JP5367386B2 - IP telephone terminal apparatus, VPN server apparatus, IP telephone server apparatus, and IP telephone system using them - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To facilitate initial settings for registering an IP (Internet Protocol) telephone terminal to an IP telephone server for utilization, and to dynamically change the settings. <P>SOLUTION: When authentication of user information is requested from the IP telephone terminal to a VPN (Virtual Private Network) server, the VPN server authenticates the user information and notifies information on the IP telephone server. The VPN server also notifies the IP telephone server about the authenticated user information. The IP telephone terminal requests address registration for the user information to the IP telephone server on the basis of the information notified from the VPN server. When the IP telephone server determines, in response to this request, that the request is an address registration request for the user information notified from the VPN server, the IP telephone server omits processing of authentication for the address registration. <P>COPYRIGHT: (C)2010,JPO&amp;INPIT

Description

  The present invention relates to a connection control to a head office server system of an IP telephone terminal installed in a remote place such as a small office home office (SOHO) in a corporate IP telephone system.

  VPN (Virtual Private Network) technology such as IPsec is used to connect an IP (Internet Protocol) terminal installed at a remote location such as SOHO and an IP system installed at the head office. IPsec, which is one of the VPN technologies, is a protocol standardized by IETF, and is a technology for handling two different IP networks as if they were one directly connected IP network. In order to construct a VPN using a protocol such as IPsec, authentication between the VPN client device installed at a remote location such as SOHO and a VPN server installed at the head office, and the user It is necessary to authenticate.

  On the other hand, in order to use an IP telephone terminal to receive or send a call, it is necessary to register with an IP telephone server. SIP standardized by RFC 3261 of IETF defines a protocol for making and receiving calls and registration using an IP telephone terminal. According to RFC3261, when using an IP telephone terminal, the IP telephone terminal transmits an address registration request message called SIP Register Request to the IP telephone server, and an address registration completion message called 200 OK Response is sent from the IP telephone server. Will be received. Here, the IP telephone server can authenticate the user of the IP telephone terminal (address used by the IP telephone terminal).

  As described above, in order to register and use an IP telephone terminal installed in a remote location such as SOHO in an IP telephone server connected to the head office IP system, (1) VPN-compatible client equipment installed in SOHO And user authentication between the server and the VPN server installed at the head office, and (2) the address of the user between the IP telephone terminal installed at the SOHO and the IP telephone server installed at the head office A plurality of authentications called registration authentication are required, which are performed using the IPsec protocol and the SIP protocol, respectively.

  For example, the following Patent Document 1 describes a method for easily establishing a VPN for inter-site connection with a communication partner network using a telephone or a GUI similar to a telephone, such as a numeric keypad of an IP telephone terminal. However, this technique does not relate VPN authentication processing to IP phone address registration authentication processing.

  Patent Document 2 below describes a method for collectively managing initial setting information necessary for setting such as a VPN by a server and simplifying an initial setting operation of a device. There is no mention of server coordination or server selection processing.

JP 2006-50006 A JP 2003-87424 A

  As described above, in order to register and use an IP telephone terminal installed in a remote place such as SOHO in an IP telephone server connected to the IP system of the head office, for example, using the IPsec protocol and the SIP protocol respectively. Multiple authentications are required. Performing multiple authentications in this way is detrimental to the head office system in terms of the load on the head office system and bandwidth resource consumption, and the operability of the user in terms of the complexity of performing two authentication operations. There are also disadvantages.

  In addition, since both VPN (IPsec) and SIP protocols require initial settings, initial settings of devices in the SOHO environment are complicated. Furthermore, these initial settings may be changed dynamically depending on the operational circumstances or failure of the head office system, but devices such as IP phone terminals installed in SOHO must follow these dynamic setting changes. I can't.

  The present invention has been made in consideration of such circumstances, and an object of the present invention is to easily perform initial setting for registering and using an IP telephone terminal in an IP telephone server, and to dynamically change the setting. Is to be able to. Another object of the present invention is to reduce system resource consumption when registering and using an IP telephone terminal in an IP telephone server, and simplify user operations.

  An IP telephone terminal apparatus according to an aspect of the present invention includes a user information storage unit that stores user information for identifying a user, a VPN client unit that provides a VPN client function, and an IP that provides an IP telephone address function. A telephone function unit, a setting information storage unit that stores setting information related to the VPN client function and the IP phone address function, and (1) VPN authentication is performed using the user information stored in the user information storage unit (2) When performing the VPN authentication, the setting information of the IP telephone address function is acquired and stored in the setting information storage unit, and (3) the IP address function setting stored in the setting information storage unit And a control unit that executes an IP telephone address registration function using the user information stored in the user information storage unit.

  According to the present invention, the initial setting for registering and using the IP telephone terminal in the IP telephone server can be easily performed, and the setting can be dynamically changed.

In particular,
(1) Operation of a user who uses an IP telephone terminal in SOHO and necessary initial settings can be simplified.

  (2) In an IP telephone system that accommodates IP telephone terminals installed in SOHO, the flexibility of setting an IP telephone server increases. Specifically, dynamic setting change is facilitated.

Furthermore, according to the present invention,
(3) In an IP telephone system that accommodates an IP telephone terminal installed in SOHO, there is an effect that the system load generated when the IP telephone terminal is accommodated and the bandwidth resources to be used can be reduced.

The figure which shows an example of the IP telephone system which concerns on one Embodiment of this invention The figure which shows the structural example of an IP telephone terminal The figure which shows the structural example of a VPN server The figure which shows the structural example of an IP telephone server The figure which shows an example of the connection sequence of an IP telephone terminal The figure which shows an example of the ISAKMP packet which carries the setting information of an IP telephone server The figure which shows an example of the reconnection sequence which concerns on 2nd Embodiment The figure which shows another example of the ISAKMP packet which carries the setting information of an IP telephone server The figure which shows the structural example of the VPN server which concerns on 3rd Embodiment. The figure which shows the structural example of the IP telephone server which concerns on 3rd Embodiment. Diagram showing an example of an end sequence

  In the embodiment of the present invention, an initial setting for registering and using an IP telephone terminal in an IP telephone server can be easily performed, and it is possible to follow even when the setting is dynamically changed. For example, the following approach is adopted.

  (1) A VPN client function is built in the IP telephone terminal.

  (2) Once the user performs a login operation on the IP phone terminal, the IP phone terminal is controlled so that both the VPN connection user authentication and the IP phone address registration authentication are completed.

  (3) Upon completion of VPN connection authentication, the head office VPN server notifies the IP phone terminal of the IP phone server address for IP phone address registration and the setting information necessary for registration.

  (4) When the IP phone server performs address registration authentication of the IP phone terminal, it refers to the result of VPN connection authentication. If the VPN connection authentication of the corresponding user is completed correctly, Skip the procedure.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a diagram showing an IP telephone system according to an embodiment of the present invention. The head office 2 is a base where a core system is operated in a company. Here, specifically, a mode in which the VPN server 6 and the IP telephone server 8 are connected by the head office LAN 7 is shown. There may be a plurality of VPN servers 6 and IP telephone servers 8.

  The branch office / SOHO (hereinafter referred to as “SOHO”) 1 is a base different from the head office 2 used by a small number of users. In order to use the core system, it is essential to connect to the head office 2 via a network. Here, specifically, it has an IP telephone terminal 4 and a modem 5. In addition, a PC (personal computer) or the like may be connected. The Internet 3 is shown as an example of a network connecting the head office 2 and the SOHO 1. The IP telephone terminal 4 is a terminal that provides an IP telephone function to a user of the SOHO 1. Specifically, it operates as a SIP UA using the SIP protocol. In the present embodiment, the IP telephone terminal 4 further operates as a VPN client device. Specifically, it is an IPsec client. When using the IP telephone terminal 4, the user performs a login operation on the IP telephone terminal 4. Specifically, this is input of a user name and a password. The modem 5 is a device used to connect the SOHO 1 device to the Internet 3.

  The VPN server 6 provides a function of accepting a connection from the VPN client device of the SOHO 1 and virtually connecting the VPN client device to the corporate office LAN 7. Specifically, an IPsec server function is provided. The connection form of the VPN client device is “remote access VPN”. For this reason, in addition to the device authentication by PSK (Pre Shared Key) at the time of connection, the user uses the user name / password using XAUTH, which is an extended function of IPsec. Also authenticate the person. The in-house LAN 7 is an IP network that provides IP services to users. Various IP services (not shown) may be provided.

  The IP telephone server 8 is a server that provides a call processing service for the IP telephone terminal 4 to use the IP telephone function. Specifically, it operates as a SIP Proxy, SIP Registrar, and SIP Register Server using the SIP protocol. When registering the address of the IP telephone terminal 4, digest authentication of the registered address by WWW-Authenticate is performed according to a standardized procedure.

(First embodiment)
Hereinafter, a first embodiment of the present invention will be described. First, the configuration of the IP telephone terminal 4 will be described with reference to FIG. The IP phone terminal 4 includes a control unit 40, a UI unit 43, a VPN client unit 44, an IP phone function unit 45, and a communication unit 46.

  The control unit 40 controls the VPN client unit 44, the IP telephone function unit 45, the communication unit 46, and the UI unit 43. The control unit 40 further holds user information 41 and setting information 42. The user information 41 is information corresponding to a user name, an address, and a password that are required when the user uses the function of the IP phone terminal 4, and is commonly used by the VPN client unit 44 and the IP phone function unit 45. Used. The setting information 42 includes setting information for the VPN client unit 44 and setting information for the IP telephone function unit 45. The setting information of the IP telephone function unit 45 can be dynamically set by the VPN client unit 44. These pieces of information are set not only by the user via the UI unit 43 but also from the VPN client unit 44, the IP telephone function unit 45, and the communication unit 46.

  The UI unit 43 provides an operation interface and an output interface to the user of the IP telephone terminal 4. Specifically, it comprises an input interface (such as a numeric keypad or function key) for an IP telephone function, a receiver or headset (microphone / speaker), an LCD or LED for displaying the status, and the like. The VPN client unit 44 establishes a VPN connection using IPsec with the VPN server 6 of the head office 2. Specifically, IPsec IKE Tunnel Mode is executed with the VPN server 6. As a result, the IP telephone terminal 4 is virtually connected to the head office LAN 7. The IP telephone function unit 45 is a SIP UA that provides an IP telephone function by exchanging SIP messages with the IP telephone server 8 of the head office 2. It also handles media data such as IP phone voice. The communication unit 46 is a network interface function that performs communication with the Internet 3 via the modem 5 and communication with the VPN server 6 or the IP telephone server 8 in the head office 2.

  Next, the configuration of the VPN server 6 will be described with reference to FIG. The VPN server 6 includes a VPN processing unit 60, a VPN authentication unit 61, a VPN authentication result notification unit 62, an IP phone server communication unit 63, an IP phone server load / setting / failure information acquisition unit 64, and an IP phone server information holding unit 65. IP phone server selection unit 66 and IP phone terminal communication unit 67.

  The VPN processing unit 60 provides a VPN service to the IP telephone terminal 4. The VPN authentication unit 61 receives a VPN connection authentication request from the IP telephone terminal 4 and executes VPN connection authentication processing. The VPN authentication includes authentication by IKE (PSK: Pre Shared Key authentication) and authentication by a user name and a password using XAUTH. The VPN authentication result notifying unit 62 notifies the IP telephone server 8 of the result of VPN connection authentication executed by the VPN authenticating unit 61. The IP telephone server communication unit 63 is a network interface used for communication with the IP telephone server 8. The load / setting / failure information acquisition unit 64 of the IP telephone server acquires load / setting / failure information of the IP telephone server 8 through communication with the IP telephone server 8. The IP telephone server information holding unit 65 stores and holds the load / setting / failure information acquired from the IP telephone server 8. The IP telephone server selection unit 66 determines and selects the IP telephone server 8 to be used by the IP telephone terminal 4 based on the information of the plurality of IP telephone servers 8 stored and held in the IP telephone server information holding unit 65. Is. The IP telephone terminal communication unit 67 is a network interface used for communication with the IP telephone terminal 4.

  Next, the configuration of the IP telephone server 8 will be described with reference to FIG. The IP phone server 8 includes a load / setting / failure information providing unit 80, a VPN server communication unit 81, a VPN authentication result information acquisition unit 82, a VPN information holding unit 83, an IP phone address registration authentication unit 84, and an IP phone terminal communication unit 85. And a call processing service providing unit 86.

  The load / setting / failure information providing unit 80 provides information on the load / setting / failure of the IP telephone server 8 through communication with the VPN server 6. The VPN server communication unit 81 is a network interface used for communication with the VPN server 6. The VPN authentication result information acquisition unit 82 acquires the result of the VPN connection authentication executed by the VPN authentication unit 61 from the VPN server 6. The VPN information holding unit 83 stores and holds the VPN connection authentication result acquired from the VPN server 6. The IP phone address registration authentication unit 84 receives an address registration authentication request from the IP phone terminal 4 and executes IP phone address registration authentication processing. The IP telephone terminal communication unit 85 is a network interface used for communication with the IP telephone terminal 4. The call processing service providing unit 86 is a SIP Proxy that provides a call processing service to the IP telephone terminal 4 that has performed address registration.

  Next, a connection sequence of the IP telephone terminal 4 will be described with reference to FIG.

  (0) Prior to the execution of the connection sequence, the VPN server 6 connected to the head office in-house LAN 7 is set / loaded / failed in advance or dynamically from a plurality of IP telephone servers 8 also connected to the head office in-house LAN 7. Information is collected.

  Specifically, the setting / load / failure information providing unit 80 of the IP telephone server 8 transmits its setting / load / failure information to the VPN server 6 via the VPN server communication unit 81. In the VPN server 6, the IP phone server setting / load / failure information acquisition unit 64 acquires these pieces of information via the IP phone server communication unit 63, and holds and stores them in the IP phone server information holding unit 65.

  It is assumed that information exchange between the IP telephone server 8 and the VPN server 6 is protected by some method such as using pre-set shared key information.

  (1) In SOHO 1, the user executes a login procedure for IP telephone terminal 4.

  This corresponds to input of a user name and a password. The IP telephone terminal 4 stores these pieces of information as user information 41 of the control unit 40 via the UI unit 43. As the setting information 42 in the control unit 40, information necessary for connection authentication with the VPN server 6 is set in advance by a user or a maintenance person of a SOHO or an IP telephone terminal. However, information necessary for address registration authentication with the IP telephone server 8 does not need to be stored at this point.

  (2) The VPN client unit 44 of the IP telephone terminal 4 starts executing VPN connection authentication with the VPN server 6 under the control of the control unit 40.

  Specifically, the VPN client unit 44 refers to the address of the VPN server 6 stored in the setting information 42 of the control unit 40, PSK (Pre Shared Key) information, or IPsec mode setting or authentication algorithm setting. And obtained as IPsec setting information. In addition, the user name and password of the user stored in the user information 41 of the control unit 40 are acquired by referring to the user name and password for authentication using XAUTH. The VPN client unit 44 transmits a VPN establishment request by IPsec IKE Tunnel Mode to the VPN server 6 via the communication unit 46 based on the acquired VPN related information.

  The VPN server 6 accepts these requests at the VPN authentication unit 61 via the IP telephone terminal communication unit 85. Thereafter, the VPN server 6 executes VPN establishment processing including PSK authentication of the IP telephone terminal 4 and XAUTH authentication of the user, and establishes an IPsec SA by repeating IKE communication with the IP telephone terminal 4. .

  At the time when the IPsec SA is established, the IP telephone terminal 4 is virtually stored in the head office LAN 7 by the VPN server 6 and the VPN tunnel connecting the SOHO 1 and the head office 2 via the Internet 3 is established. Become. Note that communication via the VPN tunnel is realized by transferring a message by the VPN processing unit 60 of the VPN server 6.

  (3) At the final stage of the sequence (2), the VPN server 6 notifies the IP telephone terminal 4 of setting information for IP telephone address registration.

  Specifically, the IP phone server selection unit 66 of the VPN server 6 refers to the setting / load / failure information of the plurality of IP phone servers 8 held and stored from the IP phone server information holding unit 65 to determine a certain standard. Then, the IP telephone server 8 is selected, and the setting information of the IP telephone server 8 is notified to the VPN authentication unit 61. The VPN authentication unit 61 uses the IP telephone server communication unit 67 as a part of the sequence (2) of the above-described sequence (2) for setting information of the IP telephone server 8 selected by the IP telephone server selection unit 66. Transmit to terminal 4.

  There are no particular limitations on the criteria by which IP telephone server selection unit 66 selects IP telephone server 8. For example, a method of selecting an IP telephone server 8 with the smallest number of IP telephone terminals 4 currently connected, a method of selecting an IP telephone server 8 with the smallest CPU load, and the like can be considered.

  The setting information of the IP telephone server 8 includes the IP address of the IP telephone server 8, the domain name to be used as the SIP URI, and various timers related to the SIP protocol.

  A message for notifying the setting information of the IP telephone server 8 will be described below.

  The VPN server 6 and the IP telephone terminal 4 exchange a packet called ISAKMP a plurality of times in order to establish a VPN connection. Among the ISAKMP packets transmitted from the VPN server 6 to the IP telephone terminal 4, the ISAKMP packet including the IPsec SA Proposal, HASH, and NONE, which has been accepted for use in the IPsec SA, is extended and used. Specifically, a Notification payload for notifying the setting information of the IP telephone server 8 is further added to the ISAKMP packet, and transmitted from the VPN server 6 to the IP telephone terminal 4. FIG. 6 shows a specific packet configuration example. The above-mentioned packet is one of the messages exchanged in the sequence (2) above, and a part of the message is expanded to add setting information of the IP telephone server 8. .

  The VPN client unit 44 of the IP phone terminal 4 receives the ISAKMP packet via the communication unit 46 and acquires the setting information of the IP phone server 8 from the Notification payload. The acquired setting information of the IP telephone server 8 is held and stored as setting information 42 in the control unit 40.

  (4) When the VPN connection authentication is completed between the IP telephone terminal 4 and the VPN server 6, the VPN authentication result notifying unit 62 of the VPN server 6 transmits the information of the user authenticated by XAUTH in the VPN connection authentication to the IP telephone server. Notification is made to the IP telephone server 8 via the communication unit 63. The VPN authentication result information acquisition unit 82 of the IP telephone server 8 acquires information on the user authenticated by the VPN connection authentication via the VPN server communication unit 81 and stores and stores the information in the VPN information holding unit 83.

  (5) When the VPN connection authentication is correctly completed according to the above (2), the IP telephone terminal 4 is virtually stored in the LAN 7 in the head office by the VPN server 6, and the VPN connecting the SOHO 1 and the head office 2 via the Internet 3 A tunnel is established. Further, the IP telephone terminal 4 has already held and stored the setting information of the IP telephone server 8 for executing IP telephone address registration in the setting information 42 of the control unit 40 according to (3) above.

  The IP telephone function unit 45 of the IP telephone terminal 4 includes the IP address of the IP telephone server 8 held and stored in the setting information 42 of the control unit 40, the domain name to be used as the SIP URI, and various timers related to the SIP protocol. The user name of the user stored and stored in the user information 41 of the control unit 40 is referred to, and a SIP address registration request for the IP telephone server 8 selected by the VPN server 6 is created. To send through. This corresponds to transmission of a SIP Register Request message. The SIP address for requesting registration is created, for example, by connecting the user name stored in the user information 41 of the control unit 40 and the domain name stored in the setting information 42 of the control unit 40 with “@”. It shall be.

  The IP telephone address registration authentication unit 84 of the IP telephone server 8 receives the SIP address registration request from the IP telephone terminal 4 via the IP telephone terminal communication unit 85.

  Conventionally, in order to authenticate the SIP address registration, the IP telephone server 8 transmits a 401 Unauthorized Response message to the IP telephone terminal, and performs digest authentication according to the SIP standard authentication mechanism defined by RFC3261. Start. On the other hand, in this embodiment, the IP telephone address registration authentication unit 84 first refers to the list of user names for which VPN connection authentication has been completed (by XAUTH) from the VPN information holding unit 83. The IP phone address registration authentication unit 84 is stored in the user part of the user address of the IP phone terminal 4 that has transmitted the SIP address registration request (the first part separated by “@”) and the VPN information holding unit 83. If the user name matches, the VPN server 6 determines that the user has already been correctly authenticated. Therefore, unlike the conventional method, the 401 Unauthorized Response message is not transmitted to the IP telephone terminal, but the 200 OK Response message is transmitted, and the SIP address registration authentication is omitted and the SIP address registration is executed.

  The IP telephone function unit 45 of the IP telephone terminal 4 receives the 200 OK Response message via the communication unit 46, identifies that the user's address registration has been completed, and uses this situation via the UI unit 43. To the user.

By the above sequence,
(1) Operations necessary for using the IP telephone terminal 4 in the SOHO 1 and necessary initial settings are simplified. Specifically, the user only needs to perform a single login operation to the IP telephone terminal 4, and the user name and password input at that time are used for both VPN connection authentication and SIP address registration authentication. Is done.

  (2) In the IP telephone system that accommodates the IP telephone terminal 4 installed in the SOHO 1, the setting flexibility of the IP telephone server 8 increases. More specifically, it is not necessary to set the IP telephone server 8 in advance in the IP telephone terminal 4, and when the VPN connection authentication is executed, the setting information of the IP telephone server 8 is notified to the IP telephone terminal 4. Can be set and used.

  (3) In the IP telephone system that accommodates the IP telephone terminal 4 installed in the SOHO 1, the system load generated when the IP telephone terminal 4 is accommodated and the bandwidth resources to be used are reduced. Specifically, the digest authentication process necessary for performing SIP address registration is omitted, and the processing load on the IP telephone server 8 is reduced correspondingly, and the SIP between the IP telephone terminal 4 and the IP telephone server 8 is reduced. Bandwidth resources corresponding to SIP message exchange required for address registration authentication are vacated.

  Note that the ISAKMP packet in the IPsec VPN exchanged between the VPN server 6 and the IP telephone server 8 is expanded at one place according to the present embodiment, but the effect of this is insignificant.

  In the present embodiment, the VPN client unit 44 of the IP telephone terminal 4 may provide a VPN router function. In other words, the SOHO 1 may be configured such that other IP (Internet Protocol) devices (such as a PC) can be connected to the corporate office LAN 7 via the Internet 3 via the IP telephone terminal 4. In this case, the IP telephone terminal 4 includes a physical port that connects a plurality of IP devices, and a VPN router unit that provides a VPN router function for the IP devices connected to the physical ports.

(Second Embodiment)
Hereinafter, a second embodiment of the present invention will be described. Referring to FIG. 7, when a failure or overload occurs in IP phone server 8 that is currently registered with IP phone terminal 4 and IP phone terminal 4 is operating normally, A sequence for requesting address registration, that is, a reconnection sequence will be described.

  (0) Similar to the first embodiment, prior to the execution of the sequence, the VPN server 6 connected to the head office LAN 7 is dynamically changed from a plurality of IP telephone servers 8 similarly connected to the head office LAN 7. Setting / load / failure information is collected.

  Specifically, the setting / load / failure information providing unit 80 of the IP telephone server 8 transmits its own setting / load / failure information to the VPN server 6 via the VPN server communication unit 81. The VPN server 6 acquires the information by the IP telephone server setting / load / failure information acquisition unit 64 via the IP telephone server communication unit 63, and stores and stores the information in the IP telephone server information holding unit 65.

  (1) The VPN server 6 identifies from the failure information of the IP telephone server 8 held and stored in the IP telephone server information holding unit 65 that a certain IP telephone server 8 is in a failure or overload state. At this time, the IP telephone server selection unit 66 of the VPN server 6 causes the IP telephone terminal 4 connected to the IP telephone server 8 that has failed or overloaded, and the IP telephone terminal 4 has failed or overloaded. The IP telephone server 8 to be connected as an alternative server to the IP telephone server 8 is selected.

  The criteria for the IP telephone server selection unit 66 to select the IP telephone server 8 are not particularly limited. For example, a method of selecting an IP telephone server 8 with the smallest number of IP telephone terminals 4 currently connected, a method of selecting an IP telephone server 8 with the smallest CPU load, and the like can be considered.

  The setting information of the IP telephone server 8 selected by the IP telephone server selection unit 66 is notified to the VPN authentication unit 61. The VPN authentication unit 61 transmits the setting information of the IP phone server 8 selected by the IP phone server selection unit 66 to the IP phone terminal 4 via the IP phone terminal communication unit 67.

  The setting information of the IP telephone server 8 includes the IP address of the IP telephone server 8, the domain name to be used as the SIP URI, and various timers related to the SIP protocol.

  The message for notifying the setting information of the IP telephone server 8 is specifically shown below. The VPN server 6 and the IP telephone server 8 have already established a VPN connection, and data can be transmitted from the VPN server 6 to the IP telephone terminal 4 by a method called ISAKMP Information Exchanges. FIG. 8 shows a specific packet configuration. Here, the setting information of the IP telephone server 8 is carried as a Notification payload.

  The VPN client unit 44 of the IP phone terminal 4 receives the ISAKMP packet via the communication unit 46, determines from the Notification payload that a failure or overload has occurred in the currently connected IP phone server 8, The setting information of the alternative IP telephone server 8 is acquired and stored in the setting information 42 of the control unit 40.

  (2) When the setting information of the alternative IP telephone server 8 is held and stored in the setting information 42 of the control unit 40, the IP telephone function unit 45 of the IP telephone terminal 4 performs SIP to the alternative IP telephone server 8. Prepare to make an address registration request.

  Specifically, the IP address of the IP telephone server 8 stored and stored in the setting information 42 of the control unit 40, the domain name to be used as the SIP URI, and various timers related to the SIP protocol are referred to and controlled. A communication unit generates a SIP address registration request for the IP telephone server 8 selected as the alternative IP telephone server 8 by the VPN server 6 with reference to the user name held and stored in the user information 41 of the section 40 46 to the corresponding alternative IP telephone server 8. This corresponds to transmission of a SIP Register Request message. The SIP address for requesting registration is created, for example, by connecting the user name stored in the user information 41 of the control unit 40 and the domain name stored in the setting information 42 of the control unit 40 with “@”. It shall be.

  The IP telephone address registration authentication unit 84 of the IP telephone server 8 receives the SIP address registration request from the IP telephone terminal 4 via the IP telephone terminal communication unit 85. Subsequent processing is the same as the sequence (5) described in the first embodiment.

(Third embodiment)
Hereinafter, a third embodiment of the present invention will be described. 9 and 10 show the configuration of the VPN server 6 and the configuration of the IP telephone server 8 according to the third embodiment. The difference from the first or second embodiment is that the third embodiment is the IP telephone terminal address registration authentication information acquisition unit 69 in the configuration of the VPN server 6 of FIG. 9 and the IP telephone server 8 of FIG. The IP telephone terminal address registration authentication information notification unit 87 in the configuration of FIG.

  The IP phone terminal address registration authentication information notifying unit 87 in the configuration of the IP phone server 8 acquires from the IP address registration authentication unit 84 that the IP phone server 8 has completed the address authentication period of a certain user, and this is acquired by the VPN. This is notified to the VPN server 6 via the server communication unit 81. The IP phone terminal address registration authentication information acquisition unit 69 in the configuration of the VPN server 6 acquires address information whose address authentication period has ended from the IP phone server 8 via the IP phone server communication unit 63.

  A sequence for terminating the connection of the IP telephone terminal 4 will be described with reference to FIG.

  (1) When the user ends the use of the IP telephone terminal 4, a log-off operation is executed on the IP telephone terminal 4. This corresponds to, for example, an operation of pressing a logoff button.

  (2) The IP telephone function unit 45 of the IP telephone terminal 4 transmits a SIP message for logoff to the IP telephone server 8 that has registered the current address. This corresponds to transmission of the SIP Register Request message with the address registration period set to 0, and this message is transmitted to the IP telephone server 8 via the communication unit 46.

  The IP telephone address registration / authentication unit 84 of the IP telephone server 8 accepts this message via the IP telephone terminal communication unit 85, and executes the registration deletion of the SIP address registered according to the standard.

  (3) The IP telephone terminal address authentication information notifying unit 87 of the IP telephone server 8 notifies the VPN server 6 of the end of the SIP address registration period via the VPN server communication unit 81.

  The IP telephone terminal address registration authentication information acquisition unit 69 of the VPN server 6 acquires an address whose SIP address registration period has ended via the IP telephone server communication unit 63. The IP telephone terminal address registration authentication acquisition unit 69 notifies the VPN authentication unit 61 of the address information for which the authentication has been completed. In response to this, the VPN authenticating unit 61 deletes the IPsec SA and IKE SA of the corresponding user. As a result, the VPN connection between the corresponding IP telephone terminal 4 and the VPN server 6 is terminated, and communication thereafter becomes impossible.

  Similarly, when the IP telephone function unit 45 of the IP telephone terminal 4 receives 200 OK Response via the communication unit 46 as a response to the SIP address deletion from the IP telephone server 8, the control unit 40 causes the VPN client to The corresponding IPsec SA and IKE SA of unit 44 are erased.

  Hereinafter, an outline of an existing sequence is illustrated as a comparative example.

  (0) The IP telephone terminal 4 is previously set for initial VPN connection executed with the VPN server 6 and for initial address registration executed with the IP telephone server 8. And

  (1) The user executes a VPN connection procedure. This corresponds to input of a user name and a password used in XAUTH authentication for user authentication in “Remote Access VPN” using IPsec.

  (2) The IP telephone terminal 4 executes VPN connection processing with the VPN server 6. Specifically, IPsec IKE Tunnel Mode is executed. When the VPN connection authentication is correctly completed, the IP telephone terminal 4 is virtually stored in the head office LAN 7 by the VPN server 6 and a VPN tunnel connecting the SOHO 1 and the head office 2 via the Internet 3 is established. .

  (3) The user executes a procedure for IP phone address registration. This corresponds to input of a user name and a password used in digest authentication at the time of address registration necessary for using the IP telephone service.

  (4) The IP telephone terminal 4 executes IP telephone address registration processing with the IP telephone server 8. Specifically, digest authentication is performed according to the SIP standard mechanism defined by RFC3261. When the IP phone address registration authentication is correctly completed, the IP phone terminal 4 can make and receive calls using the call processing service of the IP phone server 8.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

1 ... Branch / SOHO;
2… Head office;
3 ... Internet;
4 ... IP phone terminal;
5 Modem;
6 ... VPN server;
7… In-house LAN;
8 ... IP phone server

Claims (7)

A user information storage unit for storing user information for identifying a user;
A VPN client unit that provides a VPN client function;
An IP phone function unit that provides an IP phone address function;
A setting information storage unit for storing setting information on the VPN client function,
(1) VPN authentication is executed using the user information stored in the user information storage unit,
(2) Acquire setting information of the IP phone address function when performing the VPN authentication ;
(3) a control unit that executes an IP phone address registration function using the acquired setting information of the IP phone address function and user information stored in the user information storage unit;
An IP telephone terminal device comprising: A VPN server device used together with an IP phone server,
An acquisition unit that acquires at least one of load information, setting information, and failure information from a plurality of IP telephone servers;
A selection unit that selects, for any of the plurality of IP telephone servers, IP telephone server setting information for notifying an IP telephone terminal based on at least one of the load information, setting information, and failure information;
An authentication unit for performing VPN connection authentication of the IP telephone terminal;
A first notification unit for notifying the IP telephone terminal authenticated by the authentication unit of the setting information of the IP telephone server selected by the selection unit as the setting information of the IP telephone server to be used next; ,
A second notification unit that notifies the IP telephone server selected by the selection unit that the IP telephone terminal has been authenticated for VPN connection;
A VPN server device comprising: An IP telephone server device used with a VPN server,
A provision unit for providing at least one of load information, IP phone address function setting information, and failure information to the VPN server in response to a request from the VPN server;
An acquisition unit for acquiring a notification of an authentication result related to VPN connection authentication of the IP telephone terminal from the VPN server;
When executing the address registration authentication of the IP telephone terminal, an authentication unit that refers to an authentication result related to the VPN connection authentication and omits the address registration authentication process if the address registration authentication is for the same user information; , comprising a,
The IP phone address function setting information is sent to the IP phone terminal by the VPN server during the VPN connection authentication,
The IP telephone server apparatus , wherein the sent IP telephone address function setting information is used by the IP telephone terminal to start the IP address registration authentication . An IP telephone system comprising an IP telephone terminal, a VPN server, and an IP telephone server,
The IP telephone terminal stores user information input from a user,
The IP phone terminal requests authentication of user information from the VPN server,
The VPN server authenticates the user information and notifies the IP telephone terminal of the information of the IP telephone server;
The VPN server notifies the IP phone server of the authenticated user information;
The IP telephone terminal requests address registration for user information to the IP telephone server based on the information of the IP telephone server notified from the VPN server,
When the IP telephone server receives the address registration request and determines that it is an address registration request for the user information notified from the VPN server, the authentication processing for the address registration is omitted. IP phone system. The VPN server is
Collect at least load information, setting information, or failure information for multiple IP phone servers,
The IP telephone server setting information to be notified to the IP telephone terminal is selected for any of the plurality of IP telephone servers based on at least one of the load information, setting information, and failure information. Item 5. The IP telephone system according to Item 4. A physical port for connecting multiple IP devices;
A VPN router unit that provides a VPN router function to the IP device connected to the physical port;
The IP telephone terminal apparatus according to claim 1, further comprising: Computer
A user information storage unit for storing user information for identifying a user;
VPN client part providing VPN client function,
IP phone function unit providing IP phone address function,
A setting information storage unit for storing setting information related to the VPN client function;
(1) VPN authentication is executed using the user information stored in the user information storage unit,
(2) Acquire setting information of the IP phone address function when performing the VPN authentication;
(3) a control unit that executes an IP phone address registration function using the acquired setting information of the IP phone address function and user information stored in the user information storage unit;
Program to function as.

Images