communication selection unit A relay destination change request signal transmission unit that transmits to a call control server that establishes a session.

  According to this configuration, even when the relay server that spontaneously relays the VPN communication is changed, such as when the maintenance of the relay server is performed, the VPN session is transferred to another relay server while continuing the VPN communication. Therefore, it is possible to shift to an environment in which maintenance work can be performed immediately while maintaining stable VPN communication.

  The relay server of the present invention is a relay server that relays VPN communication performed by constructing a virtual private network between a plurality of VPN devices on a network, and is a relay for confirming whether the VPN communication can be relayed. A relay destination status confirmation signal receiving unit that receives a destination status confirmation signal from a call control server that establishes a communication session between the VPN devices, and a process that determines whether or not the processing load of the relay server is greater than or equal to a specified value A load determination unit; a usage rate determination unit that determines whether or not a usage rate of a used communication band used for VPN communication between the VPN devices relayed by the relay server is greater than a specified value; and the processing load determination Based on the determination result by the relay unit and the determination result by the usage rate determination unit, the relay destination status confirmation response including the relay server propriety information of the VPN communication by the relay server No. a and a relay destination status acknowledgment signal transmitting unit that transmits to the call control server.

  According to this configuration, it is determined whether or not the VPN session can be accepted, and the transition of the VPN session is accepted only when the acceptance is possible. VPN communication can be performed.

  The VPN apparatus according to the present invention is a VPN apparatus that constructs a virtual private network on a network and performs VPN communication, and a relay server that relays the VPN communication from a call control server that establishes a communication session between the VPN apparatuses. A relay server change instruction signal receiving unit for receiving a relay server change instruction signal including identification information of the second relay server for changing the first relay server from the first relay server to the second relay server; A relay that includes relay server identification information and transmits a relay server connection change instruction signal for changing the relay server to a VPN device that is a communication destination for performing VPN communication with the VPN device via the call control server. VPN via the second relay server as a relay server after the server connection change instruction signal transmission unit and the communication destination VPN device are changed If feasible the signal, with the communication destination VPN device, and a data communication unit for communicating the communication data via the second relay server.

  According to this configuration, when it is necessary to change the relay server, it is possible to notify the VPN server of the communication destination that the relay server is to be changed. It is possible to transfer sessions and perform stable VPN communication.

  The VPN device of the present invention is a VPN device that constructs a virtual private network on the network and performs VPN communication, and relays the VPN communication via a call control server that establishes a communication session between the VPN devices. A communication destination for performing VPN communication with the VPN apparatus using a relay server connection change instruction signal including identification information of the second relay server for changing the relay server from the first relay server to the second relay server. A relay server connection change instruction signal receiving unit that receives from the VPN apparatus, a VPN communication availability determination unit that determines whether VPN communication is possible via the second relay server as a relay server after the change, and a VPN communication availability determination VPN communication via the second relay server when it is determined by the unit that VPN communication via the second relay server is possible A relay server connection change response signal transmitting unit that transmits a relay server connection change response signal including the possibility to the communication destination VPN device; and after transmission of the relay server connection change response signal, the communication destination VPN device And a data communication unit that communicates the communication data via the second relay server.

  According to this configuration, since it is possible to recognize that it is necessary to change the relay server by a notification from another VPN apparatus, the VPN session is transferred to another relay server while continuing the VPN communication, and stable VPN communication. Can be done.

  The VPN communication system of the present invention is a VPN communication system that establishes and communicates with a virtual private network between a plurality of VPN devices on the network, and performs VPN communication for communicating communication data via the virtual private network. A plurality of VPN devices to perform, a call control server for establishing a communication session between the plurality of VPN devices, and a plurality of relay servers for relaying VPN communication between the plurality of VPN devices. A relay destination change request signal receiving unit that receives a relay destination change request signal for changing the relay server that relays the VPN communication from the first relay server, and a relay server that newly relays the VPN communication A relay server selection unit that selects a second relay server different from the first relay server; and the relay server selection. When the second relay server selected by the method is capable of relaying the VPN communication, a relay server that includes the identification information of the second relay server and relays the VPN communication is transferred from the first relay server to the first relay server. A relay server change instruction signal transmission unit that transmits a relay server change instruction signal for changing to the second relay server to the VPN apparatus.

  According to this configuration, the call control server monitors the necessity of changing the relay server, and when it is necessary to change the relay server, the VPN session is transferred to another relay server while continuing the VPN communication, It is possible to perform stable VPN communication.

  In the VPN communication system according to the present invention, a VPN between the processing load determination unit that determines whether or not the processing load of the relay server is equal to or greater than a predetermined processing load and the VPN device that the relay server relays is provided. A usage rate determination unit that determines whether or not a usage rate of a used communication band used for communication is equal to or higher than a predetermined usage rate, and the processing load determination unit determines that the processing load is equal to or higher than the predetermined processing load. Or when the usage rate determination unit determines that the usage rate is equal to or higher than the predetermined usage rate, one or more VPN communications relayed by the relay server are different from the relay server. A change communication selection unit for selecting a VPN communication for changing the relay destination to the server, and the relay destination change request signal including information for specifying the VPN communication selected by the change communication selection unit , And a relay destination change request signal transmitting unit that transmits to the call control server.

  According to this configuration, even when the load on the relay server increases, it is possible to distribute the load on the relay server and perform stable VPN communication.

  The VPN communication system according to the present invention includes a relay destination change instruction unit that instructs the relay server to change the relay destination of the VPN communication to another relay server different from the relay server, and the relay server relays Including a change communication selection unit for selecting a VPN communication for changing a relay destination to the other relay server from one or more VPN communication to be performed, and information for specifying the VPN communication selected by the change communication selection unit A relay destination change request signal transmission unit that transmits a relay destination change request signal to the call control server.

  According to this configuration, even when the relay server that spontaneously relays the VPN communication is changed, such as when the maintenance of the relay server is performed, the VPN session is transferred to another relay server while continuing the VPN communication. Therefore, it is possible to shift to an environment in which maintenance work can be performed immediately while maintaining stable VPN communication.

  In the VPN communication system of the present invention, the relay server receives from the call control server a relay destination status confirmation signal for confirming whether the relay server can relay the VPN communication, and the relay server. A processing load determination unit that determines whether or not the processing load of the server is equal to or greater than a specified value, and a usage rate of a used communication band that is used for VPN communication between the VPN devices relayed by the relay server is equal to or greater than a specified value A relay that includes information indicating whether the relay server can relay the VPN communication based on a determination result by the use rate determination unit, a determination result by the processing load determination unit, and a determination result by the utilization rate determination unit. A relay destination status confirmation response signal transmission unit that transmits a destination status confirmation response signal to the call control server.

  According to this configuration, it is determined whether or not the VPN session can be accepted, and the transition of the VPN session is accepted only when the acceptance is possible. VPN communication can be performed.

  In the VPN communication system of the present invention, the VPN device includes a relay server change instruction signal receiving unit that receives the relay server change instruction signal from the call control server, and identification information of the second relay server, A relay server connection change instruction signal transmission unit for transmitting a relay server connection change instruction signal for changing a relay server to a VPN apparatus of a communication destination that performs VPN communication with the VPN apparatus via the call control server; When the VPN device of the communication destination can execute VPN communication via the second relay server as the relay server after the change, the second relay server is connected to the VPN device of the communication destination. And a data communication unit that communicates the communication data via the data communication unit.

  According to this configuration, when it is necessary to change the relay server, it is possible to notify the VPN server of the communication destination that the relay server is to be changed. It is possible to transfer sessions and perform stable VPN communication.

  In the VPN communication system of the present invention, the VPN device includes the identification information of the second relay server, and sends a relay server connection change instruction signal for changing the relay server via the call control server. A VPN that determines whether or not VPN communication is possible via the relay server connection change instruction signal receiving unit that receives from the destination VPN device that performs VPN communication with the VPN device, and the second relay server as the relay server after the change When it is determined by the communication availability determination unit and the VPN communication availability determination unit that VPN communication via the second relay server is possible, VPN communication via the second relay server is possible. A relay server connection change response signal transmission unit that transmits a relay server connection change response signal including the relay server connection change response signal to the communication destination VPN device; Between the serial communication destination VPN device, and a data communication unit for communicating the communication data via the second relay server.

  According to this configuration, since it is possible to recognize that it is necessary to change the relay server by a notification from another VPN apparatus, the VPN session is transferred to another relay server while continuing the VPN communication, and stable VPN communication. Can be done.

  The VPN networking method of the present invention is a VPN networking method for a call control server that establishes a communication session between a plurality of VPN devices that establish a virtual private network and perform VPN communication on a network, and relays the VPN communication. Receiving a relay destination change request signal for changing a relay server to be transmitted from the first relay server, and a second relay different from the first relay server as a relay server for newly relaying the VPN communication Selecting a server, and when the selected second relay server is capable of relaying the VPN communication, the relay server that includes the identification information of the second relay server and relays the VPN communication is selected as the first relay server. A relay server change instruction signal for changing from one relay server to the second relay server; A transmitting to the device.

  According to this method, it is possible to perform a stable VPN communication by transferring the VPN session to another relay server while continuing the VPN communication.

  The program of the present invention is a program for executing each step of the VPN networking method.

  According to this program, it is possible to perform a stable VPN communication by transferring a VPN session to another relay server while continuing the VPN communication.

  The storage medium of the present invention is a computer-readable storage medium recording a program for executing each step of the VPN networking method.

  By having this storage medium, it is possible to transfer the VPN session to another relay server while continuing the VPN communication and perform stable VPN communication.

  According to the present invention, it is possible to transfer a VPN session to another relay server while continuing VPN communication, and perform stable VPN communication. For example, even when the load on a relay server that relays VPN communication between VPN devices increases, it is possible to distribute the load on the relay server and perform stable VPN communication.

The figure which shows the structural example of the VPN system which concerns on embodiment of this invention The block diagram which shows the structural example of the hardware constitutions of the VPN apparatus which concerns on embodiment of this invention The block diagram which shows the functional structural example of the VPN apparatus which concerns on embodiment of this invention The block diagram which shows the structural example of the call control server which concerns on embodiment of this invention, and a relay server The block diagram which shows the functional structural example of the call control server which concerns on embodiment of this invention The block diagram which shows the functional structural example of the relay server which concerns on embodiment of this invention The sequence diagram which shows an example of the process sequence at the time of VPN construction in the VPN system which concerns on embodiment of this invention The sequence diagram which shows an example of the process sequence at the time of VPN construction in the VPN system which concerns on embodiment of this invention The flowchart which shows an example of the load confirmation process by the relay server which concerns on embodiment of this invention The flowchart which shows an example of the session change process by the call control server which concerns on embodiment of this invention The flowchart which shows an example of the session acceptance determination processing by the relay server concerning embodiment of this invention The flowchart which shows an example of the relay server change instruction reception process of the VPN apparatus which concerns on embodiment of this invention The flowchart which shows an example of the relay server connection change instruction reception process of the VPN apparatus which concerns on embodiment of this invention The flowchart which shows an example of the session change process at the time of the maintenance of the relay server which concerns on embodiment of this invention

  Hereinafter, a call control server, a relay server, a VPN device, a VPN communication system, a VPN networking method, a program, and an embodiment as an example of a storage medium according to the present invention will be described. Here, a configuration example in the case of constructing a virtual private network (VPN) system by connecting paths of two local area networks (LAN, local area network) via a wide area network (WAN, wide area network) is shown. A wired LAN or a wireless LAN is used as the LAN. The WAN is used as the WAN.

  FIG. 1 is a diagram showing a configuration example of a VPN system according to an embodiment of the present invention. The VPN system of this embodiment connects a communication path between the LAN 100 provided at one site and the LAN 300 provided at another site via a WAN 200 such as the Internet. VPN communication is enabled between the terminal 103 connected under the LAN 100 and the terminal 303 connected under the LAN 300. As specific uses (application programs, etc.) of VPN communication, IP phone (voice call), net meeting (moving image & voice communication), network camera (video transmission), etc. are assumed.

  A router 102 is disposed at the boundary between the LAN 100 and the WAN 200, and a router 302 is disposed at the boundary between the WAN 200 and the LAN 300. In this embodiment, in order to enable the construction of a VPN, the VPN apparatus 101 is connected to the LAN 100 and the VPN apparatus 301 is connected to the LAN 300. A subordinate terminal 103 is connected to the VPN apparatus 101, and a subordinate terminal 303 is connected to the VPN apparatus 301.

  In addition, on the WAN 200, a STUN server 201 and a call control server 202 are connected to enable a VPN connection (hereinafter referred to as “VPN connection”) between the VPN apparatus 101 and the VPN apparatus 301. ing. The STUN server 201 is a server used to execute a STUN (Simple Traversal of User Datagram Protocol (UDP) through Network Address Translators (NATs)) protocol. The call control server 202 is a server used for making and receiving calls between peers such as VPN devices and terminals. Furthermore, a first relay server 203 and a second relay server 204 that relay communication are connected on the WAN 200 in order to relay communication information between the VPN apparatus 101 and the VPN apparatus 301 according to the communication environment.

  As a communication path for VPN communication between the VPN apparatus 101 and the VPN apparatus 301 of the present embodiment, a P2P communication path for performing direct communication through a virtual closed communication path via the WAN 200, and a call control server 202 are used. A call control server communication path that performs communication through a virtual closed communication path, a first relay server communication path that performs communication through a virtual closed communication path via the first relay server 203, and a second relay server There is a second relay server communication path that performs communication through a virtual closed communication path via 204.

  FIG. 1 shows a flow of a call control signal related to control of calling and called. In FIG. 1, the solid line indicates the flow of VPN communication via the call control server 202. A broken line indicates the flow of VPN communication via the first relay server 203. A one-dot chain line indicates the flow of VPN communication via the second relay server 204. Further, between the STUN server 201 and the VPN devices 101 and 301, an external address (global IP address) for communicating between the VPN devices 101 and 301 assigned by the routers 102 and 302 in response to a request from the VPN devices 101 and 301. And external address / port information including port information.

  When each device communicates via the WAN 200, global address information that can be specified in the WAN is used on the WAN 200 as address information for specifying the source and destination of a packet to be transmitted. Since an IP network is generally used, a global IP address and a port number are used. However, in communication within each LAN 100, 300, local address information that can be specified only within the LAN is used as address information for specifying a transmission source and a transmission destination. Since an IP network is generally used, a local IP address and a port number are used. Therefore, in order to enable communication between each of the LANs 100 and 300 and the WAN 200, a NAT (Network Address Translation) function for performing mutual conversion between local address information / port information and global address information / port information is provided. The routers 102 and 302 are mounted. In the case of other than the IP network, global address information other than the global IP address may be used.

  However, each terminal under the LAN 100, 300 does not have global IP address information accessible from the outside. Further, unless special settings are made, the terminal 103 under the LAN 100 cannot perform VPN communication with the terminal 303 under the other LAN 300. Further, because of the NAT function of each router 102, 302, it is impossible to access each terminal in each LAN 100, 300 from the WAN 200 side in a normal state.

  Even in such a situation, in this embodiment, by providing the VPN devices 101 and 301 in the LANs at the respective bases, the VPN devices 101 and 301 are used for VPN connection between the LANs, so that the virtual communication path is closed. VPN communication can be performed through the network.

  The STUN server 201 performs a service related to the execution of the STUN protocol, and is a server for acquiring information necessary for performing so-called NAT traversal communication. STUN is a standardized client-server Internet protocol used as one of NAT passing methods in applications that perform bidirectional real-time IP communication such as voice, video, and text. In response to a request from the access source, the STUN server 201 returns external address / port information including global IP address and port information used for communication with the outside. As the external address / port information, in the IP network, a global IP address of the IP network layer and a port number of the transport layer are used.

  Each of the VPN apparatuses 101 and 301 receives a response packet including the global IP address and port number of the own apparatus from the STUN server 201. Thereby, each VPN apparatus 101 and 301 can acquire the global IP address and port number of an own apparatus. In addition, even when there are multiple routers between the LAN and WAN where the device is located, or even when these routers do not have UPnP (Universal Plug and Play) functions, There is also an effect that an IP address and a port number can be acquired.

  As a method for the VPN apparatuses 101 and 301 to acquire a global IP address and a port number, a method described in IETF RFC3489 (STUN) can be used.

  The call control server 202 is a call management server that performs a service related to call control for establishing a communication path by calling a specific destination. The call control server 202 holds the identification information of the registered VPN apparatus or terminal. For example, in the case of a communication system having an IP telephone function, a specific destination is called based on the telephone number of the connection partner. It is also possible. Further, the call control server 202 has a function of relaying signals and data, and forwards a packet sent from the calling side device to the called side device or sent from the called side device. It is also possible to forward the packet to the originating device.

  Note that the STUN server 201 and the call control server 202 are shown here as configuration examples using separate servers. However, the functions of the two servers, the address information server and the relay server, are mounted on one server. Alternatively, the same function may be mounted on any other server on the WAN.

  The first relay server 203 and the second relay server 204 relay communication between the VPN device 101 and the VPN device 301 according to the communication environment. Further, the relay servers 203 and 204 communicate communication data transmitted to the relay servers 203 and 204 according to the processing load on the server (including necessary processing load other than the VPN communication between the VPN apparatuses 101 and 301). Adjust the amount. In the present embodiment, two relay servers are exemplified. However, more relay servers may be provided, and the amount of communication data may be adjusted between these servers.

  Next, the configuration and function of the VPN apparatus of this embodiment will be described. The configurations and functions of the VPN apparatus 101 and the VPN apparatus 301 are the same, and will be described here using the VPN apparatus 101. FIG. 2 is a block diagram showing a configuration example of the hardware configuration of the VPN apparatus according to the present embodiment.

  The VPN apparatus 101 includes a central processing unit (CPU) 111, a non-volatile memory 112 such as a flash RAM (Random Access Memory), a memory 113 such as an SD RAM, a network interface 114, a network interface 115, a LAN side network control unit 116, A WAN-side network control unit 117, a communication relay unit 118, a display control unit 119, and a display unit 120 are included.

  The CPU 111 controls the entire VPN apparatus 101 by executing a predetermined program. The non-volatile memory 112 holds a program executed by the CPU 111. This program includes an external address / port acquisition program for the VPN apparatus 101 to acquire external address / port information.

The program executed by the CPU 111 can be acquired from an external server online via an arbitrary communication path, or can be acquired by reading from a recording medium such as a memory card or a CD-ROM. it can. In other words, the VPN apparatus can be realized by reading a program for realizing the function of the VPN apparatus from a recording medium into a general-purpose computer.
Note that when the CPU 111 executes the program, a part of the program on the nonvolatile memory 112 may be expanded on the memory 113 and the program on the memory 113 may be executed.

  The memory 113 is for temporarily storing data management during operation of the VPN apparatus 101 and various setting information. The setting information includes destination address information necessary for communication, such as external address / port information included in a response to the external address / port acquisition request of the terminal itself.

  The network interface 114 is an interface for connecting the VPN apparatus 101 and the subordinate terminal 103 managed by the own apparatus in a communicable state. The network interface 115 is an interface for connecting the VPN apparatus 101 and the LAN 100 in a communicable state. The LAN-side network control unit 116 performs communication control related to the LAN-side network interface 114. The WAN-side network control unit 117 performs communication control related to the WAN-side network interface 115.

  The communication relay unit 118, on the contrary, transmits packet data sent from the subordinate terminal 103 connected to the LAN side to the external VPN connection destination (the terminal 303 subordinate to the VPN device 301), and external VPN connection destination (the VPN device 301). The packet data arriving from the subordinate terminal 303) to the subordinate terminal 103 is relayed.

  The display unit 120 is configured by a display that displays the operation state of the VPN apparatus 101 and notifies the user or administrator of various states. The display unit 120 includes a plurality of light emitting diodes (LEDs), a liquid crystal display (LCD), and the like. The display control unit 119 performs display control of the display unit 120, and controls contents to be displayed on the display unit 120 according to a display signal from the CPU 111.

  FIG. 3 is a block diagram showing a functional configuration example of the VPN apparatus according to the present embodiment.

  The VPN apparatus 101 includes a system control unit 130, a subordinate terminal management unit 131, a memory unit 132, a data relay unit 133, a setting interface unit 134, and a communication control unit 140 as functional configurations. The memory unit 132 includes an external address / port information storage unit 135. The communication control unit 140 includes an external address / port acquisition unit 141, a VPN function unit 142, and a call control function unit 143. The VPN function unit 142 includes an encryption processing unit 144. Each of these functions is realized by the hardware operation of each block shown in FIG. 2 or when the CPU 111 executes a predetermined program.

  The network interface 114 on the LAN side of the VPN apparatus 101 is connected to the subordinate terminal 103, and the network interface 115 on the WAN side is connected to the WAN 200 via the LAN 100 and the router 102.

  The system control unit 130 performs overall control of the VPN apparatus 101. The subordinate terminal management unit 131 manages the terminals 103 subordinate to the VPN apparatus 101. In the external address / port information storage unit 135, the memory unit 132 stores external address / port information including information on an external address (global IP address on the WAN 200) and a port (port number of the IP network). The external address / port information includes information on the global IP address and port number assigned to the terminal 103 under the calling side, information on the global IP address and port number assigned to the called terminal 303, and the like. Remember.

  The data relay unit 133 transmits a packet transferred from the calling terminal 103 to the called terminal 303, or conversely, a packet transferred from the called terminal 303 to the calling terminal 103. Are respectively relayed (received / transmitted). The setting interface unit 134 is a user interface for the user or administrator to perform various operations such as a setting operation on the VPN apparatus 101. As a specific example of this user interface, a Web page displayed by a browser operating on a terminal is used.

  The external address / port acquisition unit 141 of the communication control unit 140 acquires the external address / port information assigned to the terminal 103 under the control of the VPN apparatus 101 from the STUN server 201. In addition, by receiving a packet including the external address / port information of the called terminal 303 via the call control server 202, an external device assigned to the called terminal 303 for communication from the router 302 is received. Get address / port information. The information acquired by the external address / port acquisition unit 141 is held in the external address / port information storage unit 135 of the memory unit 132.

  The VPN function unit 142 of the communication control unit 140 performs encryption processing necessary for VPN communication in the encryption processing unit 144. That is, the encryption processing unit 144 encapsulates and encrypts a packet to be transmitted, or unencapsulates and decrypts a received packet to extract an original packet. As VPN communication, even for P2P communication, packets are relayed by a server (call control server 202, relay servers 203, 204, etc.) provided on WAN 200, and VPN communication is performed by a client / server system. Is also possible. In this case, encryption processing may be performed on the server side.

  Further, the VPN function unit 142 determines whether or not VPN communication can be performed using the relay server selected by the call control server 202 as a relay destination. For example, whether or not VPN communication is possible is determined based on whether or not login to the selected relay server has been performed.

  The call control function unit 143 of the communication control unit 140 transmits a connection request for connecting to the target called party via the call control server 202. Further, a process for receiving a connection response from the called party via the call control server 202 is performed. The call control function unit 143 transmits and receives various signals (confirmation signal, instruction signal, request signal, response signal, etc.) related to VPN communication.

  Next, the hardware configuration and functional configuration of the call control server 202 and the relay servers 203 and 204 of this embodiment will be described.

  First, the hardware configuration of the call control server 202 and the relay servers 203 and 204 will be described. The hardware configuration of the call control server 202 is the same as that of the relay servers 203 and 204. Here, the first relay server 203 among the relay servers will be described. FIG. 4 is a block diagram illustrating a configuration example of the hardware configuration of the call control server 202 and the relay servers 203 and 204 of the present embodiment.

  The first relay server 203 includes a central processing unit (CPU) 211, an activation control unit 212, a memory control unit 213, a memory 214, a memory interface 216, a network interface 217, an input / output control unit 218, a display 219, a keyboard 220, and a RAM 21. It is comprised.

The CPU 211 controls the entire first relay server 203 by executing a predetermined program. The RAM 221 has predetermined operation information and holds a program executed by the CPU 211. The program executed by the CPU 211 can be acquired from an external server online via an arbitrary communication path, or can be acquired by reading from a recording medium such as a memory card or a CD-ROM. In other words, the first relay server 203 can be realized by reading a program for realizing the function of the first relay server 203 from a recording medium into a general-purpose computer.
When the CPU 211 executes the program, a part of the program on the RAM 221 may be loaded on the memory 214 and the program on the memory 214 may be executed.

  The activation control unit 212 performs activation control of the first relay server 203 in accordance with a control signal from the CPU 211.

  The memory control unit 213 controls data transfer between the memory 214 and another device in accordance with a control signal from the CPU 211. The memory 214 is an auxiliary storage device for temporarily storing various information necessary for data management during the operation of the first relay server 203 and VPN communication. The memory 214 includes a VPN information storage unit 215 that stores various types of information necessary for performing this VPN communication. The information includes external address / port information of the VPN apparatuses 101 and 301 that perform VPN communication. The memory interface 216 is an interface for connecting the memory 214 and another device in a state where data can be transferred.

  The network interface 217 is an interface for connecting the first relay server 203 and various communication devices on the WAN 200 in a communicable state. The input / output control unit 218 controls input / output devices such as the display 219, the keyboard 220, and other I / Os in accordance with control signals from the CPU 211.

Next, functional configurations of the call control server 202 and the first relay server 203 will be described.
FIG. 5 is a block diagram illustrating a functional configuration example of the call control server 202 of the present embodiment. FIG. 6 is a block diagram illustrating a functional configuration example of the first relay server 203 according to the present embodiment. As shown in FIGS. 5 and 6, the call control server 202 and the first relay server 203 have a system control unit 230, a memory unit 231, an input / output interface unit 232, and a communication control unit 240 as functional configurations. Is done. Each of these functions is realized by the hardware operation of each block shown in FIG. 4 or when the CPU 211 executes a predetermined program. The network interface 217 of the call control server 202 is connected to the WAN 200.

  A difference in functional configuration between the call control server 202 and the first relay server 203 is a function of the communication control unit 240. As shown in FIG. 5, the communication control unit 240 of the call control server 202 includes a data relay unit 241, a signal communication unit 242, and a relay server selection unit 243. On the other hand, as illustrated in FIG. 6, the communication control unit 240 of the first relay server 203 includes a data relay unit 241, a signal communication unit 242, a processing load determination unit 244, a bandwidth usage rate determination unit 245, a changed session selection unit 246, A session change instruction unit 247 is included.

  The system control unit 230 performs overall control of the first relay server 203. The memory unit 231 realizes external address / port information including information on external addresses (global IP addresses on the WAN 200) and ports (port numbers of the IP network) of both the VPN apparatuses 101 and 301, and functions of the respective control units. Control program, various setting information, and the like are stored.

  The input / output interface unit 232 includes a display, a keyboard, and other interfaces such as I / O and a control unit thereof. For example, the input / output interface unit 232 has a user interface for a user or an administrator to perform various operations such as a setting operation for the first relay server 203, display, and audio output. As a specific example of this user interface, a Web page displayed by a browser operating on a terminal is used.

  The data relay unit 241 of the communication control unit 240 relays communication between the VPN device 101 performing VPN communication and the VPN device 301. For example, a packet transferred from the VPN apparatus 101 toward the VPN apparatus 301 and a packet transferred from the VPN apparatus 301 toward the VPN apparatus 101 are relayed (transmitted / received). Note that not only VPN communication between the VPN apparatuses 101 and 301 but also VPN communication performed between other VPN apparatuses can be relayed, and a plurality of VPN communications can be relayed simultaneously. The signal communication unit 242 of the communication control unit 240 transmits and receives various signals (confirmation signal, instruction signal, request signal, response signal, etc.) related to VPN communication.

  The relay server selection unit 243 of the communication control unit 240 included in the call control server 202 selects a relay server that relays VPN communication as a plurality of relay servers in the VPN system (first relay server 203, second relay server 204, other Select from (Relay Server). For example, when the first relay server 203 requests to change (migrate) the VPN session (VPN communication) to another relay server, the second relay server 204 different from the first relay server 203 is changed (migrated). Select as the first relay server.

  The processing load determination unit 244 of the communication control unit 240 included in the first relay server 203 detects the load factor (CPU load factor) of the CPU 211 that is relaying VPN communication, and whether or not the CPU load factor is equal to or greater than a specified value. Determine whether. The band usage rate determination unit 245 detects the usage rate of a communication band (used communication band) used for VPN communication, and determines whether the usage rate is equal to or higher than a specified value. The changed session selection unit 246 relays one or more VPN communications (VPN session) relayed by the first relay server 203 to another relay server (for example, the second relay server 204) other than the first relay server 203. A VPN communication (VPN session) to be changed is selected. One or more VPN communications are selected, and all or some of the VPN communications relayed by the first relay server 203 may be used. When the session change setting unit 247 receives an instruction to change the relay destination of the VPN communication from the input / output interface unit 232 according to a user instruction, for example, during maintenance or the like, the timer in the system control unit 230 causes the VPN to change. When a predetermined time at which the communication relay destination is to be changed is detected, a setting is made to change the relay destination to another relay server (for example, the second relay server 204) different from the first relay server 203 for VPN communication.

Next, the operation at the time of VPN construction in the VPN system of this embodiment will be described.
FIG. 7 and FIG. 8 are sequence diagrams showing a processing procedure at the time of VPN construction in the VPN system of this embodiment. FIG. 7 and FIG. 8 show processing in a network including a VPN device when attempting to connect from the terminal 103 under the VPN device 101 to the terminal 303 under the other VPN device 301 via the WAN 200. Yes. FIG. 7 is a diagram illustrating an example of processing for constructing a VPN session via the first relay server using the call control server 202. 8 assumes that the VPN session via the first relay server 203 is changed and the VPN session via the second relay server 204 is constructed. Note that the process of FIG. 8 may follow the process of FIG.

  First, the VPN apparatus 101 logs in to the call control server 202 and receives user authentication (step S101). When the VPN apparatus 101 succeeds in user authentication, the call control server 202 registers and sets identification information (MAC address, user ID, telephone number, etc.) of the VPN apparatus 101, location information on the network (global IP address), etc. Is done. Thereafter, communication between the VPN apparatus 101 and the call control server 202 becomes possible. Although the VPN apparatus 101 is the calling party, the VPN apparatus 301 that is the called party also logs in to the call control server 202 and receives user authentication, and the call control server 202 identifies the identification information of the VPN apparatus 301. Are registered and set (step S102).

  Subsequently, when the VPN apparatus 101 receives a VPN connection request from the subordinate terminal 103 by the function of the external address / port acquisition unit 141 when the application for performing VPN communication is activated, the VPN apparatus 101 communicates with the STUN server 201. Perform external address / port acquisition procedure. At this time, the VPN apparatus 101 acquires the external address / port information (global IP address and port number as seen from the WAN 200 side) assigned for communication by the router 102, so that the external address / port is sent to the STUN server 201. A binding request (Binding Request, refer to RFC3489; the same applies hereinafter) packet is transmitted as an acquisition request. On the other hand, the STUN server 201 responds to the external address / port acquisition request and includes a binding response (Binding Response, see RFC3489; the same applies hereinafter) including external address / port information as a reply to the external address / port acquisition request to the VPN apparatus 101. ) Return the packet. The VPN apparatus 101 stores the external address / port information obtained by returning the external address / port information acquisition request.

  Subsequently, the VPN apparatus 101 makes a connection request for establishing a communication path to the VPN apparatus 301 having the called-side terminal 303 under its control via the call control server 202 (step S103). At this time, the VPN apparatus 101 uses the external address / port information (global IP address and port number) for communicating with the WAN side assigned to the own apparatus acquired in the external address / port acquisition procedure as the calling party address information. Is transmitted to the call control server 202. The connection request also includes identification information of the called party (VPN device 301). The call control server 202 relays this connection request and transmits it to the VPN device 301 on the called side of the VPN connection (step S104). In response to this connection request, the call control server 202 relays the request that the VPN apparatus 101 wants to establish a VPN connection to the VPN apparatus 301 for establishing a communication path to the called party.

  Upon receiving the connection request notified via the call control server 202, the called-side VPN device 301 performs an external address / port acquisition procedure with the STUN server 201. At this time, the VPN apparatus 301 obtains external address / port information (global IP address and port number as viewed from the WAN 200 side) for communicating with the WAN side assigned to the self apparatus in the same manner as the VPN apparatus 101. A binding request packet is sent to the server 201 as an external address / port acquisition request. On the other hand, the STUN server 201 responds to the external address / port acquisition request, and returns a binding response packet including the external address / port information to the VPN apparatus 301 as a reply to the external address / port information. The VPN device 301 stores the external address / port information obtained by returning the external address / port information.

  Subsequently, the VPN apparatus 301 makes a connection response to the connection request via the call control server 202 (step S105). At this time, the VPN apparatus 301 sends the call control server 202 a connection response including the external address / port information (global IP address and port number) of the own apparatus acquired in the external address / port acquisition procedure as the called party address information. To the calling side VPN apparatus 101. The connection response also includes identification information of the calling party (VPN device 101). The call control server 202 relays this connection response and transmits it to the VPN device 101 on the calling side of the VPN connection (step S106). With this connection response, the call control server 202 relays a response from the VPN apparatus 301 to the VPN apparatus 101 in response to the connection request to the calling side.

  Subsequently, the VPN apparatus 101 transmits a relay server use request for using the first relay server 203 for communication between the VPN apparatuses 101 and 301 to the call control server 202 (step S107).

  When receiving the relay server use request from the VPN apparatus 101, the call control server 202 issues a relay instruction to one of the relay servers (here, the first relay server 203 as an example) (step S108). The relay instruction includes identification information (connection device information) of the VPN devices 101 and 301 that communicate communication packets. When the first relay server 203 receives the relay instruction from the call control server 202, the first relay server 203 determines whether or not the relay server has the capability to perform the relay processing. A relay response (OK) indicating that the first relay server 203 performs communication relay is performed (step S109). When the call control server 202 receives the relay response (OK) from the first relay server 203, the call control server 202 sends a relay server utilization response to the VPN apparatus 101 (step S110). The relay server utilization response includes identification information of the first relay server 203 that relays the communication packet (URL of the first relay server 203: connection destination information).

  Through the processes in steps S101 to S110, the VPN apparatus 101 and the VPN apparatus 301 complete preparations (information exchange of information necessary for performing communication) before performing data communication.

  Upon receiving the relay server use response from the call control server 202, the VPN apparatus 101 logs in to the first relay server 203 and receives user authentication (step S111). When the VPN apparatus 101 succeeds in user authentication, the first relay server 203 registers the identification information (MAC address, user ID, telephone number, etc.) of the VPN apparatus 101 and location information (global IP address) on the network, Settings are made. When the registration and setting are completed, the first relay server 203 notifies the VPN apparatus 101 of the completion of login (step S112). Thereafter, communication between the VPN apparatus 101 and the first relay server 203 becomes possible.

  Further, the VPN apparatus 101 issues a relay server connection instruction for instructing the VPN apparatus 301 to connect to the first relay server 203 via the call control server 202 (steps S113 and S114). ). The relay server connection instruction includes identification information (URL etc .: connection destination information) of the first relay server 203 that is the relay connection destination. Upon receiving the relay server connection instruction from the VPN apparatus 101 via the call control server 202, the VPN apparatus 301 logs in to the first relay server 203 and receives user authentication (step S115). When the VPN device 301 succeeds in user authentication, the first relay server 203 registers the identification information (MAC address, user ID, telephone number, etc.) of the VPN device 301 and location information (global IP address) on the network, Settings are made. When the registration and setting are completed, the first relay server 203 notifies the VPN device 301 of the completion of login (step S116). Thereafter, communication between the VPN device 301 and the first relay server 203 becomes possible. Upon receiving the login completion notification from the first relay server 203, the VPN device 301 sends a relay server connection response indicating that the VPN device 301 has connected to the first relay server 203 via the call control server 202. It performs with respect to the apparatus 101 (step S117, S118).

  At this stage, the calling side VPN device 101 and the called side VPN device 301 have completed the login to the first relay server 203 of the other party. The VPN apparatus 101 and the VPN apparatus 301 transmit packets via the first relay server 203, and VPN communication via the first relay server 203 is possible by the VPN function unit 142 of the VPN apparatus shown in FIG. Check whether it is in a proper state. For example, the VPN device 101 transmits a packet to the VPN device 301 via the first relay server 203, and the packet is received from the VPN device 301 via the first relay server 203 within a predetermined period from this transmission. When the response shown is received, it is determined that the VPN communication via the first relay server 203 is possible. If the VPN communication is possible, the VPN apparatus 101 and the VPN apparatus 301 start encrypted data communication via the first relay server 203 (steps S119 and S120). As described above, in FIG. 7, VPN communication is performed through the communication path using the first relay server 203.

  In other words, the VPN apparatus 101 and the VPN apparatus 301 can communicate with each other through the communication path of the first relay server 203 by the processes in steps S111 to S120.

  In the processing of FIG. 8, first, when communication is performed on the communication path of the first relay server 203, the first relay server 203 sends a session change request to the call control server 202 when a predetermined condition is satisfied. Transmit (step S121). The session change request is a request for changing the VPN session, that is, for changing the communication path. In addition, the predetermined condition is that the communication path is switched by the input / output interface unit 232 of the first relay server 203 when the processing load of the first relay server 203 becomes equal to or higher than the predetermined load or due to server maintenance or the like. If instructed, etc.

  When the call control server 202 receives the session change request from the first relay server 203, the call control server 202 sends a session change status confirmation request to a relay server different from the first relay server 203 (here, the second relay server 204 as an example). Transmit (step S122). The session change status confirmation request is a request for confirming that there is no problem in processing even if the VPN session (VPN communication) is changed to another relay server. When the second relay server 204 receives the session change status confirmation request from the call control server 202, the second relay server 204 determines whether or not it has the capability to relay the current communication. A session change status confirmation response (permission) indicating that the second relay server 204 permits the communication relay is transmitted to the call control server 202 (step S123).

  The call control server 202 transmits a relay server change instruction for changing the relay server that relays VPN communication from the first relay server 203 to the second relay server 204 to the VPN apparatus 101 (step S124). The relay server change instruction includes identification information (URL or the like) of the second relay server 204 that becomes the relay server after the change.

  Upon receiving the relay server change instruction from the call control server 202, the VPN apparatus 101 logs in to the second relay server 204 and receives user authentication (step S125). When the VPN apparatus 101 succeeds in user authentication, the second relay server 204 registers the identification information (MAC address, user ID, telephone number, etc.) of the VPN apparatus 101 and location information (global IP address) on the network, Settings are made. When the registration and setting are completed, the second relay server 204 notifies the VPN apparatus 101 of the completion of login (step S126). Thereafter, communication between the VPN apparatus 101 and the second relay server 204 becomes possible.

  Further, the VPN apparatus 101 issues a relay server connection change instruction to the VPN apparatus 301 for instructing the VPN apparatus 301 to change the connection to the second relay server 204 via the call control server 202 (step). S127, S128). The relay server connection change instruction includes identification information (URL or the like: connection destination information) of the second relay server 204 that is a relay connection destination. Upon receiving the relay server connection change instruction from the VPN apparatus 101 via the call control server 202, the VPN apparatus 301 logs in to the second relay server 204 and receives user authentication (step S129). If the VPN device 301 succeeds in user authentication, the second relay server 204 registers the identification information (MAC address, user ID, telephone number, etc.) of the VPN device 301, location information on the network (global IP address), etc. Settings are made. When the registration and setting are completed, the second relay server 204 notifies the VPN device 301 of the completion of login (step S130). Thereafter, communication between the VPN device 301 and the second relay server 204 becomes possible. Upon receiving the login completion notification from the second relay server 204, the VPN device 301 receives a relay server connection change response (OK) indicating that the VPN device 301 has connected to the second relay server 204 via the call control server 202. ) Is performed on the VPN apparatus 101 (steps S131 and S132).

  At this stage, the calling-side VPN device 101 and the called-side VPN device 301 have completed the login to the second relay server 204 of the other party. The VPN apparatus 101 and the VPN apparatus 301 transmit packets via the second relay server 204, and VPN communication via the second relay server 204 is possible by the VPN function unit 142 of the VPN apparatus shown in FIG. It is confirmed whether or not. For example, the VPN device 101 transmits a packet to the VPN device 301 via the second relay server 204, and the packet is received from the VPN device 301 via the second relay server 204 within a predetermined period from this transmission. When the response shown is received, it is determined that the VPN communication via the second relay server 204 is possible. If the VPN communication is possible, the VPN apparatus 101 and the VPN apparatus 301 start encrypted data communication via the second relay server 204 (steps S133 and S134).

  Note that communication via the second relay server 204 is normally performed in accordance with the start of communication via the second relay server 204, that is, switching of the relay server from the first relay server 203 to the second relay server 204. After confirming this, the VPN session between the VPN devices 101 and 301 via the first relay server 203 is terminated, and the resources used for the first relay server 203 are released (step 135, S136).

  That is, the VPN apparatus 101 and the VPN apparatus 301 switch from communication on the first relay server communication path to communication on the second relay server communication path by performing the processing in steps S121 to S136, and perform communication on the second relay server communication path. It can be performed. Therefore, the first relay server 203 can reduce the processing load generated by the communication between the VPN devices 101 and 301, and uses the reduced processing load for the relay processing between other VPN devices. can do.

  In FIG. 8, the VPN session to be changed is described as the VPN session between the VPN apparatuses 101 and 301. However, the VPN session between other VPN apparatuses may be the change target.

  As described above, according to the VPN system of the present embodiment, it is possible to change the VPN session to another relay server while continuing the VPN communication and perform stable VPN communication. In particular, even when the load on the relay server that relays VPN communication between VPN devices increases, it is possible to distribute the load on the relay server and perform stable VPN communication.

  Next, the operation of each device of the VPN system associated with switching from the first relay server communication path to the second relay server communication path shown in FIG. 8 will be described.

  FIG. 9 is a flowchart illustrating an example of the load confirmation process of the first relay server 203. The processing in FIG. 9 is periodically performed in a relay server that relays communication between VPN devices. The term “regular” cannot be generally defined, but can be set so that, for example, confirmation is performed in a minute order.

  The load assumed in the load confirmation process includes the processing load of the first relay server 203 that performs various processes, and the data used on the communication line for communication between the VPN apparatuses 101 and 301 and the first relay server 203. Two loads of communication carrier capacity (communication bandwidth) are conceivable. If any of these loads exceeds a specified value, there is a possibility that all communications performed by the first relay server 203 fail (become incapable of communication). Therefore, the first relay server 203 shifts (changes) part or all of the communication processed by the first relay server 203 to another relay server (for example, the second relay server 204) before reaching the specified value. To do. For this reason, the above two types of loads on the first relay server 203 are periodically checked.

  In the example shown in FIG. 9, first, the processing load determination unit 244 determines whether or not the CPU load factor is larger than a predetermined specified load factor (threshold value) (step S201). This specified load factor (threshold value) varies greatly depending on the VPN system and cannot be specified unconditionally. However, normally, the CPU load is such that processing by the first relay server 203 is possible even when the amount of communication to be processed further increases. The rate is desirable. For example, in the case of only voice communication, since the CPU load factor for one communication is not large, the threshold value may be set higher (80% or more), for example, for communication with a large data capacity such as video distribution. When handling, the CPU load required for one communication becomes large, so it is appropriate to set the threshold value low (70% or less, etc.).

  When the CPU load factor is equal to or less than the specified load factor, the bandwidth usage rate determination unit 245 of the first relay server 203 uses the communication bandwidth (all used in the communication performed using the first relay server 203) ( It is determined whether or not the usage rate (used communication band) is larger than a predetermined specified usage rate (threshold) (step S202). Similarly to the specified load rate, this specified usage rate cannot be uniquely determined because the value differs for each VPN system, but is 60%, for example.

  When the CPU load rate is larger than the specified load rate, or when the usage rate of the used communication band is larger than the specified use rate, there is a possibility that the processing capacity of the first relay server 203 will be exceeded by increasing the communication amount. Therefore, a part or all of the currently communicating session (including a session between the VPN apparatuses 101 and 301 and a session between other communication apparatuses) is changed to another relay server (for example, the second relay server 204). .

  At this time, the change session selection unit 246 of the first relay server 203 sets a change target session that is a VPN session to be changed (step S203). The VPN session for changing the relay destination to the second relay server 204 may be an arbitrary VPN session. Alternatively, the changed session selection unit 246 periodically acquires the processing status for each VPN session being relayed by the first relay server 203, and changes the VPN session with a high load from the statistical information including the acquired multiple processing statuses. It may be selected as a session.

  When an arbitrary VPN session is selected as the session to be changed, it is unclear how much the load will be reduced. However, since this load confirmation process is performed periodically, the CPU is used at the timing of the next load confirmation process. If the load factor exceeds the specified load factor, the process of changing another VPN session to another relay server is repeated. In this case, it is assumed that a specified load factor that is a reference for the load is set to a low value in advance so that it can cope with an increase in the traffic.

  On the other hand, when a VPN session is selected as the change target session based on the statistical information, the VPN session is changed from a highly loaded VPN session to the second relay server 204, so that the load of the first relay server 203 is changed once. The possibility that the CPU load factor falls below the specified load factor can be increased by the processing.

  When a session to be changed is selected, the signal communication unit 242 of the first relay server 203 transmits a session change request message for requesting a session change from the first relay server 203 to the call control server 202 (step). S204).

  In step S202, when the usage rate of the used communication band is equal to or lower than the specified usage rate, or after transmission of the session change request message in step S204, the system control unit 230 performs the load confirmation process again (for periodic diagnosis). The timer is set (step S205). When this timer times out, the processing from step S201 is performed again. It should be noted that it may be determined in advance as a function of periodic activation so that the load confirmation process is periodically started.

  When the first relay server 203 can secure a sufficiently wide communication band for the processing capacity of the CPU, or the first relay server 203 has a CPU having a sufficient processing capacity for the used communication band. In some cases. In these cases, the load confirmation process in FIG. 9 can be omitted.

  According to the load confirmation process shown in FIG. 9, even when the load on the first relay server 203 increases, the load balancing as described above is performed by notifying the call control server 202 that the load has increased. For this reason, it is possible to distribute the load applied to the relay server and perform stable VPN communication.

  Next, FIG. 10 is a flowchart showing an example of session change processing of the call control server 202.

  When the signal reception unit 242 receives the session change request message from the first relay server 203 (step S301), the relay server selection unit 243 determines whether there is another relay server other than the first relay server 203. (Step S302).

  When there is another relay server, the relay server selection unit 243 selects a relay server (change destination relay server) that is a VPN session change destination from one or more relay servers associated with the call control server 202. Is selected (step S303). As a selection method of the change destination relay server, a method of selecting an arbitrary relay server associated with the call control server 202 as the change destination relay server, from one or a plurality of relay servers when receiving a periodic or session change request message There is a method of collecting relay server status information including load status information indicating the load status of each relay server, and selecting the relay server with the lightest load as the change destination relay server when receiving the session change request message. Note that the relay server associated with the call control server 202 refers to a relay server whose identification information is registered in the call control server 202.

  When the change destination relay server is selected, the signal communication unit 242 confirms whether there is no problem in processing even if the communication at the first relay server 203 is shifted (changed) to the change destination relay server. Session change status confirmation request message is transmitted (step S304). Then, the signal communication unit 242 receives a session change status confirmation response message for the session change status confirmation request message from the change destination relay server (step S305). The contents of the session change status confirmation response message are described later with reference to FIG. I will explain it.

  The relay server selection unit 243 analyzes the session change status confirmation response message and determines whether or not the communication session can be changed (step S306). If the VPN session can be changed (session change status confirmation response (OK)), the signal communication unit 242 transmits a relay server change instruction message to the VPN device that is performing the VPN session communication to be changed. (Step S307). The information of the relay server change instruction message includes information of the change destination relay server that is the change destination. The relay server change instruction message is the same regardless of whether it is sent to either the calling side (in this case, the VPN apparatus 101) or the called side (in this case, the VPN apparatus 301) of the VPN apparatus that performs communication in the VPN session. Since processing is performed, it is only necessary to send it to one of the VPN devices. Here, for the sake of convenience, it is assumed that the relay server change message is transmitted to the calling VPN device (VPN device 101).

  On the other hand, if the VPN session cannot be changed (session change status confirmation response (NG)), it is registered in the call control server 202 to other relay servers not inquiring about the status for changing the VPN session. In order to perform the same processing as described above, the process returns to step S302.

  If the processing of steps S302 to S306 is repeated and the communication session cannot be changed to any relay server registered in the call control server 202, the system control unit 302 opens the input / output interface unit 232 and performs predetermined contents. A warning (alert) is notified with. Thereby, any relay server may not be able to accept a new communication session, and it can be notified that a problem may occur as a VPN system.

  Next, FIG. 11 is a flowchart illustrating an example of session acceptance determination processing of the second relay server 204. In FIG. 11, it is assumed that the second relay server 204 is selected as the change destination relay server.

  When the signal communication unit 242 receives the session change status confirmation request message from the call control server 202 (step S401), the second relay server 204 confirms the load on the second relay server 204. The load to be confirmed here is the same as the load of the load confirmation process in the first relay server 203 shown in FIG. That is, the processing load determination unit 244 determines whether or not the CPU load factor is larger than a predetermined specified load factor (threshold value) (step S402). When the CPU load rate is equal to or less than the specified load rate, the band usage rate determination unit 245 determines whether or not the usage rate of the used communication band is larger than a predetermined specified usage rate (threshold) (step S403). Note that the specified load factor and the specified usage rate related to the first relay server 203 and the specified load rate and the specified usage rate related to the second relay server 204 may or may not be the same. This is because the processing capability and communication bandwidth of the relay servers are not all the same, and therefore the threshold value (processing capability limit) may be different for each relay server.

  When the usage rate of the used communication band is equal to or less than the specified usage rate, the signal communication unit 242 does not exceed the processing capability of the second relay server 204 even if the communication amount slightly increases. A session change status confirmation response (OK) message indicating that the VPN session change from 203 can be accepted is transmitted to the call control server 202 (step S404).

  On the other hand, when the CPU load rate is larger than the specified load rate, or when the usage rate of the used communication band is larger than the specified usage rate, the processing capacity of the second relay server 204 may be exceeded by increasing the communication amount. Therefore, the signal communication unit 242 transmits a session change status confirmation response (NG) message indicating that the VPN session change from the first relay server 203 cannot be accepted to the call control server 202 (step S31). S405).

  Thus, the second relay server 204 as the change destination relay server that has received the session change status confirmation request message determines whether or not it is possible to newly accept a VPN session from the processing state (load state) of the own server. Then, whether the VPN session can be changed is notified by a session change status confirmation response message. Thereby, it is possible to avoid the load being concentrated on a specific relay server, and to perform load distribution as a whole VPN system.

  Next, FIG. 12 is a flowchart showing an example of processing when the VPN apparatus 101 receives a relay server change instruction. In FIG. 12, it is assumed that the VPN apparatus 101 receives a relay server change instruction message from the call control server 202. Further, it is assumed that the second relay server 204 is selected as the change destination relay server.

  First, when the call control function unit 143 receives the relay server change instruction message from the call control server 202 (step S501), the VPN apparatus 101 receives the second relay as the change destination relay server included in the relay server instruction change message. Based on the identification information of the server 204, login to the second relay server 204 is attempted (step S502). The login process is as detailed above.

  When the login to the second relay server 204 is completed, the call control function unit 143 transmits a relay server connection change instruction message to the VPN device 301 which is the called VPN device (step S503). The information of the relay server connection change instruction message includes identification information of the second relay server 204 that is the relay server after the communication session is changed. As a result, the VPN apparatus 301 can also log in to the second relay server 204. On the other hand, if the login to the second relay server 204 fails, the communication session cannot be changed, and the process is terminated.

  When the call control function unit 143 receives the relay server connection change response message from the VPN device 301 (step S504), the call control function unit 143 determines whether the VPN device 301 has been connected to the second relay server 204 (step S505). Whether or not the VPN apparatus 301 can connect to the second relay server 204 is a relay server connection change response (OK) message indicating that the VPN apparatus 301 has successfully logged in to the second relay server 204, or the VPN apparatus Whether or not 301 is a relay server connection change response (NG) message indicating that login to the second relay server 204 has failed is determined.

  When it is determined that the VPN apparatus 301 can be connected to the second relay server 204, that is, when the VPN session change to the change destination relay server is possible, the data relay unit 133 communicates with the second relay server 204. Data transmission is started (step S506).

  After the start of transmission of communication data, the call control function unit 143 receives communication data from the VPN device 301 that is the called VPN device) by the data relay unit 133 via the second relay server 204 that is the change destination relay server. Is determined (step S507). When it is determined that the communication data from the VPN device 301 has been received via the second relay server 204, the call control function unit 143 has established a VPN session between the VPN devices 101 and 301 via the second relay server 204. Therefore, the transmission of communication data to the first relay server 203 that was communicating before the change of the VPN session is stopped (step S508). The VPN apparatus 101 continues to transmit communication data to the first relay server 203 until it is determined that the communication data from the VPN apparatus 301 is received via the second relay server 204.

  As described above, when the VPN apparatus 101 receives communication data from the VPN apparatus 301 via the second relay server 204, the call control function unit 143 is the first relay server 203 that is the relay server before the VPN session is changed. Log out from the server and complete the change of the relay server to establish the VPN session. In the logout process, identification information (MAC address, user ID, telephone number, etc.) of the VPN apparatus 101 that is the VPN apparatus subject to logout, network location information (global IP address), etc. are deleted from the first relay server 203. The As a result, the VPN session between the VPN apparatuses 101 and 301 via the first relay server 203 is disconnected.

  On the other hand, if it is determined in step S505 that the VPN apparatus 301 cannot be connected to the second relay server 204, that is, if it is impossible to change the VPN session to the change destination relay server, the call control function unit 143 Then, logout from the second relay server 204 is performed (step S509).

  According to the process of FIG. 12, when any VPN device is instructed to change the relay destination of the VPN session, the VPN session can be changed to another relay server while being continuously connected. it can.

  Next, FIG. 13 is a flowchart showing an example of processing when the VPN apparatus 301 receives a relay server connection change instruction. In FIG. 13, it is assumed that the second relay server 204 is selected as the change destination relay server. Further, it is assumed that the VPN device 301 receives a relay server connection change instruction message from the VPN device 101.

  First, when the call control function unit 143 receives the relay server connection change instruction message from the VPN apparatus 101 (step S601), the VPN apparatus 301 is the change destination relay server specified by the relay server connection change instruction message. A login to the second relay server 204 is attempted (step S602). The login process is as detailed above.

  When the VPN apparatus 301 successfully logs in to the second relay server 204, the call control function unit 143 sends a relay server connection change response (OK) message indicating that the login is successful to the VPN that is the calling VPN apparatus. It transmits to the apparatus 101 (step S603). Then, after transmitting the relay server connection change response (OK) message, the data relay unit 133 starts transmitting communication data to the second relay server 204 that has successfully logged in (step S604).

  Whether or not the call control function unit 143 has received communication data from the VPN apparatus 101 that is the calling side VPN apparatus via the second relay server 204 that is the change destination relay server after the start of transmission of the communication data. Is determined (step S605). When it is determined that the communication data from the VPN apparatus 101 has been received via the second relay server 204, the call control function unit 143 determines that the VPN session between the VPN apparatus 101 and the VPN apparatus 301 via the second relay server 204 has occurred. The transmission of communication data to the first relay server 203 that has been considered to have been established and was communicating before the VPN session change is stopped (step S606). The VPN device 301 continues to transmit the communication data to the first relay server 203 until it is determined that the communication data from the VPN device 101 is received via the second relay server 204.

  Thus, when the VPN apparatus 301 receives the communication data from the VPN apparatus 101 via the second relay server 204, the call control function unit 143 is the first relay server 203 that is the relay server before the VPN session is changed. Log out from the server and complete the change of the relay server to establish the VPN session. In the logout process, the identification information (MAC address, user ID, telephone number, etc.) of the VPN device 301 that is the VPN device subject to logout, network location information (global IP address), etc. are deleted from the first relay server 203. The As a result, the VPN session between the VPN apparatuses 101 and 301 via the first relay server 203 is disconnected.

  On the other hand, if the login to the second relay server 204 fails in step S602, the call control function unit 143 transmits a relay server connection change response (NG) message indicating that the login has failed to the VPN apparatus 101 ( Step S607).

  According to the process of FIG. 13, when a VPN apparatus instructed to change the relay destination of the VPN session is requested to change the relay destination of the VPN session, another relay is performed while the VPN session is continuously connected. You can change to a server.

  Next, all VPN sessions communicating with the relay server are changed to another relay server by a user operation without depending on the processing load of the relay server that relays the VPN communication between the VPN apparatuses 101 and 301. Will be described.

  FIG. 14 is a flowchart illustrating an example of a session change process based on a user instruction from the first relay server 203. In FIG. 14, it is assumed that a VPN session is established between the VPN apparatuses 101 and 301 via the first relay server 203, and the second relay server 204 is selected as the change-destination relay server. Further, it is assumed that the user instruction is a maintenance instruction for the first relay server 203 by the administrator.

  First, in the first relay server 203, when the input / output interface unit 232 issues a relay server change instruction in response to a user instruction (step S701), the changed session selection unit 246 does not establish a new VPN session. In addition, a new VPN session cannot be accepted (step S702). Thereafter, in the first relay server 203, which is a relay server that performs maintenance, the changed session selection unit 246 checks whether there is a VPN session that needs to change the VPN session (step S703).

  If there is a VPN session that needs to be changed, the first relay server 203 sets the change target session (step S704) and transmits a session change request (step S705), as in steps S203 and S204 of FIG. )I do.

  Here, since the first relay server 203 cannot grasp whether or not all communication sessions can be accepted by the second relay server 204 as the change destination relay server, the first relay server 203 performs all VPN session change processing. Are not performed at the same time. That is, the first relay server 203 changes the VPN sessions existing in the first relay server 203 to the second relay server 204 in order one by one. The system control unit 130 sets a change process waiting timer so that one change process avoids time overlap with other change processes and ensures sufficient time for the previous and subsequent change processes, and schedules the change process. (Step S706). Then, when the change processing waiting timer times out, the process returns to step S703 to change another VPN session. However, when the first relay server 203 considers the processing capability of the second relay server 204, which is the change destination relay server, there is no problem even if all communication sessions communicating with the first relay server 203 are changed. May be performed simultaneously for all communication sessions.

  When the change session selection unit 246 repeats the above processing and determines that there is no VPN session communicating with the first relay server 203, the session transfer (change) is completed to the relay server change instruction source on the display 219 or the like. And the process ends (step S707).

  According to the processing of FIG. 14, when a relay server in operation is stopped for maintenance, or when a relay server capable of higher performance and large capacity data communication is newly introduced and shifted to operation, the current VPN is used. The VPN session can be changed (transferred) to another relay server according to an instruction from a user such as an administrator without disconnecting the session. Further, the relay server having the VPN session can be set in an idle state.

  The present invention relates to a call control server, a relay server, a VPN device, a VPN communication system, a VPN networking method, and a program capable of transferring a VPN session to another relay server while continuing VPN communication and performing stable VPN communication. It is useful for storage media.

100, 300 LAN
101, 301 VPN device 102, 302 Router 103, 303 Terminal 111 Central processing unit (CPU)
112 Non-volatile memory 113 Memory 114, 115 Network interface 116 LAN side network control unit 117 WAN side network control unit 118 Communication relay unit 119 Display control unit 120 Display unit 130 System control unit 131 Subordinate terminal management unit 132 Memory unit 133 Data relay unit 134 Setting Interface Unit 135 External Address / Port Information Storage Unit 140 Communication Control Unit 141 External Address / Port Acquisition Unit 142 VPN Function Unit 143 Call Control Function Unit 144 Cryptographic Processing Unit 200 WAN
201 STUN Server 202 Call Control Server 203 First Relay Server 204 Second Relay Server 211 Central Processing Unit (CPU)
212 Start Control Unit 213 Memory Control Unit 214 Memory 215 VPN Information Storage Unit 216 Memory Interface 217 Network Interface 218 Input / Output Control Unit 219 Display 220 Keyboard 221 RAM
230 System control unit 231 Memory unit 232 Input / output interface unit 240 Communication control unit 241 Data relay unit 242 Signal communication unit 243 Relay server selection unit 244 Processing load determination unit 245 Bandwidth utilization rate determination unit 246 Change session selection unit 247 Session change setting unit

Claims (15)

A call control server that establishes a communication session between a plurality of VPN devices that construct a virtual private network and perform VPN communication on a network,
A relay destination change request signal receiving unit for receiving, from the first relay server, a relay destination change request signal for changing the relay server that relays the VPN communication;
A relay server selection unit that selects a second relay server different from the first relay server as a relay server for newly relaying the VPN communication;
When the second relay server selected by the relay server selection unit can relay the VPN communication, the relay server that includes the identification information of the second relay server and relays the VPN communication is defined as the first relay server. A relay server change instruction signal transmission unit for transmitting a relay server change instruction signal for changing from the relay server to the second relay server to the VPN apparatus;
A call control server comprising: A relay server that relays VPN communication performed by constructing a virtual private network between a plurality of VPN devices on a network,
A processing load determination unit that determines whether or not the processing load of the relay server is equal to or greater than a predetermined processing load;
A usage rate determination unit that determines whether or not the usage rate of the used communication band used for VPN communication between the VPN devices relayed by the relay server is equal to or higher than a predetermined usage rate;
When the processing load determination unit determines that the processing load is equal to or higher than the predetermined processing load, or when the usage rate determination unit determines that the usage rate is equal to or higher than the predetermined usage rate, the relay A change communication selection unit that selects VPN communication for changing the relay destination from one or more VPN communications relayed by the server to another relay server different from the relay server;
Establish a communication session between the VPN devices with a relay destination change request signal for changing a relay server that relays the VPN communication, including information for specifying the VPN communication selected by the changed communication selection unit A relay destination change request signal transmission unit to be transmitted to the call control server;
A relay server. A relay server that relays VPN communication performed by constructing a virtual private network between a plurality of VPN devices on a network,
A relay destination change instruction unit for giving an instruction to change the relay destination of the VPN communication to another relay server different from the relay server;
A change communication selection unit for selecting a VPN communication for changing a relay destination to the other relay server from one or more VPN communications relayed by the relay server;
Establish a communication session between the VPN devices with a relay destination change request signal for changing a relay server that relays the VPN communication, including information for specifying the VPN communication selected by the changed communication selection unit A relay destination change request signal transmission unit to be transmitted to the call control server;
A relay server. A relay server that relays VPN communication performed by constructing a virtual private network between a plurality of VPN devices on a network,
A relay destination status confirmation signal receiving unit that receives a relay destination status confirmation signal for confirming whether or not the VPN communication can be relayed from a call control server that establishes a communication session between the VPN devices;
A processing load determination unit that determines whether or not the processing load of the relay server is equal to or greater than a specified value;
A usage rate determination unit that determines whether or not the usage rate of the used communication band used for VPN communication between the VPN devices relayed by the relay server is equal to or greater than a specified value;
Based on the determination result by the processing load determination unit and the determination result by the usage rate determination unit, a relay destination status confirmation response signal including whether the relay server can relay the VPN communication is transmitted to the call control server. Relay destination status confirmation response signal transmitting unit,
A relay server. A VPN device that constructs a virtual private network on the network and performs VPN communication,
Identification information of the second relay server for changing the relay server that relays the VPN communication from the first relay server to the second relay server from a call control server that establishes a communication session between VPN devices. A relay server change instruction signal receiving unit for receiving a relay server change instruction signal including;
A VPN apparatus that is a communication destination for performing VPN communication with the VPN apparatus via the call control server, using the relay server connection change instruction signal for changing the relay server, including identification information of the second relay server A relay server connection change instruction signal transmitter for transmitting to
When the VPN device of the communication destination can execute VPN communication via the second relay server as the relay server after the change, the second relay server is connected to the VPN device of the communication destination. A data communication unit for communicating the communication data via
VPN device comprising: A VPN device that constructs a virtual private network on the network and performs VPN communication,
Identification of the second relay server for changing the relay server that relays the VPN communication from the first relay server to the second relay server via a call control server that establishes a communication session between VPN devices A relay server connection change instruction signal receiving unit that receives a relay server connection change instruction signal including information from a destination VPN apparatus that performs VPN communication with the VPN apparatus;
A VPN communication availability determination unit that determines whether VPN communication via the second relay server as the relay server after the change is possible;
A relay server connection change response including that VPN communication via the second relay server is possible when it is determined by the VPN communication feasibility determination unit that VPN communication via the second relay server is possible A relay server connection change response signal transmission unit for transmitting a signal to the VPN device of the communication destination;
After the transmission of the relay server connection change response signal, a data communication unit that communicates the communication data with the communication destination VPN device via the second relay server;
VPN device comprising: A VPN communication system that establishes a virtual private network and communicates between a plurality of VPN devices on a network,
A plurality of VPN devices performing VPN communication for communicating communication data via the virtual private network;
A call control server for establishing a communication session between the plurality of VPN devices;
A plurality of relay servers that relay VPN communication between the plurality of VPN devices;
With
The call control server
A relay destination change request signal receiving unit for receiving, from the first relay server, a relay destination change request signal for changing the relay server that relays the VPN communication;
A relay server selection unit that selects a second relay server different from the first relay server as a relay server for newly relaying the VPN communication;
When the second relay server selected by the relay server selection unit can relay the VPN communication, the relay server that includes the identification information of the second relay server and relays the VPN communication is defined as the first relay server. A relay server change instruction signal transmission unit for transmitting a relay server change instruction signal for changing from the relay server to the second relay server to the VPN apparatus;
A VPN communication system comprising: The VPN communication system according to claim 7, wherein
The relay server is
A processing load determination unit that determines whether or not the processing load of the relay server is equal to or greater than a predetermined processing load;
A usage rate determination unit that determines whether or not the usage rate of the used communication band used for VPN communication between the VPN devices relayed by the relay server is equal to or higher than a predetermined usage rate;
When the processing load determination unit determines that the processing load is equal to or higher than the predetermined processing load, or when the usage rate determination unit determines that the usage rate is equal to or higher than the predetermined usage rate, the relay A change communication selection unit that selects VPN communication for changing the relay destination from one or more VPN communications relayed by the server to another relay server different from the relay server;
A relay destination change request signal transmission unit for transmitting the relay destination change request signal including information for specifying the VPN communication selected by the change communication selection unit to the call control server;
A VPN communication system comprising: The VPN communication system according to claim 7, wherein
The relay server is
A relay destination change instruction unit for giving an instruction to change the relay destination of the VPN communication to another relay server different from the relay server;
A change communication selection unit for selecting a VPN communication for changing a relay destination to the other relay server from one or more VPN communications relayed by the relay server;
A relay destination change request signal transmission unit for transmitting the relay destination change request signal including information for specifying the VPN communication selected by the change communication selection unit to the call control server;
A VPN communication system comprising: The VPN communication system according to claim 7, wherein
The relay server is
A relay destination status confirmation signal receiving unit that receives from the call control server a relay destination status confirmation signal for confirming whether or not relaying of the VPN communication is possible;
A processing load determination unit that determines whether or not the processing load of the relay server is equal to or greater than a specified value;
A usage rate determination unit that determines whether or not the usage rate of the used communication band used for VPN communication between the VPN devices relayed by the relay server is equal to or greater than a specified value;
Based on the determination result by the processing load determination unit and the determination result by the usage rate determination unit, a relay destination status confirmation response signal including whether the relay server can relay the VPN communication is transmitted to the call control server. Relay destination status confirmation response signal transmitting unit,
A VPN communication system comprising: The VPN communication system according to claim 7, wherein
The VPN device is
A relay server change instruction signal receiving unit for receiving the relay server change instruction signal from the call control server;
A VPN apparatus that is a communication destination for performing VPN communication with the VPN apparatus via the call control server, using the relay server connection change instruction signal for changing the relay server, including identification information of the second relay server A relay server connection change instruction signal transmitter for transmitting to
When the VPN device of the communication destination can execute VPN communication via the second relay server as the relay server after the change, the second relay server is connected to the VPN device of the communication destination. A data communication unit for communicating the communication data via
A VPN communication system comprising: The VPN communication system according to claim 7, wherein
The VPN device is
A VPN apparatus that is a communication destination for performing VPN communication with the VPN apparatus via the call control server, using the relay server connection change instruction signal for changing the relay server, including identification information of the second relay server A relay server connection change instruction signal receiving unit that receives from:
A VPN communication availability determination unit that determines whether VPN communication via the second relay server as the relay server after the change is possible;
A relay server connection change response including that VPN communication via the second relay server is possible when it is determined by the VPN communication feasibility determination unit that VPN communication via the second relay server is possible A relay server connection change response signal transmission unit for transmitting a signal to the VPN device of the communication destination;
After the transmission of the relay server connection change response signal, a data communication unit that communicates the communication data with the communication destination VPN device via the second relay server;
A VPN communication system comprising: A VPN networking method for a call control server that establishes a communication session between a plurality of VPN devices that construct a virtual private network and perform VPN communication on a network,
Receiving a relay destination change request signal for changing a relay server that relays the VPN communication from the first relay server;
Selecting a second relay server different from the first relay server as a relay server for newly relaying the VPN communication;
When the selected second relay server is capable of relaying the VPN communication, the relay server that includes the identification information of the second relay server and relays the VPN communication is transferred from the first relay server to the first relay server. Transmitting a relay server change instruction signal for changing to the relay server to the VPN device;
VPN networking method comprising:   The program for performing each step of the VPN networking method of Claim 13.   The computer-readable storage medium which recorded the program for performing each step of the VPN networking method of Claim 13.

Images